@tyvm/knowhow 0.0.146 → 0.0.148

package/src/agents/tools/startAgentTask.ts

@@ -8,6 +8,8 @@ export interface StartAgentTaskParams {
   syncFs?: boolean;
   taskId?: string;
   resume?: boolean;
+  forkTaskId?: string;
+  rollback?: number;
   prompt: string;
   /**
    * Push this agent's work to a remote Knowhow task identified by taskId.
@@ -32,6 +34,20 @@ export interface StartAgentTaskParams {
   _ctx?: { caller?: any; taskId?: string; [key: string]: any };
 }
 
+export interface StartAgentTaskResult {
+  success: boolean;
+  status: "started" | "completed" | "failed";
+  taskId: string;
+  pid?: number;
+  syncFs: boolean;
+  syncReady: boolean;
+  agentDir?: string;
+  logPath: string;
+  parentTaskId?: string;
+  exitCode?: number | null;
+  error?: string;
+}
+
 const PROCESSES_DIR = path.join(process.cwd(), ".knowhow", "processes");
 const AGENTS_DIR = path.join(process.cwd(), ".knowhow", "processes", "agents");
 
@@ -98,12 +114,14 @@ function subagentCapabilitiesNote(): string {
  *   .knowhow/processes/agents/{taskId}/input.txt
  * The agent will pick up the new content and process it as a new message.
  */
-export async function startAgentTask(params: StartAgentTaskParams): Promise<string> {
+export async function startAgentTask(params: StartAgentTaskParams): Promise<StartAgentTaskResult> {
   const {
     messageId,
     prompt,
     taskId: providedTaskId,
     resume,
+    forkTaskId,
+    rollback = 0,
     syncFs,
     syncRemote,
     provider,
@@ -118,6 +136,18 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
   if (!prompt) {
     throw new Error("prompt is required to create a chat task");
   }
+  if (resume && forkTaskId) {
+    throw new Error("resume and forkTaskId are mutually exclusive");
+  }
+  if (resume && !providedTaskId) {
+    throw new Error("taskId is required when resuming");
+  }
+  if (!Number.isInteger(rollback) || rollback < 0) {
+    throw new Error("rollback must be a non-negative integer");
+  }
+  if (rollback > 0 && !resume && !forkTaskId) {
+    throw new Error("rollback requires resume or forkTaskId");
+  }
 
   // Default filesystem synchronization ON unless the caller explicitly opts out
   // (syncFs: false) or is using a messageId-based web sync. This ensures spawned
@@ -134,7 +164,14 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
     explicitParentTaskId ?? _ctx?.taskId ?? (_ctx?.caller as any)?.currentTaskId;
 
   // Build args array (no shell escaping needed - args are passed directly)
-  const args: string[] = ["agent"];
+  const isHistoryRun = !!resume || !!forkTaskId;
+  const args: string[] = resume
+    ? ["agents", "resume", providedTaskId!]
+    : forkTaskId
+      ? ["agents", "fork", forkTaskId]
+      : ["agent"];
+
+  if (forkTaskId) args.push("--task-id", taskId);
 
   if (messageId) {
     args.push("--message-id", messageId);
@@ -144,11 +181,11 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
   // When syncRemote is requested, pass it through so the spawned agent pushes
   // its work to the remote task identified by --task-id rather than staying
   // local-only.
-  if (syncRemote) {
+  if (syncRemote && !isHistoryRun) {
     args.push("--sync-remote");
   }
 
-  if (useSyncFs || providedTaskId) {
+  if (!isHistoryRun && (useSyncFs || providedTaskId)) {
     // Pass --task-id whenever we have a known taskId (syncFs or explicit taskId)
     args.push("--task-id", taskId);
   }
@@ -165,20 +202,19 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
     args.push("--agent-name", agentName);
   }
 
-  if (maxTimeLimit !== undefined) {
+  if (maxTimeLimit !== undefined && !isHistoryRun) {
     args.push("--max-time-limit", String(maxTimeLimit));
   }
 
-  if (maxSpendLimit !== undefined) {
+  if (maxSpendLimit !== undefined && !isHistoryRun) {
     args.push("--max-spend-limit", String(maxSpendLimit));
   }
-  if (parentTaskId) {
+  if (parentTaskId && !isHistoryRun) {
     // Tell the child who spawned it so it can report back to the parent.
     args.push("--parent-task-id", parentTaskId);
   }
-  if (resume) {
-    // --resume is a boolean flag; task ID is already passed via --task-id above
-    args.push("--resume");
+  if (rollback > 0) {
+    args.push("--rollback", String(rollback));
   }
 
   const timeoutMs = maxTimeLimit ? maxTimeLimit * 60 * 1000 : 60 * 60 * 1000;
@@ -213,43 +249,54 @@ export async function startAgentTask(params: StartAgentTaskParams): Promise<stri
   child.stdin!.write(promptWithCaps, "utf8");
   child.stdin!.end();
 
-  return new Promise<string>((resolve) => {
+  return new Promise<StartAgentTaskResult>((resolve) => {
     let settled = false;
-    const done = (msg: string) => {
+    let exited = false;
+    const done = (result: StartAgentTaskResult) => {
       if (settled) return;
       settled = true;
       try { fs.closeSync(fd); } catch {}
-      resolve(msg);
+      resolve(result);
     };
 
     child.once("error", (e) => {
-      done(`Failed to start agent: ${String(e)}\nLogs: ${logPath}`);
+      done({
+        success: false, status: "failed", taskId, pid, syncFs: useSyncFs,
+        syncReady: false, agentDir: useSyncFs ? agentTaskDir : undefined,
+        logPath, parentTaskId, error: String(e),
+      });
     });
 
-    const syncFsNote = useSyncFs
-      ? `\nTask ID: ${taskId}\nAgent dir: ${agentTaskDir}\n` +
-        `To send agent messages, write to: ${agentTaskDir}/input.txt\n` +
-        `To check status, read: ${agentTaskDir}/status.txt\n`
-      : "";
-
     child.once("exit", (code) => {
-      done(
-        `Agent finished with exit code ${code}.\nLogs: ${logPath}\n` +
-        syncFsNote
-      );
+      exited = true;
+      done({
+        success: code === 0, status: code === 0 ? "completed" : "failed",
+        taskId, pid, syncFs: useSyncFs,
+        syncReady: useSyncFs && fs.existsSync(path.join(agentTaskDir, "metadata.json")),
+        agentDir: useSyncFs ? agentTaskDir : undefined, logPath, parentTaskId,
+        exitCode: code, ...(code === 0 ? {} : { error: `Agent exited with code ${code}` }),
+      });
     });
 
     if (!waitForCompletion) {
-      // Give the agent 5 seconds to finish before detaching (fire-and-forget mode)
-      const detachTime = 5 * 1000;
-      setTimeout(() => {
-        try { child.unref(); } catch {}
-        done(
-          `Agent started (pid=${pid}), running in background.\n` +
-          `Logs: ${logPath}\n` +
-          syncFsNote
-        );
-      }, detachTime);
+      // A spawn is not the same as an initialized fs-sync agent. Poll briefly
+      // so callers can distinguish those states without parsing log prose.
+      const deadline = Date.now() + (useSyncFs ? 5000 : 100);
+      const acknowledge = () => {
+        if (settled || exited) return;
+        const syncReady = useSyncFs && fs.existsSync(path.join(agentTaskDir, "metadata.json"));
+        if (!useSyncFs || syncReady || Date.now() >= deadline) {
+          try { child.unref(); } catch {}
+          done({
+            success: true, status: "started", taskId, pid, syncFs: useSyncFs,
+            syncReady, agentDir: useSyncFs ? agentTaskDir : undefined,
+            logPath, parentTaskId,
+          });
+          return;
+        }
+        setTimeout(acknowledge, 100);
+      };
+      setTimeout(acknowledge, 50);
     }
   });
 }
@@ -320,6 +367,16 @@ export const startAgentTaskDefinition: Tool = {
           description:
             "Resume a previously started task from where it left off. Must be used together with taskId which identifies the task to resume.",
         },
+        forkTaskId: {
+          type: "string",
+          description:
+            "Fork this existing task into a new task. The source remains unchanged; taskId optionally selects the new task ID.",
+        },
+        rollback: {
+          type: "number",
+          description:
+            "Discard this many newest agent interactions before resuming or forking. Must be a non-negative integer.",
+        },
         parentTaskId: {
           type: "string",
           description:

package/src/ai.ts

@@ -65,13 +65,16 @@ export async function singlePrompt(
     // This ensures generate agent runs produce readable output and are observable
     // via `knowhow agents list/tail/status`, matching `knowhow agent --input` behaviour.
     const { startAgentTask } = await import("./agents/tools/startAgentTask");
-    return startAgentTask({
+    const result = await startAgentTask({
       agentName: agent,
       prompt: userPrompt,
       model: model || undefined,
       waitForCompletion: true,
       ...(agentOptions ?? {}),
     });
+    // singlePrompt is a text API; keep generation pipelines compatible while
+    // the tool itself exposes a structured orchestration result.
+    return JSON.stringify(result);
   }
 
   if (!model) {

package/src/auth/browserLogin.ts

@@ -1,6 +1,7 @@
 import http from "../utils/http";
 import { exec } from "child_process";
 import { promisify } from "util";
+import crypto from "crypto";
 import * as os from "os";
 import * as fs from "fs";
 import * as path from "path";
@@ -28,6 +29,8 @@ interface RetrieveTokenResponse {
 
 export class BrowserLoginService {
   private baseUrl: string;
+  /** PKCE verifier — generated once per login attempt, never sent in a URL */
+  private verifier: string = crypto.randomBytes(32).toString("hex");
 
   constructor(baseUrl: string = KNOWHOW_API_URL, private orgId?: string) {
     if (!baseUrl) {
@@ -100,9 +103,10 @@ export class BrowserLoginService {
             spinner.stop();
             spinner.start("Authentication successful! Retrieving token");
 
-            // Step 4: Retrieve JWT token
+            // Step 4: Redeem session using PKCE verifier (never sent in URL)
             const tokenResponse = await http.post(
-              `${this.baseUrl}/api/cli-login/session/${sessionData.sessionId}/token`
+              `${this.baseUrl}/api/cli-login/session/${sessionData.sessionId}/redeem`,
+              { verifier: this.verifier }
             );
 
             const tokenData = tokenResponse.data as RetrieveTokenResponse;
@@ -170,9 +174,11 @@ export class BrowserLoginService {
    */
   private async createSession(): Promise<CreateSessionResponse> {
     try {
+      // Compute the PKCE challenge (sha256 of verifier) to store server-side
+      const challenge = crypto.createHash("sha256").update(this.verifier, "utf8").digest("hex");
       const response = await http.post<CreateSessionResponse>(
         `${this.baseUrl}/api/cli-login/session`,
-        {},
+        { challenge },
         { headers: { "User-Agent": getCliUserAgent() } }
       );
       return response.data;

package/src/auth/keyAuth.ts

@@ -0,0 +1,115 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import http from "../utils/http";
+import { getCliUserAgent } from "./browserLogin";
+import { keyPairExists, loadKeyPair, signMessage } from "./keyManager";
+
+const JWT_FILE_PATH = path.join(process.cwd(), ".knowhow", ".jwt");
+const DEFAULT_API_URL = process.env.KNOWHOW_API_URL || "https://api.knowhow.tyvm.ai";
+
+/**
+ * This is intentionally based only on the selected identity. Registration is
+ * server-side and scoped to its environment/user/org; a local `.registered`
+ * marker cannot safely represent that state. An unknown or revoked key is
+ * cheaply rejected by the selected API and login then falls back to PKCE.
+ */
+export function hasKeyPair(privateKeyPath?: string): boolean {
+  return keyPairExists(privateKeyPath);
+}
+
+/** Exchange a registered Ed25519 identity for a new short-lived JWT. */
+export async function exchangePublicKeyJwt(
+  orgId: string,
+  apiUrl: string = DEFAULT_API_URL,
+  privateKeyPath?: string
+): Promise<string> {
+  if (!keyPairExists(privateKeyPath)) {
+    throw new Error("CLI identity is unavailable");
+  }
+
+  const keyPair = loadKeyPair(privateKeyPath);
+  const headers = { "User-Agent": getCliUserAgent() };
+  const challengeResponse = await http.post<{
+    challengeId: string;
+    message: string;
+    expiresAt: string;
+  }>(
+    `${apiUrl}/api/public-keys/challenge`,
+    { publicKey: keyPair.publicKeyBase64, orgId },
+    { headers }
+  );
+  const { challengeId, message } = challengeResponse.data;
+  if (
+    typeof challengeId !== "string" ||
+    challengeId.length === 0 ||
+    challengeId.length > 128 ||
+    !/^[A-Za-z0-9_-]+$/.test(challengeId) ||
+    typeof message !== "string" ||
+    message.length === 0
+  ) {
+    throw new Error("Public-key challenge response is invalid");
+  }
+
+  const response = await http.post<{ jwt: string }>(
+    `${apiUrl}/api/public-keys/authenticate`,
+    { challengeId, signature: signMessage(message, privateKeyPath) },
+    { headers }
+  );
+  if (!response.data.jwt) {
+    throw new Error("Public-key authentication returned no JWT");
+  }
+  return response.data.jwt;
+}
+
+export async function authenticateWithKey(
+  orgId: string,
+  apiUrl: string = DEFAULT_API_URL,
+  privateKeyPath?: string
+): Promise<boolean> {
+  if (!keyPairExists(privateKeyPath)) return false;
+
+  try {
+    storeJwt(await exchangePublicKeyJwt(orgId, apiUrl, privateKeyPath));
+    return true;
+  } catch (error: unknown) {
+    // The identity is not registered for this environment/org (or was revoked).
+    if (http.isHttpError(error) && (error.status === 401 || error.status === 404)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/** Register an Ed25519 CLI-auth key using the JWT obtained by browser PKCE. */
+export async function registerPublicKey(
+  jwt: string,
+  publicKeyBase64: string,
+  apiUrl: string = DEFAULT_API_URL
+): Promise<void> {
+  const rawPublicKey = Buffer.from(publicKeyBase64, "base64");
+  if (rawPublicKey.length !== 32 || rawPublicKey.toString("base64") !== publicKeyBase64) {
+    throw new Error("CLI authentication requires a 32-byte Ed25519 public key");
+  }
+
+  await http.post(
+    `${apiUrl}/api/public-keys/register`,
+    {
+      publicKey: publicKeyBase64,
+      label: os.hostname(),
+    },
+    {
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "User-Agent": getCliUserAgent(),
+      },
+    }
+  );
+}
+
+export function storeJwt(jwt: string): void {
+  const directory = path.dirname(JWT_FILE_PATH);
+  fs.mkdirSync(directory, { recursive: true });
+  fs.writeFileSync(JWT_FILE_PATH, jwt, { mode: 0o600 });
+  fs.chmodSync(JWT_FILE_PATH, 0o600);
+}

package/src/auth/keyManager.ts

@@ -0,0 +1,166 @@
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+const ED25519_KEY_TYPE = "ssh-ed25519";
+const ED25519_RAW_KEY_LENGTH = 32;
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+export interface KeyPair {
+  privateKeyPath: string;
+  publicKeyPath: string;
+  /** Raw 32-byte Ed25519 key, base64 encoded for the authentication API. */
+  publicKeyBase64: string;
+  /** OpenSSH SHA-256 fingerprint (hashes the SSH wire-format public key). */
+  fingerprint: string;
+}
+
+export function getKeyDir(): string {
+  return path.join(os.homedir(), ".knowhow", "keys");
+}
+
+export function getDefaultPrivateKeyPath(): string {
+  return path.join(getKeyDir(), "id_ed25519");
+}
+
+export function getDefaultPublicKeyPath(): string {
+  return `${getDefaultPrivateKeyPath()}.pub`;
+}
+
+export function keyPairExists(privateKeyPath?: string): boolean {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  return fs.existsSync(privatePath) && fs.existsSync(`${privatePath}.pub`);
+}
+
+/** Generate a CLI-only Ed25519 key and an OpenSSH-compatible public-key file. */
+export function generateKeyPair(privateKeyPath?: string): KeyPair {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  const publicPath = `${privatePath}.pub`;
+
+  fs.mkdirSync(path.dirname(privatePath), { recursive: true, mode: 0o700 });
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "der" },
+  });
+  const rawPublicKey = extractRawPublicKey(publicKey);
+
+  // Refuse to overwrite either half of an identity. Partial identities should be
+  // repaired explicitly rather than silently replacing a user's key.
+  if (fs.existsSync(privatePath) || fs.existsSync(publicPath)) {
+    throw new Error(`Cannot generate identity: a key file already exists at ${privatePath} or ${publicPath}`);
+  }
+
+  fs.writeFileSync(privatePath, privateKey, { mode: 0o600, flag: "wx" });
+  try {
+    fs.writeFileSync(publicPath, formatOpenSshPublicKey(rawPublicKey), {
+      mode: 0o644,
+      flag: "wx",
+    });
+  } catch (error) {
+    fs.rmSync(privatePath, { force: true });
+    throw error;
+  }
+
+  return keyPairMetadata(privatePath, rawPublicKey);
+}
+
+/** Load and validate an Ed25519 identity. Legacy raw-base64 .pub files remain supported. */
+export function loadKeyPair(privateKeyPath?: string): KeyPair {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  const publicPath = `${privatePath}.pub`;
+  if (!fs.existsSync(privatePath)) throw new Error(`Private key not found at: ${privatePath}`);
+  if (!fs.existsSync(publicPath)) throw new Error(`Public key not found at: ${publicPath}`);
+
+  const privateKey = readEd25519PrivateKey(privatePath);
+  const publicKey = parsePublicKey(fs.readFileSync(publicPath, "utf8"));
+  const derivedPublicKey = extractRawPublicKey(
+    crypto.createPublicKey(privateKey).export({ type: "spki", format: "der" })
+  );
+  if (!crypto.timingSafeEqual(publicKey, derivedPublicKey)) {
+    throw new Error(`Public key does not match private key: ${publicPath}`);
+  }
+
+  return keyPairMetadata(privatePath, publicKey);
+}
+
+export function getOrCreatePublicKey(privateKeyPath?: string): KeyPair {
+  return keyPairExists(privateKeyPath)
+    ? loadKeyPair(privateKeyPath)
+    : generateKeyPair(privateKeyPath);
+}
+
+export function signMessage(message: string, privateKeyPath?: string): string {
+  const privatePath = privateKeyPath ?? getDefaultPrivateKeyPath();
+  if (!fs.existsSync(privatePath)) throw new Error(`Private key not found at: ${privatePath}`);
+  return crypto.sign(null, Buffer.from(message, "utf8"), readEd25519PrivateKey(privatePath)).toString("base64");
+}
+
+function readEd25519PrivateKey(privatePath: string): crypto.KeyObject {
+  let key: crypto.KeyObject;
+  try {
+    key = crypto.createPrivateKey(fs.readFileSync(privatePath));
+  } catch {
+    throw new Error(`Identity at ${privatePath} is not a supported PEM Ed25519 private key`);
+  }
+  if (key.asymmetricKeyType !== "ed25519") {
+    throw new Error(`Identity at ${privatePath} must be an Ed25519 private key`);
+  }
+  return key;
+}
+
+function extractRawPublicKey(spkiDer: Buffer): Buffer {
+  if (
+    spkiDer.length !== ED25519_SPKI_PREFIX.length + ED25519_RAW_KEY_LENGTH ||
+    !spkiDer.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)
+  ) {
+    throw new Error("Invalid Ed25519 public key");
+  }
+  return spkiDer.subarray(ED25519_SPKI_PREFIX.length);
+}
+
+function sshPublicKeyBlob(rawPublicKey: Buffer): Buffer {
+  const type = Buffer.from(ED25519_KEY_TYPE, "ascii");
+  const typeLength = Buffer.alloc(4);
+  const keyLength = Buffer.alloc(4);
+  typeLength.writeUInt32BE(type.length);
+  keyLength.writeUInt32BE(rawPublicKey.length);
+  return Buffer.concat([typeLength, type, keyLength, rawPublicKey]);
+}
+
+function formatOpenSshPublicKey(rawPublicKey: Buffer): string {
+  return `${ED25519_KEY_TYPE} ${sshPublicKeyBlob(rawPublicKey).toString("base64")} knowhow-cli\n`;
+}
+
+function parsePublicKey(value: string): Buffer {
+  const trimmed = value.trim();
+  if (trimmed.startsWith(`${ED25519_KEY_TYPE} `)) {
+    const parts = trimmed.split(/\s+/);
+    const blob = Buffer.from(parts[1] ?? "", "base64");
+    const expected = sshPublicKeyBlob(blob.subarray(blob.length - ED25519_RAW_KEY_LENGTH));
+    if (blob.length !== expected.length || !blob.equals(expected)) {
+      throw new Error("Invalid OpenSSH Ed25519 public key");
+    }
+    return blob.subarray(blob.length - ED25519_RAW_KEY_LENGTH);
+  }
+
+  // Compatibility with key files written by early CLI builds.
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(trimmed)) {
+    throw new Error("Public key must be an OpenSSH Ed25519 key");
+  }
+  const raw = Buffer.from(trimmed, "base64");
+  if (raw.length !== ED25519_RAW_KEY_LENGTH || raw.toString("base64") !== trimmed) {
+    throw new Error("Ed25519 public key must contain exactly 32 bytes");
+  }
+  return raw;
+}
+
+function keyPairMetadata(privatePath: string, rawPublicKey: Buffer): KeyPair {
+  const hash = crypto.createHash("sha256").update(sshPublicKeyBlob(rawPublicKey)).digest("base64").replace(/=+$/, "");
+  return {
+    privateKeyPath: privatePath,
+    publicKeyPath: `${privatePath}.pub`,
+    publicKeyBase64: rawPublicKey.toString("base64"),
+    fingerprint: `SHA256:${hash}`,
+  };
+}

package/src/chat/CliChatService.ts

@@ -20,6 +20,12 @@ import fs from "fs";
 import path from "path";
 import { services } from "../services";
 import { logger } from "../logger";
+import { ModuleExtension } from "../services/ExtensionsService";
+
+export interface ChatExtension extends ModuleExtension {
+  type: "chat";
+  commands: ChatCommand[];
+}
 
 export class CliChatService implements ChatService {
   private context: ChatContext;
@@ -59,6 +65,7 @@ export class CliChatService implements ChatService {
         }
       },
     });
+    this.refreshExtensions();
     this.loadInputHistory();
 
     // Set up callback to add entries to inputHistory immediately when user presses Enter
@@ -151,7 +158,12 @@ export class CliChatService implements ChatService {
   }
 
   registerCommand(command: ChatCommand): void {
-    this.commands.push(command);
+    const existing = this.commands.findIndex((item) => item.name === command.name);
+    if (existing >= 0) {
+      this.commands[existing] = command;
+    } else {
+      this.commands.push(command);
+    }
   }
 
   registerMode(mode: ChatMode): void {
@@ -163,9 +175,17 @@ export class CliChatService implements ChatService {
   }
 
   getCommands(): ChatCommand[] {
+    this.refreshExtensions();
     return this.commands;
   }
 
+  /** Re-read the registry so services created before module setup still work. */
+  refreshExtensions(): void {
+    for (const extension of services().Extensions.list<ChatExtension>("chat")) {
+      for (const command of extension.commands ?? []) this.registerCommand(command);
+    }
+  }
+
   /**
    * Get commands available in the current mode
    */
@@ -176,6 +196,7 @@ export class CliChatService implements ChatService {
   }
 
   getCommandsForActiveModes(): ChatCommand[] {
+    this.refreshExtensions();
     const activeModes = this.modes
       .filter((mode) => mode.active)
       .map((mode) => mode.name);
@@ -216,7 +237,7 @@ export class CliChatService implements ChatService {
       const command = availableCommands.find((cmd) => cmd.name === commandName);
 
       if (command) {
-        const result = await command.handler(args);
+        const result = await command.handler(args, this);
 
         // If handler returns a CommandResult and it's not handled, pass to modules
         if (result && typeof result === "object" && "handled" in result) {