@phuetz/code-buddy 1.6.1 → 2.1.0

package/dist/desktop/codebuddy-engine-adapter.js

@@ -11,8 +11,61 @@ import { logger } from '../utils/logger.js';
 import { createHash } from 'node:crypto';
 import { maybeContinueGoalAfterTurn } from '../goals/goal-loop.js';
 import { getGoalManager } from '../goals/goal-manager.js';
+import { parseContextOptimizationMetadata } from '../shared/context-optimization-metadata.js';
+import { RelationshipSafetyStreamGuard } from '../conversation/relationship-safety.js';
 const COWORK_GOAL_SESSION_PREFIX = 'cowork:';
 const GOAL_LOOP_HARD_BACKSTOP = 100;
+function engineMessageFingerprint(message) {
+    return createHash('sha256')
+        .update(message.role)
+        .update('\u0000')
+        .update(message.content)
+        .update('\u0000')
+        .update(message.contextId ?? '')
+        .digest('hex');
+}
+function countEngineMessages(messages) {
+    const counts = new Map();
+    for (const message of messages) {
+        const fingerprint = engineMessageFingerprint(message);
+        counts.set(fingerprint, (counts.get(fingerprint) ?? 0) + 1);
+    }
+    return counts;
+}
+/**
+ * Return only host-history entries that were not present in the previous
+ * host-visible transcript. Counts are occurrence-aware: a repeated message is
+ * injected only when the new transcript contains one more occurrence than the
+ * previous snapshot.
+ *
+ * Cowork prepends voice / channel continuity to its local transcript on every
+ * turn. A warm CodeBuddyAgent already owns the local conversation (and any
+ * continuity loaded on its first turn), so replaying the whole array would
+ * duplicate history. Conversely, ignoring the array makes newly-arrived voice
+ * or Telegram turns invisible. Stable context IDs distinguish separate shared
+ * events even when a bounded host window replaces one with identical text.
+ * This multiset delta provides the narrow bridge between those behaviours
+ * without persisting origin metadata in the core agent.
+ */
+function findNewHostHistoryMessages(previousCounts, currentHistory) {
+    const remainingPrevious = new Map(previousCounts);
+    const added = [];
+    for (const message of currentHistory) {
+        const fingerprint = engineMessageFingerprint(message);
+        const remaining = remainingPrevious.get(fingerprint) ?? 0;
+        if (remaining > 0) {
+            if (remaining === 1) {
+                remainingPrevious.delete(fingerprint);
+            }
+            else {
+                remainingPrevious.set(fingerprint, remaining - 1);
+            }
+            continue;
+        }
+        added.push({ role: message.role, content: message.content });
+    }
+    return added;
+}
 /**
  * Concrete implementation of EngineAdapter that wraps CodeBuddyAgent.
  *
@@ -44,6 +97,13 @@ export class CodeBuddyEngineAdapter {
      * effect on the next turn (Phase 8).
      */
     agentIdentities = new Map();
+    /**
+     * Occurrence counts for the last host-visible transcript per warm session.
+     * Only content/context fingerprints are retained here: the core agent already
+     * owns the actual conversation, and this projection exists solely to detect
+     * newly prepended cross-channel messages on the next Cowork turn.
+     */
+    hostTranscriptFingerprints = new Map();
     /**
      * Configured reasoning/thinking level (`off | minimal | … | xhigh`), set via
      * {@link setThinkingLevel}. Re-applied to each freshly-created agent so a
@@ -77,9 +137,18 @@ export class CodeBuddyEngineAdapter {
         let fullContent = '';
         let totalTokens = 0;
         let toolCallCount = 0;
+        const previousAbortController = this.abortControllers.get(sessionId);
+        previousAbortController?.abort();
+        // Register before the first lazy-import await. A host cancellation during
+        // adapter setup must not disappear before the streaming controller exists.
+        const abortController = new AbortController();
+        this.abortControllers.set(sessionId, abortController);
         try {
             // Lazy-import CodeBuddyAgent to avoid loading heavy modules at startup
             const { CodeBuddyAgent } = await import('../agent/codebuddy-agent.js');
+            if (abortController.signal.aborted) {
+                return { content: fullContent, tokenCount: totalTokens, toolCallCount };
+            }
             // Phase 8 — detect model / endpoint / apiKey change between turns and
             // dispose the cached agent if the identity differs so the next
             // turn picks up the new config. Without this, switching model
@@ -88,7 +157,7 @@ export class CodeBuddyEngineAdapter {
             const promptAppendHash = config.systemPromptAppend
                 ? createHash('sha256').update(config.systemPromptAppend).digest('hex').slice(0, 12)
                 : '';
-            const desiredIdentity = `${config.apiKey || ''}:${config.baseURL || ''}:${config.model || ''}:${config.workingDirectory || ''}:${promptAppendHash}`;
+            const desiredIdentity = `${config.apiKey || ''}:${config.baseURL || ''}:${config.model || ''}:${config.workingDirectory || ''}:${config.thinkingLevel || ''}:${promptAppendHash}`;
             const cachedIdentity = this.agentIdentities.get(sessionId);
             let agent = this.agents.get(sessionId);
             if (agent && cachedIdentity !== desiredIdentity) {
@@ -104,10 +173,14 @@ export class CodeBuddyEngineAdapter {
                     logger.warn('[CodeBuddyEngineAdapter] dispose failed during hot-swap', { err });
                 }
                 this.agents.delete(sessionId);
+                this.hostTranscriptFingerprints.delete(sessionId);
                 agent = undefined;
             }
             // Get or create agent for this session
+            let agentWasCreated = false;
             if (!agent) {
+                agentWasCreated = true;
+                this.hostTranscriptFingerprints.delete(sessionId);
                 agent = new CodeBuddyAgent(config.apiKey, config.baseURL, config.model, config.maxToolRounds, true, undefined, config.workingDirectory, config.systemPromptAppend);
                 if (typeof agent.setVisionGroundingModel === 'function') {
                     agent.setVisionGroundingModel(this.config.visionGroundingModel);
@@ -116,8 +189,9 @@ export class CodeBuddyEngineAdapter {
                 // (new session or post model-swap) keeps the user's chosen level on the
                 // Gemini-native path. The OpenAI-compat / Grok / Ollama path reads the
                 // global extended-thinking budget per turn, so it needs no per-agent step.
-                if (this.thinkingLevel) {
-                    this.applyGeminiThinkingLevel(agent, this.thinkingLevel);
+                const effectiveThinkingLevel = config.thinkingLevel || this.thinkingLevel;
+                if (effectiveThinkingLevel) {
+                    this.applyGeminiThinkingLevel(agent, effectiveThinkingLevel);
                 }
                 // Phase 9 — enforce LRU before insertion so we never exceed
                 // the cap. Evict the least-recently-used (head of the
@@ -141,6 +215,10 @@ export class CodeBuddyEngineAdapter {
                         }
                     }
                 }
+                // Establish a baseline immediately, before streaming starts. This also
+                // protects command/error paths that return before the normal completed-
+                // turn snapshot: history already seeded above must never be replayed.
+                this.hostTranscriptFingerprints.set(sessionId, countEngineMessages(messages.slice(0, -1)));
             }
             else {
                 // Phase 9 — touch the LRU position by re-inserting at the
@@ -155,21 +233,52 @@ export class CodeBuddyEngineAdapter {
             // process directory while the review panels read the project dir — the
             // self-improvement review loop never closed. Re-applied every turn so a
             // hot-swapped/reused cached agent always targets the current project.
+            // NB: `{ ...this.config, ...options }` above lets an options key that is
+            // PRESENT but undefined clobber the adapter default — log the effective
+            // value so a missing session cwd is diagnosable from the host log.
+            logger.debug('[CodeBuddyEngineAdapter] turn workingDirectory', {
+                sessionId,
+                workingDirectory: config.workingDirectory ?? '(undefined)',
+            });
+            agent.setRecoverySessionId?.(sessionId);
             agent.setWorkingDirectory(config.workingDirectory);
             agent.setSystemPromptAppend(config.systemPromptAppend);
+            if (config.bufferAssistantResponse) {
+                agent.suspendTranscriptSnapshots();
+            }
             // The last message must be the user's current prompt
             const lastMessage = messages[messages.length - 1];
             if (!lastMessage || lastMessage.role !== 'user') {
                 throw new Error('Last message must be a user message');
             }
-            // Create abort controller for this session
-            const abortController = new AbortController();
-            this.abortControllers.set(sessionId, abortController);
+            // A cached agent already contains the local conversation and the shared
+            // context loaded on its first turn. Reconcile only additions in the
+            // host-provided history so voice / Telegram turns that arrived while the
+            // Cowork session stayed warm reach the model exactly once.
+            if (!agentWasCreated) {
+                const previousFingerprints = this.hostTranscriptFingerprints.get(sessionId) ?? new Map();
+                const additions = findNewHostHistoryMessages(previousFingerprints, messages.slice(0, -1));
+                for (const message of additions) {
+                    agent.addToHistory({
+                        role: message.role,
+                        content: message.content,
+                    });
+                }
+                if (additions.length > 0) {
+                    logger.debug('[CodeBuddyEngineAdapter] synchronized warm-session context', {
+                        sessionId,
+                        count: additions.length,
+                        roles: additions.map((message) => message.role),
+                    });
+                }
+            }
             // Intercept /ultraplan
             if (lastMessage.content.trim().startsWith('/ultraplan')) {
                 const { handleUltraplan } = await import('../commands/handlers/ultraplan-handler.js');
                 const args = lastMessage.content.trim().replace('/ultraplan', '').trim().split(' ');
                 await handleUltraplan(args, (msg) => {
+                    if (abortController.signal.aborted)
+                        return;
                     // Strip ANSI escape codes for cleaner UI display
                     const escapeChar = String.fromCharCode(27);
                     const cleanMsg = msg.replace(new RegExp(`${escapeChar}\\[[0-9;]*m`, 'g'), '');
@@ -184,14 +293,42 @@ export class CodeBuddyEngineAdapter {
             }
             const streamingAgent = agent;
             const goalSessionKey = buildCoworkGoalSessionKey(sessionId);
-            const runPromptTurn = async (prompt) => {
+            const [{ getPermissionModeManager }, { getOperatingModeManager }, { ConfirmationService },] = await Promise.all([
+                import('../security/permission-modes.js'),
+                import('../agent/operating-modes.js'),
+                import('../utils/confirmation-service.js'),
+            ]);
+            if (abortController.signal.aborted) {
+                return { content: fullContent, tokenCount: totalTokens, toolCallCount };
+            }
+            const permissionManager = getPermissionModeManager();
+            const operatingModeManager = getOperatingModeManager();
+            const confirmationService = ConfirmationService.getInstance();
+            const turnPermissionMode = config.permissionMode ?? permissionManager.getMode();
+            const runPromptTurn = async (prompt, transientContext) => {
                 let turnContent = '';
+                const relationshipGuard = config.relationshipSafety
+                    ? new RelationshipSafetyStreamGuard()
+                    : null;
+                let doneSeen = false;
+                const emitContent = (content) => {
+                    if (!content)
+                        return;
+                    turnContent += content;
+                    fullContent += content;
+                    onEvent({ type: 'content', content });
+                };
                 const toolEvidence = [];
                 // Tracks FAILED tool actions this turn so the goal judge can't be fooled
                 // into a premature "done" by an assistant that narrates success after a
                 // write/patch/command actually failed (Hermes-style mutation verifier).
                 const toolFailures = [];
-                const stream = streamingAgent.processUserMessageStream(prompt);
+                const streamOptions = {
+                    surface: 'cowork',
+                    ...(transientContext ? { transientContext } : {}),
+                    ...(config.relationshipSafety ? { relationshipSafety: true } : {}),
+                };
+                const stream = streamingAgent.processUserMessageStream(prompt, streamOptions);
                 for await (const chunk of stream) {
                     // Check for abort
                     if (abortController.signal.aborted) {
@@ -200,9 +337,11 @@ export class CodeBuddyEngineAdapter {
                     switch (chunk.type) {
                         case 'content':
                             if (chunk.content) {
-                                turnContent += chunk.content;
-                                fullContent += chunk.content;
-                                onEvent({ type: 'content', content: chunk.content });
+                                const safeChunks = relationshipGuard
+                                    ? relationshipGuard.push(chunk.content)
+                                    : [chunk.content];
+                                for (const safeChunk of safeChunks)
+                                    emitContent(safeChunk);
                             }
                             break;
                         case 'reasoning':
@@ -228,6 +367,7 @@ export class CodeBuddyEngineAdapter {
                         case 'tool_result':
                             if (chunk.toolCall && chunk.toolResult) {
                                 const finalOutput = chunk.toolResult.output || chunk.toolResult.error;
+                                const contextOptimization = parseContextOptimizationMetadata(chunk.toolResult.metadata?.contextOptimization);
                                 const toolStatus = chunk.toolResult.success ? 'success' : 'error';
                                 if (finalOutput) {
                                     toolEvidence.push(`[tool:${chunk.toolCall.function.name} ${toolStatus}]\n${String(finalOutput)}`);
@@ -244,10 +384,13 @@ export class CodeBuddyEngineAdapter {
                                     tool: {
                                         id: chunk.toolCall.id,
                                         name: chunk.toolCall.function.name,
-                                        input: chunk.toolCall.function.arguments,
+                                        input: config.relationshipSafety
+                                            ? JSON.stringify({ redacted: 'companion-safety' })
+                                            : chunk.toolCall.function.arguments,
                                         output: finalOutput,
                                         isError: !chunk.toolResult.success,
                                         data: chunk.toolResult.data,
+                                        ...(contextOptimization ? { contextOptimization } : {}),
                                     },
                                 });
                             }
@@ -291,12 +434,26 @@ export class CodeBuddyEngineAdapter {
                             }
                             break;
                         case 'done':
-                            onEvent({ type: 'done' });
+                            doneSeen = true;
                             break;
                     }
                 }
+                if (relationshipGuard) {
+                    for (const safeChunk of relationshipGuard.finish())
+                        emitContent(safeChunk);
+                    const assessment = relationshipGuard.assessment();
+                    if (assessment.intervened) {
+                        logger.warn('[CodeBuddyEngineAdapter] relationship safety gate intervened', {
+                            sessionId,
+                            issues: assessment.issues,
+                        });
+                    }
+                }
+                if (doneSeen)
+                    onEvent({ type: 'done' });
                 return { interrupted: false, judgeResponse: buildGoalJudgeResponse(turnContent, toolEvidence, toolFailures) };
             };
+            const runScopedPromptTurn = (prompt, transientContext) => confirmationService.withApprovalContextAsync(sessionId, () => permissionManager.withModeAsync(turnPermissionMode, () => operatingModeManager.withModeAsync(turnPermissionMode === 'plan' ? 'plan' : 'balanced', () => runPromptTurn(prompt, transientContext))));
             const emitGoalStatus = (message) => {
                 const content = `${fullContent ? '\n\n' : ''}${message}\n\n`;
                 fullContent += content;
@@ -312,10 +469,12 @@ export class CodeBuddyEngineAdapter {
                 onEvent({
                     type: 'goal_status',
                     goalStatus: {
+                        goalId: s.goalId,
                         goal: s.goal,
                         status: s.status,
                         turnsUsed: s.turnsUsed,
                         maxTurns: s.maxTurns,
+                        verifyGated: s.verifyGated === true,
                         ...(s.lastVerdict ? { lastVerdict: s.lastVerdict } : {}),
                         ...(s.lastReason ? { lastReason: s.lastReason } : {}),
                     },
@@ -324,7 +483,8 @@ export class CodeBuddyEngineAdapter {
             // Emit once up-front so the banner appears the instant a goal turn starts
             // (before the first judge verdict), then again after each judged turn.
             emitGoalSnapshot();
-            let turn = await runPromptTurn(lastMessage.content);
+            const currentTurnContext = config.currentTurnContext?.trim();
+            let turn = await runScopedPromptTurn(lastMessage.content, currentTurnContext);
             for (let i = 0; i < GOAL_LOOP_HARD_BACKSTOP; i++) {
                 const outcome = await maybeContinueGoalAfterTurn({
                     client: streamingAgent.getClient?.() ?? null,
@@ -341,8 +501,9 @@ export class CodeBuddyEngineAdapter {
                 if (turn.interrupted || !outcome?.continuationPrompt) {
                     break;
                 }
-                turn = await runPromptTurn(outcome.continuationPrompt);
+                turn = await runScopedPromptTurn(outcome.continuationPrompt);
             }
+            this.rememberHostTranscript(sessionId, messages, fullContent);
             return {
                 content: fullContent,
                 tokenCount: totalTokens,
@@ -350,8 +511,26 @@ export class CodeBuddyEngineAdapter {
             };
         }
         catch (error) {
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            onEvent({ type: 'error', error: errorMsg });
+            // The core agent mutates its own history before provider streaming. Once
+            // a turn throws, the host transcript and warm agent may disagree about
+            // what committed; evicting is safer than replaying a user turn twice.
+            const failedAgent = this.agents.get(sessionId);
+            try {
+                failedAgent?.dispose?.({ skipSessionLearning: true });
+            }
+            catch (disposeError) {
+                logger.warn('[CodeBuddyEngineAdapter] dispose failed after turn error', {
+                    sessionId,
+                    error: disposeError,
+                });
+            }
+            this.agents.delete(sessionId);
+            this.agentIdentities.delete(sessionId);
+            this.hostTranscriptFingerprints.delete(sessionId);
+            if (!abortController.signal.aborted) {
+                const errorMsg = error instanceof Error ? error.message : String(error);
+                onEvent({ type: 'error', error: errorMsg });
+            }
             return {
                 content: fullContent,
                 tokenCount: totalTokens,
@@ -359,7 +538,9 @@ export class CodeBuddyEngineAdapter {
             };
         }
         finally {
-            this.abortControllers.delete(sessionId);
+            if (this.abortControllers.get(sessionId) === abortController) {
+                this.abortControllers.delete(sessionId);
+            }
         }
     }
     cancel(sessionId) {
@@ -369,6 +550,33 @@ export class CodeBuddyEngineAdapter {
             logger.info('[CodeBuddyEngineAdapter] cancelled session', { sessionId });
         }
     }
+    /**
+     * Commit a host-side last-mile rewrite back into the warm agent. Cowork's
+     * semantic/relationship gates run after the engine stream, so both the
+     * agent transcript and the host reconciliation fingerprints must move to
+     * the exact text that was actually delivered.
+     */
+    replaceLastAssistantResponse(sessionId, expected, replacement) {
+        const agent = this.agents.get(sessionId);
+        if (!agent?.replaceLastAssistantResponse?.(expected, replacement))
+            return false;
+        const snapshot = this.hostTranscriptFingerprints.get(sessionId);
+        if (snapshot) {
+            const expectedKey = engineMessageFingerprint({ role: 'assistant', content: expected });
+            const replacementKey = engineMessageFingerprint({ role: 'assistant', content: replacement });
+            const expectedCount = snapshot.get(expectedKey) ?? 0;
+            if (expectedCount <= 1)
+                snapshot.delete(expectedKey);
+            else
+                snapshot.set(expectedKey, expectedCount - 1);
+            snapshot.set(replacementKey, (snapshot.get(replacementKey) ?? 0) + 1);
+        }
+        return true;
+    }
+    resumeTranscriptSnapshots(sessionId) {
+        const agent = this.agents.get(sessionId);
+        agent?.resumeTranscriptSnapshots?.();
+    }
     steer(sessionId, prompt) {
         const controller = this.abortControllers.get(sessionId);
         const agent = this.agents.get(sessionId);
@@ -382,14 +590,42 @@ export class CodeBuddyEngineAdapter {
         return true;
     }
     clearSession(sessionId) {
+        this.clearSessionInternal(sessionId, false);
+    }
+    discardSession(sessionId) {
+        this.clearSessionInternal(sessionId, true);
+    }
+    clearSessionInternal(sessionId, discard) {
         const agent = this.agents.get(sessionId);
-        if (agent && typeof agent.dispose === 'function') {
-            agent.dispose();
+        const disposable = agent;
+        if (typeof disposable?.dispose === 'function') {
+            if (discard)
+                disposable.dispose({ skipSessionLearning: true });
+            else
+                disposable.dispose();
         }
         this.agents.delete(sessionId);
         this.abortControllers.delete(sessionId);
         this.agentIdentities.delete(sessionId);
-        logger.debug('[CodeBuddyEngineAdapter] cleared session', { sessionId });
+        this.hostTranscriptFingerprints.delete(sessionId);
+        logger.debug('[CodeBuddyEngineAdapter] cleared session', { sessionId, discard });
+    }
+    /**
+     * Remember exactly what Cowork will normally send back on the next turn:
+     * the input transcript plus the assembled assistant response. Only hashes
+     * and occurrence counts are retained; raw content already belongs to the
+     * agent and is not duplicated in adapter bookkeeping.
+     */
+    rememberHostTranscript(sessionId, messages, assistantContent) {
+        const snapshot = countEngineMessages(messages);
+        if (assistantContent) {
+            const fingerprint = engineMessageFingerprint({
+                role: 'assistant',
+                content: assistantContent,
+            });
+            snapshot.set(fingerprint, (snapshot.get(fingerprint) ?? 0) + 1);
+        }
+        this.hostTranscriptFingerprints.set(sessionId, snapshot);
     }
     /**
      * Drop oldest cached agents until `agents.size <= maxRetained`.
@@ -405,6 +641,7 @@ export class CodeBuddyEngineAdapter {
             const evicted = this.agents.get(oldestKey);
             this.agents.delete(oldestKey);
             this.agentIdentities.delete(oldestKey);
+            this.hostTranscriptFingerprints.delete(oldestKey);
             if (evicted && typeof evicted.dispose === 'function') {
                 try {
                     evicted.dispose();
@@ -435,6 +672,53 @@ export class CodeBuddyEngineAdapter {
     setPermissionCallback(callback) {
         this.permissionCallback = callback;
         logger.debug('[CodeBuddyEngineAdapter] permission callback set');
+        void this.wireInteractiveConfirmationBridge();
+    }
+    /**
+     * Connect the ConfirmationService to the host's permission dialog. This was
+     * the dead link that made EVERY embedded confirmation fail closed with
+     * « Approval requires an interactive terminal »: Cowork wired its
+     * DesktopPermissionBridge to `setPermissionCallback`, but nothing ever
+     * called the callback. The interactive bridge routes each confirmation
+     * through the host dialog and carries an optional denial reason back to the
+     * agent as feedback (Hermes `/deny <reason>` parity).
+     */
+    async wireInteractiveConfirmationBridge() {
+        try {
+            const { ConfirmationService } = await import('../utils/confirmation-service.js');
+            const service = ConfirmationService.getInstance();
+            let nextId = 1;
+            service.setInteractiveBridge(async (options) => {
+                const callback = this.permissionCallback;
+                if (!callback) {
+                    return { confirmed: false, feedback: 'No permission callback available' };
+                }
+                const raw = await callback({
+                    id: `conf-${Date.now()}-${nextId++}`,
+                    operation: options.operation,
+                    filename: options.filename,
+                    ...(options.content !== undefined ? { content: options.content } : {}),
+                    ...(options.diffPreview !== undefined ? { diffPreview: options.diffPreview } : {}),
+                });
+                // Hosts may bind requestPermissionDetailed (object with a denial
+                // reason) or the legacy requestPermission (bare string) — accept both.
+                const detailed = typeof raw === 'string'
+                    ? { response: raw }
+                    : raw;
+                if (detailed.response === 'allow')
+                    return { confirmed: true };
+                if (detailed.response === 'allow_always')
+                    return { confirmed: true, dontAskAgain: true };
+                return {
+                    confirmed: false,
+                    feedback: detailed.reason ?? "Refusé par l'utilisateur depuis l'interface",
+                };
+            });
+            logger.info('[CodeBuddyEngineAdapter] interactive confirmation bridge wired');
+        }
+        catch (err) {
+            logger.warn('[CodeBuddyEngineAdapter] failed to wire confirmation bridge', { err });
+        }
     }
     /**
      * Reload the global SKILL.md registry. Called by Cowork after the
@@ -594,6 +878,7 @@ export class CodeBuddyEngineAdapter {
             }
             logger.debug('[CodeBuddyEngineAdapter] disposed agent', { sessionId });
         }
+        this.hostTranscriptFingerprints.clear();
         this.agents.clear();
         this.abortControllers.clear();
         this.agentIdentities.clear();

package/dist/desktop/electron-launch-args.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Chromium flags required to boot Cowork on a typical Linux source checkout.
+ * Without them, Electron aborts on chrome-sandbox SUID and can freeze on
+ * xrdp/VNC (see cowork/DEV-LINUX.md). `buddy gui` must pass these so the
+ * documented launcher matches the documented flags.
+ */
+export declare function electronLaunchArgs(entryPoint: string, platform?: NodeJS.Platform): string[];

package/dist/desktop/electron-launch-args.js

@@ -0,0 +1,13 @@
+/**
+ * Chromium flags required to boot Cowork on a typical Linux source checkout.
+ * Without them, Electron aborts on chrome-sandbox SUID and can freeze on
+ * xrdp/VNC (see cowork/DEV-LINUX.md). `buddy gui` must pass these so the
+ * documented launcher matches the documented flags.
+ */
+export function electronLaunchArgs(entryPoint, platform = process.platform) {
+    if (platform === 'linux') {
+        return ['--no-sandbox', '--disable-gpu', entryPoint];
+    }
+    return [entryPoint];
+}
+//# sourceMappingURL=electron-launch-args.js.map

package/dist/desktop/engine-adapter.d.ts

@@ -40,6 +40,10 @@ export interface EngineAdapter {
      * Cancel a running session.
      */
     cancel(sessionId: string): void;
+    /** Replace a post-processed assistant draft in a warm session, when supported. */
+    replaceLastAssistantResponse?(sessionId: string, expected: string, replacement: string): boolean;
+    /** Release a snapshot hold created by a buffered assistant turn. */
+    resumeTranscriptSnapshots?(sessionId: string): void;
     /**
      * Deliver user guidance into an active run when the underlying agent
      * supports steer mode. Returns false when there is no active run/agent.
@@ -49,6 +53,8 @@ export interface EngineAdapter {
      * Clear internal state for a session (free memory, close resources).
      */
     clearSession(sessionId: string): void;
+    /** Discard an uncommitted/undelivered turn without session-end learning. */
+    discardSession?(sessionId: string): void;
     /**
      * List available models from the engine.
      */

package/dist/desktop/launcher.js

@@ -11,6 +11,7 @@ import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { logger } from '../utils/logger.js';
 import { getElectronBaseDirs, hasElectronBinary, resolveElectronBinaryPath, } from './electron-paths.js';
+import { electronLaunchArgs } from './electron-launch-args.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Get the project root directory.
@@ -66,7 +67,7 @@ export async function launchDesktop(options = {}) {
         dev: !!options.dev,
     });
     return new Promise((resolvePromise) => {
-        const child = spawn(electronBin, [entryPoint], {
+        const child = spawn(electronBin, electronLaunchArgs(entryPoint), {
             cwd: coworkDir,
             env,
             stdio: options.detach ? 'ignore' : 'inherit',

package/dist/desktop/permission-bridge.d.ts

@@ -9,6 +9,12 @@
  * @module desktop/permission-bridge
  */
 import type { EnginePermissionRequest, EnginePermissionResponse } from '../shared/engine-types.js';
+/** Response enriched with the user's optional denial reason (Hermes parity:
+ * the reason travels back to the agent as confirmation feedback). */
+export interface DetailedPermissionResponse {
+    response: EnginePermissionResponse;
+    reason?: string;
+}
 /**
  * Callback type for sending IPC events to the Electron renderer.
  * Injected at construction time to avoid importing Electron directly.
@@ -43,10 +49,15 @@ export declare class DesktopPermissionBridge {
      * Returns a promise that resolves when the user responds.
      */
     requestPermission(request: EnginePermissionRequest): Promise<EnginePermissionResponse>;
+    /**
+     * Same as {@link requestPermission} but keeps the user's optional denial
+     * reason so callers can surface it to the agent.
+     */
+    requestPermissionDetailed(request: EnginePermissionRequest): Promise<DetailedPermissionResponse>;
     /**
      * Handle user's response from the renderer via IPC.
      */
-    handleResponse(id: string, response: EnginePermissionResponse): void;
+    handleResponse(id: string, response: EnginePermissionResponse, reason?: string): void;
     /**
      * Cancel all pending requests (e.g., on session stop).
      */