@love-moon/conductor-cli 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @love-moon/conductor-cli
 
+## 0.9.0
+
+### Minor Changes
+
+- 3a499cc: Add `conductor remote-exec` for running a single command on another daemon's
+  host, over a new `remote_exec_request`/`remote_exec_response` daemon protocol
+  pair gated by a `remote_exec` capability. Supports `--workspace`, `--env`,
+  `--timeout` with automatic polling for long commands, `--kill-on-timeout`, and
+  ssh-style exit codes. Hosts can decline with `remote_exec: false` in the config.
+- a15b55d: Add per-turn multi-image and local context-file inputs, plus authenticated attachment materialization from Conductor Web to the executing daemon.
+
+### Patch Changes
+
+- Updated dependencies [a15b55d]
+  - @love-moon/ai-sdk@0.9.0
+  - @love-moon/conductor-sdk@0.9.0
+
 ## 0.8.0
 
 ### Minor Changes

package/bin/conductor-config.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { execFileSync, execSync } from "node:child_process";
+import { createRequire } from "node:module";
 import yargs from "yargs/yargs";
 import { hideBin } from "yargs/helpers";
 import { RUNTIME_SUPPORTED_BACKENDS } from "../src/runtime-backends.js";
@@ -43,6 +44,11 @@ const DEFAULT_CLIs = {
     execArgs: "",
     description: "GitHub Copilot (built in via SDK)"
   },
+  dsh: {
+    command: "dsh",
+    execArgs: "",
+    description: "DeepSeek Harness agent (built in via SDK; needs DEEPSEEK_API_KEY)"
+  },
   // chat-web is the runtime backend (an in-process Chromium driver, not a CLI
   // binary). It has multiple sub-providers selected via --model. Each user-
   // facing alias below resolves to the chat-web runtime; advertising the bare
@@ -102,6 +108,20 @@ function isBuiltInChatWebAvailable() {
   );
 }
 
+function isBuiltInDshAvailable() {
+  // The dsh runtime ships as pinned dependencies of @love-moon/ai-sdk (not of
+  // the CLI itself), so resolve it THROUGH ai-sdk's resolution context — a
+  // direct resolve from cli/bin fails under pnpm's isolated node_modules.
+  try {
+    const require = createRequire(import.meta.url);
+    const aiSdkEntry = require.resolve("@love-moon/ai-sdk");
+    createRequire(aiSdkEntry).resolve("@deepseek-ai/dsh-sdk-jsonrpc-demo/bin");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function buildConfigEntryLines(cli, info, { commented = false } = {}) {
   const fullCommand = info.execArgs
     ? `${info.command} ${info.execArgs}`
@@ -335,6 +355,10 @@ function detectInstalledCLIs() {
       detected.push(key);
       continue;
     }
+    if (runtimeBackend === "dsh" && isBuiltInDshAvailable()) {
+      detected.push(key);
+      continue;
+    }
     if (isCommandAvailable(info.command)) {
       detected.push(key);
     }

package/bin/conductor-fire.js

@@ -798,7 +798,7 @@ async function main() {
       extraEnv: env,
       extraHeaders: buildConductorConnectHeaders(pkgJson.version, {
         backends: [cliArgs.backend],
-        capabilities: ["refresh_session_inplace"],
+        capabilities: ["refresh_session_inplace", "task_attachments_v1"],
       }),
       configFile: cliArgs.configFile,
       onConnected: (event) => {
@@ -3069,7 +3069,13 @@ export class BridgeRunner {
   }
 
   async respondToMessage(message) {
-    const content = String(message.content || "").trim();
+    const localAttachments = Array.isArray(message.attachments)
+      ? message.attachments.filter((attachment) =>
+          attachment && typeof attachment === "object" && typeof (attachment.path || attachment.localPath) === "string"
+        )
+      : [];
+    const rawContent = String(message.content || "").trim();
+    const content = rawContent || (localAttachments.length ? "Analyze the attached files." : "");
     if (!content) {
       this.copilotLog(`skip empty message replyTo=${message?.message_id || "latest"}`);
       return;
@@ -3091,6 +3097,22 @@ export class BridgeRunner {
       String(message.role || "").toLowerCase() === "user" &&
       content === this.pendingInitialPrompt;
     const useInitialImages = isQueuedInitialPromptMessage && this.includeInitialImages;
+    const nativeImageMimes = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+    const media = localAttachments
+      .filter((attachment) => attachment.kind === "image" && nativeImageMimes.has(String(attachment.mimeType || "").toLowerCase()))
+      .map((attachment) => ({
+        kind: "image",
+        path: attachment.path || attachment.localPath,
+        mimeType: attachment.mimeType,
+        name: attachment.name,
+      }));
+    const contextFiles = localAttachments
+      .filter((attachment) => !media.some((image) => image.path === (attachment.path || attachment.localPath)))
+      .map((attachment) => ({
+        path: attachment.path || attachment.localPath,
+        mimeType: attachment.mimeType,
+        name: attachment.name,
+      }));
     if (
       this.useSessionFileReplyStream &&
       typeof this.backendSession?.setSessionReplyTarget === "function"
@@ -3140,6 +3162,8 @@ export class BridgeRunner {
 
       const turnPromise = this.dispatchBackendTurn(content, {
         useInitialImages,
+        media,
+        contextFiles,
         onProgress: (payload) => {
           void this.reportRuntimeStatus(payload, replyTo);
         },
@@ -3330,8 +3354,12 @@ export class BridgeRunner {
     const goalCapable = Boolean(
       snapshot && snapshot.capabilities && snapshot.capabilities.goal === true,
     );
+    const hasAttachmentInputs =
+      (Array.isArray(options.media) && options.media.length > 0) ||
+      (Array.isArray(options.contextFiles) && options.contextFiles.length > 0);
     const willRunGoal =
       goalDirective != null &&
+      !hasAttachmentInputs &&
       goalCapable &&
       typeof this.backendSession?.runGoal === "function";
 

package/bin/conductor-remote-exec.js

@@ -0,0 +1,365 @@
+#!/usr/bin/env node
+
+/**
+ * conductor remote-exec — run one command on another daemon's host.
+ *
+ *   conductor remote-exec --target ubuntu --workspace /home/duino/ws/holomotion ls .
+ *   conductor remote-exec --target ubuntu -- bash -lc "pnpm build 2>&1 | tail -20"
+ *
+ * The command is sent as argv and spawned without a shell on the target, so
+ * quoting is not re-interpreted remotely. Pass `-- bash -lc "..."` when pipes
+ * or globs are actually wanted.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+import { ConductorConfig, loadConfig } from "@love-moon/conductor-sdk";
+import { envForExplicitConfigFile } from "../src/config-env.js";
+import { resolveConductorConfigPath } from "../src/conductor-paths.js";
+
+/**
+ * Following ssh: the remote command's exit code is passed through verbatim
+ * (0-254) and 255 is reserved for this CLI's own failures. Reusing 1/2/4 for
+ * local errors would make `grep` finding nothing (1) or `ls` on a missing path
+ * (2) indistinguishable from a network error or a usage mistake.
+ */
+const EXIT = { OK: 0, CLI_ERROR: 255 };
+const DEFAULT_TIMEOUT_MS = 60_000;
+const POLL_INTERVAL_MS = 1_000;
+/** How long a single request may block server-side before we switch to polling. */
+const POST_WAIT_MS = 10_000;
+
+const VALUE_FLAGS = new Map([
+  ["--target", "target"],
+  ["-t", "target"],
+  ["--workspace", "workspace"],
+  ["-w", "workspace"],
+  ["--timeout", "timeout"],
+  ["--config-file", "configFile"],
+  ["--env", "env"],
+  ["-e", "env"],
+]);
+
+const BOOL_FLAGS = new Map([
+  ["--json", "json"],
+  ["--kill-on-timeout", "killOnTimeout"],
+  ["--help", "help"],
+  ["-h", "help"],
+]);
+
+const isMainModule = (() => {
+  const currentFile = fileURLToPath(import.meta.url);
+  const entryFile = process.argv[1] ? path.resolve(process.argv[1]) : "";
+  return entryFile === currentFile;
+})();
+
+/**
+ * Split argv into flags and the remote command.
+ *
+ * Both `... --workspace /p ls .` and `... --workspace /p -- ls .` are accepted:
+ * the first token that is not a recognized flag starts the remote command, and
+ * everything after it is passed through verbatim.
+ */
+export function parseArgs(argv) {
+  const options = { env: {}, json: false, help: false };
+  const command = [];
+
+  let index = 0;
+  while (index < argv.length) {
+    const token = argv[index];
+
+    if (token === "--") {
+      command.push(...argv.slice(index + 1));
+      break;
+    }
+
+    let name = token;
+    let inlineValue = null;
+    if (token.startsWith("--") && token.includes("=")) {
+      const splitAt = token.indexOf("=");
+      name = token.slice(0, splitAt);
+      inlineValue = token.slice(splitAt + 1);
+    }
+
+    if (BOOL_FLAGS.has(name) && inlineValue === null) {
+      options[BOOL_FLAGS.get(name)] = true;
+      index += 1;
+      continue;
+    }
+
+    if (VALUE_FLAGS.has(name)) {
+      const key = VALUE_FLAGS.get(name);
+      const value = inlineValue !== null ? inlineValue : argv[index + 1];
+      if (value === undefined) {
+        throw new UsageError(`${name} requires a value`);
+      }
+      if (key === "env") {
+        const splitAt = value.indexOf("=");
+        if (splitAt <= 0) {
+          throw new UsageError(`--env expects KEY=VALUE, got: ${value}`);
+        }
+        options.env[value.slice(0, splitAt)] = value.slice(splitAt + 1);
+      } else {
+        options[key] = value;
+      }
+      index += inlineValue !== null ? 1 : 2;
+      continue;
+    }
+
+    command.push(...argv.slice(index));
+    break;
+  }
+
+  return { options, command };
+}
+
+export class UsageError extends Error {}
+
+/** Accepts `500ms`, `30s`, `2m`, or a bare number of seconds. */
+export function parseTimeoutMs(value) {
+  if (value === undefined || value === null || value === "") {
+    return DEFAULT_TIMEOUT_MS;
+  }
+  const raw = String(value).trim().toLowerCase();
+  const match = raw.match(/^(\d+(?:\.\d+)?)(ms|s|m)?$/);
+  if (!match) {
+    throw new UsageError(`invalid --timeout value: ${value}`);
+  }
+  const amount = Number.parseFloat(match[1]);
+  const unit = match[2] || "s";
+  const multiplier = unit === "ms" ? 1 : unit === "m" ? 60_000 : 1_000;
+  const ms = Math.round(amount * multiplier);
+  if (!Number.isFinite(ms) || ms <= 0) {
+    throw new UsageError(`invalid --timeout value: ${value}`);
+  }
+  return ms;
+}
+
+function loadCliConfig(configFile, env = process.env) {
+  const configPath = resolveConductorConfigPath(configFile, env);
+  const configEnv = envForExplicitConfigFile(configFile, env);
+  if (fs.existsSync(configPath)) {
+    return loadConfig(configPath, { env: configEnv });
+  }
+
+  const agentToken = typeof env.CONDUCTOR_AGENT_TOKEN === "string" ? env.CONDUCTOR_AGENT_TOKEN.trim() : "";
+  const backendUrl = typeof env.CONDUCTOR_BACKEND_URL === "string" ? env.CONDUCTOR_BACKEND_URL.trim() : "";
+  if (agentToken && backendUrl) {
+    return new ConductorConfig({ agentToken, backendUrl });
+  }
+
+  return loadConfig(configPath, { env: configEnv });
+}
+
+async function callApi(config, method, pathname, body, fetchImpl) {
+  const url = new URL(pathname, config.backendUrl);
+  const response = await fetchImpl(url.toString(), {
+    method,
+    headers: {
+      Authorization: `Bearer ${config.agentToken}`,
+      Accept: "application/json",
+      ...(body ? { "Content-Type": "application/json" } : {}),
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  });
+
+  const text = await response.text();
+  let payload = null;
+  try {
+    payload = text ? JSON.parse(text) : null;
+  } catch {
+    payload = null;
+  }
+
+  if (!response.ok) {
+    const message = payload?.error || text.trim() || `HTTP ${response.status}`;
+    const error = new Error(message);
+    error.status = response.status;
+    throw error;
+  }
+  return payload;
+}
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export function showHelp(consoleImpl = console) {
+  consoleImpl.log(`conductor remote-exec - run a command on another daemon's host
+
+Usage:
+  conductor remote-exec --target <daemon> [options] <command> [args...]
+  conductor remote-exec --target <daemon> [options] -- <command> [args...]
+
+Options:
+  -t, --target <daemon>   Daemon name to run on (required)
+  -w, --workspace <path>  Working directory on the target (default: target's home)
+      --timeout <dur>     Overall deadline, e.g. 30s, 2m, 500ms (default: 60s)
+  -e, --env KEY=VALUE     Extra environment variable (repeatable)
+      --json              Print the raw run result as JSON
+      --kill-on-timeout   Stop the remote command when --timeout is reached
+                          (default: it keeps running on the target)
+      --config-file <p>   Conductor config file to authenticate with
+  -h, --help              Show this help
+
+Notes:
+  The command is spawned without a shell. For pipes, globs or redirection use:
+    conductor remote-exec -t ubuntu -- bash -lc "ls | wc -l"
+
+  Exit codes follow ssh: the remote command's own code is passed through, and
+  255 means this CLI failed (bad usage, daemon offline, network error).
+
+Examples:
+  conductor remote-exec --target ubuntu --workspace /home/duino/ws/holomotion ls .
+  conductor remote-exec -t ubuntu -w /srv/app -- git log --oneline -5
+`);
+}
+
+export async function runRemoteExec(argv, deps = {}) {
+  const consoleImpl = deps.console || console;
+  const fetchImpl = deps.fetch || globalThis.fetch;
+  const env = deps.env || process.env;
+  const sleep = deps.sleep || delay;
+  const now = deps.now || (() => Date.now());
+
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (error) {
+    consoleImpl.error(`Error: ${error.message}`);
+    return EXIT.CLI_ERROR;
+  }
+  const { options, command } = parsed;
+
+  if (options.help) {
+    showHelp(consoleImpl);
+    return EXIT.OK;
+  }
+
+  const target = typeof options.target === "string" ? options.target.trim() : "";
+  if (!target) {
+    consoleImpl.error("Error: --target <daemon> is required");
+    showHelp(consoleImpl);
+    return EXIT.CLI_ERROR;
+  }
+  if (command.length === 0) {
+    consoleImpl.error("Error: no command given");
+    showHelp(consoleImpl);
+    return EXIT.CLI_ERROR;
+  }
+
+  let timeoutMs;
+  try {
+    timeoutMs = parseTimeoutMs(options.timeout);
+  } catch (error) {
+    consoleImpl.error(`Error: ${error.message}`);
+    return EXIT.CLI_ERROR;
+  }
+
+  let config;
+  try {
+    config = deps.config || loadCliConfig(options.configFile, env);
+  } catch (error) {
+    consoleImpl.error(`Error: ${error.message}`);
+    return EXIT.CLI_ERROR;
+  }
+
+  const basePath = `/api/agents/${encodeURIComponent(target)}/exec`;
+  const deadline = now() + timeoutMs;
+
+  let run;
+  try {
+    run = await callApi(config, "POST", basePath, {
+      command: command[0],
+      args: command.slice(1),
+      ...(options.workspace ? { workspace: options.workspace } : {}),
+      ...(Object.keys(options.env).length > 0 ? { env: options.env } : {}),
+      // Deliberately short, and independent of `--timeout`: the overall deadline
+      // is owned by the poll loop below. Handing the daemon the full deadline
+      // would make one HTTP request block for it, and would leave the loop
+      // unreachable because the POST alone would consume the whole budget.
+      timeoutMs: Math.min(timeoutMs, POST_WAIT_MS),
+    }, fetchImpl);
+  } catch (error) {
+    consoleImpl.error(`Error: ${error.message}`);
+    return EXIT.CLI_ERROR;
+  }
+
+  let pollError = null;
+  while (run?.status === "running" && now() < deadline) {
+    if (!run.runId) {
+      pollError = new Error("daemon reported a running command but returned no runId");
+      break;
+    }
+    await sleep(POLL_INTERVAL_MS);
+    try {
+      run = await callApi(
+        config,
+        "GET",
+        `${basePath}/runs/${encodeURIComponent(run.runId)}`,
+        null,
+        fetchImpl,
+      );
+      pollError = null;
+    } catch (error) {
+      // A saturated or briefly unreachable daemon can fail one status poll.
+      // Keep waiting until the caller's own deadline rather than aborting a
+      // long-running command that is still perfectly healthy.
+      pollError = error;
+    }
+  }
+
+  if (run?.status === "running" && options.killOnTimeout && run.runId) {
+    try {
+      run = await callApi(
+        config,
+        "DELETE",
+        `${basePath}/runs/${encodeURIComponent(run.runId)}`,
+        null,
+        fetchImpl,
+      );
+      consoleImpl.error(`[conductor] deadline reached; stopped the command on ${target}`);
+    } catch (error) {
+      consoleImpl.error(`[conductor] failed to stop the run on ${target}: ${error.message}`);
+    }
+  }
+
+  if (options.json) {
+    consoleImpl.log(JSON.stringify(run, null, 2));
+  } else {
+    if (run?.stdoutTail) process.stdout.write(run.stdoutTail);
+    if (run?.stderrTail) process.stderr.write(run.stderrTail);
+    if (run?.truncated) {
+      consoleImpl.error(`[conductor] output truncated; showing the tail only`);
+    }
+    if (run?.error) {
+      consoleImpl.error(`Error: ${run.error}`);
+    }
+  }
+
+  if (run?.status === "running") {
+    if (pollError) {
+      consoleImpl.error(`[conductor] last status poll failed: ${pollError.message}`);
+    }
+    consoleImpl.error(
+      `[conductor] still running on ${target} after ${timeoutMs}ms; ` +
+        `it keeps going there — poll GET ${basePath}/runs/${run.runId}, ` +
+        `stop it with DELETE on the same path, or use --kill-on-timeout`,
+    );
+    return EXIT.CLI_ERROR;
+  }
+  if (run?.status === "cancelled") {
+    return EXIT.CLI_ERROR;
+  }
+  if (typeof run?.exitCode === "number") {
+    return run.exitCode;
+  }
+  return run?.status === "completed" ? EXIT.OK : EXIT.CLI_ERROR;
+}
+
+if (isMainModule) {
+  // `process.exitCode` rather than `process.exit()`: writes to a pipe are async,
+  // and exiting outright truncates them. Let the loop drain and end naturally.
+  process.exitCode = await runRemoteExec(process.argv.slice(2));
+}

package/bin/conductor.js

@@ -15,6 +15,7 @@
  *   project  - Manage Conductor projects (list/show/create/...)
  *   issue    - Manage issues (list/show/create/update/start/done)
  *   task     - Manage tasks (create/list/show/send/messages/schedule)
+ *   remote-exec - Run a command on another daemon's host
  */
 
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -50,6 +51,7 @@ export function runConductorCli(args = argv, deps = {}) {
     "project",
     "issue",
     "task",
+    "remote-exec",
   ];
 
   if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
@@ -135,6 +137,7 @@ Subcommands:
   project   Manage Conductor projects (list/show/create/...)
   issue     Manage issues (list/show/create/update/start/done)
   task      Manage tasks (create/list/show/send/messages/schedule)
+  remote-exec Run a command on another daemon's host
 
 Options:
   -h, --help     Show this help message
@@ -159,6 +162,7 @@ Examples:
   conductor task create --title "Refactor module" --prompt "Extract the parser" --backend codex
   conductor task send <task-id> "please add a unit test"
   conductor task schedule create <task-id> "follow up" --delay 10m
+  conductor remote-exec --target ubuntu --workspace /home/duino/ws/holomotion ls .
 
 For subcommand-specific help:
   conductor fire --help
@@ -172,6 +176,7 @@ For subcommand-specific help:
   conductor project --help
   conductor issue --help
   conductor task --help
+  conductor remote-exec --help
 
 Version: ${pkgJson.version}
 `);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@love-moon/conductor-cli",
-  "version": "0.8.0",
-  "gitCommitId": "04d4f62",
+  "version": "0.9.0",
+  "gitCommitId": "606e5a6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lovemoon-ai/conductor.git"
@@ -24,8 +24,8 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@love-moon/ai-sdk": "0.8.0",
-    "@love-moon/conductor-sdk": "0.8.0",
+    "@love-moon/ai-sdk": "0.9.0",
+    "@love-moon/conductor-sdk": "0.9.0",
     "@github/copilot-sdk": "^0.3.0",
     "chrome-launcher": "^1.2.1",
     "chrome-remote-interface": "^0.33.0",
@@ -38,7 +38,7 @@
   },
   "optionalDependencies": {
     "@roamhq/wrtc": "^0.10.0",
-    "@love-moon/chat-web": "0.8.0"
+    "@love-moon/chat-web": "0.9.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package/src/ai-manager-handlers.js

@@ -5,7 +5,7 @@
 import { AiManager } from "@love-moon/ai-sdk";
 
 const VALID_ACTIONS = new Set(["status", "quota", "list_accounts", "switch_account"]);
-const BASE_QUOTA_TOOLS = ["codex", "claude", "kimi", "copilot"];
+const BASE_QUOTA_TOOLS = ["codex", "claude", "kimi", "copilot", "dsh"];
 
 /**
  * @param {object} opts
@@ -23,7 +23,7 @@ export function createAiManagerHandlers(opts = {}) {
       manager.getCurrentCodexAccount().catch(() => null),
     ]);
     const network = {};
-    const tools = ["codex", "claude", "kimi", "copilot"];
+    const tools = [...BASE_QUOTA_TOOLS];
     await Promise.all(
       tools.map(async (tool) => {
         if (install[tool]?.installed) {
@@ -70,6 +70,9 @@ export function createAiManagerHandlers(opts = {}) {
     addJob("copilot", () => manager.getCopilotQuota({
       forceRefresh,
     }));
+    addJob("dsh", () => manager.getDshQuota({
+      forceRefresh,
+    }));
     const externalBackends = pickExternalQuotaBackends(args);
     for (const backend of externalBackends) {
       if (!tools.has(backend)) {

package/src/daemon.js

@@ -30,6 +30,11 @@ import {
   createCustomCommandHandlers,
   handleCustomCommandsRequest,
 } from "./custom-command-handlers.js";
+import {
+  REMOTE_EXEC_CAPABILITY,
+  createRemoteExecHandlers,
+  handleRemoteExecRequest,
+} from "./remote-exec-handlers.js";
 import { resolveResumeContext } from "./fire/resume.js";
 import {
   filterRuntimeSupportedAllowCliList,
@@ -213,6 +218,32 @@ function getFireTmuxModeEnabled(userConfig) {
   return false;
 }
 
+// Whether this host will accept `remote-exec`. Unlike `pty_task` (gated on a
+// node-pty probe) and `custom_commands` (opt-in per script), remote exec would
+// otherwise be unconditional, leaving a shared CI box or a root-owned daemon no
+// way to decline. Defaults to enabled to match the other daemon capabilities.
+//
+// Resolution order:
+//   1. CONDUCTOR_REMOTE_EXEC env var ("1"/"true"/"on" enable, "0"/"false"/"off" disable)
+//   2. remote_exec boolean in the resolved Conductor config.yaml
+//   3. Default: true
+function getRemoteExecEnabled(userConfig) {
+  const rawEnv = process.env.CONDUCTOR_REMOTE_EXEC;
+  if (typeof rawEnv === "string" && rawEnv.trim()) {
+    const normalized = rawEnv.trim().toLowerCase();
+    if (normalized === "1" || normalized === "true" || normalized === "on" || normalized === "yes") {
+      return true;
+    }
+    if (normalized === "0" || normalized === "false" || normalized === "off" || normalized === "no") {
+      return false;
+    }
+  }
+  if (userConfig && typeof userConfig === "object" && userConfig.remote_exec === false) {
+    return false;
+  }
+  return true;
+}
+
 function normalizePlanLimitType(limitType) {
   if (typeof limitType !== "string") {
     return null;
@@ -799,6 +830,7 @@ export function startDaemon(config = {}, deps = {}) {
   // warning and silently fall back to direct spawn rather than failing every
   // create_task with ENOENT.
   const FIRE_TMUX_MODE_ENABLED = getFireTmuxModeEnabled(userConfig);
+  const remoteExecEnabled = getRemoteExecEnabled(userConfig);
 
   // Get allow_cli_list from config
   const RAW_ALLOW_CLI_LIST = getRawAllowCliList(userConfig);
@@ -2196,11 +2228,19 @@ export function startDaemon(config = {}, deps = {}) {
 
       if (linkStat) {
         if (!linkStat.isSymbolicLink()) {
-          throw new Error(
-            `worktree symlink destination already exists and is not a symlink: ${linkPath}. ` +
-              `Refusing to replace it because it may hold real data — remove it manually, ` +
-              `or drop "${configuredPath}" from worktree.symlink in .conductor/settings.yaml.`,
+          // A real file/dir at the destination means something materialised
+          // data inside the worktree (e.g. `pnpm install` replaced the
+          // node_modules link with a real directory). It may hold real data,
+          // so never clobber it — but throwing here made every task in this
+          // worktree permanently un-restartable. Keep the local copy and skip
+          // the link; remove the path manually (or drop the entry from
+          // worktree.symlink) to restore sharing with the project workspace.
+          logError(
+            `[worktree] skipping symlink for ${configuredPath}: destination already exists and ` +
+              `is not a symlink: ${linkPath}. Keeping the local copy — remove it manually to ` +
+              `restore sharing via worktree.symlink in .conductor/settings.yaml.`,
           );
+          continue;
         }
         // Compare the link's TARGET, not whether that target resolves. A link
         // that already points at the right place is correct even when the
@@ -2934,8 +2974,14 @@ export function startDaemon(config = {}, deps = {}) {
     "project_agents_registry",
     "restart_daemon",
     "refresh_session_inplace",
+    "task_attachments_v1",
     CUSTOM_COMMANDS_CAPABILITY,
   ];
+  if (remoteExecEnabled) {
+    advertisedCapabilities.push(REMOTE_EXEC_CAPABILITY);
+  } else {
+    log("[remote-exec] Disabled by config (remote_exec: false); capability not advertised");
+  }
   if (ptyTaskCapabilityEnabled) {
     advertisedCapabilities.push("pty_task", "terminal_snapshot");
   }
@@ -2944,6 +2990,9 @@ export function startDaemon(config = {}, deps = {}) {
   }
   const aiManagerHandlers = createAiManagerHandlers({ configPath: effectiveConfigPath });
   const customCommandHandlers = createCustomCommandHandlers({ configPath: effectiveConfigPath });
+  const remoteExecHandlers = remoteExecEnabled
+    ? createRemoteExecHandlers({ defaultWorkspace: homeDir })
+    : null;
 
   const client = createWebSocketClient(sdkConfig, {
     extraHeaders,
@@ -5171,6 +5220,40 @@ export function startDaemon(config = {}, deps = {}) {
         logError(`Unhandled custom_commands_request failure: ${error?.message || error}`);
       });
     }
+    if (event.type === "remote_exec_request") {
+      // Remote exec is the only execution path that leaves no Task row and no
+      // per-run log file, so record it here — otherwise a run is invisible
+      // once the daemon restarts. argv is deliberately omitted: it routinely
+      // carries secrets and this log is collected by `collect_logs`.
+      const execArgs = event?.payload?.args && typeof event.payload.args === "object" ? event.payload.args : {};
+      log(
+        `[remote-exec] ${event?.payload?.action || "?"} command=${execArgs.command || ""} ` +
+          `argc=${Array.isArray(execArgs.args) ? execArgs.args.length : 0} cwd=${execArgs.workspace || "<default>"}`,
+      );
+      // Fail fast rather than letting the caller wait out its full timeout —
+      // it has no other way to learn that this daemon will never answer.
+      const rejectReason = !remoteExecHandlers
+        ? "remote exec is disabled on this daemon (remote_exec: false)"
+        : daemonShuttingDown
+          ? "daemon is shutting down"
+          : "";
+      if (rejectReason) {
+        void client
+          .sendJson({
+            type: "remote_exec_response",
+            payload: {
+              request_id: event?.payload?.request_id ? String(event.payload.request_id) : "",
+              action: event?.payload?.action ? String(event.payload.action) : "",
+              error: rejectReason,
+            },
+          })
+          .catch(() => {});
+        return;
+      }
+      handleRemoteExecRequest(client, remoteExecHandlers, event.payload).catch((error) => {
+        logError(`Unhandled remote_exec_request failure: ${error?.message || error}`);
+      });
+    }
     if (event.type === "restart_daemon") {
       void handleRestartDaemon(event.payload).catch((error) => {
         logError(`Unhandled restart_daemon failure: ${error?.message || error}`);
@@ -6218,6 +6301,10 @@ export function startDaemon(config = {}, deps = {}) {
         PWD: taskDir,
         CONDUCTOR_PROJECT_ID: projectId,
         CONDUCTOR_TASK_ID: taskId,
+        // Fire derives its own stable host identity from the owning daemon plus
+        // the task. Passing the resolved name keeps that identity meaningful
+        // even when the daemon was named through the config file.
+        CONDUCTOR_DAEMON_NAME: AGENT_NAME,
         CONDUCTOR_LAUNCHED_BY_DAEMON: "1",
         ...(cliCommand ? { CONDUCTOR_CLI_COMMAND: cliCommand } : {}),
       };
@@ -6732,7 +6819,11 @@ export function startDaemon(config = {}, deps = {}) {
         resolvedResumeCwd = await resolveRestartCwd({
           taskId: normalizedTargetTaskId,
           projectId: normalizedProjectId,
-          backendType: effectiveBackend,
+          // A fork starts a fresh target-backend session, but its workspace
+          // still belongs to the source task. Resolve the source session in
+          // its own provider namespace; target + source session id is not a
+          // meaningful pair for cross-backend handoff.
+          backendType: sourceBackendType,
           launchConfig: targetLaunchConfig,
           sessionId: normalizedSourceSessionId,
           sourceSessionFilePath: sourceSessionFilePath ? String(sourceSessionFilePath) : "",
@@ -6920,6 +7011,7 @@ export function startDaemon(config = {}, deps = {}) {
       PWD: taskDir,
       CONDUCTOR_PROJECT_ID: normalizedProjectId,
       CONDUCTOR_TASK_ID: normalizedTargetTaskId,
+      CONDUCTOR_DAEMON_NAME: AGENT_NAME,
       CONDUCTOR_LAUNCHED_BY_DAEMON: "1",
       ...(cliCommand ? { CONDUCTOR_CLI_COMMAND: cliCommand } : {}),
     };

package/src/remote-exec-handlers.js

@@ -0,0 +1,421 @@
+import { promises as fsp } from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+
+import { resolveUserHome } from "./conductor-paths.js";
+
+const VALID_ACTIONS = new Set(["exec", "status", "cancel"]);
+const MAX_TAIL_CHARS = 64_000;
+const MAX_RUNS = 200;
+const MAX_CONCURRENT_RUNS = 32;
+const MAX_ARGS = 256;
+const DEFAULT_WAIT_MS = 30_000;
+const MAX_WAIT_MS = 120_000;
+/** Grace between SIGTERM and SIGKILL when a run is cancelled. */
+const KILL_GRACE_MS = 5_000;
+const NUL = String.fromCharCode(0);
+
+export const REMOTE_EXEC_CAPABILITY = "remote_exec";
+
+/**
+ * Run arbitrary commands on this daemon's host on behalf of the account that
+ * owns it.
+ *
+ * This is not a new trust boundary: the same account can already reach the same
+ * shell through `create_pty_task`, whose `entrypoint_type: "custom"` branch
+ * takes a caller-supplied command, argv, cwd and env, and whose server-side
+ * validation only checks `cols`/`rows`. The one case where this genuinely does
+ * add reach is a host whose node-pty probe failed — there `pty_task` is not
+ * advertised at all — which is why the capability is opt-out-able via
+ * `remote_exec: false` in the daemon's config.
+ *
+ * Commands are spawned without a shell: the caller sends argv, so nothing is
+ * re-parsed here. Callers that genuinely want a shell pass `-- bash -lc "..."`.
+ *
+ * @param {object} opts
+ * @param {typeof spawn} [opts.spawnFn]
+ * @param {string} [opts.defaultWorkspace] cwd used when the request omits one
+ */
+export function createRemoteExecHandlers(opts = {}) {
+  const spawnFn = opts.spawnFn || spawn;
+  const defaultWorkspace = opts.defaultWorkspace || resolveUserHome();
+  const runs = new Map();
+
+  async function exec(args = {}) {
+    // Start the clock before any I/O. The server's waiter starts ticking the
+    // moment it sends the request, and its only margin is a few seconds of
+    // slack; a slow `stat` on a stale network mount would otherwise let the
+    // server time out first, stranding a running child whose runId the caller
+    // never learned.
+    const waitMs = clampWaitMs(args.timeoutMs ?? args.timeout_ms);
+    const waitDeadline = Date.now() + waitMs;
+
+    const command = normalizeCommand(args.command);
+    if (!command) {
+      throw new Error("exec requires a `command` string");
+    }
+    const argv = normalizeArgv(args.args);
+    const running = countRunning(runs);
+    if (running >= MAX_CONCURRENT_RUNS) {
+      throw new Error(
+        `too many concurrent remote exec runs on this daemon (${running}/${MAX_CONCURRENT_RUNS}); cancel one first`,
+      );
+    }
+    const cwd = await resolveWorkspace(args.workspace ?? args.workspace_path, defaultWorkspace);
+    const env = buildExecEnv(args.env);
+
+    const runState = {
+      runId: randomUUID(),
+      command,
+      args: argv,
+      workspace: cwd,
+      status: "running",
+      pid: null,
+      exitCode: null,
+      signal: null,
+      stdoutTail: "",
+      stderrTail: "",
+      truncated: false,
+      error: null,
+      startedAt: new Date().toISOString(),
+      finishedAt: null,
+      settleWaiters: [],
+      child: null,
+      cancelRequested: false,
+      killTimer: null,
+    };
+    rememberRun(runs, runState);
+
+    let child;
+    try {
+      child = spawnFn(command, argv, {
+        cwd,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (error) {
+      finishRun(runState, "failed", { error: errMsg(error) });
+      return toPublicRun(runState);
+    }
+
+    runState.child = child;
+    runState.pid = typeof child.pid === "number" ? child.pid : null;
+
+    // Decode per stream: a multi-byte character can straddle two `data` chunks,
+    // and a naive String(chunk) would turn each half into U+FFFD.
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
+    child.stdout?.on("data", (chunk) => {
+      runState.stdoutTail = appendTail(runState, runState.stdoutTail, stdoutDecoder.write(chunk));
+    });
+    child.stderr?.on("data", (chunk) => {
+      runState.stderrTail = appendTail(runState, runState.stderrTail, stderrDecoder.write(chunk));
+    });
+    child.on("error", (error) => {
+      finishRun(runState, "failed", { error: errMsg(error) });
+    });
+    child.on("close", (code, signal) => {
+      runState.stdoutTail = appendTail(runState, runState.stdoutTail, stdoutDecoder.end());
+      runState.stderrTail = appendTail(runState, runState.stderrTail, stderrDecoder.end());
+      const status = runState.cancelRequested ? "cancelled" : code === 0 ? "completed" : "failed";
+      finishRun(runState, status, {
+        exitCode: typeof code === "number" ? code : null,
+        signal: signal || null,
+      });
+    });
+
+    await waitForSettle(runState, Math.max(0, waitDeadline - Date.now()));
+    return toPublicRun(runState);
+  }
+
+  async function status(args = {}) {
+    return toPublicRun(mustFindRun(runs, args.runId));
+  }
+
+  async function cancel(args = {}) {
+    const runState = mustFindRun(runs, args.runId);
+    if (runState.status !== "running") {
+      return toPublicRun(runState);
+    }
+    runState.cancelRequested = true;
+    try {
+      runState.child?.kill("SIGTERM");
+    } catch (error) {
+      runState.error = runState.error || errMsg(error);
+    }
+    // Escalate if the child ignores SIGTERM. The timer is unref'd so it can
+    // never hold the daemon's event loop open.
+    runState.killTimer = setTimeout(() => {
+      try {
+        runState.child?.kill("SIGKILL");
+      } catch {
+        /* already gone */
+      }
+    }, KILL_GRACE_MS);
+    runState.killTimer.unref?.();
+
+    await waitForSettle(runState, KILL_GRACE_MS * 2);
+    return toPublicRun(runState);
+  }
+
+  /**
+   * Run a single action and return a `result` object, never throwing.
+   * @param {{action:string,args?:object}} payload
+   */
+  async function dispatch(payload) {
+    const action = payload?.action;
+    if (!VALID_ACTIONS.has(action)) {
+      return { error: `unknown action: ${action}` };
+    }
+    try {
+      switch (action) {
+        case "exec":
+          return { result: await exec(payload?.args ?? {}) };
+        case "status":
+          return { result: await status(payload?.args ?? {}) };
+        case "cancel":
+          return { result: await cancel(payload?.args ?? {}) };
+        default:
+          return { error: `unhandled action: ${action}` };
+      }
+    } catch (err) {
+      return { error: errMsg(err) };
+    }
+  }
+
+  return { dispatch, runs, defaultWorkspace };
+}
+
+/**
+ * @param {object} client
+ * @param {ReturnType<typeof createRemoteExecHandlers>} handlers
+ * @param {object} payload
+ */
+export async function handleRemoteExecRequest(client, handlers, payload) {
+  const requestId = payload?.request_id ? String(payload.request_id) : "";
+  const action = payload?.action ? String(payload.action) : "";
+  if (!requestId) {
+    return { error: "missing request_id" };
+  }
+
+  const response = await handlers.dispatch({
+    action,
+    args: payload?.args && typeof payload.args === "object" ? payload.args : {},
+  });
+
+  const outgoing = {
+    type: "remote_exec_response",
+    payload: {
+      request_id: requestId,
+      action,
+      ...(response?.error ? { error: response.error } : { result: response?.result }),
+    },
+  };
+  await client.sendJson(outgoing).catch(() => {});
+  return response;
+}
+
+function mustFindRun(runs, rawRunId) {
+  const runId = typeof rawRunId === "string" ? rawRunId.trim() : "";
+  if (!runId) {
+    throw new Error("this action requires a `runId` string");
+  }
+  const runState = runs.get(runId);
+  if (!runState) {
+    throw new Error(`remote exec run not found: ${runId}`);
+  }
+  return runState;
+}
+
+function countRunning(runs) {
+  let count = 0;
+  for (const entry of runs.values()) {
+    if (entry.status === "running") count += 1;
+  }
+  return count;
+}
+
+export function normalizeCommand(value) {
+  if (typeof value !== "string") {
+    return "";
+  }
+  const command = value.trim();
+  if (!command || command.includes(NUL)) {
+    return "";
+  }
+  return command;
+}
+
+export function normalizeArgv(value) {
+  if (value === undefined || value === null) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("`args` must be an array of strings");
+  }
+  if (value.length > MAX_ARGS) {
+    throw new Error(`\`args\` must contain at most ${MAX_ARGS} entries`);
+  }
+  return value.map((entry) => {
+    if (typeof entry !== "string") {
+      throw new Error("`args` must contain only strings");
+    }
+    if (entry.includes(NUL)) {
+      throw new Error("`args` must not contain NUL bytes");
+    }
+    return entry;
+  });
+}
+
+export async function resolveWorkspace(value, fallback) {
+  const raw = typeof value === "string" ? value.trim() : "";
+  const target = raw ? expandHome(raw) : fallback;
+  const resolved = path.resolve(target);
+
+  let stat;
+  try {
+    stat = await fsp.stat(resolved);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      throw new Error(`workspace does not exist: ${resolved}`);
+    }
+    throw error;
+  }
+  if (!stat.isDirectory()) {
+    throw new Error(`workspace is not a directory: ${resolved}`);
+  }
+  return resolved;
+}
+
+function expandHome(raw) {
+  if (raw === "~") {
+    return resolveUserHome();
+  }
+  if (raw.startsWith("~/")) {
+    return path.join(resolveUserHome(), raw.slice(2));
+  }
+  return raw;
+}
+
+export function clampWaitMs(value) {
+  const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_WAIT_MS;
+  }
+  return Math.min(Math.trunc(parsed), MAX_WAIT_MS);
+}
+
+/**
+ * Inherit the daemon environment minus `CONDUCTOR_*`, matching what
+ * `custom_commands` does. This keeps the agent token out of the child's env; it
+ * is NOT a confidentiality guarantee — the token still sits in
+ * `~/.conductor/config.yaml`, which an arbitrary command can simply read. Do
+ * not build any security control on top of this.
+ */
+export function buildExecEnv(overrides) {
+  const env = { ...process.env };
+  for (const name of Object.keys(env)) {
+    if (name.startsWith("CONDUCTOR_")) {
+      delete env[name];
+    }
+  }
+  if (overrides && typeof overrides === "object" && !Array.isArray(overrides)) {
+    for (const [key, value] of Object.entries(overrides)) {
+      if (!key || key.includes("=") || key.includes(NUL)) {
+        throw new Error(`invalid env variable name: ${key}`);
+      }
+      if (typeof value !== "string" || value.includes(NUL)) {
+        throw new Error(`env variable ${key} must be a string`);
+      }
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
+function waitForSettle(runState, waitMs) {
+  if (runState.status !== "running") {
+    return Promise.resolve();
+  }
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const index = runState.settleWaiters.indexOf(finish);
+      if (index >= 0) runState.settleWaiters.splice(index, 1);
+      resolve();
+    };
+    const timer = setTimeout(finish, waitMs);
+    timer.unref?.();
+    runState.settleWaiters.push(finish);
+  });
+}
+
+function rememberRun(runs, runState) {
+  runs.set(runState.runId, runState);
+  while (runs.size > MAX_RUNS) {
+    const oldest = [...runs.values()].find((entry) => entry.status !== "running")?.runId;
+    // Only finished runs are evictable, and `MAX_CONCURRENT_RUNS` bounds how
+    // many can be running at once, so the map cannot grow without limit.
+    if (!oldest) break;
+    runs.delete(oldest);
+  }
+}
+
+function finishRun(runState, status, updates = {}) {
+  if (runState.status !== "running") {
+    return;
+  }
+  runState.status = status;
+  runState.finishedAt = new Date().toISOString();
+  runState.exitCode = updates.exitCode ?? runState.exitCode;
+  runState.signal = updates.signal ?? runState.signal;
+  runState.error = updates.error ?? runState.error;
+  if (runState.killTimer) {
+    clearTimeout(runState.killTimer);
+    runState.killTimer = null;
+  }
+  runState.child = null;
+  for (const waiter of runState.settleWaiters.splice(0)) {
+    waiter();
+  }
+}
+
+function appendTail(runState, current, chunk) {
+  if (!chunk) {
+    return current;
+  }
+  const next = current + chunk;
+  if (next.length <= MAX_TAIL_CHARS) {
+    return next;
+  }
+  runState.truncated = true;
+  return next.slice(next.length - MAX_TAIL_CHARS);
+}
+
+function toPublicRun(runState) {
+  return {
+    runId: runState.runId,
+    command: runState.command,
+    args: runState.args,
+    workspace: runState.workspace,
+    status: runState.status,
+    pid: runState.pid,
+    exitCode: runState.exitCode,
+    signal: runState.signal,
+    error: runState.error,
+    startedAt: runState.startedAt,
+    finishedAt: runState.finishedAt,
+    stdoutTail: runState.stdoutTail,
+    stderrTail: runState.stderrTail,
+    truncated: runState.truncated,
+  };
+}
+
+function errMsg(err) {
+  return err?.message ?? String(err);
+}

package/src/runtime-backends.js

@@ -9,12 +9,13 @@ import { resolveConductorConfigPath } from "./conductor-paths.js";
 // CLI display order for built-in backends. ai-sdk owns the canonical set of
 // built-in backends; CLI just picks an ordering for "Supported Backends:" log
 // output. The self-check below ensures this list always matches ai-sdk's set.
-const BUILT_IN_RUNTIME_BACKENDS = ["codex", "claude", "kimi", "opencode", "copilot", "chat-web"];
+const BUILT_IN_RUNTIME_BACKENDS = ["codex", "claude", "kimi", "opencode", "copilot", "chat-web", "dsh"];
 const BUILT_IN_RUNTIME_BACKEND_SET = new Set(BUILT_IN_RUNTIME_BACKENDS);
 // Backends that don't shell out to a CLI binary AND should be advertised
-// without any user-side allow_cli_list entry. `copilot` is the only such
-// backend today — it ships with @github/copilot-sdk as a hard dep so
-// every install gets it for free.
+// without any user-side allow_cli_list entry. `copilot` ships with
+// @github/copilot-sdk as a hard dep so every install gets it for free;
+// `dsh` (DeepSeek Harness) ships its pinned runtime inside ai-sdk's own
+// dependencies and is spawned via @deepseek-ai/dsh-sdk-client.
 //
 // chat-web is intentionally NOT here even though it's also command-optional
 // (it drives a Chromium browser, not a CLI). The reason: chat-web has
@@ -23,7 +24,7 @@ const BUILT_IN_RUNTIME_BACKEND_SET = new Set(BUILT_IN_RUNTIME_BACKENDS);
 // aliases like `web-chatgpt` / `web-gemini` is just confusing — the alias
 // IS the sub-provider choice. Users who want chat-web must declare an
 // explicit allow_cli_list entry (which is also where `--model` lives).
-const COMMAND_OPTIONAL_BUILT_IN_RUNTIME_BACKENDS = ["copilot"];
+const COMMAND_OPTIONAL_BUILT_IN_RUNTIME_BACKENDS = ["copilot", "dsh"];
 const COMMAND_OPTIONAL_BUILT_IN_RUNTIME_BACKEND_SET = new Set(COMMAND_OPTIONAL_BUILT_IN_RUNTIME_BACKENDS);
 
 // Legacy aliases (e.g. "code" → "codex", "kimi-cli" → "kimi") are derived