@tomflow/chatloop-extension 0.3.29 → 0.3.33

package/extension/background.js

@@ -2,6 +2,7 @@
 // Only extension-owned Action pages execute Continue or cross-Chat Handoff.
 importScripts("loop/core.js");
 const RUN_KEY = "chat-loop.action.run.v1";
+const SESSION_HOST = "com.tomflow.chatloop.extension";
 const HOUR_MS = 60 * 60 * 1000; // Acceptance wall-clock hours are independent of the MVP timeout.
 const RUN_BUDGET_MS = 10 * 60 * 1000; // Ten minutes per Chat; never interrupt a running Turn.
 const ALARM_NAME = "chat-loop.turn-watch.v1";
@@ -10,6 +11,10 @@ const DEADLINE_ALARM_NAME = "chat-loop.handoff-deadline.v1";
 const COUNT_ALARM_NAME = "chat-loop.count-wait.v1";
 const COUNT_INTERVAL_MS = 60000;
 const CONTINUE_TEXT = "继续当前任务，完成本轮后只在末行写一个状态：[CHAT_LOOP_STATUS:CONTINUE]、[CHAT_LOOP_STATUS:DONE] 或 [CHAT_LOOP_STATUS:BLOCKED]。";
+// The model cannot authenticate its originating Chat through MCP alone.
+// This per-Turn capability is sent only to the newly confirmed loop-owned Chat.
+// It is never a browser-send authorization; it only permits staging one intent.
+const turnToolNote = token => "\n\n【Chat Loop 本轮工具凭证】只有本轮需要自定下一轮内容或提前交接时，才能调用 chat_loop_extension__continue / chat_loop_extension__handoff；参数 turnToken 填写 " + token + "。工具只登记意图，不等待本轮结束，不直接发送；请照常在本轮结束时输出 CONTINUE、DONE 或 BLOCKED 标记。不要在助手正文重复该凭证。";
 // Explicit acceptance setup only, dispatched by the same formal Continue page.
 // Fixed harmless prompt; no arbitrary text or external write interface.
 const ACTION_TEST_TEXT = "这是 Chat Loop 短轮回归专用测试，不调用工具、不改文件。每次仅回复一句短话，最后一行单独输出一个协议状态标记。\n第1条消息：OK1，然后末行 [CHAT_LOOP_STATUS:CONTINUE]。\n第2条消息：OK2，然后末行 [CHAT_LOOP_STATUS:CONTINUE]。\n第3条消息：OK3，然后末行 [CHAT_LOOP_STATUS:DONE]。\n不主动交接，也不追加解释。校验串：LOOP-V037-FAST-3C1H。";
@@ -52,7 +57,37 @@ const deadlineOf = run => Number.isSafeInteger(run?.startedAt) && run.startedAt
   ? run.startedAt + windowMsOf(run) : null;
 const clockActive = run => run && ["RESERVED", "PENDING", "WAITING_REPLY", "WAITING_INTERVAL"].includes(run.phase)
   && !run.testSetup && !run.wallTestHours;
+// Durable, bounded metadata for model intent receipts. The prompt text remains only
+// in the active run while its Action is pending; history never stores the prompt.
+const MODEL_RECEIPT_TTL_MS = 24 * 60 * 60 * 1000;
+const receiptHistory = run => Array.isArray(run?.modelReceipts)
+  ? run.modelReceipts.filter(x => x && typeof x.id === "string"
+    && Number.isSafeInteger(x.updatedAt)
+    && Date.now() - x.updatedAt < MODEL_RECEIPT_TTL_MS).slice(-16) : [];
+const updateModelReceipt = (run, id, change) => {
+  if (!id) return run;
+  const records = receiptHistory(run);
+  const index = records.findIndex(x => x.id === id);
+  const existing = index >= 0 ? records.splice(index, 1)[0] : {id};
+  return {...run, modelReceipts: [...records,
+    {...existing, ...change, id, updatedAt:Date.now()}].slice(-16)};
+};
+const settleModelIntent = (run, status, reason) => {
+  const pending = run?.modelIntent;
+  const finished = pending
+    ? updateModelReceipt(run, pending.id, {status,
+        reason:reason||run.reason||null,
+        actualAction:run.action||pending.action,
+        checkpointForwarded:false})
+    : run;
+  const next = {...finished};
+  delete next.modelIntent;
+  delete next.modelTurnToken;
+  return next;
+};
 async function saveRun(run) {
+  if (run && ["DONE","BLOCKED"].includes(run.phase))
+    run = settleModelIntent(run, run.phase==="DONE"?"CANCELLED_DONE":"BLOCKED", run.reason);
   const now = Date.now(), deadlineAt = deadlineOf(run);
   // Persist the intent even when a delayed alarm arrives after an Action
   // receipt. This never revokes a Continue already reserved before deadline.
@@ -63,6 +98,14 @@ async function saveRun(run) {
     next.handoffPendingAt = now;
   }
   await chrome.storage.local.set({[RUN_KEY]: next});
+  if(next.sessionId){
+    const record = sessionProjection(next);
+    const saved = await chrome.runtime.sendNativeMessage(SESSION_HOST,
+      {op:"session-sync",session:record}).catch(()=>null);
+    if(saved?.status!=="OK"||saved.session?.sessionId!==next.sessionId)
+      throw Error(saved?.code||"SESSION_PERSISTENCE_UNVERIFIED");
+  }
+
   try {
     if (clockActive(next) && !next.handoffPending && deadlineAt > Date.now()) {
       await chrome.alarms?.create?.(DEADLINE_ALARM_NAME, {when: deadlineAt});
@@ -74,6 +117,104 @@ async function saveRun(run) {
     else await chrome.alarms?.clear?.(COUNT_ALARM_NAME);
   } catch { /* The existing periodic alarm is a conservative backup. */ }
 }
+// Browser Owner remains the only send authority. Native Host mirrors a minimal
+// session pointer so later Chats can find the current Web Chat without a task engine.
+function sessionProjection(run) {
+  const page=typeof run.page==='string'?run.page:'';
+  const match=page.match(/\/c\/([0-9a-f-]{12,})$/i);
+  const activeChatId=match?.[1]||null;
+  return {sessionId:run.sessionId,projectId:run.projectId,
+    phase:run.phase,generation:run.generation||0,activeChatId,
+    activeChatUrl:activeChatId?"https://chatgpt.com"+page:null,
+    updatedAt:Date.now()};
+}
+const sessionPage=(sender,name,id)=> Number.isInteger(sender.tab?.id)
+  && typeof id==='string'&&/^[a-f0-9]{32}$/.test(id)
+  && sender.url===chrome.runtime.getURL(name+'.html')+'?requestId='+id;
+async function sessionStartPrepare(message,sender){
+  if(!sessionPage(sender,'start',message.requestId))
+    return {status:'DENIED',code:'INVALID_START_SOURCE'};
+  const prior=await readRun();
+  if(prior&&prior.phase!=='DONE')
+    return {status:'DENIED',code:'LOOP_ALREADY_ACTIVE'};
+  const disk=await chrome.runtime.sendNativeMessage(SESSION_HOST,{op:'session-read'}).catch(()=>null);
+  if(disk?.status!=='OK')return {status:'DENIED',code:'SESSION_STATE_UNVERIFIED'};
+  if(disk.session&&disk.session.phase!=='DONE')
+    return {status:'DENIED',code:'SESSION_ALREADY_ACTIVE'};
+  const proof=await chrome.runtime.sendNativeMessage(SESSION_HOST,
+    {op:'acquire',id:message.requestId,action:'start'}).catch(()=>null);
+  const intent=proof?.intent;
+  if(proof?.status!=='OK'||intent?.confirmed!==true
+    ||typeof intent.projectId!=='string'
+    ||!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(intent.projectId)
+    ||typeof intent.prompt!=='string'||!intent.prompt.trim()||intent.prompt.length>4000)
+    return {status:'DENIED',code:'START_INTENT_UNVERIFIED'};
+  const next={sessionId:crypto.randomUUID(),projectId:intent.projectId,
+    generation:0,phase:'STARTING',action:'START',token:crypto.randomUUID(),
+    page:'/',tabId:null,startedAt:Date.now(),
+    machineRequestId:message.requestId,machineActionTabId:sender.tab.id,
+    startPrompt:intent.prompt};
+  await saveRun(next); // Reserve BEFORE any new Chrome tab or send.
+  return {status:'PREPARED',token:next.token,sessionId:next.sessionId};
+}
+async function sessionStartTake(message,sender){
+  const run=await readRun();
+  if(!sessionPage(sender,'start',message.requestId)||run?.machineRequestId!==message.requestId
+    ||run.machineActionTabId!==sender.tab.id||run.token!==message.token
+    ||run.phase!=='STARTING')return {status:'DENIED',code:'START_OWNER_CHANGED'};
+  await saveRun({...run,phase:'PENDING'});
+  return {status:'OK',sessionId:run.sessionId,prompt:run.startPrompt};
+}
+async function sessionStartResult(message,sender){
+  const run=await readRun();
+  if(!sessionPage(sender,'start',message.requestId)||run?.machineRequestId!==message.requestId
+    ||run.machineActionTabId!==sender.tab.id||run.token!==message.token
+    ||run.phase!=='PENDING')return {status:'DENIED',code:'START_OWNER_CHANGED'};
+  let confirmed=message.result==='SENT_CONFIRMED'
+    &&Number.isInteger(message.newTabId)
+    &&typeof message.newPage==='string'&&pathOf('https://chatgpt.com'+message.newPage)===message.newPage
+    &&typeof message.newUserKey==='string'&&/^user:[^\s]{8,}$/.test(message.newUserKey);
+  if(confirmed){
+    const tab=await chrome.tabs.get(message.newTabId).catch(()=>null);
+    confirmed=!!tab&&pathOf(tab.url)===message.newPage;
+  }
+  const next={...run,phase:confirmed?'WAITING_REPLY':'BLOCKED',
+    reason:confirmed?'':'START_SEND_UNVERIFIED',
+    ...(confirmed?{tabId:message.newTabId,page:message.newPage,
+      newUserKey:message.newUserKey}:{attemptedNewTabId:Number.isInteger(message.newTabId)?message.newTabId:null})};
+  delete next.startPrompt;
+  delete next.machineRequestId;
+  delete next.machineActionTabId;
+  await saveRun(next);
+  return confirmed?{status:'OK',sessionId:next.sessionId,
+    activeChatId:sessionProjection(next).activeChatId,
+    activeChatUrl:sessionProjection(next).activeChatUrl}
+    :{status:'BLOCKED',code:'START_SEND_UNVERIFIED'};
+}
+async function sessionStatus(message,sender){
+  if(!sessionPage(sender,'status',message.requestId))
+    return {status:'DENIED',code:'INVALID_STATUS_SOURCE'};
+  const run=await readRun();
+  const disk=await chrome.runtime.sendNativeMessage(SESSION_HOST,{op:'session-read'}).catch(()=>null);
+  if(disk?.status!=='OK')return {status:'UNVERIFIED',code:'SESSION_STATE_UNVERIFIED'};
+  if(run?.sessionId&&(!disk.session||run.sessionId!==disk.session.sessionId
+    ||run.phase!==disk.session.phase
+    ||(run.generation||0)!==disk.session.generation))
+    return {status:'UNVERIFIED',code:'SESSION_FILE_MISMATCH'};
+  if(!run?.sessionId&&disk.session&&disk.session.phase!=='DONE')
+    return {status:'UNVERIFIED',code:'SESSION_OWNER_MISMATCH'};
+  if(run&&run.phase!=='DONE'&&!run.sessionId)
+    return {status:'OK',state:'LEGACY_OWNER',phase:run.phase};
+  if(!run||run.phase==='DONE')return {status:'OK',state:'IDLE',
+    ...(disk.session?{lastSession:disk.session}:{} )};
+  const record=sessionProjection(run);
+  if(record.activeChatId&&run.phase==='WAITING_REPLY'){
+    const tab=await chrome.tabs.get(run.tabId).catch(()=>null);
+    if(!tab||pathOf(tab.url)!==run.page)
+      return {status:'UNVERIFIED',code:'OWNER_TAB_MISSING',session:record};
+  }
+  return {status:'OK',state:run.phase==='BLOCKED'?'BLOCKED':'ACTIVE',session:record};
+}
 async function prepareHandoffIfDue() {
   const run = await readRun();
   const deadlineAt = deadlineOf(run);
@@ -126,6 +267,18 @@ async function recheckUnknownTurn(message, previous, tabId) {
   }
   return null;
 }
+// A suspended MV3 Worker may lose the Action receipt. Never retry a send
+// from a stale RESERVED/PENDING phase; scrub the queued task text and block.
+async function expireStaleModelIntent() {
+  const run=await readRun();
+  if(!run?.modelIntent || !Number.isSafeInteger(run.modelIntent.queuedAt)
+    ||Date.now()-run.modelIntent.queuedAt<=MODEL_RECEIPT_TTL_MS)return;
+  const pendingSend=["RESERVED","PENDING"].includes(run.phase);
+  const next=settleModelIntent(run,"STALE_UNVERIFIED","INTENT_TTL_EXPIRED");
+  await saveRun(pendingSend
+    ?{...next,phase:"BLOCKED",reason:"STALE_INTENT_UNKNOWN_SEND"}
+    :next);
+}
 async function onTurnBlocked(message, sender) {
   const reason = message.reason;
   if (!["PAGE_ERROR", "CONTEXT_LIMIT", "SECURITY_CHALLENGE"].includes(reason)
@@ -164,9 +317,14 @@ async function onTurnBlocked(message, sender) {
     || reason === "PAGE_ERROR" && previous.retryCount !== 1 && second.retryAvailable === true) {
     const retry = reason === "PAGE_ERROR";
     const token = crypto.randomUUID();
-    const next = {...previous, phase: "RESERVED", action: retry ? "CONTINUE" : "HANDOFF",
+    let next = {...previous, phase: "RESERVED", action: retry ? "CONTINUE" : "HANDOFF",
       token, reason: "", ...(retry ? {retryMode: "NATIVE", retryCount: 1}
         : {handoffMode: "ERROR", errorReason: reason})};
+    if (previous.modelIntent) {
+      next=updateModelReceipt(next,previous.modelIntent.id,{
+        status:"OVERRIDDEN_BY_ERROR",reason,actualAction:next.action});
+      delete next.modelIntent;
+    }
     await saveRun(next); // Durable before opening the only authorized Action.
     try {
       const url = chrome.runtime.getURL(retry ? "continue.html" : "handoff.html")
@@ -183,6 +341,76 @@ async function onTurnBlocked(message, sender) {
     : "CONTEXT_HANDOFF_REPEATED", errorUserKey: message.userKey, errorAt: Date.now()});
   return {status: "BLOCKED", code: reason === "PAGE_ERROR" ? "PAGE_ERROR" : "CONTEXT_HANDOFF_REPEATED"};
 }
+// A model-driven request can only be queued against a currently RUNNING,
+// already-owned user Turn. The MCP call returns immediately: waiting for this
+// assistant to finish inside the tool call would deadlock the Turn.
+async function onModelIntent(message,sender) {
+  const action=message?.action;
+  const file=action==='HANDOFF'?'handoff.html':action==='CONTINUE'?'continue.html':null;
+  const id=message?.id;
+  if(!file||!Number.isInteger(sender.tab?.id)||!/^[a-f0-9]{32}$/.test(id||'')
+    ||sender.url!==chrome.runtime.getURL(file)+'?requestId='+id)
+    return {status:'DENIED',code:'INVALID_MODEL_INTENT_SOURCE'};
+  const intent=message.intent;
+  if(!intent||typeof intent!=='object'||Array.isArray(intent)
+    ||Object.keys(intent).some(k=>k!=='turnToken' && (action==='CONTINUE'?k!=='nextPrompt':k!=='reason'))
+    ||typeof intent.turnToken!=='string'
+    ||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(intent.turnToken))
+    return {status:'DENIED',code:'INVALID_MODEL_INTENT'};
+  if(action==='CONTINUE' && (typeof intent.nextPrompt!=='string'
+      ||!intent.nextPrompt.trim()||intent.nextPrompt.length>4000
+      ||/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(intent.nextPrompt))
+    ||action==='HANDOFF' && intent.reason!==undefined
+      &&(typeof intent.reason!=='string'||intent.reason.length>400
+        ||/[\x00-\x1f]/.test(intent.reason)))
+    return {status:'DENIED',code:'INVALID_MODEL_INTENT'};
+  const run=await readRun();
+  if(!run||run.phase!=='WAITING_REPLY'||run.testSetup||run.countMode
+    ||run.timedTest||run.wallTestHours||run.modelTurnToken!==intent.turnToken)
+    return {status:'DENIED',code:'MODEL_INTENT_OWNER_NOT_RUNNING'};
+  if(run.modelIntent)
+    return {status:'DENIED',code:'MODEL_INTENT_ALREADY_QUEUED'};
+  const tab=await chrome.tabs.get(run.tabId).catch(()=>null);
+  if(!tab||pathOf(tab.url)!==run.page)
+    return {status:'DENIED',code:'MODEL_INTENT_OWNER_CHANGED'};
+  const proof=await chrome.tabs.sendMessage(run.tabId,{
+    type:'CHAT_LOOP_TURN_OBSERVE_V1',poll:true}).catch(()=>null);
+  if(proof?.contract!=='chat-loop.turn-observer.v1'||proof.status!=='RUNNING'
+    ||proof.page!==run.page||proof.userKey!==run.newUserKey)
+    return {status:'DENIED',code:'MODEL_INTENT_TURN_NOT_RUNNING'};
+  const next = {...run,modelIntent:{
+    id, action, page:run.page, userKey:run.newUserKey,
+    ...(action==='CONTINUE'?{nextPrompt:intent.nextPrompt}
+      :{reason:intent.reason||''}), queuedAt:Date.now()
+  }};
+  await saveRun(updateModelReceipt(next,id,{action,turnToken:intent.turnToken,
+    status:'QUEUED',reason:null,actualAction:null,checkpointForwarded:false}));
+  return {status:'QUEUED',action,intentId:id};
+}
+async function onModelIntentStatus(message,sender) {
+  const action=message?.action;
+  const file=action==='HANDOFF'?'handoff.html':action==='CONTINUE'?'continue.html':null;
+  const id=message?.id, intent=message?.intent;
+  if(!file||!Number.isInteger(sender.tab?.id)||!/^[a-f0-9]{32}$/.test(id||'')
+    ||sender.url!==chrome.runtime.getURL(file)+'?requestId='+id
+    ||!intent||typeof intent!=='object'||Array.isArray(intent)
+    ||typeof intent.turnToken!=='string'
+    ||!(intent.lookup===true||typeof intent.intentId==='string')
+    ||Object.keys(intent).some(k=>k!=='turnToken'&&
+      k!==(intent.lookup===true?'lookup':'intentId'))
+    ||intent.lookup!==true&& !/^[a-f0-9]{32}$/.test(intent.intentId||''))
+    return {status:'DENIED',code:'INTENT_QUERY_UNAUTHORIZED'};
+  const run=await readRun();
+  const receipts=receiptHistory(run).filter(x=>x.turnToken===intent.turnToken
+    &&x.action===action);
+  const receipt=intent.lookup===true?receipts.at(-1)
+    :receipts.find(x=>x.id===intent.intentId);
+  if(!receipt)return {status:'DENIED',code:'INTENT_RECEIPT_NOT_FOUND'};
+  return {status:'STATUS',action,intentId:receipt.id,phase:receipt.status,
+    actualAction:receipt.actualAction||null,reason:receipt.reason||null,
+    checkpointForwarded:receipt.checkpointForwarded===true,
+    updatedAt:receipt.updatedAt};
+}
 async function onTurnFinished(message, sender) {
   if (!await eligible(sender, message.page)
     || typeof message.userKey !== "string" || !/^user:[^\s]{8,}$/.test(message.userKey)
@@ -248,9 +476,14 @@ async function onTurnFinished(message, sender) {
   const timeExpired = now >= startedAt + windowMsOf(previous);
   // Deadline intent can be persisted by the timer even while a Turn RUNS.
   // The decision below still waits for the observer's complete Turn proof.
+  const queued = previous?.modelIntent?.page===message.page
+    && previous.modelIntent.userKey===message.userKey ? previous.modelIntent : null;
+  // Existing DONE/BLOCKED, deadline and page-error policies still win.
+  // A queued model request only changes a still-eligible CONTINUE Turn.
   let nextAction = status === "HANDOFF" ? "UNSUPPORTED_MODEL_HANDOFF"
     : (previous?.handoffPending || timeExpired) && status === "CONTINUE"
-      ? "HANDOFF" : status;
+      ? "HANDOFF" : status === "CONTINUE" && queued
+        ? queued.action : status;
   if (nextAction !== "CONTINUE" && nextAction !== "HANDOFF") {
     if (previous?.phase === "WAITING_REPLY" && previous.tabId === tabId) {
       await saveRun({...previous, phase: status === "DONE" ? "DONE" : "BLOCKED",
@@ -289,9 +522,11 @@ async function onTurnFinished(message, sender) {
   const newlyDue = Date.now() >= startedAt + windowMsOf(previous);
   if (nextAction === "CONTINUE" && newlyDue) nextAction = "HANDOFF";
   const token = crypto.randomUUID();
-  const run = {tabId, page: message.page, userKey: message.userKey,
+  const run = {...(previous?.sessionId ? {sessionId: previous.sessionId,
+    projectId: previous.projectId, generation: previous.generation || 0} : {}),
+    tabId, page: message.page, userKey: message.userKey,
     assistantKey: message.assistantKey, phase: "RESERVED", token,
-    action: nextAction, startedAt,
+    action: nextAction, startedAt, modelReceipts:receiptHistory(previous),
     ...(countMode ? {countMode:true, countValue:verifiedCount,
       countLastSendAt:previous.countLastSendAt,
       countHandoffs:previous.countHandoffs || 0} : {}),
@@ -322,16 +557,28 @@ async function onTurnFinished(message, sender) {
           wallOriginalReleaseAt: previous.wallOriginalReleaseAt} : {})} : {})} : {}),
     // A timed Handoff uses an Action-local read-only snapshot. Do not keep
     // the entire conversation in storage or embed it in the Action URL.
-    handoffMode: nextAction === "HANDOFF" ? "TIMED" : null};
+    handoffMode: nextAction === "HANDOFF" ? "TIMED" : null,
+    ...(status==="CONTINUE" && queued
+      && (queued.action===nextAction
+        ||queued.action==="CONTINUE"&&nextAction==="HANDOFF")
+      ? {modelIntent:queued} : {})};
+  // Deadline wins, but the queued continuation is retained as a *proposal*
+  // in the bounded Handoff packet instead of silently losing task progress.
+  const overridden=queued?.action==="CONTINUE"&&nextAction==="HANDOFF";
+  const recorded=queued?updateModelReceipt(run,queued.id,{
+    status:overridden?"OVERRIDDEN_BY_DEADLINE":"RESERVED",
+    actualAction:nextAction,
+    reason:overridden?"OVERRIDDEN_BY_DEADLINE":null,
+    checkpointForwarded:false}):run;
   // Durable before opening an Action; an uncertain outcome must never be retried.
-  await saveRun(run);
+  await saveRun(recorded);
   try {
     const url = chrome.runtime.getURL(nextAction === "HANDOFF" ? "handoff.html" : "continue.html")
       + "?tabId=" + tabId + "&token=" + encodeURIComponent(token);
     const actionTab = await chrome.tabs.create({url, active: false, windowId: sender.tab.windowId});
     return {status: "QUEUED", actionTabId: actionTab.id};
   } catch (error) {
-    await saveRun({...run, phase: "BLOCKED", reason: "ACTION_PAGE_CREATE_FAILED"});
+    await saveRun({...recorded, phase: "BLOCKED", reason: "ACTION_PAGE_CREATE_FAILED"});
     return {status: "BLOCKED", code: error.message || "ACTION_PAGE_CREATE_FAILED"};
   }
 }
@@ -386,7 +633,8 @@ async function onManualPrepare(message, sender) {
       || message.tabId !== Number(rawTabId))))
     return {status: "DENIED", code: "INVALID_ACTION_URL"};
   const previous = await readRun();
-  if (previous && !["DONE", "BLOCKED"].includes(previous.phase))
+  if (previous && (previous.sessionId&&previous.phase!=="DONE"
+    || !["DONE", "BLOCKED"].includes(previous.phase)))
     return {status: "DENIED", code: "LOOP_ALREADY_ACTIVE"};
   const candidates = await chrome.tabs.query({url: "https://chatgpt.com/*"});
   const all = candidates.filter(tab => Number.isInteger(tab.id) && pathOf(tab.url));
@@ -448,7 +696,8 @@ async function onTestPrepare(message, sender) {
       chrome.runtime.getURL("continue.html") + "?tabId=" + tabId + "&setup=1&discardDraft=1&timed=1&wall=10m&count=86"].includes(sender.url))
     return {status: "DENIED", code: "INVALID_TEST_ACTION"};
   const previous = await readRun();
-  if (previous && !["DONE", "BLOCKED"].includes(previous.phase))
+  if (previous && (previous.sessionId&&previous.phase!=="DONE"
+    || !["DONE", "BLOCKED"].includes(previous.phase)))
     return {status: "DENIED", code: "LOOP_ALREADY_ACTIVE"};
   if (previous?.tabId === tabId)
     return {status: "DENIED", code: "TEST_TARGET_ALREADY_USED"};
@@ -639,8 +888,18 @@ async function onTake(message, sender) {
     await saveRun({...run, phase: "BLOCKED", reason: "CHAT_TARGET_CHANGED"});
     return {status: "DENIED", code: "CHAT_TARGET_CHANGED"};
   }
-  await saveRun({...run, phase: "PENDING"});
-  return {status: "OK", action: run.action || "CONTINUE",
+  // Bind a model-control capability to the next *user* Turn, not to a tab or to another Chat.
+  // Acceptance fixtures retain their existing prompts; native Retry keeps its original Turn token.
+  const modelTurnToken = run.retryMode === "NATIVE" ? run.modelTurnToken || null
+    : run.testSetup || run.countMode || run.timedTest || run.wallTestHours
+      ? null : crypto.randomUUID();
+  const pending={...run, phase: "PENDING", modelTurnToken};
+  await saveRun(run.modelIntent ? updateModelReceipt(pending,run.modelIntent.id,{
+    status:run.action==="HANDOFF"&&run.modelIntent.action==="CONTINUE"
+      ?"OVERRIDDEN_BY_DEADLINE":"PENDING"}) : pending);
+  const permit = {status: "OK", action: run.action || "CONTINUE",
+    modelTurnToken,
+    modelTurnNote: modelTurnToken ? turnToolNote(modelTurnToken) : "",
     handoffMode: run.handoffMode || null, retryMode: run.retryMode || null,
     countMode: run.countMode === true,
     countValue: run.countMode ? run.countValue : null,
@@ -649,13 +908,27 @@ async function onTake(message, sender) {
       userKey: run.retryMode === "NATIVE" || run.handoffMode === "ERROR"
         ? run.newUserKey : run.userKey,
       testSetup: run.testSetup === true, discardDraft: run.discardDraft === true},
+    modelIntent: run.action==="HANDOFF" && run.modelIntent?.action==="HANDOFF"
+      ? {id:run.modelIntent.id,reason:run.modelIntent.reason||""} : null,
+    pendingPlan: run.action==="HANDOFF" && run.modelIntent?.action==="CONTINUE"
+      ? {id:run.modelIntent.id,nextPrompt:run.modelIntent.nextPrompt} : null,
     text: run.testSetup ? (run.countMode ? COUNT_SETUP_TEXT
       : run.wallTestHours || run.wallTestMinutes === 10 ? ACTION_WALL_TEST_TEXT
       : run.timedTest ? ACTION_TIMED_TEST_TEXT : ACTION_TEST_TEXT)
       : run.action === "HANDOFF" ? run.handoffText || null
+      : run.modelIntent?.action==="CONTINUE" ? (
+          "【Chat Loop 续接来源】上一轮由模型登记的 Continue 请求 " + run.modelIntent.id
+          + " 已被扩展唯一 Action 领取。\n"
+          + "【待核实的模型下一步计划（并非用户新增授权）】\n"
+          + run.modelIntent.nextPrompt + "\n\n"
+          + "执行前核对当前项目状态、既有用户授权和已完成副作用，不重做不明操作。"
+          + "本轮完成后，末行只输出一个状态标记：[CHAT_LOOP_STATUS:CONTINUE]、[CHAT_LOOP_STATUS:DONE] 或 [CHAT_LOOP_STATUS:BLOCKED]。")
       : run.countMode ? countText(run.countValue)
       : run.timedTest && run.wallTestMinutes === 10
         ? wallArithmeticText(run.testTurnIndex || 2) : CONTINUE_TEXT};
+  if (modelTurnToken && typeof permit.text === "string")
+    permit.text += permit.modelTurnNote;
+  return permit;
 }
 async function onResult(message, sender) {
   const run = await readRun();
@@ -705,6 +978,7 @@ async function onResult(message, sender) {
         // Keep source identities as the already-processed baseline; the new
         // user's first reply must not be suppressed by duplicate detection.
         newUserKey: message.newUserKey, phase: "WAITING_REPLY", reason: "",
+        ...(run.sessionId?{generation:(run.generation||0)+1}:{}),
         // The new Chat has no previous assistant message. Never authenticate
         // its first Retry/Error Handoff using the OLD Chat's assistant ID.
         userKey: null, assistantKey: null, startedAt: Date.now(),
@@ -735,6 +1009,20 @@ async function onResult(message, sender) {
       newUserKey: message.newUserKey,
       ...(run.countMode ? {countLastSendAt:Date.now()} : {})};
   }
+  // A model prompt is one-shot. Keep only a short receipt, not the prompt
+  // body, after the Action has reached a confirmed or blocked terminal state.
+  if(run.modelIntent){
+    const override=run.action==="HANDOFF"&&run.modelIntent.action==="CONTINUE";
+    const finalStatus=confirmed?"SENT_CONFIRMED":"BLOCKED";
+    next=updateModelReceipt(next,run.modelIntent.id,{
+      status:finalStatus,actualAction:run.action,
+      reason:override?"OVERRIDDEN_BY_DEADLINE":confirmed?null:failure,
+      checkpointForwarded:confirmed&&override});
+    next.lastModelIntent={id:run.modelIntent.id,action:run.modelIntent.action,
+      result:finalStatus,at:Date.now()};
+    delete next.modelIntent;
+  }
+  if (!confirmed) delete next.modelTurnToken;
   await saveRun(next);
   return {status: confirmed ? "OK" : "BLOCKED"};
 }
@@ -818,7 +1106,7 @@ async function ensureAlarm() {
 async function watchActiveTurn() {
   // Normal periodic wakeups also reconcile a delayed one-shot deadline.
   // All state changes share the same serial queue as Turn/Action receipts.
-  await serial(prepareHandoffIfDue);
+  await serial(async()=>{await expireStaleModelIntent();await prepareHandoffIfDue();});
   const run = await readRun();
   // While an Action is pending, never dispatch competing operations.
   if (run?.phase === "WALL_CLOCK_HOLD") {
@@ -914,9 +1202,18 @@ chrome.runtime.onMessage.addListener((message, sender, reply) => {
   if (["CHAT_LOOP_TURN_FINISHED_V1", "CHAT_LOOP_TURN_BLOCKED_V1",
     "CHAT_LOOP_ACTION_TAKE_V1",
     "CHAT_LOOP_ACTION_RESULT_V1", "CHAT_LOOP_ACTION_MANUAL_PREPARE_V1",
+    "CHAT_LOOP_MODEL_INTENT_V1", "CHAT_LOOP_MODEL_INTENT_STATUS_V1",
     "CHAT_LOOP_ACTION_TEST_PREPARE_V1",
+    "CHAT_LOOP_SESSION_START_PREPARE_V1", "CHAT_LOOP_SESSION_START_TAKE_V1",
+    "CHAT_LOOP_SESSION_START_RESULT_V1", "CHAT_LOOP_SESSION_STATUS_V1",
     "CHAT_LOOP_ACCEPTANCE_CLOCK_ADVANCE_V1"].includes(type)) {
-    const work = serial(() => type === "CHAT_LOOP_TURN_FINISHED_V1"
+    const work = serial(() => type === "CHAT_LOOP_SESSION_START_PREPARE_V1"
+      ? sessionStartPrepare(message,sender) : type === "CHAT_LOOP_SESSION_START_TAKE_V1"
+      ? sessionStartTake(message,sender) : type === "CHAT_LOOP_SESSION_START_RESULT_V1"
+      ? sessionStartResult(message,sender) : type === "CHAT_LOOP_SESSION_STATUS_V1"
+      ? sessionStatus(message,sender) : type === "CHAT_LOOP_MODEL_INTENT_V1"
+      ? onModelIntent(message, sender) : type === "CHAT_LOOP_MODEL_INTENT_STATUS_V1"
+      ? onModelIntentStatus(message,sender) : type === "CHAT_LOOP_TURN_FINISHED_V1"
       ? onTurnFinished(message, sender) : type === "CHAT_LOOP_TURN_BLOCKED_V1"
         ? onTurnBlocked(message, sender) : type === "CHAT_LOOP_ACTION_TAKE_V1"
         ? onTake(message, sender) : type === "CHAT_LOOP_ACTION_MANUAL_PREPARE_V1"

package/extension/clean.html

@@ -0,0 +1,5 @@
+<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>Chat Loop · Clean</title>
+<style>body{font:14px system-ui;padding:22px;color:#242424}#status{font-weight:bold}#details{color:#666}</style></head>
+<body><h1>Clean · 清理输入框</h1><p id="status">VERIFYING</p><p id="details">正在核实目标 Chat，不发送消息。</p>
+<script src="actions/clean.js"></script></body></html>

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Chat Loop Extension",
-  "version": "0.3.29",
+  "version": "0.3.33",
   "description": "Chat Loop browser companion: Eye actions, Turn observer, Continue and Handoff Actions",
   "permissions": [
     "activeTab",

package/extension/popup.html

@@ -17,7 +17,7 @@
   <p id="status" role="status">正在检测…</p>
   <p id="detail">仅检查当前页面与浏览器类型，不读取聊天内容。</p>
   <p>打开动作页即执行，成功后自动关闭。多 Chat 标签页时请在动作页 URL 指定 <code>?tabId=...</code>。</p>
-  <p><a href="screenshot.html" target="_blank">Screenshot</a> · <a href="dom.html" target="_blank">DOM</a> · <a href="text.html" target="_blank">Text</a> · <a href="reload.html" target="_blank">Reload</a></p>
+  <p><a href="screenshot.html" target="_blank">Screenshot</a> · <a href="dom.html" target="_blank">DOM</a> · <a href="text.html" target="_blank">Text</a> · <a href="reload.html" target="_blank">Reload</a> · <button id="clean-action" type="button">Clean 输入框</button></p>
   <p><a href="https://chatgpt.com/" target="_blank" rel="noopener noreferrer">打开 ChatGPT 网页版</a></p>
   <p id="action-state" role="status">最近发送动作：读取中…</p>
   <script src="popup.js"></script>

package/extension/popup.js

@@ -56,6 +56,7 @@ async function showActionState() {
   const run = (await chrome.storage.local.get(key))[key];
   const allowed = ["phase", "action", "reason", "tabId", "page", "sourceTabId", "sourcePage",
     "userKey", "assistantKey", "newUserKey", "testSetup", "startedAt",
+    "sessionId", "projectId", "generation",
     "deadlineAt", "handoffPending", "handoffPendingAt", "attemptedNewTabId"];
   const summary = {version: chrome.runtime.getManifest().version};
   if (run) for (const key of allowed) if (run[key] !== undefined) summary[key] = run[key];
@@ -68,3 +69,13 @@ void showActionState().catch(() => {
   document.getElementById("action-state").textContent = "最近发送动作：状态无法确认，不要重复发送";
 });
 chrome.storage.onChanged.addListener(() => {void showActionState();});
+
+// User-clicked menu action only; bind to the single active ChatGPT tab.
+document.getElementById('clean-action').addEventListener('click',async()=>{
+  const selected=(await chrome.tabs.query({active:true,currentWindow:true}))[0];
+  if(!selected?.id||!selected?.url?.startsWith('https://chatgpt.com/')){
+    show('CLEAN_NOT_AVAILABLE','请先选中要清理的 ChatGPT 标签页。');return;
+  }
+  await chrome.tabs.create({url:chrome.runtime.getURL('clean.html?tabId='+selected.id),
+    windowId:selected.windowId,active:true});
+});

package/extension/start.html

@@ -0,0 +1,6 @@
+<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>Chat Loop · start</title>
+<style>body{font:15px system-ui,sans-serif;padding:24px;max-width:620px;color:#222}#status{font-weight:bold}#details{white-space:pre-wrap;overflow-wrap:anywhere}body[data-result="error"] #status{color:#b00020}</style>
+</head><body><h1>Chat Loop · start</h1><p id="status" role="status">STARTING</p>
+<p id="details">只有已确认意图且成功取得全局执行权才会发送首条消息。</p>
+<script src="actions/start.js"></script></body></html>

package/extension/status.html

@@ -0,0 +1,6 @@
+<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>Chat Loop · status</title>
+<style>body{font:15px system-ui,sans-serif;padding:24px;max-width:620px;color:#222}#status{font-weight:bold}#details{white-space:pre-wrap;overflow-wrap:anywhere}body[data-result="error"] #status{color:#b00020}</style>
+</head><body><h1>Chat Loop · status</h1><p id="status" role="status">STARTING</p>
+<p id="details">只读查询唯一网页执行会话，不执行网页副作用。</p>
+<script src="actions/status.js"></script></body></html>

package/lib/bridge.mjs

@@ -4,7 +4,7 @@ import {homedir, tmpdir} from 'node:os';
 import {join} from 'node:path';
 
 export const HOST_NAME = 'com.tomflow.chatloop.extension';
-export const ACTIONS = ['chat_text', 'chat_dom', 'chat_screenshot', 'reload'];
+export const ACTIONS = ['chat_text', 'chat_dom', 'chat_screenshot', 'reload', 'continue', 'handoff', 'clean', 'status', 'start'];
 const ID = /^[a-f0-9]{32}$/;
 const MAX_TEXT = 8 * 1024 * 1024;
 const MAX_PNG = 24 * 1024 * 1024;
@@ -23,13 +23,62 @@ export function requestDir(id) {
   if(typeof id!=='string'||!ID.test(id))throw Object.assign(Error('Invalid request ID'),{code:'INVALID_REQUEST_ID'});
   return join(tempRoot(),id);
 }
-export function prepare(action) {
+export function validateIntent(action, intent) {
+  if(action==='start'){
+    if(!intent||typeof intent!=='object'||Array.isArray(intent)
+      ||Object.keys(intent).some(k=>!['projectId','prompt','confirmed'].includes(k))
+      ||!(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/).test(intent.projectId||'')
+      ||intent.confirmed!==true||typeof intent.prompt!=='string'
+      ||!intent.prompt.trim()||intent.prompt.length>4000
+      ||/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(intent.prompt))
+      throw Object.assign(Error('Explicit confirmed task and project required'),{code:'INVALID_START_INTENT'});
+    return {projectId:intent.projectId,prompt:intent.prompt,confirmed:true};
+  }
+  if(action==='clean'){
+    if(!intent || typeof intent!=='object' || Array.isArray(intent)
+      || Object.keys(intent).length!==1 || !Number.isSafeInteger(intent.tabId)
+      || intent.tabId<1)
+      throw Object.assign(Error('Clean requires an exact tabId'),{code:'INVALID_CLEAN_TARGET'});
+    return {tabId:intent.tabId};
+  }
+  if(!['continue','handoff'].includes(action)) {
+    if(intent!==undefined)throw Object.assign(Error('Unexpected intent'),{code:'INVALID_INTENT'});
+    return null;
+  }
+  if(!intent||typeof intent!=='object'||Array.isArray(intent)
+    || typeof intent.turnToken!=='string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(intent.turnToken))
+    throw Object.assign(Error('Invalid model intent'),{code:'INVALID_INTENT'});
+  // Query is read-only and uses the same formal Action page; no seventh Action.
+  if(Object.hasOwn(intent,'intentId')||intent.lookup===true){
+    const latest=intent.lookup===true;
+    if(Object.keys(intent).some(k=>k!=='turnToken'&&k!==(latest?'lookup':'intentId'))
+      ||latest&&Object.hasOwn(intent,'intentId')
+      ||!latest&&(typeof intent.intentId!=='string'||!/^[a-f0-9]{32}$/.test(intent.intentId)))
+      throw Object.assign(Error('Invalid intent query'),{code:'INVALID_INTENT'});
+    return latest?{turnToken:intent.turnToken,lookup:true}
+      :{turnToken:intent.turnToken,intentId:intent.intentId};
+  }
+  if(Object.keys(intent).some(k=>k!=='turnToken'&&(action==='continue'?k!=='nextPrompt':k!=='reason')))
+    throw Object.assign(Error('Invalid model intent'),{code:'INVALID_INTENT'});
+  if(action==='continue' && (typeof intent.nextPrompt!=='string'
+    || !intent.nextPrompt.trim() || intent.nextPrompt.length>4000
+    || /[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(intent.nextPrompt)))
+    throw Object.assign(Error('Invalid continuation text'),{code:'INVALID_INTENT'});
+  if(action==='handoff' && intent.reason!==undefined
+    && (typeof intent.reason!=='string'||intent.reason.length>400
+      || /[\x00-\x1f]/.test(intent.reason)))
+    throw Object.assign(Error('Invalid handoff reason'),{code:'INVALID_INTENT'});
+  return action==='continue' ? {turnToken:intent.turnToken,nextPrompt:intent.nextPrompt}
+    : {turnToken:intent.turnToken,reason:intent.reason||''};
+}
+export function prepare(action,intent) {
   if(!ACTIONS.includes(action))throw Object.assign(Error('Unknown extension action'),{code:'UNKNOWN_ACTION'});
+  const validated=validateIntent(action,intent);
   privateDir(tempRoot());
   cleanup();
   const id=randomUUID().replaceAll('-',''), nonce=randomUUID().replaceAll('-',''), at=Date.now();
   const dir=privateDir(requestDir(id));
-  writeFileSync(join(dir,'request.json'), JSON.stringify({id,nonce,action,at,expiresAt:at+TTL_MS}),
+  writeFileSync(join(dir,'request.json'), JSON.stringify({id,nonce,action,at,expiresAt:at+TTL_MS,...(validated ? {intent:validated} : {})}),
     {flag:'wx',mode:0o600});
   return {id,nonce,action,dir};
 }
@@ -43,6 +92,7 @@ export function readRequest(id) {
   const r=JSON.parse(readFileSync(p,'utf8'));
   if(r.id!==id||!ACTIONS.includes(r.action)||Date.now()>r.expiresAt)
     throw Object.assign(Error('Request expired or changed'),{code:'REQUEST_EXPIRED'});
+  if(['continue','handoff','clean','start'].includes(r.action))validateIntent(r.action,r.intent);
   return r;
 }
 export function finish({id,nonce,action,status,payload='',code=null}) {
@@ -84,6 +134,15 @@ export function readResult(id) {
   privateDir(requestDir(id));
   return JSON.parse(readFileSync(p,'utf8'));
 }
+// Read-only cleanup proof. Only an aged, durably FAILED machine request
+// can qualify; never expose the nonce, original intent, or result contents.
+export function staleFailureConfirmed(id,action) {
+  if(!ACTIONS.includes(action))return false;
+  const result=readResult(id);
+  return !!(result && result.id===id && result.action===action
+    && result.status==='FAILED' && Number.isSafeInteger(result.at)
+    && result.at<=Date.now()-TTL_MS);
+}
 export function cleanup(){
   const root=tempRoot();
   if(!existsSync(root))return;