@muyichengshayu/promptx 0.2.0 → 0.2.2

package/apps/server/src/gitDiff.js

@@ -787,6 +787,185 @@ function parseNumstat(output = '') {
   }
 }
 
+function parseGitEntryMode(output = '') {
+  const line = String(output || '')
+    .split('\0')
+    .find(Boolean)
+    || ''
+  const match = line.match(/^(\d{6})\s+/)
+  return match?.[1] ? match[1] : ''
+}
+
+function isGitSubmodulePath(repoRoot = '', filePath = '', headOid = '') {
+  const normalizedPath = String(filePath || '').trim()
+  if (!repoRoot || !normalizedPath) {
+    return false
+  }
+
+  if (headOid) {
+    const result = runGit(repoRoot, ['ls-tree', '-z', headOid, '--', normalizedPath])
+    return parseGitEntryMode(result.stdout) === '160000'
+  }
+
+  const result = runGit(repoRoot, ['ls-files', '-z', '-s', '--', normalizedPath])
+  return parseGitEntryMode(result.stdout) === '160000'
+}
+
+function resolveSubmoduleRootForNestedPath(repoRoot = '', filePath = '', headOid = '') {
+  const normalizedPath = String(filePath || '').trim().replace(/^\/+|\/+$/g, '')
+  if (!repoRoot || !normalizedPath || !normalizedPath.includes('/')) {
+    return ''
+  }
+
+  const segments = normalizedPath.split('/')
+  for (let index = segments.length - 1; index >= 1; index -= 1) {
+    const candidate = segments.slice(0, index).join('/')
+    if (isGitSubmodulePath(repoRoot, candidate, headOid) || isGitSubmodulePath(repoRoot, candidate)) {
+      return candidate
+    }
+  }
+
+  return ''
+}
+
+function buildSubmoduleDiffPayload(repoRoot = '', filePath = '', options = {}) {
+  const normalizedPath = String(filePath || '').trim()
+  const fromHeadOid = String(options.fromHeadOid || '').trim()
+  const toHeadOid = String(options.toHeadOid || '').trim()
+  const workspaceMode = Boolean(options.workspaceMode)
+  const includePatch = Boolean(options.includePatch)
+  const includeStats = includePatch || Boolean(options.includeStats)
+
+  if (!repoRoot || !normalizedPath) {
+    return {
+      binary: false,
+      tooLarge: false,
+      patch: '',
+      patchLoaded: false,
+      additions: 0,
+      deletions: 0,
+      statsLoaded: false,
+      message: '',
+    }
+  }
+
+  const diffArgs = ['diff', '--submodule=diff', '--no-color', '--unified=3']
+  if (!workspaceMode && fromHeadOid && toHeadOid) {
+    diffArgs.push(`${fromHeadOid}..${toHeadOid}`)
+  } else {
+    diffArgs.push('HEAD')
+  }
+  diffArgs.push('--', normalizedPath)
+
+  const result = runGit(repoRoot, diffArgs)
+  const patch = String(result.stdout || '').trim()
+  const stats = includeStats ? parsePatchStats(patch) : { additions: null, deletions: null }
+
+  if (!includePatch) {
+    return {
+      binary: false,
+      tooLarge: false,
+      patch: '',
+      patchLoaded: false,
+      additions: stats.additions,
+      deletions: stats.deletions,
+      statsLoaded: includeStats,
+      message: '',
+    }
+  }
+
+  if (patch.length > MAX_PATCH_TEXT_BYTES) {
+    return {
+      binary: false,
+      tooLarge: true,
+      patch: '',
+      patchLoaded: true,
+      additions: stats.additions,
+      deletions: stats.deletions,
+      statsLoaded: includeStats,
+      message: 'diff 内容较长，暂不在页面内完整展示。',
+    }
+  }
+
+  return {
+    binary: false,
+    tooLarge: false,
+    patch,
+    patchLoaded: true,
+    additions: stats.additions,
+    deletions: stats.deletions,
+    statsLoaded: includeStats,
+    message: '',
+  }
+}
+
+function parseSubmodulePatchEntries(submodulePath = '', patch = '') {
+  const normalizedSubmodulePath = String(submodulePath || '').trim().replace(/\/+$/, '')
+  const text = String(patch || '').trim()
+  if (!normalizedSubmodulePath || !text) {
+    return []
+  }
+
+  const lines = text.split('\n')
+  const sections = []
+  let currentSection = []
+
+  lines.forEach((line) => {
+    if (line.startsWith('diff --git a/')) {
+      if (currentSection.length) {
+        sections.push(currentSection.join('\n').trim())
+      }
+      currentSection = [line]
+      return
+    }
+
+    if (currentSection.length) {
+      currentSection.push(line)
+    }
+  })
+
+  if (currentSection.length) {
+    sections.push(currentSection.join('\n').trim())
+  }
+
+  return sections
+    .map((section) => {
+      const header = section.split('\n', 1)[0] || ''
+      const matched = header.match(/^diff --git a\/(.+?) b\/(.+)$/)
+      const rawPath = matched?.[2] || matched?.[1] || ''
+      let nestedPath = String(rawPath || '').trim()
+      if (!nestedPath) {
+        return null
+      }
+
+      const duplicatedPrefix = `${normalizedSubmodulePath}/`
+      if (nestedPath === normalizedSubmodulePath) {
+        nestedPath = ''
+      } else if (nestedPath.startsWith(duplicatedPrefix)) {
+        nestedPath = nestedPath.slice(duplicatedPrefix.length)
+      }
+
+      if (!nestedPath) {
+        return null
+      }
+
+      const stats = parsePatchStats(section)
+      return {
+        path: `${normalizedSubmodulePath}/${nestedPath}`,
+        status: 'M',
+        additions: stats.additions,
+        deletions: stats.deletions,
+        statsLoaded: true,
+        binary: false,
+        tooLarge: false,
+        patch: section,
+        patchLoaded: true,
+        message: '',
+      }
+    })
+    .filter(Boolean)
+}
+
 function buildDiffPayloadForFile(filePath = '', previousState = null, nextState = null, options = {}) {
   const includePatch = Boolean(options.includePatch)
   const includeStats = includePatch || Boolean(options.includeStats)
@@ -1057,7 +1236,24 @@ function createDiffFileEntry(filePath = '', previousState = null, nextState = nu
     return null
   }
 
-  const patchPayload = buildDiffPayloadForFile(filePath, previousState, nextState, options)
+  const repoRoot = String(options.repoRoot || '').trim()
+  const fromHeadOid = String(options.fromHeadOid || '').trim()
+  const toHeadOid = String(options.toHeadOid || '').trim()
+  const isSubmodule = repoRoot && (
+    isGitSubmodulePath(repoRoot, filePath, fromHeadOid)
+    || isGitSubmodulePath(repoRoot, filePath, toHeadOid)
+    || isGitSubmodulePath(repoRoot, filePath)
+  )
+
+  const patchPayload = isSubmodule
+    ? buildSubmoduleDiffPayload(repoRoot, filePath, {
+      includePatch: Boolean(options.includePatch),
+      includeStats: Boolean(options.includeStats),
+      fromHeadOid,
+      toHeadOid,
+      workspaceMode: Boolean(options.workspaceMode),
+    })
+    : buildDiffPayloadForFile(filePath, previousState, nextState, options)
   return {
     path: filePath,
     status: deriveFileStatus(previousState, nextState),
@@ -1072,6 +1268,61 @@ function createDiffFileEntry(filePath = '', previousState = null, nextState = nu
   }
 }
 
+function createDiffEntriesForPath(filePath = '', previousState = null, nextState = null, options = {}) {
+  if (areFileStatesEqual(previousState, nextState)) {
+    return []
+  }
+
+  const repoRoot = String(options.repoRoot || '').trim()
+  const fromHeadOid = String(options.fromHeadOid || '').trim()
+  const toHeadOid = String(options.toHeadOid || '').trim()
+  const submoduleRoot = repoRoot && (
+    isGitSubmodulePath(repoRoot, filePath, fromHeadOid)
+    || isGitSubmodulePath(repoRoot, filePath, toHeadOid)
+    || isGitSubmodulePath(repoRoot, filePath)
+      ? filePath
+      : resolveSubmoduleRootForNestedPath(repoRoot, filePath, fromHeadOid)
+        || resolveSubmoduleRootForNestedPath(repoRoot, filePath, toHeadOid)
+        || resolveSubmoduleRootForNestedPath(repoRoot, filePath)
+  )
+
+  if (!submoduleRoot) {
+    const entry = createDiffFileEntry(filePath, previousState, nextState, options)
+    return entry ? [entry] : []
+  }
+
+  const payload = buildSubmoduleDiffPayload(repoRoot, submoduleRoot, {
+    includePatch: true,
+    includeStats: Boolean(options.includeStats),
+    fromHeadOid,
+    toHeadOid,
+    workspaceMode: Boolean(options.workspaceMode),
+  })
+
+  const nestedEntries = payload.patchLoaded
+    ? parseSubmodulePatchEntries(submoduleRoot, payload.patch)
+    : []
+
+  if (nestedEntries.length) {
+    const normalizedPath = String(filePath || '').trim()
+    const matchedEntry = nestedEntries.find((entry) => entry.path === normalizedPath)
+    return matchedEntry ? [matchedEntry] : nestedEntries
+  }
+
+  return [{
+    path: filePath,
+    status: deriveFileStatus(previousState, nextState),
+    additions: payload.additions,
+    deletions: payload.deletions,
+    statsLoaded: payload.statsLoaded,
+    binary: payload.binary,
+    tooLarge: payload.tooLarge,
+    patch: payload.patch,
+    patchLoaded: payload.patchLoaded,
+    message: payload.message,
+  }]
+}
+
 function createUnsupportedResult(reason = '', repoRoot = '', branch = '') {
   return {
     supported: false,
@@ -1141,20 +1392,26 @@ export function getWorkspaceGitDiffReviewByCwd(cwd = '', options = {}) {
   candidatePaths.forEach((filePath) => {
     const previousState = baselineStateForPath(filePath)
     const nextState = readFileState(repoRoot, filePath)
-    const diffEntry = createDiffFileEntry(filePath, previousState, nextState, {
+    const diffEntries = createDiffEntriesForPath(filePath, previousState, nextState, {
       includePatch: Boolean(targetFilePath),
       includeStats,
+      repoRoot,
+      fromHeadOid: headOid,
+      toHeadOid: currentHeadOid,
+      workspaceMode: true,
     })
-    if (!diffEntry) {
+    if (!diffEntries.length) {
       return
     }
 
-    fileCount += 1
-    additions += Math.max(0, Number(diffEntry.additions) || 0)
-    deletions += Math.max(0, Number(diffEntry.deletions) || 0)
-    if (includeFiles) {
-      files.push(diffEntry)
-    }
+    diffEntries.forEach((diffEntry) => {
+      fileCount += 1
+      additions += Math.max(0, Number(diffEntry.additions) || 0)
+      deletions += Math.max(0, Number(diffEntry.deletions) || 0)
+      if (includeFiles) {
+        files.push(diffEntry)
+      }
+    })
   })
 
   const payload = {
@@ -1400,20 +1657,25 @@ export function getTaskGitDiffReview(taskSlug = '', options = {}) {
   candidatePaths.forEach((filePath) => {
     const previousState = baselineStateForPath(filePath)
     const nextState = nextStateForPath(filePath)
-    const diffEntry = createDiffFileEntry(filePath, previousState, nextState, {
+    const diffEntries = createDiffEntriesForPath(filePath, previousState, nextState, {
       includePatch: Boolean(targetFilePath),
       includeStats,
+      repoRoot,
+      fromHeadOid: baseline.headOid,
+      toHeadOid: currentHeadOid,
     })
-    if (!diffEntry) {
+    if (!diffEntries.length) {
       return
     }
 
-    fileCount += 1
-    additions += Math.max(0, Number(diffEntry.additions) || 0)
-    deletions += Math.max(0, Number(diffEntry.deletions) || 0)
-    if (includeFiles) {
-      files.push(diffEntry)
-    }
+    diffEntries.forEach((diffEntry) => {
+      fileCount += 1
+      additions += Math.max(0, Number(diffEntry.additions) || 0)
+      deletions += Math.max(0, Number(diffEntry.deletions) || 0)
+      if (includeFiles) {
+        files.push(diffEntry)
+      }
+    })
   })
 
   const payload = {

package/apps/server/src/internalRoutes.js

@@ -1,12 +1,19 @@
 import { assertInternalRequest } from './internalAuth.js'
 
+const RUNNER_EVENTS_BODY_LIMIT = Math.max(
+  1024 * 1024,
+  Number(process.env.PROMPTX_INTERNAL_RUNNER_EVENTS_BODY_LIMIT) || 8 * 1024 * 1024
+)
+
 function registerInternalRunnerRoutes(app, options = {}) {
   const {
     runEventIngestService,
     taskAutomationService,
   } = options
 
-  app.post('/internal/runner-events', async (request, reply) => {
+  app.post('/internal/runner-events', {
+    bodyLimit: RUNNER_EVENTS_BODY_LIMIT,
+  }, async (request, reply) => {
     try {
       assertInternalRequest(request.headers)
       return runEventIngestService.ingestEvents(request.body?.items || [])

package/apps/server/src/relayClient.js

@@ -1,6 +1,7 @@
 import process from 'node:process'
 import WebSocket from 'ws'
 
+import { buildInternalAuthHeaders } from './internalAuth.js'
 import {
   buildRelayWebSocketUrl,
   createRelayRequestId,
@@ -315,7 +316,10 @@ function createRelayClient({
       const targetUrl = new URL(record.path, config.localBaseUrl)
       const response = await fetch(targetUrl, {
         method: record.method,
-        headers: sanitizeProxyHeaders(record.headers, ['cookie']),
+        headers: buildInternalAuthHeaders({
+          ...sanitizeProxyHeaders(record.headers, ['cookie']),
+          'x-promptx-relay-request': '1',
+        }),
         body: ['GET', 'HEAD'].includes(record.method) || !bodyBuffer.length ? undefined : bodyBuffer,
         signal: controller.signal,
       })

package/apps/server/src/relayConfig.js

@@ -14,6 +14,9 @@ function normalizeRelayConfig(input = {}) {
   const relayUrl = String(input?.relayUrl || '').trim()
   const deviceId = String(input?.deviceId || '').trim()
   const deviceToken = String(input?.deviceToken || '').trim()
+  const allowRemoteShell = typeof input?.allowRemoteShell === 'boolean'
+    ? input.allowRemoteShell
+    : ['1', 'true', 'on', 'yes'].includes(String(input?.allowRemoteShell || '').trim().toLowerCase())
   const enabled = typeof input?.enabled === 'boolean'
     ? input.enabled
     : !['0', 'false', 'off', 'no'].includes(String(input?.enabled || '').trim().toLowerCase())
@@ -22,6 +25,7 @@ function normalizeRelayConfig(input = {}) {
     relayUrl,
     deviceId,
     deviceToken,
+    allowRemoteShell,
     enabled: Boolean(enabled && relayUrl && deviceId && deviceToken),
   }
 }
@@ -49,6 +53,7 @@ function getRelayConfigForClient() {
   const relayUrl = String(process.env.PROMPTX_RELAY_URL || stored.relayUrl || '').trim()
   const deviceId = String(process.env.PROMPTX_RELAY_DEVICE_ID || stored.deviceId || '').trim()
   const deviceToken = String(process.env.PROMPTX_RELAY_DEVICE_TOKEN || stored.deviceToken || '').trim()
+  const envAllowRemoteShell = String(process.env.PROMPTX_RELAY_ALLOW_REMOTE_SHELL || '').trim()
   const envEnabled = String(process.env.PROMPTX_RELAY_ENABLED || '').trim()
   const managedByEnv = isRelayConfigManagedByEnv()
   const enabled = envEnabled
@@ -56,11 +61,15 @@ function getRelayConfigForClient() {
     : managedByEnv
       ? Boolean(relayUrl && deviceId && deviceToken)
       : Boolean(stored.enabled)
+  const allowRemoteShell = envAllowRemoteShell
+    ? ['1', 'true', 'on', 'yes'].includes(envAllowRemoteShell.toLowerCase())
+    : Boolean(stored.allowRemoteShell)
 
   return normalizeRelayConfig({
     relayUrl,
     deviceId,
     deviceToken,
+    allowRemoteShell,
     enabled,
   })
 }
@@ -70,6 +79,7 @@ function isRelayConfigManagedByEnv() {
     String(process.env.PROMPTX_RELAY_URL || '').trim()
     || String(process.env.PROMPTX_RELAY_DEVICE_ID || '').trim()
     || String(process.env.PROMPTX_RELAY_DEVICE_TOKEN || '').trim()
+    || String(process.env.PROMPTX_RELAY_ALLOW_REMOTE_SHELL || '').trim()
     || String(process.env.PROMPTX_RELAY_ENABLED || '').trim()
   )
 }

package/apps/server/src/runDispatchService.js

@@ -2,6 +2,7 @@ import {
   extractRunnerDispatchPatch,
   reconcileRunAfterRunnerDispatchError,
 } from './runnerDispatch.js'
+import { extractShellCommandIntent } from '../../../packages/shared/src/index.js'
 import { createApiError } from './apiErrors.js'
 
 function normalizeBaseUrl(value = '') {
@@ -82,6 +83,11 @@ function buildRunnerPromptPayload(session = {}, input = {}, options = {}) {
   }
 }
 
+function normalizeCommandMode(value = '') {
+  const normalized = String(value || '').trim().toLowerCase()
+  return normalized === 'shell' ? 'shell' : ''
+}
+
 export function createRunDispatchService(options = {}) {
   const runnerClient = options.runnerClient
   const logger = options.logger || console
@@ -100,36 +106,56 @@ export function createRunDispatchService(options = {}) {
 
   async function startTaskRunForTask(payload = {}) {
     const normalizedTaskSlug = String(payload.taskSlug || '').trim()
-    const normalizedSessionId = String(payload.sessionId || '').trim()
-    const normalizedProjectSessionId = String(payload.projectSessionId || normalizedSessionId).trim()
+    const requestedSessionId = String(payload.sessionId || '').trim()
+    const normalizedProjectSessionId = String(payload.projectSessionId || requestedSessionId).trim()
     const normalizedPrompt = String(payload.prompt || '').trim()
     const promptBlocks = Array.isArray(payload.promptBlocks) ? payload.promptBlocks : []
+    const displayEngine = String(payload.displayEngine || '').trim()
+    const requestedCommandMode = normalizeCommandMode(payload.commandMode)
+    const shellIntent = extractShellCommandIntent({
+      prompt: normalizedPrompt,
+      promptBlocks,
+    })
+    const commandMode = shellIntent.mode === 'shell' ? 'shell' : ''
+    const normalizedCommand = commandMode === 'shell' ? shellIntent.command : ''
+    const allowShellCommand = payload.allowShellCommand === true
 
     if (!normalizedTaskSlug) {
       throw createApiError('errors.taskNotFound', '任务不存在。', 404)
     }
-    if (!normalizedSessionId) {
+    if (!requestedSessionId) {
       throw createApiError('errors.sessionRequired', '请先选择一个 PromptX 项目。')
     }
     if (!normalizedPrompt) {
       throw createApiError('errors.noPromptToSend', '没有可发送的提示词。')
     }
+    if (requestedCommandMode === 'shell' && shellIntent.reason === 'unsupported_blocks') {
+      throw createApiError('errors.shellUnsupportedBlocks', '命令模式暂不支持图片或导入文件，请只保留纯文本命令。', 400)
+    }
+    if (requestedCommandMode === 'shell' && shellIntent.reason === 'empty_command') {
+      throw createApiError('errors.shellEmptyCommand', '请输入要执行的命令，例如 !git status', 400)
+    }
+    if (commandMode === 'shell' && !allowShellCommand) {
+      throw createApiError('errors.shellLocalOnly', '命令模式默认仅允许在本机本地界面中使用；如需对远程访问开放，请先到设置里显式开启。', 403)
+    }
 
     const task = getTaskBySlug(normalizedTaskSlug)
     if (!task || task.expired) {
       throw createApiError('errors.taskNotFound', '任务不存在。', 404)
     }
 
-    const session = getPromptxCodexSessionById(normalizedSessionId)
-    if (!session) {
+    const requestedSession = getPromptxCodexSessionById(requestedSessionId)
+    if (!requestedSession) {
       throw createApiError('errors.sessionNotFound', '没有找到对应的 PromptX 项目。', 404)
     }
-    const projectSession = normalizedProjectSessionId === normalizedSessionId
-      ? session
+    const projectSession = normalizedProjectSessionId === requestedSessionId
+      ? requestedSession
       : getPromptxCodexSessionById(normalizedProjectSessionId)
     if (!projectSession) {
       throw createApiError('errors.sessionNotFound', '没有找到对应的 PromptX 项目。', 404)
     }
+    const session = commandMode === 'shell' ? projectSession : requestedSession
+    const normalizedSessionId = String(session?.id || '').trim()
 
     const relatedSessionIds = new Set([
       normalizedProjectSessionId,
@@ -145,11 +171,16 @@ export function createRunDispatchService(options = {}) {
       throw createApiError('errors.currentProjectRunning', '当前项目正在执行中，请等待完成后再发送。', 409)
     }
 
+    const runEngine = commandMode === 'shell' ? 'shell' : (session.engine || 'codex')
+    const runnerPrompt = commandMode === 'shell' ? normalizedCommand : normalizedPrompt
+
     const runRecord = createCodexRun({
       taskSlug: normalizedTaskSlug,
       sessionId: normalizedSessionId,
       prompt: normalizedPrompt,
       promptBlocks,
+      engine: runEngine,
+      displayEngine,
       status: 'queued',
     })
 
@@ -160,7 +191,7 @@ export function createRunDispatchService(options = {}) {
 
     try {
       const runnerPromptPayload = buildRunnerPromptPayload(session, {
-        prompt: normalizedPrompt,
+        prompt: runnerPrompt,
         promptBlocks,
       }, {
         localServerBaseUrl,
@@ -172,15 +203,15 @@ export function createRunDispatchService(options = {}) {
         runId: runRecord.id,
         taskSlug: normalizedTaskSlug,
         sessionId: normalizedSessionId,
-        engine: session.engine,
+        engine: runEngine,
         prompt: runnerPromptPayload.prompt,
         promptBlocks: runnerPromptPayload.promptBlocks,
         cwd: session.cwd,
         title: session.title,
-        codexThreadId: session.codexThreadId,
-        engineSessionId: session.engineSessionId,
-        engineThreadId: session.engineThreadId,
-        engineMeta: session.engineMeta,
+        codexThreadId: commandMode === 'shell' ? '' : session.codexThreadId,
+        engineSessionId: commandMode === 'shell' ? '' : session.engineSessionId,
+        engineThreadId: commandMode === 'shell' ? '' : session.engineThreadId,
+        engineMeta: commandMode === 'shell' ? {} : session.engineMeta,
         sessionCreatedAt: session.createdAt,
         sessionUpdatedAt: session.updatedAt,
       })

package/apps/server/src/runEventIngest.js

@@ -8,26 +8,28 @@ import {
 import { getPromptxCodexSessionById, updatePromptxCodexSession } from './codexSessions.js'
 
 function toSafeSessionPatch(session = {}) {
+  const isShellEngine = String(session?.engine || '').trim().toLowerCase() === 'shell'
   const hasIdentityPatch = [
     'codexThreadId',
     'engineSessionId',
     'engineThreadId',
   ].some((key) => Object.prototype.hasOwnProperty.call(session, key))
+    && !isShellEngine
 
   return {
     ...(Object.prototype.hasOwnProperty.call(session, 'title')
       ? { title: session.title }
       : {}),
-    ...(Object.prototype.hasOwnProperty.call(session, 'codexThreadId')
+    ...(!isShellEngine && Object.prototype.hasOwnProperty.call(session, 'codexThreadId')
       ? { codexThreadId: session.codexThreadId }
       : {}),
-    ...(Object.prototype.hasOwnProperty.call(session, 'engineSessionId')
+    ...(!isShellEngine && Object.prototype.hasOwnProperty.call(session, 'engineSessionId')
       ? { engineSessionId: session.engineSessionId }
       : {}),
-    ...(Object.prototype.hasOwnProperty.call(session, 'engineThreadId')
+    ...(!isShellEngine && Object.prototype.hasOwnProperty.call(session, 'engineThreadId')
       ? { engineThreadId: session.engineThreadId }
       : {}),
-    ...(Object.prototype.hasOwnProperty.call(session, 'engineMeta')
+    ...(!isShellEngine && Object.prototype.hasOwnProperty.call(session, 'engineMeta')
       ? { engineMeta: session.engineMeta }
       : {}),
     ...(hasIdentityPatch

package/apps/server/src/taskRoutes.js

@@ -1,8 +1,75 @@
 import { normalizeCodexRunEventsMode } from '../../../packages/shared/src/index.js'
 import { getApiErrorPayload } from './apiErrors.js'
+import { isValidInternalAuthToken, readInternalAuthToken } from './internalAuth.js'
+import { getRelayConfigForClient } from './relayConfig.js'
 
 const MAX_TASK_REORDER_COUNT = 200
 
+function isLoopbackHost(value = '') {
+  const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '')
+  return host === '127.0.0.1'
+    || host === '::1'
+    || host === 'localhost'
+    || host.endsWith('.localhost')
+}
+
+function isLoopbackUrl(value = '') {
+  const text = String(value || '').trim()
+  if (!text) {
+    return false
+  }
+
+  try {
+    return isLoopbackHost(new URL(text).hostname)
+  } catch {
+    return false
+  }
+}
+
+function isLocalShellCommandRequest(request) {
+  if (isRelayProxyRequest(request)) {
+    return false
+  }
+
+  const origin = String(request?.headers?.origin || '').trim()
+  if (origin) {
+    return isLoopbackUrl(origin)
+  }
+
+  const referer = String(request?.headers?.referer || '').trim()
+  if (referer) {
+    return isLoopbackUrl(referer)
+  }
+
+  const hostname = String(request?.hostname || '').trim()
+  if (hostname) {
+    return isLoopbackHost(hostname)
+  }
+
+  const hostHeader = String(request?.headers?.host || '').trim()
+  if (hostHeader) {
+    return isLoopbackHost(hostHeader.split(':')[0])
+  }
+
+  return false
+}
+
+function isRelayProxyRequest(request) {
+  const relayRequestFlag = String(request?.headers?.['x-promptx-relay-request'] || '').trim()
+  if (relayRequestFlag !== '1') {
+    return false
+  }
+  return isValidInternalAuthToken(readInternalAuthToken(request?.headers || {}))
+}
+
+function isShellCommandRequestAllowed(request, relayConfig = {}) {
+  if (isLocalShellCommandRequest(request)) {
+    return true
+  }
+
+  return isRelayProxyRequest(request) && Boolean(relayConfig?.allowRemoteShell)
+}
+
 function createEmptyWorkspaceDiffSummary() {
   return {
     supported: false,
@@ -116,6 +183,7 @@ function registerTaskRoutes(app, options = {}) {
     deleteTask,
     deleteTaskCodexRuns,
     getPromptxCodexSessionById,
+    getRelayConfig = getRelayConfigForClient,
     getRunningCodexRunByTaskSlug,
     getTaskBySlug,
     getTaskGitDiffReviewInSubprocess,
@@ -366,6 +434,10 @@ function registerTaskRoutes(app, options = {}) {
         sessionId: request.body?.sessionId,
         prompt: request.body?.prompt,
         promptBlocks: request.body?.promptBlocks,
+        displayEngine: request.body?.displayEngine,
+        commandMode: request.body?.commandMode,
+        command: request.body?.command,
+        allowShellCommand: isShellCommandRequestAllowed(request, getRelayConfig()),
       })
       return reply.code(payload?.runnerDispatchPending ? 202 : 201).send(payload)
     } catch (error) {