@love-moon/conductor-cli 0.15.2 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,153 @@
 # @love-moon/conductor-cli
 
+## 0.17.0
+
+### Minor Changes
+
+- 88e1ae0: Support `/stop` in task chats. A bare `/stop` message, sent from the web, the
+  CLI or a channel, makes the server interrupt the AI's running turn right away
+  instead of waiting for fire to read the message once that turn ends. When fire
+  does read the queued `/stop`, it posts a confirmation and does not send it to
+  the model. `/stop` also drops every message queued before it (except the
+  server's end-of-round summary request); resend what you still want. The server
+  targets the reply it knows is running, so older fires stop it too;
+  `interrupt_turn` no longer needs a reply target, and without one fire
+  interrupts the turn it is running, including the initial prompt and pre_prompt
+  turns. In the web chat, the ⋯ menu gains `/stop`, `/clear` and `/compact`,
+  which send those commands as messages, and Interrupt (Esc) sends `/stop`,
+  ignored while an earlier `/stop` is unanswered. The Interrupt action is gone
+  from the message toolbar.
+
+### Patch Changes
+
+- 79ca552: Claude no longer switches to `acceptEdits` mode when the daemon runs as root.
+  That fallback looked like it worked, but in a headless task it silently refused
+  every shell command (ssh, rsync, ...) and every read outside the project. Claude
+  now keeps `bypassPermissions` everywhere. As root without `IS_SANDBOX=1`, the
+  chat shows a warning right after "session started" telling you to add
+  `envs: { IS_SANDBOX: "1" }` to the conductor config (or run the daemon as a
+  regular user). Terminal tasks print the same hint. An `IS_SANDBOX` set in config
+  `envs` now also reaches terminal (PTY) claude tasks. `conductor config` always
+  writes `--dangerously-skip-permissions` for claude.
+- c0c1489: `conductor task speak <text> [-o FILE|-]` saves Doubao text-to-speech as an
+  .mp3 — the same voice the web chat's new voice-conversation mode reads replies with.
+- 39ee057: `conductor update` and the daemon updater compile node-pty against the headers
+  the running Node ships, instead of downloading them from nodejs.org, so an
+  update no longer needs that host to be reachable. `conductor update` also stops
+  an npm install that has not finished after 15 minutes instead of waiting on a
+  stalled registry connection forever.
+- b09b28a: Remove `conductor task create --remote-worktree <host>`; passing it now fails
+  with a pointer to the replacement. Running the AI on one daemon while the code
+  lives on another is done only through a global AI backend:
+  `--global-backend <backend>@<host>` (add `--worktree` for a worktree on the
+  code's daemon). Note the host changes meaning: `--remote-worktree` named the
+  daemon holding the code, `--global-backend` names the daemon running the AI, so
+  create the task in the project on the code's daemon. The server refuses a caller-supplied
+  `launch_config.remoteWorktree`.
+
+  `conductor task create --global-backend` now takes `<backend>@<host>`, the same
+  form as `conductor issue start` and the web UI. The older `<host>:<backend>` is
+  still accepted.
+
+- 68fe7b9: Add `conductor task preview <id> <path>`: open a temporary link to a file on the
+  task's daemon (HTML with its CSS/JS/images, Markdown, images, video), the same
+  preview the chat opens when you click a file link in an AI reply or shows in
+  place for `![](picture.png)` / `![](recording.mp4)`. The link expires after
+  5 idle minutes (30 minutes at most) and only reaches the file's own directory.
+
+  The daemon advertises a new `remote_file_preview` capability; previews need a
+  daemon of this version or later. `conductor config` now writes
+  `remote_file: true` explicitly into a new config file (the default was already
+  on; set it to `false` to decline file transfers and previews).
+
+- Updated dependencies [d088b31]
+- Updated dependencies [79ca552]
+- Updated dependencies [ccbfeeb]
+- Updated dependencies [88e1ae0]
+  - @love-moon/ai-sdk@0.17.0
+  - @love-moon/conductor-sdk@0.17.0
+
+## 0.16.0
+
+### Minor Changes
+
+- 0495b79: The CLI can now do what the web app can:
+
+  - `conductor task`: `stop`, `interrupt`, `restart`, `delete`, `archive`/`unarchive`,
+    `rename`, `pin`/`unpin`, `move`, `labels`, `share`/`unshare`, `persistent`,
+    `round start|end`, `cleanup-worktree`, `terminal open|show|close`, `resume`,
+    `attachment download`, `shared <token|link>` (read a shared task), `transcribe <audio>`
+    (speech to text), and `schedule update`. `create` also takes `--daemon-host`, `--agent` (multi-agent group),
+    `--global-backend`, `--worktree`, `--remote-worktree` and `--persistent`.
+    `send --attach` uploads files, `messages --follow` streams new messages, and
+    `list --all-projects` / `--project-ids` lists tasks across projects.
+  - `conductor project`: `update`, `refresh`, `delete`, `reorder`, `agents`,
+    `collab invite|show-invite|join|leave`, `labels list|add|rename|remove`.
+  - `conductor issue`: `delete`, and `list --all-projects` / `--project-ids`.
+  - `conductor daemon`: `restart`, `upgrade [--status|--wait]`, `sessions`, `accounts`,
+    `switch-account`, `commands list|run|status`, `share create|list|revoke|show-invite|accept`.
+  - New `conductor search`, `conductor settings` (global backends, catchphrases, daily
+    report, task-list and card-group preferences, generated reports) and `conductor auth`
+    (`whoami`, `tokens list|create|revoke`).
+
+  Fix: `conductor project hide/unhide` (and the SDK's `setProjectHidden`) no longer erase
+  the project's metadata (task labels, memos, binding data).
+
+  On a cross-daemon merged project, `project hide/unhide`, `delete` and
+  `update --merge-opt-out` act on every daemon, like the web. `hide/unhide --json`
+  still prints the target project, plus `ids` for every project changed.
+  `delete --daemon-host <h>` deletes only that copy; a group delete stops at the
+  first failure and says which ids were deleted. `update --merge-opt-out` lists the
+  same-name projects it also split or re-merged.
+
+- b68fadf: `conductor issue` now matches the web issue board:
+  `start --daemon <host> [--project <id>]` picks the daemon, or the merged-group
+  sibling project, that the task runs on (on another member's shared project the
+  server decides). `--priority` takes `P0|P1|P2`, and `--status` uses
+  `todo|doing|done`; `create` no longer offers `doing`. `list --status` is sent to
+  the server and still applied locally, so an older server that ignores it filters
+  too. An invalid argument now exits 2 without sending a request. The SDK's
+  `updateIssue` forwards `projectId`, and `listIssues` sends multiple statuses to
+  the server and filters the result the same way.
+
+  The matching web server changes (metadata patches merge instead of replacing,
+  `GET /api/issues?status=` filtering) should be deployed before publishing.
+
+- 7c45a56: `conductor issue start` can pick the AI for the task it spawns: `--backend <b>`,
+  or `--global-backend <backend>@<host>` to run the AI on one of your global AI
+  backends while the code stays on the project's daemon (same as the web "Move
+  Issue To Doing" dialog). The SDK's `updateIssue` forwards `globalBackend`.
+
+  Requires a Conductor web server that ships issue global backends (the same
+  release): deploy the web server before publishing the CLI/SDK. An older server
+  ignores `--global-backend` and starts a plain task on the project's daemon; the
+  CLI then prints a warning instead of failing silently.
+
+### Patch Changes
+
+- 5c81d06: Claude turns that wait on background subagents now report their full token
+  usage. Such a turn emits one result per segment and the task card used to show
+  only the last segment; it now sums the result's `modelUsage`, which covers
+  every segment, every subagent and small side calls. `conductor serve-ai`'s
+  `prompt_tokens` / `completion_tokens` come from the same usage, so they now
+  include those too. A turn cut off after an earlier segment keeps that
+  segment's usage.
+- b69d665: Codex turns that spawn sub-agents now include the sub-agents' tokens in the
+  turn usage. Their `thread/tokenUsage/updated` notifications carry the
+  sub-agent's own thread id and were dropped with its other events. A
+  sub-agent's replayed total is not counted, and whatever it spends after the
+  parent turn ends goes to the next turn.
+- 1423475: `conductor task persistent` takes `--auto-end-round` / `--no-auto-end-round`. Persistent
+  tasks now end the current round automatically (asking the AI for its summary, like
+  End round) after an hour without a reply; on by default.
+- Updated dependencies [5c81d06]
+- Updated dependencies [0495b79]
+- Updated dependencies [b69d665]
+- Updated dependencies [b68fadf]
+- Updated dependencies [7c45a56]
+  - @love-moon/ai-sdk@0.16.0
+  - @love-moon/conductor-sdk@0.16.0
+
 ## 0.15.2
 
 ### Patch Changes

package/bin/conductor-auth.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+
+/**
+ * conductor auth — who am I, and the API tokens shown on the web settings page.
+ *
+ * Subcommands:
+ *   whoami                     GET  /api/auth/me                       -> { user: { id, email, phone, tokenScope } }
+ *   tokens list                GET  /api/auth/tokens                   -> [{ id, name, token_prefix, created_at, last_used_at }]
+ *   tokens create [--name N]   POST /api/auth/tokens { name }          -> { token, tokenId, tokenPrefix, createdAt }
+ *   tokens revoke <tokenId>    POST /api/auth/tokens/:tokenId/revoke   -> 204
+ *
+ * `tokens create` prints the raw token once (the server never lists it again).
+ * Login / register / OAuth are intentionally not here: `conductor config`
+ * handles signing in.
+ *
+ * Global flags: --json, --dry-run (write verbs), --config-file.
+ */
+
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+import yargs from "yargs/yargs";
+import { hideBin } from "yargs/helpers";
+
+import { EXIT, exitCodeForError, printJson, printPretty, reportError } from "../src/entity-helpers.js";
+import { apiPath, buildHttp, formatTable, sendOrPreview } from "../src/backend-http.js";
+
+const isMainModule = (() => {
+  const currentFile = fileURLToPath(import.meta.url);
+  const entryFile = process.argv[1] ? path.resolve(process.argv[1]) : "";
+  return entryFile === currentFile;
+})();
+
+const DEFAULT_TOKEN_NAME = "cli";
+
+async function handleWhoami(argv, deps) {
+  const http = await buildHttp(deps);
+  const result = await http.get(apiPath("auth", "me"));
+  if (argv.json) {
+    printJson(deps.stdout, result);
+    return EXIT.OK;
+  }
+  const user = result?.user ?? {};
+  printPretty(deps.stdout, `id:      ${user.id ?? ""}`);
+  if (user.email) printPretty(deps.stdout, `email:   ${user.email}`);
+  if (user.phone) printPretty(deps.stdout, `phone:   ${user.phone}`);
+  if (user.tokenScope) printPretty(deps.stdout, `scope:   ${user.tokenScope}`);
+  printPretty(deps.stdout, `backend: ${http.baseUrl}`);
+  return EXIT.OK;
+}
+
+async function handleTokensList(argv, deps) {
+  const http = await buildHttp(deps);
+  const result = await http.get(apiPath("auth", "tokens"));
+  if (argv.json) {
+    printJson(deps.stdout, result);
+    return EXIT.OK;
+  }
+  const tokens = Array.isArray(result) ? result : [];
+  if (tokens.length === 0) {
+    printPretty(deps.stdout, "(no tokens)");
+    return EXIT.OK;
+  }
+  const rows = tokens.map((token) => [
+    token.id, token.token_prefix ?? "", token.created_at ?? "", token.last_used_at ?? "-", token.name ?? "",
+  ]);
+  for (const line of formatTable(["ID", "PREFIX", "CREATED", "LAST USED", "NAME"], rows)) {
+    printPretty(deps.stdout, line);
+  }
+  return EXIT.OK;
+}
+
+async function handleTokensCreate(argv, deps) {
+  const http = await buildHttp(deps);
+  const body = { name: String(argv.name ?? DEFAULT_TOKEN_NAME) };
+  const { dryRun, data } = await sendOrPreview(http, argv, deps, "POST", apiPath("auth", "tokens"), body);
+  if (dryRun) return EXIT.OK;
+  deps.stderr.write("Warning: this token is shown only once. Store it somewhere safe now.\n");
+  if (argv.json) {
+    printJson(deps.stdout, data);
+    return EXIT.OK;
+  }
+  printPretty(deps.stdout, `Created token ${data?.tokenId ?? ""} (${body.name}, prefix ${data?.tokenPrefix ?? ""})`);
+  printPretty(deps.stdout, `token: ${data?.token ?? ""}`);
+  return EXIT.OK;
+}
+
+async function handleTokensRevoke(argv, deps) {
+  const http = await buildHttp(deps);
+  const tokenId = String(argv.tokenId);
+  const { dryRun } = await sendOrPreview(
+    http, argv, deps, "POST", apiPath("auth", "tokens", tokenId, "revoke"), undefined,
+  );
+  if (dryRun) return EXIT.OK;
+  if (argv.json) {
+    printJson(deps.stdout, { revoked: true, tokenId });
+    return EXIT.OK;
+  }
+  printPretty(deps.stdout, `Revoked token ${tokenId}`);
+  return EXIT.OK;
+}
+
+export async function main(argvInput = hideBin(process.argv), deps = {}) {
+  const stdout = deps.stdout || process.stdout;
+  const stderr = deps.stderr || process.stderr;
+  const env = deps.env || process.env;
+  const cwd = deps.cwd || process.cwd();
+  const consoleErr = { error: (msg) => stderr.write(`${msg}\n`) };
+  const handlerDeps = { ...deps, stdout, stderr, env, cwd };
+  const run = (handler) => async (argv) => {
+    exitCode = await handler(argv, { ...handlerDeps, configFile: argv.configFile });
+  };
+
+  let exitCode = EXIT.OK;
+  try {
+    await yargs(argvInput)
+      .scriptName("conductor auth")
+      .strict()
+      .help()
+      .option("json", { type: "boolean", default: false })
+      .option("dry-run", { type: "boolean", default: false })
+      .option("config-file", { type: "string", describe: "Path to Conductor config file" })
+      .command("whoami", "Show the user the configured token belongs to", () => {}, run(handleWhoami))
+      .command("tokens", "List, create, or revoke API tokens", (tokens) => tokens
+        .command("list", "List active API tokens", () => {}, run(handleTokensList))
+        .command(
+          "create",
+          "Create an API token (the token is printed once)",
+          (cmd) => cmd.option("name", { type: "string", describe: `Token label (default "${DEFAULT_TOKEN_NAME}")` }),
+          run(handleTokensCreate),
+        )
+        .command(
+          "revoke <tokenId>",
+          "Revoke an API token",
+          (cmd) => cmd.positional("tokenId", { type: "string", demandOption: true }),
+          run(handleTokensRevoke),
+        )
+        .demandCommand(1))
+      .demandCommand(1)
+      .fail((msg, err) => {
+        if (err) {
+          throw err;
+        }
+        stderr.write(`${msg}\n`);
+        exitCode = EXIT.ARGS;
+      })
+      .parseAsync();
+  } catch (err) {
+    exitCode = reportError(consoleErr, err);
+  }
+  return exitCode;
+}
+
+if (isMainModule) {
+  main().then((code) => {
+    if (code !== 0) process.exit(code);
+  }).catch((err) => {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(exitCodeForError(err));
+  });
+}

package/bin/conductor-config.js

@@ -10,7 +10,6 @@ import { createRequire } from "node:module";
 import yargs from "yargs/yargs";
 import { hideBin } from "yargs/helpers";
 import { RUNTIME_SUPPORTED_BACKENDS } from "../src/runtime-backends.js";
-import { isClaudeRootPermissionRestricted } from "@love-moon/ai-sdk";
 import { resolveConductorConfigPath } from "../src/conductor-paths.js";
 
 const CONFIG_FILE = resolveConductorConfigPath();
@@ -22,12 +21,10 @@ const packageJson = JSON.parse(
 const DEFAULT_CLIs = {
   claude: {
     command: "claude",
-    // claude exits 1 with `--dangerously-skip-permissions` under root, so never
-    // write a flag the user's own machine cannot run. Same root check the
-    // daemon and the ai-sdk session use.
-    execArgs: isClaudeRootPermissionRestricted()
-      ? "--permission-mode acceptEdits"
-      : "--dangerously-skip-permissions",
+    // Kept even on root: a headless acceptEdits session silently denies every
+    // shell command. Root users opt in with `envs.IS_SANDBOX: "1"`; fire and
+    // the daemon tell them so when claude starts.
+    execArgs: "--dangerously-skip-permissions",
     description: "Anthropic Claude CLI"
   },
   codex: {
@@ -387,9 +384,9 @@ async function main() {
     "# Env: CONDUCTOR_REMOTE_EXEC",
     "# remote_exec: true",
     "",
-    "# Accept `conductor remote cp` file transfers for this host.",
+    "# Accept `conductor remote cp` file transfers and file previews for this host.",
     "# Env: CONDUCTOR_REMOTE_FILE",
-    "# remote_file: true",
+    "remote_file: true",
     "",
     "# Launch each Fire process inside a detached tmux session so it survives a",
     "# daemon restart. Requires tmux on PATH. Env: CONDUCTOR_FIRE_TMUX_MODE",

package/bin/conductor-daemon-query.js

@@ -1,5 +1,7 @@
 /**
- * conductor daemon list|tools|quota — read-only queries about daemons.
+ * conductor daemon list|tools|quota — read-only queries about daemons, plus the
+ * remote-control / sharing verbs in src/daemon-share-commands.js (restart,
+ * upgrade, sessions, accounts, switch-account, commands, share).
  *
  *   list [--all]                          Online daemons, CLI version, AI backends
  *   tools <host>                          AI tools installed on a daemon + network
@@ -12,24 +14,16 @@ import process from "node:process";
 
 import yargs from "yargs/yargs";
 
-import { EXIT, buildApis, pad, printJson, printPretty, reportError } from "../src/entity-helpers.js";
+import { EXIT, buildApis, printJson, printPretty, reportError } from "../src/entity-helpers.js";
+import { DAEMON_REMOTE_VERBS, printTable, readOnly, registerDaemonRemoteCommands } from "../src/daemon-share-commands.js";
 
-export const DAEMON_QUERY_VERBS = new Set(["list", "tools", "quota"]);
+export const DAEMON_QUERY_VERBS = new Set(["list", "tools", "quota", ...DAEMON_REMOTE_VERBS]);
 
 // Ephemeral per-task `conductor fire` processes also register as agents.
 const FIRE_HOST_PREFIX = "conductor-fire-";
 
 const WINDOW_LABELS = { fiveHour: "5h", weekly: "weekly", weeklySonnet: "weekly-sonnet" };
 
-function printTable(stream, header, rows) {
-  const widths = header
-    .slice(0, -1)
-    .map((title, i) => Math.max(title.length, ...rows.map((row) => String(row[i]).length)));
-  for (const row of [header, ...rows]) {
-    printPretty(stream, row.map((cell, i) => (i < widths.length ? pad(cell, widths[i]) : cell)).join("  "));
-  }
-}
-
 function formatReset(window) {
   if (typeof window.resetAt !== "number") return window.resetOnDate ?? "";
   const date = new Date(window.resetAt * 1000);
@@ -139,12 +133,13 @@ export async function main(argvInput, deps = {}) {
   };
 
   try {
-    await yargs(argvInput)
+    const y = yargs(argvInput)
       .scriptName("conductor daemon")
       .strict()
       .help()
       .option("json", { type: "boolean", default: false })
       .option("config-file", { type: "string", describe: "Path to Conductor config file" })
+      .option("dry-run", { type: "boolean", default: false, describe: "Print the request a write verb would send, without sending it" })
       .command(
         "list",
         "List online daemons with their CLI version and AI backends",
@@ -153,13 +148,13 @@ export async function main(argvInput, deps = {}) {
           default: false,
           describe: `Include ephemeral ${FIRE_HOST_PREFIX}* hosts`,
         }),
-        run(handleList),
+        run(readOnly(handleList)),
       )
       .command(
         "tools <host>",
         "Show which AI tools are installed on a daemon and whether they are reachable",
         (cmd) => cmd.positional("host", { type: "string", describe: "Daemon host name" }),
-        run(handleTools),
+        run(readOnly(handleTools)),
       )
       .command(
         "quota <host>",
@@ -168,8 +163,9 @@ export async function main(argvInput, deps = {}) {
           .positional("host", { type: "string", describe: "Daemon host name" })
           .option("tool", { type: "string", describe: "Only this tool, e.g. claude or codex" })
           .option("refresh", { type: "boolean", default: false, describe: "Bypass the daemon's quota cache" }),
-        run(handleQuota),
-      )
+        run(readOnly(handleQuota)),
+      );
+    await registerDaemonRemoteCommands(y, run)
       .demandCommand(1)
       .fail((msg, err) => {
         // Throw so the command handler does not run after a validation error

package/bin/conductor-daemon.js

@@ -24,7 +24,8 @@ import { DAEMON_QUERY_VERBS, main as runDaemonQuery } from "./conductor-daemon-q
 
 const argv = hideBin(process.argv);
 
-// `conductor daemon list|tools|quota` are read-only queries, not a daemon launch.
+// `conductor daemon list|tools|quota|restart|upgrade|sessions|accounts|switch-account|commands|share`
+// talk to the backend about daemons; they are not a daemon launch.
 // Exit (so startup below never runs) only after stdout drains: a piped
 // --json payload over 64KB would otherwise be cut off.
 if (DAEMON_QUERY_VERBS.has(argv[0])) {
@@ -181,6 +182,10 @@ const args = yargs(argv)
   .example("$0 --nohup", "Run daemon in background with logfile")
   .example("$0 --nohup --force", "Restart daemon in background by stopping the existing one")
   .example("$0 list | tools <host> | quota <host>", "Query online daemons, their AI tools and quota")
+  .example("$0 restart <host> | upgrade <host> [--wait]", "Restart or upgrade a remote daemon")
+  .example("$0 sessions <host> | accounts <host> | switch-account <host> <name>", "Resumable AI sessions, codex accounts")
+  .example("$0 commands list|run|status <host> ...", "Run a daemon's custom commands")
+  .example("$0 share create|list|revoke|show-invite|accept ...", "Share a daemon with another user")
   .help()
   .strict()
   .parse();

package/bin/conductor-fire.js

@@ -1648,6 +1648,10 @@ export function formatCompactReply(backendName, compact, instructions = "") {
  * Per-message `/clear` detector. Only a bare `/clear` (case-insensitive)
  * counts: anything after it is more likely an instruction for the model.
  */
+export function isStopCommand(content) {
+  return typeof content === "string" && /^\/stop$/i.test(content.trim());
+}
+
 export function isClearCommand(content) {
   return typeof content === "string" && /^\/clear$/i.test(content.trim());
 }
@@ -2168,6 +2172,8 @@ export class BridgeRunner {
     this.remoteInterruptsByReplyTo = new Map();
     this.pendingInterruptRetryTimers = new Map();
     this.activeTurnReplyTo = "";
+    // A `/stop` arrived mid-batch: drop the rest of this batch (all sent before it).
+    this.dropQueuedBeforeStop = false;
     this.sessionAnnouncementSent = false;
     this.sessionAnnouncementSubscribed = false;
     this.boundSessionId = "";
@@ -2309,6 +2315,7 @@ export class BridgeRunner {
       });
       this.sessionAnnouncementSent = true;
       this.copilotLog(hasRealSessionId ? `session announced id=${sessionId}` : "session announced without id");
+      await this.reportBackendNotices();
       await this.reportRuntimeStatus(
         {
           state: this.useSessionFileReplyStream ? undefined : "WAIT_READY",
@@ -2577,7 +2584,12 @@ export class BridgeRunner {
     }
     const requestId = typeof event.requestId === "string" ? event.requestId.trim() : "";
     const reason = typeof event.reason === "string" ? event.reason.trim() : "";
-    const targetReplyTo = this.normalizeReplyTarget(event.targetReplyTo);
+    if (reason === "user_stop" && this.runningTurn) {
+      this.dropQueuedBeforeStop = true;
+    }
+    // No target (`/stop`): interrupt whatever turn is running right now.
+    const targetReplyTo =
+      this.normalizeReplyTarget(event.targetReplyTo) || (this.runningTurn ? this.activeTurnReplyTo : "");
     if (!targetReplyTo) {
       return false;
     }
@@ -2767,7 +2779,12 @@ export class BridgeRunner {
         .join(",")}`,
     );
 
-    for (const message of messages) {
+    // `/stop` drops every message queued before it; the user resends what they still want.
+    let lastStopIndex = -1;
+    messages.forEach((message, index) => {
+      if (this.isUserStopMessage(message)) lastStopIndex = index;
+    });
+    for (const [index, message] of messages.entries()) {
       if (this.stopped) {
         break;
       }
@@ -2775,8 +2792,16 @@ export class BridgeRunner {
         this.copilotLog(`skip message role=${String(message?.role || "unknown").toLowerCase()}`);
         continue;
       }
+      if (this.isUserStopMessage(message)) {
+        this.dropQueuedBeforeStop = false;
+      } else if ((index < lastStopIndex || this.dropQueuedBeforeStop) && this.isDroppableOnStop(message)) {
+        if (message.message_id) this.processedMessageIds.add(message.message_id);
+        this.copilotLog(`drop message queued before /stop replyTo=${message.message_id || "unknown"}`);
+        continue;
+      }
       await this.respondToMessage(message);
     }
+    this.dropQueuedBeforeStop = false;
 
     if (ackToken) {
       await this.conductor.ackMessages(this.taskId, ackToken);
@@ -2786,6 +2811,15 @@ export class BridgeRunner {
     return hasMore;
   }
 
+  isUserStopMessage(message) {
+    return String(message?.role || "").toLowerCase() === "user" && isStopCommand(message.content);
+  }
+
+  // The end-of-round summary request is the server's, not the user's: dropping it would lock the round.
+  isDroppableOnStop(message) {
+    return String(message?.role || "").toLowerCase() === "user" && message.metadata?.kind !== "persistent_round_end";
+  }
+
   shouldRespond(message) {
     if (!message || typeof message !== "object") {
       return false;
@@ -3664,6 +3698,9 @@ export class BridgeRunner {
     if (!hasAttachmentInputs && this.createFreshBackendSession && isClearCommand(content)) {
       return this.runClearCommand(options);
     }
+    if (!hasAttachmentInputs && isStopCommand(content)) {
+      return this.runStopCommand(options);
+    }
 
     if (willRunGoal) {
       const goalResult = await this.runWithTurnUsage(() =>
@@ -3852,6 +3889,24 @@ export class BridgeRunner {
     return { text, items: [], usage: null, provider: this.backendName, events: [], metadata: {} };
   }
 
+  /**
+   * `/stop`: the server already interrupted the running turn when the message
+   * arrived (fire only reads it once that turn ends), so just confirm it
+   * instead of sending it to the model.
+   */
+  async runStopCommand({ onProgress, replyTo = "" } = {}) {
+    const text = `${this.backendName} 已停止。`;
+    onProgress?.({ phase: "turn_completed", reply_in_progress: false, status_done_line: text });
+    if (this.useSessionFileReplyStream && !this.stopped) {
+      try {
+        await this.sendSessionStreamMessage({ text, replyTo });
+      } catch (error) {
+        log(`[stop] failed to post confirmation: ${error?.message || error}`);
+      }
+    }
+    return { text, items: [], usage: null, provider: this.backendName, events: [], metadata: {} };
+  }
+
   async handlePrePromptMessage(content) {
     const text = typeof content === "string" ? content.trim() : "";
     if (!text) {
@@ -3889,6 +3944,8 @@ export class BridgeRunner {
   }) {
     this.lastRuntimeStatusSignature = null;
     this.runningTurn = true;
+    // Lets a target-less interrupt (`/stop`) reach this turn.
+    this.activeTurnReplyTo = replyTarget;
     // Only this turn's own streamed replies may carry its usage.
     this.lastStreamedReplyIds.clear();
     const startedAt = Date.now();
@@ -3963,6 +4020,11 @@ export class BridgeRunner {
         this.copilotLog(`${logTag} turn interrupted by stop_task elapsedMs=${Date.now() - startedAt}`);
         return;
       }
+      const interruptInfo = this.remoteInterruptsByReplyTo.get(replyTarget);
+      if (interruptInfo && this.isTurnInterruptedError(error)) {
+        await this.handleInterruptedTurn(replyTarget, interruptInfo);
+        return;
+      }
       if (
         await this.settleCodexCheckpointUnavailableAfterStream(replyTarget, errorMessage, {
           markProcessed: false,
@@ -3976,11 +4038,38 @@ export class BridgeRunner {
       await this.reportError(`${errorLabel}执行失败: ${errorMessage}`);
     } finally {
       this.copilotLog(`${logTag} turn end elapsedMs=${Date.now() - startedAt}`);
+      this.activeTurnReplyTo = "";
+      this.clearInterruptRetryForReplyTarget(replyTarget);
+      this.remoteInterruptsByReplyTo.delete(replyTarget);
       this.runningTurn = false;
       this.scheduleRuntimeHeartbeat();
     }
   }
 
+  // Provider-level warnings the user has to act on (e.g. claude refusing
+  // bypassPermissions as root without IS_SANDBOX=1). Sent right after the
+  // "session started" line so the reason is visible before the turn fails.
+  async reportBackendNotices() {
+    const snapshot =
+      typeof this.backendSession?.getSnapshot === "function" ? this.backendSession.getSnapshot() : null;
+    const notices = Array.isArray(snapshot?.notices)
+      ? snapshot.notices.filter((notice) => typeof notice === "string" && notice.trim())
+      : [];
+    for (const notice of notices) {
+      try {
+        await this.conductor.sendMessage(this.taskId, notice, {
+          severity: "warning",
+          backend: this.backendName,
+          cli_args: this.cliArgs,
+          synthetic: true,
+        });
+        this.copilotLog(`backend notice sent: ${sanitizeForLog(notice, 120)}`);
+      } catch (error) {
+        log(`Failed to send backend notice: ${error?.message || error}`);
+      }
+    }
+  }
+
   async reportError(message, replyTo) {
     try {
       await this.conductor.sendMessage(this.taskId, message, {