@steerable/agent-shell 0.7.1 → 0.7.4

package/dist/host/runtime.js

@@ -21,6 +21,7 @@ import { mcpExecutor } from '../mcp-executor.js';
 import { ProjectRegistry } from '../project-registry.js';
 import { getProductConfig } from '../product-config.js';
 import { LocalBackendRouter } from '../local-backend/router.js';
+import { getLiveStream, recordGrantedEgress } from '../local-backend/live-stream.js';
 import { WorktreeService } from '../local-backend/worktree-service.js';
 import { TaskService } from '../local-backend/task-service.js';
 import { LoopPtyMonitor } from '../local-backend/loop-pty-monitor.js';
@@ -224,6 +225,27 @@ export async function createHostRuntime(options) {
                 ...(declaredLabel ? { declaredLabel } : {}),
             });
         },
+        recordEgressGrant: (prompt, decision) => {
+            if (!prompt.chatId) {
+                onLog('approval: egress grant has no chatId; not stored');
+                return;
+            }
+            const live = getLiveStream(prompt.chatId);
+            if (!live || live.status !== 'running')
+                return;
+            recordGrantedEgress(live, {
+                requestId: prompt.requestId,
+                arguments: prompt.arguments,
+                kind: decision.kind,
+                reason: decision.reason,
+            });
+        },
+        blockedCommand: (toolName, args) => {
+            if (toolName !== 'local_exec_shell')
+                return null;
+            const command = typeof args.command === 'string' ? args.command : '';
+            return localExecutor.detectDangerousCommand(command);
+        },
         outsideWorkspace: async ({ toolName, arguments: args, chatId }) => {
             if (!chatId || !localBackendRouter)
                 return false;
@@ -246,6 +268,7 @@ export async function createHostRuntime(options) {
         hasWindow,
         onLog: (line) => onLog(line),
     });
+    localBackendRouter.setAskReplay((chatId) => askUserBridge.takeResolved(chatId));
     let started = false;
     let instanceLease = null;
     let warmTimer = null;
@@ -293,7 +316,7 @@ export async function createHostRuntime(options) {
                         ...(project?.sourceFolders ?? []),
                         ...collectPackExecWritableRoots(chatId),
                         // 技能根：workflows/references/templates 是只读参考，模型必须能读
-                        // （spec_lock_reference.md 定义 pptx_layouts 怎么写，正是它被拒过）。
+                        // （技能包里的版式说明曾因读不到而被拒）。
                         ...listSkillRoots(),
                         // spill 根：工具输出过大时 sidecar 落到这里，模型要读回全文。
                         ...spillReadRoots(),

package/dist/local-backend/coreloop-stream.d.ts

@@ -37,6 +37,7 @@ export interface CoreLoopToolAction {
         category?: string;
         cached?: boolean;
         waitMs?: number;
+        auto?: boolean;
     };
 }
 export interface CoreLoopTurnOutcome {

package/dist/local-backend/live-stream.d.ts

@@ -12,7 +12,7 @@
  * 活数组引用（appendTimelineDelta / syncTimelineTools / onToolAction 都
  * 原地 mutate），因此 GET 序列化时自然读到最新状态，无需逐事件拷贝。
  */
-import type { PersistedTurnBlock } from './turn-timeline.js';
+import { type PersistedTurnBlock } from './turn-timeline.js';
 export interface LiveStreamState {
     chatId: string;
     status: 'running' | 'completed' | 'cancelled' | 'failed';
@@ -24,7 +24,16 @@ export interface LiveStreamState {
     timeline: PersistedTurnBlock[];
     /** 编排子代理生命周期事件（按到达顺序累积）。 */
     children: Array<Record<string, unknown>>;
+    /** 出网放行写入 executedActions 后通知正在看这一轮的界面。 */
+    notify?: () => void;
 }
+/** 把一次已允许的出网放行记进正在运行的回合。这不是工具结果，模型看不到。 */
+export declare function recordGrantedEgress(live: LiveStreamState, grant: {
+    requestId: string;
+    arguments: Record<string, unknown>;
+    kind: string;
+    reason: string;
+}): void;
 export declare function registerLiveStream(chatId: string, refs: {
     executedActions: Array<Record<string, unknown>>;
     timeline: PersistedTurnBlock[];

package/dist/local-backend/live-stream.js

@@ -1,4 +1,34 @@
+/**
+ * 运行中回合的「实时快照」注册表 —— 让 renderer 在切走再切回时能把正在
+ * 流式的回合重新接上（显示运行状态 + 已产出的部分内容 / 工具卡片 / 时间线）。
+ *
+ * 背景：AgentChatView 卸载时不再取消回合（回合不因切页而暂停），但该回合
+ * 的 SSE 事件只会流向当初发起 fetch 的那个组件；切回后的新组件拿不到这些
+ * 事件，只能靠轮询本注册表把「运行中 + 部分产出」恢复出来。
+ *
+ * 设计：注册表只存「正在运行」的回合。router 的 handleCoreLoopTurn 在
+ * 流开始前 register、每个产出点更新 content、结束（落库后）立即 remove。
+ * executedActions / timeline / children 三个字段存的是 router 里同名的
+ * 活数组引用（appendTimelineDelta / syncTimelineTools / onToolAction 都
+ * 原地 mutate），因此 GET 序列化时自然读到最新状态，无需逐事件拷贝。
+ */
+import { syncTimelineTools } from './turn-timeline.js';
 const liveStreams = new Map();
+/** 把一次已允许的出网放行记进正在运行的回合。这不是工具结果，模型看不到。 */
+export function recordGrantedEgress(live, grant) {
+    live.executedActions.push({
+        id: `egress-${grant.requestId}`,
+        tool: 'network_egress',
+        arguments: grant.arguments,
+        success: true,
+        approval: {
+            kind: grant.kind,
+            ...(grant.reason === 'unattended' ? { auto: true } : {}),
+        },
+    });
+    syncTimelineTools(live.timeline, live.executedActions);
+    live.notify?.();
+}
 export function registerLiveStream(chatId, refs) {
     const state = {
         chatId,

package/dist/local-backend/router.d.ts

@@ -1,5 +1,6 @@
 import type { ScopedStore } from '../storage/scoped-store.js';
 import { ToolRouter } from '../tool-router.js';
+import { type ResolvedAsk } from '../sidecar/reverse-ask-user.js';
 import type { TaskService } from './task-service.js';
 import { type Principal } from '../auth/index.js';
 export interface LocalBackendRequest {
@@ -60,12 +61,15 @@ export declare class LocalBackendRouter {
     private readonly broadcast;
     /** 4.6a/4.6c：任务面板的路由入口（列表 + 合并/丢弃）。未注入时任务路由 503。 */
     private readonly taskService;
+    private takeAskReplay;
     constructor(toolRouter: ToolRouter, options: {
         store: ScopedStore;
         resolveStore?: (principal?: Principal) => ScopedStore;
         broadcast?: LocalBackendBroadcast;
         taskService?: TaskService;
     });
+    /** The host records each answered ask; the following tool row stores that text. */
+    setAskReplay(take: (chatId: string) => ResolvedAsk | undefined): void;
     private get store();
     /** Store selected for the active request, or the host default outside one. */
     get activeStore(): ScopedStore;

package/dist/local-backend/router.js

@@ -27,6 +27,7 @@ import { sanitizeCompatOverrides, sanitizePresetsChoice, sanitizeLlmProvider, sa
 import { setDefaultExecTimeoutMs } from '../local-executor.js';
 import { allowEgressForBaseUrl, getActiveEgressBroker, getEgressPosture } from '../sidecar/egress-proxy.js';
 import { buildExecSandbox, parseExecPolicy } from '../sidecar/exec-sandbox.js';
+import { storedAskResult } from '../sidecar/reverse-ask-user.js';
 import { clampExecPolicy } from '../host-tools.js';
 import { getResolvedHostTools, isProductLlmLocked, resolveRuntimeLlmSettings, resolveTurnApproval, resolveTurnChatMode, resolveTurnOrchestration, } from '../host-tools-runtime.js';
 import { SidecarSupervisor } from '../sidecar/index.js';
@@ -320,6 +321,7 @@ export class LocalBackendRouter {
     broadcast;
     /** 4.6a/4.6c：任务面板的路由入口（列表 + 合并/丢弃）。未注入时任务路由 503。 */
     taskService;
+    takeAskReplay = null;
     constructor(toolRouter, options) {
         this.toolRouter = toolRouter;
         this.defaultStore = options.store;
@@ -331,6 +333,10 @@ export class LocalBackendRouter {
             this.broadcast?.('goal-changed', { chatId, goal });
         });
     }
+    /** The host records each answered ask; the following tool row stores that text. */
+    setAskReplay(take) {
+        this.takeAskReplay = take;
+    }
     get store() {
         return this.storeContext.getStore() ?? this.defaultStore;
     }
@@ -3674,6 +3680,9 @@ export class LocalBackendRouter {
         // 实时快照：executedActions / timeline / children 传引用（原地 mutate），
         // content 由 onText 逐段更新。切走再切回的 renderer 靠 GET /live-stream 读它。
         const live = registerLiveStream(chatId, { executedActions, timeline, children });
+        live.notify = () => {
+            emit(this.sseData({ type: 'executed_actions', actions: [...executedActions] }));
+        };
         // 场景包的回合观察器（如识别包技能调用并广播产物更新）。
         const packObservers = beginPackTurnObservers({ chatId, broadcast: this.broadcast ?? undefined });
         // 回合产物文件列表（回合收尾时收集）：扫描根与 exec 沙箱可写根同源
@@ -3817,13 +3826,15 @@ export class LocalBackendRouter {
                     const idx = action.id
                         ? executedActions.findIndex((row) => row.id === action.id)
                         : -1;
+                    const replay = action.tool === 'ask_user' ? this.takeAskReplay?.(args.chatId) : undefined;
+                    const result = replay ? storedAskResult(replay) : action.result;
                     const row = {
                         id: action.id,
                         tool: action.tool,
                         mode: chatMode,
                         arguments: action.arguments,
-                        view: presentToolCall(action.tool, action.arguments, action.result),
-                        result: action.result,
+                        view: presentToolCall(action.tool, action.arguments, result),
+                        result,
                         success: action.success,
                         error: action.error,
                         durationMs: action.durationMs,

package/dist/sidecar/reverse-approval.d.ts

@@ -5,9 +5,11 @@
  *
  * Fail-closed by construction: no window, no listener, a renderer error,
  * or an invalid reply all become `deny_once` — never a hang, never an
- * auto-allow. An explicit `timeoutMs` on the approval config still fails
- * closed as `timed_out`; the desktop omits it, so the prompt waits until
- * the user decides.
+ * auto-allow. A command on the dangerous-command list is the exception:
+ * the bridge returns `allow_once` without a card so the executor can
+ * reject it with the blocked-command error. An explicit `timeoutMs` on
+ * the approval config still fails closed as `timed_out`; the desktop
+ * omits it, so the prompt waits until the user decides.
  *
  * The renderer answers via the `approval:decide` invoke with the requestId
  * echoed back; decisions are validated against the algebra's kind set
@@ -68,6 +70,19 @@ export interface ApprovalBridgeDeps {
         arguments: Record<string, unknown>;
         chatId?: string;
     }) => boolean | 'project' | 'workspace' | Promise<boolean | 'project' | 'workspace'>;
+    /**
+     * Pattern that will block this command in the executor.
+     * When set, the bridge does not show a card.
+     */
+    blockedCommand?: (toolName: string, args: Record<string, unknown>) => string | null;
+    /**
+     * An allowed network_egress grant is not a tool result. The host stores it
+     * on the running turn so the row survives reopening the chat.
+     */
+    recordEgressGrant?: (prompt: ApprovalPromptRequest, decision: {
+        kind: ApprovalDecisionKind;
+        reason: string;
+    }) => void;
 }
 export interface ApprovalBridge {
     /** Reverse-channel handler for the sidecar's `approval.request`. */

package/dist/sidecar/reverse-approval.js

@@ -5,9 +5,11 @@
  *
  * Fail-closed by construction: no window, no listener, a renderer error,
  * or an invalid reply all become `deny_once` — never a hang, never an
- * auto-allow. An explicit `timeoutMs` on the approval config still fails
- * closed as `timed_out`; the desktop omits it, so the prompt waits until
- * the user decides.
+ * auto-allow. A command on the dangerous-command list is the exception:
+ * the bridge returns `allow_once` without a card so the executor can
+ * reject it with the blocked-command error. An explicit `timeoutMs` on
+ * the approval config still fails closed as `timed_out`; the desktop
+ * omits it, so the prompt waits until the user decides.
  *
  * The renderer answers via the `approval:decide` invoke with the requestId
  * echoed back; decisions are validated against the algebra's kind set
@@ -38,15 +40,19 @@ export function createApprovalBridge(deps) {
             if (!toolName) {
                 return { kind: 'deny_once', reason: 'malformed approval request (no toolName)' };
             }
+            const args = p.arguments && typeof p.arguments === 'object'
+                ? p.arguments
+                : {};
+            if (deps.blockedCommand?.(toolName, args)) {
+                deps.onLog?.(`approval: ${toolName} matches the dangerous-command list; no card`);
+                return { kind: 'allow_once', reason: '' };
+            }
             if (!deps.hasWindow()) {
                 deps.onLog?.(`approval: no renderer window; denying ${toolName} once`);
                 return deny('no renderer window available to approve the call');
             }
             const requestId = randomUUID();
             const chatId = typeof p.chatId === 'string' && p.chatId ? p.chatId : undefined;
-            const args = p.arguments && typeof p.arguments === 'object'
-                ? p.arguments
-                : {};
             const category = typeof p.category === 'string' ? p.category : toolName;
             const categoryLabel = deps.categoryLabel?.(toolName, category);
             const fence = deps.outsideWorkspace
@@ -91,10 +97,17 @@ export function createApprovalBridge(deps) {
                 entry.resolve(deny(`renderer returned an invalid decision kind: ${String(p.kind)}`));
                 return { ok: true };
             }
-            entry.resolve({
-                kind,
-                reason: typeof p.reason === 'string' ? p.reason : '',
-            });
+            const reason = typeof p.reason === 'string' ? p.reason : '';
+            entry.resolve({ kind, reason });
+            if (entry.prompt.toolName === 'network_egress'
+                && (kind === 'allow_once' || kind === 'allow_for_session' || kind === 'allow_always')) {
+                try {
+                    deps.recordEgressGrant?.(entry.prompt, { kind, reason });
+                }
+                catch (err) {
+                    deps.onLog?.(`approval: failed to store egress grant: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
             return { ok: true };
         },
     };

package/dist/sidecar/reverse-ask-user.d.ts

@@ -19,6 +19,13 @@ export interface AskUserPromptRequest {
     /** 发起提问的对话。renderer 只在这条会话的输入框展示卡片。 */
     chatId?: string;
 }
+/** One answered ask, kept so the tool row can store the full text. */
+export interface ResolvedAsk {
+    intro: string;
+    questions: Array<Record<string, unknown>>;
+    answers: Record<string, string | string[]>;
+    unattended?: boolean;
+}
 export interface AskUserBridgeDeps {
     broadcast: (channel: 'ask-user:request', payload: AskUserPromptRequest) => void;
     /** 是否有能应答的窗口/浏览器连接；没有则立即空答。 */
@@ -34,5 +41,17 @@ export interface AskUserBridge {
     answer: (payload: unknown) => {
         ok: boolean;
     };
+    /**
+     * The next answered ask for this chat. The tool result that follows only
+     * carries a short preview, so the turn stores this instead.
+     */
+    takeResolved: (chatId: string) => ResolvedAsk | undefined;
 }
+/** The tool-row result stored in place of the truncated preview. */
+export declare function storedAskResult(ask: ResolvedAsk): {
+    intro: string;
+    questions: Array<Record<string, unknown>>;
+    answers: Record<string, string | string[]>;
+    unattended?: true;
+};
 export declare function createAskUserBridge(deps: AskUserBridgeDeps): AskUserBridge;

package/dist/sidecar/reverse-ask-user.js

@@ -11,25 +11,59 @@
  */
 import { randomUUID } from 'node:crypto';
 const EMPTY_REPLY = { answers: {} };
+function rememberAsk(resolved, chatId, intro, questions, answers, unattended) {
+    if (questions.length === 0)
+        return;
+    const key = chatId ?? '';
+    const queue = resolved.get(key) ?? [];
+    queue.push({
+        intro,
+        questions,
+        answers,
+        ...(unattended ? { unattended: true } : {}),
+    });
+    resolved.set(key, queue);
+}
+function shiftAsk(resolved, key) {
+    const queue = resolved.get(key);
+    if (!queue || queue.length === 0)
+        return undefined;
+    const next = queue.shift();
+    if (queue.length === 0)
+        resolved.delete(key);
+    return next;
+}
+/** The tool-row result stored in place of the truncated preview. */
+export function storedAskResult(ask) {
+    return {
+        intro: ask.intro,
+        questions: ask.questions,
+        answers: ask.answers,
+        ...(ask.unattended ? { unattended: true } : {}),
+    };
+}
 export function createAskUserBridge(deps) {
     const pending = new Map();
+    const resolved = new Map();
     return {
         handler: (params) => {
             const p = (params ?? {});
             const questions = Array.isArray(p.questions) ? p.questions : [];
             const chatId = typeof p.chatId === 'string' && p.chatId ? p.chatId : undefined;
+            const intro = typeof p.intro === 'string' ? p.intro : '';
             if (questions.length === 0) {
                 deps.onLog?.('ask_user: malformed request (no questions); answering empty');
                 return Promise.resolve({ ...EMPTY_REPLY });
             }
             if (!deps.hasWindow()) {
                 deps.onLog?.('ask_user: no renderer window; answering empty');
+                rememberAsk(resolved, chatId, intro, questions, {}, false);
                 return Promise.resolve({ ...EMPTY_REPLY });
             }
             const requestId = randomUUID();
             const prompt = {
                 requestId,
-                intro: typeof p.intro === 'string' ? p.intro : '',
+                intro,
                 questions: questions,
                 ...(chatId ? { chatId } : {}),
             };
@@ -41,6 +75,7 @@ export function createAskUserBridge(deps) {
                 catch (err) {
                     pending.delete(requestId);
                     deps.onLog?.(`ask_user: broadcast failed: ${String(err)}`);
+                    rememberAsk(resolved, chatId, intro, prompt.questions, {}, false);
                     resolve({ ...EMPTY_REPLY });
                 }
             });
@@ -55,8 +90,10 @@ export function createAskUserBridge(deps) {
             const answers = p.answers && typeof p.answers === 'object' && !Array.isArray(p.answers)
                 ? p.answers
                 : {};
+            rememberAsk(resolved, entry.prompt.chatId, entry.prompt.intro, entry.prompt.questions, answers, p.unattended === true);
             entry.resolve({ answers });
             return { ok: true };
         },
+        takeResolved: (chatId) => shiftAsk(resolved, chatId) ?? (chatId ? shiftAsk(resolved, '') : undefined),
     };
 }

package/dist/sidecar/types.d.ts

@@ -531,12 +531,13 @@ export interface SidecarStreamChunk {
             backend?: string;
             enforcement: string;
         };
-        /** Session-allow reuse. `cached` means this call did not show a card. */
+        /** Session-allow reuse. `cached` means this call did not show a card. `auto` is an unattended allow. */
         approval?: {
             kind?: string;
             category?: string;
             cached?: boolean;
             waitMs?: number;
+            auto?: boolean;
         };
     };
     /** CoreLoop notices: soft_timeout / budget_exhausted / round_end / hook_action. */

package/dist/tool-presentation.js

@@ -38,6 +38,24 @@ function dataOf(result) {
 function failed(result) {
     return Boolean(result && typeof result === 'object' && result.success === false);
 }
+function askTitle(args, result) {
+    return clip(firstQuestion(args) || firstQuestion(result) || str(args, 'intro') || str(args, 'question')) || '提问';
+}
+function firstQuestion(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return '';
+    const questions = value.questions;
+    if (!Array.isArray(questions))
+        return '';
+    for (const question of questions) {
+        if (!question || typeof question !== 'object' || Array.isArray(question))
+            continue;
+        const text = str(question, 'text').trim();
+        if (text)
+            return text;
+    }
+    return '';
+}
 function commandTitle(args) {
     return clip(str(args, 'command')) || 'shell';
 }
@@ -230,7 +248,7 @@ const PRESENTERS = {
     ask_user: {
         card: 'generic',
         kind: 'other',
-        title: (args) => clip(str(args, 'intro') || str(args, 'question')) || '提问',
+        title: (args, result) => askTitle(args, result),
     },
     skill: { card: 'generic', kind: 'read', title: (args) => str(args, 'name') || 'skill' },
     delegate_subagent: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steerable/agent-shell",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "description": "Steerable framework — product-neutral Node HostRuntime and headless HTTP server shared by Tauri desktop and browser deployments; scenario packs extend it through @steerable/pack-sdk.",
   "license": "Apache-2.0",
   "homepage": "https://steerableframework.com/",
@@ -53,9 +53,9 @@
     "jpeg-js": "^0.4.4",
     "node-pty": "^1.1.0",
     "pngjs": "^7.0.0",
-    "@steerable/agent-harness": "0.7.1",
-    "@steerable/pack-sdk": "0.7.1",
-    "@steerable/agent-protocol": "0.7.1"
+    "@steerable/agent-harness": "0.7.4",
+    "@steerable/agent-protocol": "0.7.4",
+    "@steerable/pack-sdk": "0.7.4"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",