@love-moon/conductor-cli 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # @love-moon/conductor-cli
 
+## 0.17.0
+
+### Minor Changes
+
+- 88e1ae0: Support `/stop` in task chats. A bare `/stop` message, sent from the web, the
+  CLI or a channel, makes the server interrupt the AI's running turn right away
+  instead of waiting for fire to read the message once that turn ends. When fire
+  does read the queued `/stop`, it posts a confirmation and does not send it to
+  the model. `/stop` also drops every message queued before it (except the
+  server's end-of-round summary request); resend what you still want. The server
+  targets the reply it knows is running, so older fires stop it too;
+  `interrupt_turn` no longer needs a reply target, and without one fire
+  interrupts the turn it is running, including the initial prompt and pre_prompt
+  turns. In the web chat, the ⋯ menu gains `/stop`, `/clear` and `/compact`,
+  which send those commands as messages, and Interrupt (Esc) sends `/stop`,
+  ignored while an earlier `/stop` is unanswered. The Interrupt action is gone
+  from the message toolbar.
+
+### Patch Changes
+
+- 79ca552: Claude no longer switches to `acceptEdits` mode when the daemon runs as root.
+  That fallback looked like it worked, but in a headless task it silently refused
+  every shell command (ssh, rsync, ...) and every read outside the project. Claude
+  now keeps `bypassPermissions` everywhere. As root without `IS_SANDBOX=1`, the
+  chat shows a warning right after "session started" telling you to add
+  `envs: { IS_SANDBOX: "1" }` to the conductor config (or run the daemon as a
+  regular user). Terminal tasks print the same hint. An `IS_SANDBOX` set in config
+  `envs` now also reaches terminal (PTY) claude tasks. `conductor config` always
+  writes `--dangerously-skip-permissions` for claude.
+- c0c1489: `conductor task speak <text> [-o FILE|-]` saves Doubao text-to-speech as an
+  .mp3 — the same voice the web chat's new voice-conversation mode reads replies with.
+- 39ee057: `conductor update` and the daemon updater compile node-pty against the headers
+  the running Node ships, instead of downloading them from nodejs.org, so an
+  update no longer needs that host to be reachable. `conductor update` also stops
+  an npm install that has not finished after 15 minutes instead of waiting on a
+  stalled registry connection forever.
+- b09b28a: Remove `conductor task create --remote-worktree <host>`; passing it now fails
+  with a pointer to the replacement. Running the AI on one daemon while the code
+  lives on another is done only through a global AI backend:
+  `--global-backend <backend>@<host>` (add `--worktree` for a worktree on the
+  code's daemon). Note the host changes meaning: `--remote-worktree` named the
+  daemon holding the code, `--global-backend` names the daemon running the AI, so
+  create the task in the project on the code's daemon. The server refuses a caller-supplied
+  `launch_config.remoteWorktree`.
+
+  `conductor task create --global-backend` now takes `<backend>@<host>`, the same
+  form as `conductor issue start` and the web UI. The older `<host>:<backend>` is
+  still accepted.
+
+- 68fe7b9: Add `conductor task preview <id> <path>`: open a temporary link to a file on the
+  task's daemon (HTML with its CSS/JS/images, Markdown, images, video), the same
+  preview the chat opens when you click a file link in an AI reply or shows in
+  place for `![](picture.png)` / `![](recording.mp4)`. The link expires after
+  5 idle minutes (30 minutes at most) and only reaches the file's own directory.
+
+  The daemon advertises a new `remote_file_preview` capability; previews need a
+  daemon of this version or later. `conductor config` now writes
+  `remote_file: true` explicitly into a new config file (the default was already
+  on; set it to `false` to decline file transfers and previews).
+
+- Updated dependencies [d088b31]
+- Updated dependencies [79ca552]
+- Updated dependencies [ccbfeeb]
+- Updated dependencies [88e1ae0]
+  - @love-moon/ai-sdk@0.17.0
+  - @love-moon/conductor-sdk@0.17.0
+
 ## 0.16.0
 
 ### Minor Changes

package/bin/conductor-config.js

@@ -10,7 +10,6 @@ import { createRequire } from "node:module";
 import yargs from "yargs/yargs";
 import { hideBin } from "yargs/helpers";
 import { RUNTIME_SUPPORTED_BACKENDS } from "../src/runtime-backends.js";
-import { isClaudeRootPermissionRestricted } from "@love-moon/ai-sdk";
 import { resolveConductorConfigPath } from "../src/conductor-paths.js";
 
 const CONFIG_FILE = resolveConductorConfigPath();
@@ -22,12 +21,10 @@ const packageJson = JSON.parse(
 const DEFAULT_CLIs = {
   claude: {
     command: "claude",
-    // claude exits 1 with `--dangerously-skip-permissions` under root, so never
-    // write a flag the user's own machine cannot run. Same root check the
-    // daemon and the ai-sdk session use.
-    execArgs: isClaudeRootPermissionRestricted()
-      ? "--permission-mode acceptEdits"
-      : "--dangerously-skip-permissions",
+    // Kept even on root: a headless acceptEdits session silently denies every
+    // shell command. Root users opt in with `envs.IS_SANDBOX: "1"`; fire and
+    // the daemon tell them so when claude starts.
+    execArgs: "--dangerously-skip-permissions",
     description: "Anthropic Claude CLI"
   },
   codex: {
@@ -387,9 +384,9 @@ async function main() {
     "# Env: CONDUCTOR_REMOTE_EXEC",
     "# remote_exec: true",
     "",
-    "# Accept `conductor remote cp` file transfers for this host.",
+    "# Accept `conductor remote cp` file transfers and file previews for this host.",
     "# Env: CONDUCTOR_REMOTE_FILE",
-    "# remote_file: true",
+    "remote_file: true",
     "",
     "# Launch each Fire process inside a detached tmux session so it survives a",
     "# daemon restart. Requires tmux on PATH. Env: CONDUCTOR_FIRE_TMUX_MODE",

package/bin/conductor-fire.js

@@ -1648,6 +1648,10 @@ export function formatCompactReply(backendName, compact, instructions = "") {
  * Per-message `/clear` detector. Only a bare `/clear` (case-insensitive)
  * counts: anything after it is more likely an instruction for the model.
  */
+export function isStopCommand(content) {
+  return typeof content === "string" && /^\/stop$/i.test(content.trim());
+}
+
 export function isClearCommand(content) {
   return typeof content === "string" && /^\/clear$/i.test(content.trim());
 }
@@ -2168,6 +2172,8 @@ export class BridgeRunner {
     this.remoteInterruptsByReplyTo = new Map();
     this.pendingInterruptRetryTimers = new Map();
     this.activeTurnReplyTo = "";
+    // A `/stop` arrived mid-batch: drop the rest of this batch (all sent before it).
+    this.dropQueuedBeforeStop = false;
     this.sessionAnnouncementSent = false;
     this.sessionAnnouncementSubscribed = false;
     this.boundSessionId = "";
@@ -2309,6 +2315,7 @@ export class BridgeRunner {
       });
       this.sessionAnnouncementSent = true;
       this.copilotLog(hasRealSessionId ? `session announced id=${sessionId}` : "session announced without id");
+      await this.reportBackendNotices();
       await this.reportRuntimeStatus(
         {
           state: this.useSessionFileReplyStream ? undefined : "WAIT_READY",
@@ -2577,7 +2584,12 @@ export class BridgeRunner {
     }
     const requestId = typeof event.requestId === "string" ? event.requestId.trim() : "";
     const reason = typeof event.reason === "string" ? event.reason.trim() : "";
-    const targetReplyTo = this.normalizeReplyTarget(event.targetReplyTo);
+    if (reason === "user_stop" && this.runningTurn) {
+      this.dropQueuedBeforeStop = true;
+    }
+    // No target (`/stop`): interrupt whatever turn is running right now.
+    const targetReplyTo =
+      this.normalizeReplyTarget(event.targetReplyTo) || (this.runningTurn ? this.activeTurnReplyTo : "");
     if (!targetReplyTo) {
       return false;
     }
@@ -2767,7 +2779,12 @@ export class BridgeRunner {
         .join(",")}`,
     );
 
-    for (const message of messages) {
+    // `/stop` drops every message queued before it; the user resends what they still want.
+    let lastStopIndex = -1;
+    messages.forEach((message, index) => {
+      if (this.isUserStopMessage(message)) lastStopIndex = index;
+    });
+    for (const [index, message] of messages.entries()) {
       if (this.stopped) {
         break;
       }
@@ -2775,8 +2792,16 @@ export class BridgeRunner {
         this.copilotLog(`skip message role=${String(message?.role || "unknown").toLowerCase()}`);
         continue;
       }
+      if (this.isUserStopMessage(message)) {
+        this.dropQueuedBeforeStop = false;
+      } else if ((index < lastStopIndex || this.dropQueuedBeforeStop) && this.isDroppableOnStop(message)) {
+        if (message.message_id) this.processedMessageIds.add(message.message_id);
+        this.copilotLog(`drop message queued before /stop replyTo=${message.message_id || "unknown"}`);
+        continue;
+      }
       await this.respondToMessage(message);
     }
+    this.dropQueuedBeforeStop = false;
 
     if (ackToken) {
       await this.conductor.ackMessages(this.taskId, ackToken);
@@ -2786,6 +2811,15 @@ export class BridgeRunner {
     return hasMore;
   }
 
+  isUserStopMessage(message) {
+    return String(message?.role || "").toLowerCase() === "user" && isStopCommand(message.content);
+  }
+
+  // The end-of-round summary request is the server's, not the user's: dropping it would lock the round.
+  isDroppableOnStop(message) {
+    return String(message?.role || "").toLowerCase() === "user" && message.metadata?.kind !== "persistent_round_end";
+  }
+
   shouldRespond(message) {
     if (!message || typeof message !== "object") {
       return false;
@@ -3664,6 +3698,9 @@ export class BridgeRunner {
     if (!hasAttachmentInputs && this.createFreshBackendSession && isClearCommand(content)) {
       return this.runClearCommand(options);
     }
+    if (!hasAttachmentInputs && isStopCommand(content)) {
+      return this.runStopCommand(options);
+    }
 
     if (willRunGoal) {
       const goalResult = await this.runWithTurnUsage(() =>
@@ -3852,6 +3889,24 @@ export class BridgeRunner {
     return { text, items: [], usage: null, provider: this.backendName, events: [], metadata: {} };
   }
 
+  /**
+   * `/stop`: the server already interrupted the running turn when the message
+   * arrived (fire only reads it once that turn ends), so just confirm it
+   * instead of sending it to the model.
+   */
+  async runStopCommand({ onProgress, replyTo = "" } = {}) {
+    const text = `${this.backendName} 已停止。`;
+    onProgress?.({ phase: "turn_completed", reply_in_progress: false, status_done_line: text });
+    if (this.useSessionFileReplyStream && !this.stopped) {
+      try {
+        await this.sendSessionStreamMessage({ text, replyTo });
+      } catch (error) {
+        log(`[stop] failed to post confirmation: ${error?.message || error}`);
+      }
+    }
+    return { text, items: [], usage: null, provider: this.backendName, events: [], metadata: {} };
+  }
+
   async handlePrePromptMessage(content) {
     const text = typeof content === "string" ? content.trim() : "";
     if (!text) {
@@ -3889,6 +3944,8 @@ export class BridgeRunner {
   }) {
     this.lastRuntimeStatusSignature = null;
     this.runningTurn = true;
+    // Lets a target-less interrupt (`/stop`) reach this turn.
+    this.activeTurnReplyTo = replyTarget;
     // Only this turn's own streamed replies may carry its usage.
     this.lastStreamedReplyIds.clear();
     const startedAt = Date.now();
@@ -3963,6 +4020,11 @@ export class BridgeRunner {
         this.copilotLog(`${logTag} turn interrupted by stop_task elapsedMs=${Date.now() - startedAt}`);
         return;
       }
+      const interruptInfo = this.remoteInterruptsByReplyTo.get(replyTarget);
+      if (interruptInfo && this.isTurnInterruptedError(error)) {
+        await this.handleInterruptedTurn(replyTarget, interruptInfo);
+        return;
+      }
       if (
         await this.settleCodexCheckpointUnavailableAfterStream(replyTarget, errorMessage, {
           markProcessed: false,
@@ -3976,11 +4038,38 @@ export class BridgeRunner {
       await this.reportError(`${errorLabel}执行失败: ${errorMessage}`);
     } finally {
       this.copilotLog(`${logTag} turn end elapsedMs=${Date.now() - startedAt}`);
+      this.activeTurnReplyTo = "";
+      this.clearInterruptRetryForReplyTarget(replyTarget);
+      this.remoteInterruptsByReplyTo.delete(replyTarget);
       this.runningTurn = false;
       this.scheduleRuntimeHeartbeat();
     }
   }
 
+  // Provider-level warnings the user has to act on (e.g. claude refusing
+  // bypassPermissions as root without IS_SANDBOX=1). Sent right after the
+  // "session started" line so the reason is visible before the turn fails.
+  async reportBackendNotices() {
+    const snapshot =
+      typeof this.backendSession?.getSnapshot === "function" ? this.backendSession.getSnapshot() : null;
+    const notices = Array.isArray(snapshot?.notices)
+      ? snapshot.notices.filter((notice) => typeof notice === "string" && notice.trim())
+      : [];
+    for (const notice of notices) {
+      try {
+        await this.conductor.sendMessage(this.taskId, notice, {
+          severity: "warning",
+          backend: this.backendName,
+          cli_args: this.cliArgs,
+          synthetic: true,
+        });
+        this.copilotLog(`backend notice sent: ${sanitizeForLog(notice, 120)}`);
+      } catch (error) {
+        log(`Failed to send backend notice: ${error?.message || error}`);
+      }
+    }
+  }
+
   async reportError(message, replyTo) {
     try {
       await this.conductor.sendMessage(this.taskId, message, {

package/bin/conductor-task.js

@@ -19,11 +19,13 @@
  *   schedule update <id> <schedule-id> [<message>] [--delay|--at|--every ...]
  *   stop <id> | interrupt <id> [--target-reply-to <msg-id>]
  *   restart <id> [--strategy inplace|new_task] [--backend] [--refresh-session]
- *           [--daemon-host <h>] [--first-message <text>]
+ *           [--daemon-host <h>] [--code-host <h>] [--first-message <text>]
  *   delete <id> --yes [--permanent] | archive <id> | unarchive <id> [--daemon-host <h>]
  *   rename <id> <title> | pin <id> | unpin <id> | labels <id> [<label-id>...] [--clear]
  *   move <id> [<project>] [--back] | share <id> | unshare <id> | shared <token|link>
+ *   preview <id> <path>
  *   transcribe <audio.wav|mp3> [--language <tag>]
+ *   speak <text> [-o FILE|-]
  *   persistent <id> [--enable|--disable] [--instructions ...] [--summary ...]
  *   round end <id> | round start <id> [<message>] [--backend] [--daemon-host] [--worktree inherit|new|none]
  *   cleanup-worktree <id> | terminal open|close|show <id>
@@ -31,8 +33,7 @@
  *   resume --daemon-host <h> --backend <b> --session <id> [--session-file <p>] [--title] [--prompt]
  *
  *   create also takes: --daemon-host, --agent <name>[:backend] (repeatable; first
- *   is the worker), --global-backend <host>:<backend>, --worktree,
- *   --remote-worktree <host>, --persistent
+ *   is the worker), --global-backend <backend>@<host>, --worktree, --persistent
  *   send also takes: --attach FILE (repeatable)
  *   messages also takes: --follow [--interval <sec>] [--until-idle]
  *   list also takes (without --archived): --all-projects, --project-ids a,b
@@ -351,6 +352,16 @@ async function handleList(argv, deps) {
 }
 
 async function handleCreate(argv, deps) {
+  // Removed flag: an unknown argument only warns, and would start a plain local task.
+  if (argv.remoteWorktree !== undefined) {
+    const err = new Error(
+      "--remote-worktree was removed. Create the task in the project on the daemon that holds the code, "
+        + "with --global-backend <backend>@<ai-host> --worktree: the host now names the daemon that runs the AI, "
+        + "not the one that holds the code.",
+    );
+    err.code = "ARGS";
+    throw err;
+  }
   const apis = await buildApis(deps);
   const project = await resolveProject(apis, {
     env: deps.env,
@@ -774,9 +785,9 @@ export async function main(argvInput = hideBin(process.argv), deps = {}) {
             array: true,
             describe: "Multi-agent group member <name>[:backend]; repeat it. The first is the worker, the rest reviewers",
           })
-          .option("global-backend", { type: "string", describe: "Run the AI on a global backend <host>:<backend> (RFC 0041)" })
+          .option("global-backend", { type: "string", describe: "Run the AI on a global AI backend from settings, as <backend>@<host>" })
           .option("worktree", { type: "boolean", describe: "Run in a new git worktree on the project's daemon" })
-          .option("remote-worktree", { type: "string", describe: "Run in a new git worktree on this remote daemon" })
+          .option("remote-worktree", { type: "string", hidden: true })
           .option("persistent", { type: "boolean", describe: "Create a persistent task (RFC 0039)" }),
         async (argv) => {
           exitCode = await handleCreate(argv, { ...handlerDeps, configFile: argv.configFile });
@@ -862,7 +873,8 @@ export async function main(argvInput = hideBin(process.argv), deps = {}) {
           .option("strategy", { choices: ["inplace", "new_task"], describe: "inplace resumes the session; new_task forks a successor" })
           .option("backend", { type: "string", describe: "Switch to this AI backend" })
           .option("refresh-session", { type: "boolean", default: false, describe: "Start a fresh AI session in place" })
-          .option("daemon-host", { type: "string", describe: "Run the restarted session on this daemon" })
+          .option("daemon-host", { type: "string", describe: "Run the restarted AI on this daemon; with --strategy new_task it keeps working on the source task's code remotely when it can (add --code-host <same> to move the work there instead)" })
+          .option("code-host", { type: "string", describe: "With --strategy new_task: daemon holding the code (default: the source task's); another daemon moves the work there and needs --daemon-host set to it" })
           .option("first-message", { type: "string", describe: "With --strategy new_task: first message instead of the transcript handoff" }),
         run(extra.handleRestart),
       )
@@ -932,6 +944,14 @@ export async function main(argvInput = hideBin(process.argv), deps = {}) {
         (cmd) => cmd.positional("id", { type: "string", demandOption: true }),
         run(extra.handleShare),
       )
+      .command(
+        "preview <id> <path>",
+        "Open a temporary link to a file on the task's daemon (HTML, Markdown, images…)",
+        (cmd) => cmd
+          .positional("id", { type: "string", demandOption: true })
+          .positional("path", { type: "string", demandOption: true, describe: "Absolute, ~/ or relative to the task's working directory" }),
+        run(extra.handlePreview),
+      )
       .command(
         "unshare <id>",
         "Revoke a task's share link",
@@ -952,6 +972,14 @@ export async function main(argvInput = hideBin(process.argv), deps = {}) {
           .option("language", { type: "string", describe: "Language hint, e.g. zh or en" }),
         run(extra.handleTranscribe),
       )
+      .command(
+        "speak <text>",
+        "Text to speech as .mp3 (the web voice mode's reply voice)",
+        (cmd) => cmd
+          .positional("text", { type: "string", demandOption: true })
+          .option("output", { alias: "o", type: "string", describe: "Output file (default speech.mp3), or - for stdout" }),
+        run(extra.handleSpeak),
+      )
       .command(
         "persistent <id>",
         "Change persistent-task settings (RFC 0039)",

package/bin/conductor-update.js

@@ -17,6 +17,7 @@ import {
   fetchLatestVersion,
   isNewerVersion,
   detectPackageManager,
+  resolveBundledNodeDir,
   resolveGlobalInstallPrefix,
 } from "../src/version-check.js";
 import {
@@ -31,6 +32,7 @@ const PKG_ROOT = path.join(__dirname, "..");
 
 const pkgJson = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf-8"));
 const CURRENT_VERSION = pkgJson.version;
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
 const INSTALL_METHOD = resolveInstallMethod({
   env: process.env,
   packageRoot: PKG_ROOT,
@@ -176,6 +178,11 @@ async function performUpdate() {
     console.log("");
   }
 
+  const nodeDir = resolveBundledNodeDir();
+  if (nodeDir && !process.env.npm_config_nodedir) {
+    process.env.npm_config_nodedir = nodeDir;
+  }
+
   if (packageManager === "pnpm") {
     console.log("   Preparing pnpm native dependency allowlist...");
     await ensurePnpmOnlyBuiltDependencies({
@@ -212,16 +219,26 @@ async function performUpdate() {
       stdio: "inherit",
       shell: true
     });
+    // npm never gives up on a registry connection that stalls mid-handshake.
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+    }, INSTALL_TIMEOUT_MS);
 
     child.on("close", (code) => {
+      clearTimeout(timer);
       if (code === 0) {
         resolve();
+      } else if (timedOut) {
+        reject(new Error(`${cmd} did not finish within ${INSTALL_TIMEOUT_MS / 60_000} minutes`));
       } else {
         reject(new Error(`Exit code ${code}`));
       }
     });
 
     child.on("error", (error) => {
+      clearTimeout(timer);
       reject(error);
     });
   });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@love-moon/conductor-cli",
-  "version": "0.16.0",
-  "gitCommitId": "77239b9",
+  "version": "0.17.0",
+  "gitCommitId": "2799bc0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lovemoon-ai/conductor.git"
@@ -24,8 +24,8 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@love-moon/ai-sdk": "0.16.0",
-    "@love-moon/conductor-sdk": "0.16.0",
+    "@love-moon/ai-sdk": "0.17.0",
+    "@love-moon/conductor-sdk": "0.17.0",
     "@github/copilot-sdk": "^0.3.0",
     "chrome-launcher": "^1.2.1",
     "chrome-remote-interface": "^0.33.0",
@@ -38,7 +38,7 @@
   },
   "optionalDependencies": {
     "@roamhq/wrtc": "^0.10.0",
-    "@love-moon/chat-web": "0.16.0"
+    "@love-moon/chat-web": "0.17.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/src/backend-http.js

@@ -134,13 +134,19 @@ export function createBackendHttp({ config, fetchImpl, env = process.env }) {
     return payload;
   }
 
-  /** GET a binary body; resolves to the raw fetch Response (caller streams it). */
+  /** Fetch a binary body (GET, or POST with `options.body` as JSON); resolves to the raw Response. */
   async function download(pathname, options = {}) {
+    const hasBody = options.body !== undefined;
     let response;
     try {
       response = await doFetch(buildUrl(pathname, options.query), {
-        method: "GET",
-        headers: { Authorization: `Bearer ${config.agentToken}`, Accept: "*/*" },
+        method: hasBody ? "POST" : "GET",
+        headers: {
+          Authorization: `Bearer ${config.agentToken}`,
+          Accept: "*/*",
+          ...(hasBody ? { "Content-Type": "application/json" } : {}),
+        },
+        ...(hasBody ? { body: JSON.stringify(options.body) } : {}),
       });
     } catch (error) {
       throw new BackendHttpError(`Download failed: ${error?.message || String(error)}`, undefined, undefined);

package/src/daemon-update.js

@@ -11,6 +11,7 @@ import {
   detectPackageManager,
   fetchLatestVersion,
   isNewerVersion,
+  resolveBundledNodeDir,
   resolveGlobalInstallPrefix,
 } from "./version-check.js";
 import {
@@ -283,6 +284,8 @@ function buildInstallEnv(packageManager, packageRoot, env) {
     const prefix = resolveGlobalInstallPrefix(packageRoot);
     if (prefix) installEnv.npm_config_prefix = prefix;
   }
+  const nodeDir = resolveBundledNodeDir();
+  if (nodeDir && !installEnv.npm_config_nodedir) installEnv.npm_config_nodedir = nodeDir;
   return installEnv;
 }
 

package/src/daemon.js

@@ -47,6 +47,7 @@ import {
 import { REMOTE_WORKTREE_ENV, remoteWorktreeFireEnv } from "./remote/mcp-launch.js";
 import {
   REMOTE_FILE_CAPABILITY,
+  REMOTE_FILE_PREVIEW_CAPABILITY,
   createRemoteFileHandlers,
   handleRemoteFileRequest,
 } from "./remote-file-handlers.js";
@@ -68,7 +69,7 @@ import {
   normalizeRuntimeBackendAlias,
   normalizeRuntimeBackendName,
 } from "./runtime-backends.js";
-import { resolveClaudeCommandForRoot } from "@love-moon/ai-sdk";
+import { buildClaudeRootSandboxNotice, claudeCommandNeedsRootSandbox } from "@love-moon/ai-sdk";
 import {
   PACKAGE_NAME,
   buildUpgradeCommand,
@@ -573,15 +574,20 @@ export function ensureNodePtySpawnHelperExecutable(deps = {}) {
 }
 
 // A tool-preset PTY task runs the configured allow_cli_list command through a
-// login shell, bypassing ai-sdk entirely. claude refuses to start as root with
-// `--dangerously-skip-permissions`, so rewrite the command the same way the
-// ai-sdk session rewrites its permission mode — one shared root check, so the
-// two paths cannot drift.
-export function resolvePtyToolPresetCommand(cliCommand, env = process.env) {
+// login shell, bypassing ai-sdk entirely. The command is never rewritten: as
+// root without IS_SANDBOX=1, claude refuses `--dangerously-skip-permissions`
+// and exits, so print the same IS_SANDBOX hint the chat path shows, right in
+// the terminal before claude's own error.
+export function resolvePtyToolPresetCommand(cliCommand, env = process.env, options = {}) {
   if (inferBuiltInRuntimeBackendFromCommand(cliCommand) !== "claude") {
     return cliCommand;
   }
-  return resolveClaudeCommandForRoot(cliCommand, env);
+  if (!claudeCommandNeedsRootSandbox(cliCommand, env)) {
+    return cliCommand;
+  }
+  const notice = buildClaudeRootSandboxNotice({ configFile: options.configFile });
+  const quoted = `'${notice.replace(/'/g, "'\\''")}'`;
+  return `printf '%s\\n\\n' ${quoted} >&2; ${cliCommand}`;
 }
 
 export function isSafeTaskWorktreeRoot(projectWorkspacePath, worktreeRoot) {
@@ -989,6 +995,21 @@ function buildPtyTaskEnv(baseEnv = process.env, launchEnv = {}) {
   };
 }
 
+const CLAUDE_ROOT_OPT_OUT_ENV_KEYS = ["IS_SANDBOX", "CLAUDE_CODE_BUBBLEWRAP"];
+
+function pickClaudeRootOptOutEnv(configEnv) {
+  const picked = {};
+  if (!configEnv || typeof configEnv !== "object") {
+    return picked;
+  }
+  for (const key of CLAUDE_ROOT_OPT_OUT_ENV_KEYS) {
+    if (configEnv[key] !== undefined && configEnv[key] !== null) {
+      picked[key] = String(configEnv[key]);
+    }
+  }
+  return picked;
+}
+
 // Module-level so the PTY launch wiring is directly testable: the tool-preset
 // branch has to hand the *child's* env to the root check, and that seam is
 // exactly where a bug hid before (the check read the daemon's own process.env,
@@ -1037,9 +1058,17 @@ export function buildPtyLaunchSpec(launchConfig, fallbackCwd, deps = {}) {
     if (!cliCommand) {
       throw new Error(`Unsupported tool preset: ${toolPreset}`);
     }
-    const launchCommand = resolvePtyToolPresetCommand(cliCommand, buildPtyTaskEnv(baseEnv, env));
+    // The PTY child inherits the daemon env, not the config's `envs:` block,
+    // yet the root hint tells users to set `envs.IS_SANDBOX: "1"`. Forward
+    // just claude's root opt-outs so that advice works for terminal tasks too.
+    // launch_config.env still wins, matching the spawned env.
+    const isClaudePreset = inferBuiltInRuntimeBackendFromCommand(cliCommand) === "claude";
+    const launchEnv = isClaudePreset ? { ...pickClaudeRootOptOutEnv(deps.configEnv), ...env } : env;
+    const launchCommand = resolvePtyToolPresetCommand(cliCommand, buildPtyTaskEnv(baseEnv, launchEnv), {
+      configFile: deps.configFile,
+    });
     if (launchCommand !== cliCommand) {
-      log(`[pty] Adjusted ${toolPreset} command for root: ${launchCommand}`);
+      log(`[pty] ${toolPreset} runs as root without IS_SANDBOX=1; claude will refuse bypassPermissions`);
     }
     return {
       entrypointType,
@@ -1048,7 +1077,7 @@ export function buildPtyLaunchSpec(launchConfig, fallbackCwd, deps = {}) {
       args: ["-lc", launchCommand],
       shell: preferredShell,
       cwd,
-      env,
+      env: launchEnv,
       cols,
       rows,
     };
@@ -3909,7 +3938,7 @@ export function startDaemon(config = {}, deps = {}) {
     log("[remote-exec] Disabled by config (remote_exec: false); capability not advertised");
   }
   if (remoteFileEnabled) {
-    advertisedCapabilities.push(REMOTE_FILE_CAPABILITY);
+    advertisedCapabilities.push(REMOTE_FILE_CAPABILITY, REMOTE_FILE_PREVIEW_CAPABILITY);
   } else {
     log("[remote-file] Disabled by config (remote_file: false); capability not advertised");
   }
@@ -3985,6 +4014,15 @@ export function startDaemon(config = {}, deps = {}) {
         config: sdkConfig,
         agentHost: AGENT_NAME,
         guestRoot: IS_GUEST_DAEMON ? GUEST_ROOT : null,
+        // Every Fire logs to `<task dir>/conductor.log`, so the log path is the
+        // one place the working directory survives a daemon restart (adopted
+        // tmux records carry it too).
+        resolveTaskCwd: (taskId) => {
+          const ptyCwd = activePtySessions.get(taskId)?.cwd;
+          if (ptyCwd) return ptyCwd;
+          const logPath = activeTaskProcesses.get(taskId)?.logPath;
+          return logPath ? path.dirname(logPath) : null;
+        },
       })
     : null;
 
@@ -5554,6 +5592,8 @@ export function startDaemon(config = {}, deps = {}) {
   function resolvePtyLaunchSpec(launchConfig, fallbackCwd) {
     return buildPtyLaunchSpec(launchConfig, fallbackCwd, {
       allowCliList: ALLOW_CLI_LIST,
+      configEnv: userConfig?.envs,
+      configFile: effectiveConfigPath,
       supportedBackends: SUPPORTED_BACKENDS,
       existsSync: existsSyncFn,
       log,

package/src/remote/mcp-launch.js

@@ -139,9 +139,9 @@ export function buildRemoteWorktreeSessionOptions({
         ...(sessionOptions.mcpServers || {}),
         [MCP_SERVER_NAME]: { type: "stdio", command: execPath, args },
       },
-      // Under the default bypassPermissions a root install is downgraded to
-      // acceptEdits, which would deny every remote_* call headless. A mode the
-      // user chose on purpose is left alone rather than widened.
+      // Pre-approve the remote_* tools under the default bypassPermissions so
+      // they keep working if claude ever runs in a prompting mode headless. A
+      // mode the user chose on purpose is left alone rather than widened.
       ...(mode === undefined || mode === "bypassPermissions"
         ? { allowedTools: [...new Set([...allowed, `mcp__${MCP_SERVER_NAME}`])] }
         : {}),

package/src/remote-file-handlers.js

@@ -38,6 +38,13 @@ const MAX_CONCURRENT_TRANSFERS = 4;
 const NUL = String.fromCharCode(0);
 
 export const REMOTE_FILE_CAPABILITY = "remote_file";
+/**
+ * This daemon enforces `rootPath` on `push` and resolves a relative path against
+ * a task's working directory. The backend must see it before opening a file
+ * preview: an older daemon would silently ignore `rootPath` and serve the whole
+ * disk to a preview link.
+ */
+export const REMOTE_FILE_PREVIEW_CAPABILITY = "remote_file_preview";
 
 /**
  * Move single files between this daemon's disk and the account that owns it,
@@ -68,6 +75,7 @@ export const REMOTE_FILE_CAPABILITY = "remote_file";
  * @param {number} [opts.chunkBytes]
  * @param {(ms:number)=>Promise<unknown>} [opts.sleep] backoff hook, injectable for tests
  * @param {string|null} [opts.guestRoot] when set, paths outside it are refused
+ * @param {(taskId:string)=>string|null} [opts.resolveTaskCwd] working directory of a live task
  */
 export function createRemoteFileHandlers(opts = {}) {
   const config = opts.config || null;
@@ -77,6 +85,7 @@ export function createRemoteFileHandlers(opts = {}) {
   const chunkBytes = resolveRemoteChunkBytes(opts.chunkBytes);
   const sleep = typeof opts.sleep === "function" ? opts.sleep : delay;
   const guestRoot = opts.guestRoot || null;
+  const resolveTaskCwd = typeof opts.resolveTaskCwd === "function" ? opts.resolveTaskCwd : () => null;
   // One controller for the whole daemon: `abortAll()` on shutdown tears down
   // every in-flight stream instead of letting them hold the process open.
   const shutdownController = new AbortController();
@@ -114,14 +123,57 @@ export function createRemoteFileHandlers(opts = {}) {
    * mistakes rather than a determined escape — same caveat as everywhere else
    * in this repo.
    */
-  function resolveRemotePath(value) {
-    const resolved = normalizeRemotePath(value);
+  function resolveRemotePath(value, taskId) {
+    const resolved = normalizeRemotePath(taskId ? resolveAgainstTask(value, taskId) : value);
     if (guestRoot && !isPathInsideGuestRoot(resolved, guestRoot)) {
       throw new Error(`path is outside this daemon's shared root: ${resolved}`);
     }
     return resolved;
   }
 
+  /** A link the AI wrote as `docs/report.md` means "relative to where I ran". */
+  function resolveAgainstTask(value, taskId) {
+    const raw = typeof value === "string" ? value.trim() : "";
+    if (!raw || path.isAbsolute(raw) || raw === "~" || raw.startsWith("~/")) return value;
+    const cwd = resolveTaskCwd(String(taskId));
+    if (!cwd) {
+      throw new Error(`cannot resolve relative path ${raw}: task ${taskId} is not running on this daemon`);
+    }
+    return path.join(cwd, raw);
+  }
+
+  /**
+   * Confine a preview read to `rootPath`. Unlike the guest-root check this one
+   * follows symlinks: the paths under a preview link are chosen by the page
+   * being previewed, not typed by the machine's owner, so a symlink into
+   * `~/.ssh` must not be a way out. Dotfiles below the root are refused for the
+   * same reason (`.env`, `.git/config`).
+   */
+  async function resolveInsideRoot(source, rootPath) {
+    let real;
+    let root;
+    try {
+      root = await fsp.realpath(normalizeRemotePath(rootPath));
+      real = await fsp.realpath(source);
+    } catch (error) {
+      if (error?.code === "ENOENT" || error?.code === "ENOTDIR") {
+        throw new Error(`no such file: ${source}`);
+      }
+      throw error;
+    }
+    const relative = path.relative(root, real);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+      throw new Error(`path is outside the preview root: ${source}`);
+    }
+    if (relative.split(path.sep).some((segment) => segment.startsWith("."))) {
+      throw new Error(`hidden files are not available to preview: ${source}`);
+    }
+    if (guestRoot && !isPathInsideGuestRoot(real, await fsp.realpath(guestRoot))) {
+      throw new Error(`path is outside this daemon's shared root: ${source}`);
+    }
+    return real;
+  }
+
   async function acquireSlot() {
     if (activeTransfers >= MAX_CONCURRENT_TRANSFERS) {
       throw new Error(
@@ -306,7 +358,10 @@ export function createRemoteFileHandlers(opts = {}) {
   async function push(args = {}) {
     const transferId = requireId(args.transferId ?? args.transfer_id, "transferId");
     const transferToken = requireId(args.transferToken ?? args.transfer_token, "transferToken");
-    const source = resolveRemotePath(args.remotePath ?? args.remote_path);
+    let source = resolveRemotePath(args.remotePath ?? args.remote_path);
+    const rootPath = args.rootPath ?? args.root_path;
+    if (rootPath) source = await resolveInsideRoot(source, rootPath);
+    const limit = Math.min(maxBytes, toPositiveInt(args.maxBytes ?? args.max_bytes) || maxBytes);
 
     const stat = await statOrNull(source);
     if (!stat) {
@@ -318,8 +373,8 @@ export function createRemoteFileHandlers(opts = {}) {
     if (!stat.isFile()) {
       throw new Error(`${source} is not a regular file`);
     }
-    if (stat.size > maxBytes) {
-      throw new Error(`${source} is ${stat.size} bytes, over the ${maxBytes} byte limit`);
+    if (stat.size > limit) {
+      throw new Error(`${source} is ${stat.size} bytes, over the ${limit} byte limit`);
     }
 
     await acquireSlot();
@@ -414,11 +469,12 @@ export function createRemoteFileHandlers(opts = {}) {
 
   /** Probe a path. A missing path is an answer, not an error. */
   async function stat(args = {}) {
-    const target = resolveRemotePath(args.remotePath ?? args.remote_path);
+    const target = resolveRemotePath(args.remotePath ?? args.remote_path, args.taskId ?? args.task_id);
     const info = await statOrNull(target);
     if (!info) {
       return {
         path: target,
+        realPath: null,
         exists: false,
         isFile: false,
         isDirectory: false,
@@ -429,6 +485,9 @@ export function createRemoteFileHandlers(opts = {}) {
     }
     return {
       path: target,
+      // Symlinks resolved: a preview roots itself here, so that the root it
+      // later enforces is the directory the file really lives in.
+      realPath: await fsp.realpath(target),
       exists: true,
       isFile: info.isFile(),
       isDirectory: info.isDirectory(),

package/src/task-commands.js

@@ -102,6 +102,10 @@ export async function handleRestart(argv, deps) {
   if (trimmed(argv.backend)) body.backend_type = trimmed(argv.backend);
   if (argv.refreshSession) body.restart_mode = "refresh_session";
   if (trimmed(argv.daemonHost)) body.agent_host = trimmed(argv.daemonHost);
+  if (trimmed(argv.codeHost)) {
+    if (argv.strategy !== "new_task") throw argsError("--code-host requires --strategy new_task");
+    body.code_host = trimmed(argv.codeHost);
+  }
   if (trimmed(argv.firstMessage)) {
     if (argv.strategy !== "new_task") throw argsError("--first-message requires --strategy new_task");
     body.first_message = trimmed(argv.firstMessage);
@@ -248,6 +252,15 @@ export async function handleShare(argv, deps) {
   return print(deps, argv, url ? { ...data, url } : data, url ? `Share link: ${url}` : `Shared task ${argv.id}`);
 }
 
+/** Open a temporary preview link for a file on the task's daemon (what clicking a file link in the chat does). */
+export async function handlePreview(argv, deps) {
+  const http = await buildHttp(deps);
+  const { dryRun, data } = await sendOrPreview(http, argv, deps, "POST", taskPath(argv.id, "preview"), { path: argv.path });
+  if (dryRun) return EXIT.OK;
+  const url = data?.viewUrl ? `${http.baseUrl}${data.viewUrl}` : null;
+  return print(deps, argv, url ? { ...data, url } : data, url ? `Preview link (expires after 5 idle minutes): ${url}` : `No preview link for ${argv.path}`);
+}
+
 export async function handleUnshare(argv, deps) {
   const http = await buildHttp(deps);
   const { dryRun, data } = await sendOrPreview(http, argv, deps, "DELETE", taskPath(argv.id, "share"));
@@ -317,6 +330,31 @@ export async function handleTranscribe(argv, deps) {
   return print(deps, argv, data, String(data?.text ?? ""));
 }
 
+/** Text to speech (the web voice mode's reply voice); saves an .mp3. */
+export async function handleSpeak(argv, deps) {
+  const text = trimmed(argv.text);
+  if (!text) throw argsError("Text is required");
+  const http = await buildHttp(deps);
+  if (argv.dryRun) {
+    return sendOrPreview(http, argv, deps, "POST", apiPath("speech", "synthesize"), { text, format: "mp3" }).then(() => EXIT.OK);
+  }
+  const response = await http.download(apiPath("speech", "synthesize"), { body: { text, format: "mp3" } });
+  let bytes;
+  try {
+    bytes = Buffer.from(await response.arrayBuffer());
+  } catch (error) {
+    // Synthesis failed mid-stream: never save a truncated file as success.
+    throw new Error(`Speech synthesis was interrupted: ${error?.message || String(error)}`);
+  }
+  if (argv.output === "-") {
+    deps.stdout.write(bytes);
+    return EXIT.OK;
+  }
+  const target = path.resolve(deps.cwd || process.cwd(), argv.output ? String(argv.output) : "speech.mp3");
+  fs.writeFileSync(target, bytes);
+  return print(deps, argv, { path: target, bytes: bytes.length }, `Saved ${bytes.length} bytes to ${target}`);
+}
+
 // ---- persistent tasks (RFC 0039) -----------------------------------------
 
 export async function handlePersistent(argv, deps) {
@@ -568,14 +606,21 @@ export function parseAgents(values) {
   });
 }
 
+/** `claude@l20`, as the web UI and `issue start` write it; the older `l20:claude` still parses. */
 export function parseGlobalBackend(value) {
   const raw = trimmed(value);
   if (!raw) return undefined;
-  const index = raw.indexOf(":");
-  const host = index > 0 ? raw.slice(0, index).trim() : "";
-  const backend = index > 0 ? raw.slice(index + 1).trim() : "";
-  if (!host || !backend) throw argsError("--global-backend must look like <host>:<backend>, e.g. l20:claude");
-  return { host, backend };
+  const at = raw.indexOf("@");
+  const colon = raw.indexOf(":");
+  const [backend, host] = at > 0
+    ? [raw.slice(0, at), raw.slice(at + 1)]
+    : colon > 0
+      ? [raw.slice(colon + 1), raw.slice(0, colon)]
+      : ["", ""];
+  if (!host.trim() || !backend.trim()) {
+    throw argsError("--global-backend must look like <backend>@<host>, e.g. claude@l20");
+  }
+  return { host: host.trim(), backend: backend.trim().toLowerCase() };
 }
 
 /** True when `task create` needs the full frontend payload rather than the SDK subset. */
@@ -585,24 +630,16 @@ export function hasExtendedCreateOptions(argv) {
       || (argv.agent && [].concat(argv.agent).length)
       || trimmed(argv.globalBackend)
       || argv.worktree
-      || trimmed(argv.remoteWorktree)
       || argv.persistent,
   );
 }
 
 export function buildExtendedCreateBody(argv, deps, projectId, title) {
-  if (argv.worktree && trimmed(argv.remoteWorktree)) {
-    throw argsError("Pass --worktree or --remote-worktree, not both");
-  }
   const globalBackend = parseGlobalBackend(argv.globalBackend);
   const agents = parseAgents(argv.agent);
   if (globalBackend && (agents.length || trimmed(argv.daemonHost))) {
     throw argsError("--global-backend cannot be combined with --agent or --daemon-host");
   }
-  // Both are rejected by POST /api/tasks; fail before the round trip.
-  if (globalBackend && trimmed(argv.remoteWorktree)) {
-    throw argsError("--global-backend cannot be combined with --remote-worktree");
-  }
   if (globalBackend && trimmed(argv.backend) && trimmed(argv.backend) !== globalBackend.backend) {
     throw argsError(
       `--backend ${trimmed(argv.backend)} does not match --global-backend backend ${globalBackend.backend}; drop --backend`,
@@ -625,8 +662,7 @@ export function buildExtendedCreateBody(argv, deps, projectId, title) {
     if (trimmed(argv.backend)) body.backendType = trimmed(argv.backend);
   }
   if (agents.length) body.agents = agents;
-  if (trimmed(argv.remoteWorktree)) body.launchConfig = { remoteWorktree: { host: trimmed(argv.remoteWorktree) } };
-  else if (argv.worktree) body.launchConfig = { worktree: true };
+  if (argv.worktree) body.launchConfig = { worktree: true };
   return body;
 }
 

package/src/version-check.js

@@ -162,6 +162,16 @@ export function resolveGlobalInstallPrefix(packageRoot) {
   return normalized.slice(0, markerIndex);
 }
 
+/**
+ * The directory of the running Node when it ships its own headers, which official tarballs, nvm
+ * and Homebrew all do. Handed to node-gyp as `npm_config_nodedir`, it compiles node-pty against
+ * those instead of downloading the headers from nodejs.org.
+ */
+export function resolveBundledNodeDir(nodeExecutable = process.execPath, { existsSync = fs.existsSync } = {}) {
+  const nodeDir = path.dirname(path.dirname(nodeExecutable));
+  return existsSync(path.join(nodeDir, "include", "node", "common.gypi")) ? nodeDir : null;
+}
+
 export function buildUpgradeCommand(options = {}) {
   const installMethod = resolveInstallMethod(options);
   if (installMethod === "homebrew") {