@workflow-code/cli 0.2.4-20261010003.codex-cli-web → 0.2.4-20261011001.codex-cli-web

package/dist/index.js

@@ -24,7 +24,7 @@ async function main(argv = process.argv.slice(2)) {
   const prepared = prepareCliInvocation(argv);
   argv = prepared.argv;
   if (argv[0] === "web") {
-    const webCli = await import("./web-7QLJGSAQ.js");
+    const webCli = await import("./web-TJ2SME4G.js");
     return webCli.main(argv.slice(1));
   }
   if (argv[0] === "workspace") {

package/dist/web/worker.mjs

@@ -1,11 +1,12 @@
 import { readFileSync } from 'node:fs';
-import { readFile, writeFile, readdir, rm, stat, mkdir, link } from 'node:fs/promises';
+import { readFile, writeFile, readdir, rm, stat, mkdir, link, mkdtemp } from 'node:fs/promises';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { register } from 'tsx/esm/api';
 import { resolve } from 'import-meta-resolve';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 let ts;
+let assistantScopeDirectory;
 
 
 const write = process.stdout.write.bind(process.stdout);
@@ -93,8 +94,21 @@ try {
     }
     send('result', { projects, errors });
   } else if (request.project?.folderPath) {
-    const projectKey = createHash('sha256').update(request.project.folderPath).digest('hex').slice(0, 24);
+    const projectKey = createHash('sha256').update(request.project.assistant ? `assistant:${request.project.assistant.workdir}` : request.project.folderPath).digest('hex').slice(0, 24);
     const dataDir = path.join(request.storageDir, projectKey);
+    if (request.project.assistant) {
+      const assistant = request.project.assistant;
+      const primary = assistant.roots.find(root => root.folderPath === assistant.workdir);
+      if (!primary) { throw new Error('Assistant working directory is not an opened workspace folder.'); }
+      await mkdir(dataDir, { recursive: true });
+      assistantScopeDirectory = await mkdtemp(path.join(dataDir, 'scope-'));
+      const manifestPath = path.join(assistantScopeDirectory, 'workspace.json');
+      await writeFile(manifestPath, JSON.stringify({ schemaVersion: 2, primaryTarget: { kind: 'folder', folderId: primary.uri }, warnings: [],
+        roots: assistant.roots.map(root => ({ target: { kind: 'folder', folderId: root.uri }, name: root.name, rootPath: root.folderPath, role: root === primary ? 'primary' : 'linked', depth: root === primary ? 0 : 1 })) }));
+      process.env.WORKFLOW_DEVELOPER_ASSISTANT_HOST = 'vscode';
+      process.env.WORKFLOW_DEVELOPER_ASSISTANT_WORKDIR = assistant.workdir;
+      process.env.WORKFLOW_DEVELOPER_ASSISTANT_WORKSPACE_MANIFEST = manifestPath;
+    }
     const storage = { host: 'local', local: { kvStoreDir: path.join(dataDir, 'kv'), persistentValueStoreDir: path.join(dataDir, 'values') } };
     const filesDir = path.join(dataDir, 'files');
     const createdFiles = [];
@@ -205,4 +219,6 @@ try {
 } catch (error) {
   write(`__WORKFLOW_WEB__${JSON.stringify({ kind: 'error', error: error.message, status: error.metadata?.status })}\n`);
   process.exitCode = 1;
+} finally {
+  if (assistantScopeDirectory) { await rm(assistantScopeDirectory, { recursive: true, force: true }); }
 }

package/dist/web/workflow-ui.js

@@ -4102,6 +4102,7 @@ ${state.user?.avatarUrl ?? ""}`;
     constructor(emit) {
       this.emit = emit;
       if (this.token) {
+        sessionStorage.setItem("workflow-web-session", this.token);
         history.replaceState(null, "", `${location.pathname}${location.search}`);
       }
       queueMicrotask(() => {
@@ -4139,7 +4140,7 @@ ${state.user?.avatarUrl ?? ""}`;
     status = "connecting";
     attempts = 0;
     closed = false;
-    token = new URLSearchParams(location.hash.slice(1)).get("session");
+    token = new URLSearchParams(location.hash.slice(1)).get("session") ?? sessionStorage.getItem("workflow-web-session");
     update(status) {
       this.status = status;
       this.emit({ type: "connection", status });
@@ -4182,13 +4183,15 @@ ${state.user?.avatarUrl ?? ""}`;
         try {
           if (this.token) {
             const session2 = await fetch("/api/session", { method: "POST", headers: { Authorization: `Bearer ${this.token}` }, signal: AbortSignal.timeout(1e4) });
-            if (!session2.ok) {
+            if (session2.status === 401) {
               this.update("expired");
               return;
             }
-            this.token = null;
+            if (!session2.ok) {
+              throw new Error("Cannot connect to the project.");
+            }
           }
-          const session = await fetch("/api/session", { signal: AbortSignal.timeout(1e4) });
+          const session = await fetch("/api/session", { headers: this.headers(), signal: AbortSignal.timeout(1e4) });
           if (session.status === 401) {
             this.update("expired");
             return;
@@ -4196,13 +4199,13 @@ ${state.user?.avatarUrl ?? ""}`;
           if (!session.ok) {
             throw new Error("Cannot connect to the project.");
           }
-          const source = this.source = new EventSource("/api/events");
+          const source = this.source = new EventSource(this.fileUrl("/api/events"));
           source.onopen = () => {
             this.attempts = 0;
             this.update("connected");
           };
           source.onmessage = (event) => {
-            this.emit(JSON.parse(event.data));
+            this.emit(this.publicFiles(JSON.parse(event.data)));
           };
           source.onerror = () => {
             if (this.source === source && !this.closed) {
@@ -4229,7 +4232,7 @@ ${state.user?.avatarUrl ?? ""}`;
       }
       let response;
       try {
-        response = await fetch("/api/message", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(message) });
+        response = await fetch("/api/message", { method: "POST", headers: { ...this.headers(), "Content-Type": "application/json" }, body: JSON.stringify(message) });
       } catch {
         this.interrupted();
         throw new ConnectionError("\u8FDE\u63A5\u5DF2\u4E2D\u65AD\u3002");
@@ -4249,7 +4252,25 @@ ${state.user?.avatarUrl ?? ""}`;
       if (!response.ok) {
         throw new Error(reply.message || "Request failed.");
       }
-      return reply.messages ?? [];
+      return (reply.messages ?? []).map((message2) => this.publicFiles(message2));
+    }
+    headers() {
+      return this.token ? { Authorization: `Bearer ${this.token}` } : {};
+    }
+    fileUrl(path) {
+      return this.token ? `${path}?session=${encodeURIComponent(this.token)}` : path;
+    }
+    publicFiles(value) {
+      if (Array.isArray(value)) {
+        return value.map((entry) => this.publicFiles(entry));
+      }
+      if (!value || typeof value !== "object") {
+        return value;
+      }
+      return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        key,
+        key === "previewUrl" && typeof entry === "string" && entry.startsWith("/api/file/") ? this.fileUrl(entry) : this.publicFiles(entry)
+      ]));
     }
   };
 
@@ -4280,6 +4301,17 @@ ${state.user?.avatarUrl ?? ""}`;
         handleReply(entry);
       }
     };
+    addEventListener("message", (event) => {
+      if (window.parent === window || event.source !== window.parent || event.data?.type !== "workflow-host") {
+        return;
+      }
+      if (event.data.theme === "dark" || event.data.theme === "light") {
+        document.documentElement.dataset.theme = event.data.theme;
+      }
+      if (event.data.command === "new" || event.data.command === "history") {
+        emit({ type: "assistant-command", command: event.data.command });
+      }
+    });
     const handleReply = (reply) => {
       if (reply.type === "download") {
         const url = URL.createObjectURL(new Blob([reply.content], { type: reply.mimeType ?? "application/json" }));
@@ -4364,7 +4396,7 @@ ${state.user?.avatarUrl ?? ""}`;
           return;
         }
         if (message.type === "open-file") {
-          window.open(`/api/file/${encodeURIComponent(message.id)}`, "_blank", "noopener");
+          window.open(connection.fileUrl(`/api/file/${encodeURIComponent(message.id)}`), "_blank", "noopener");
           return;
         }
         if (message.type === "login") {

package/dist/{web-7QLJGSAQ.js → web-TJ2SME4G.js}

@@ -17,7 +17,7 @@ import "./chunk-NSPRIPOP.js";
 
 // src/web.ts
 import { spawn as spawn3 } from "child_process";
-import path3 from "path";
+import path4 from "path";
 
 // src/web/server.ts
 import { createServer } from "http";
@@ -699,8 +699,29 @@ function createWebRuntime(projectDir, storageDir, connection) {
       return;
     }
     const auth = connection();
-    const env = { ...process.env, WORKFLOW_RUNTIME_PLATFORM: "cli", WORKFLOW_SERVER_URL: auth?.serverUrl ?? "", WORKFLOW_SERVER_ADMIN_KEY: auth?.accessToken ?? "" };
-    for (const key of ["TSX_TSCONFIG_PATH", "WORKFLOW_LOCAL_CORE_ROOT", "WORKFLOW_LOCAL_SHARED_ROOT", "WORKFLOW_LOCAL_SOURCE_MODE"]) {
+    if ((request.method === "run" || request.method === "resolve") && request.project?.requiresLogin && !auth) {
+      reject(new Error("Workflow Server login is not configured."));
+      return;
+    }
+    const env = {
+      ...process.env,
+      WORKFLOW_RUNTIME_PLATFORM: "cli",
+      WORKFLOW_SERVER_URL: auth?.serverUrl ?? "",
+      WORKFLOW_SERVER_ADMIN_KEY: auth?.accessToken ?? "",
+      WORKFLOW_SERVER_TOKEN: "",
+      WORKFLOW_LLM_SERVER_URL: auth?.serverUrl ?? "",
+      WORKFLOW_LLM_SERVER_TOKEN: auth?.accessToken ?? "",
+      WORKFLOW_CLI_AUTH_DIR: path.join(storageDir, "runtime-auth")
+    };
+    for (const key of [
+      "TSX_TSCONFIG_PATH",
+      "WORKFLOW_LOCAL_CORE_ROOT",
+      "WORKFLOW_LOCAL_SHARED_ROOT",
+      "WORKFLOW_LOCAL_SOURCE_MODE",
+      "WORKFLOW_DEVELOPER_ASSISTANT_HOST",
+      "WORKFLOW_DEVELOPER_ASSISTANT_WORKDIR",
+      "WORKFLOW_DEVELOPER_ASSISTANT_WORKSPACE_MANIFEST"
+    ]) {
       delete env[key];
     }
     if (env.NODE_OPTIONS) {
@@ -965,7 +986,7 @@ async function loginWebAccount(serverUrl, email, password) {
 // src/web/server.ts
 async function startWebServer(options) {
   const projectDir = await realpath(path2.resolve(options.projectDir));
-  const key = createHash("sha256").update(projectDir).digest("hex").slice(0, 24);
+  const key = createHash("sha256").update(options.host?.assistant ? `assistant:${options.host.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
   const storageDir = path2.resolve(options.dataDir ?? path2.join(os.homedir(), ".workflow-code", "web"));
   const historyPath = path2.join(storageDir, key, "conversations.json");
   const clients = /* @__PURE__ */ new Set();
@@ -975,6 +996,11 @@ async function startWebServer(options) {
   let authIdentity = "";
   let login;
   let passwordLogin = false;
+  let hostConnection = options.host?.connection;
+  let hostManaged = !!hostConnection;
+  let authEpoch = 0;
+  let authCheck;
+  const sensitiveTokens = /* @__PURE__ */ new Set();
   const runtime = options.runtime ?? createWebRuntime(projectDir, storageDir, () => connection);
   let inspected;
   try {
@@ -996,6 +1022,14 @@ async function startWebServer(options) {
     throw new Error("workflow-code web currently supports Conversation and Workflow projects.");
   }
   const project = { ...descriptor, uri: pathToFileURL(projectDir).href };
+  if (options.host?.assistant) {
+    project.assistant = options.host.assistant;
+    project.uri = `studio-assistant:${encodeURIComponent(project.assistant.workdir)}`;
+    project.requiresLogin = true;
+    project.fields = project.fields.map((field) => field.name === "permissionPolicy" ? { ...field, defaultValue: "workspace" } : field);
+    const supported = /* @__PURE__ */ new Set(["read", "write", "edit", "bash", "grep", "find", "ls", "skill", "workflow-memory_global_memory", "workflow-ui_present_card"]);
+    project.tools = project.tools?.filter((tool) => supported.has(tool.name));
+  }
   let saved = {};
   try {
     saved = JSON.parse(await readFile(historyPath, "utf8"));
@@ -1024,7 +1058,7 @@ async function startWebServer(options) {
     }
     return value;
   };
-  const state = () => publicValue(redactWorkflowData({ type: "state", project, sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {}, account, authenticationRevision: authRevision }, [connection?.accessToken ?? ""]));
+  const state = () => publicValue(redactWorkflowData({ type: "state", project, sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {}, account, authenticationRevision: authRevision }, [...sensitiveTokens]));
   const broadcast = () => {
     if (broadcastTimer) {
       return;
@@ -1055,37 +1089,63 @@ async function startWebServer(options) {
     }
   });
   const refreshAuth = async (force = false) => {
-    if (passwordLogin || login) {
+    if ((passwordLogin || login) && !force) {
       return;
     }
+    const readingEpoch = authEpoch;
     const config = await readCliAuthConfig();
-    const serverUrl = process.env.WORKFLOW_SERVER_URL ?? config.serverUrl;
-    const token = process.env.WORKFLOW_SERVER_ADMIN_KEY ?? config.apiKey;
+    if (readingEpoch !== authEpoch) {
+      return;
+    }
+    const serverUrl = hostManaged ? hostConnection?.serverUrl : process.env.WORKFLOW_SERVER_URL ?? config.serverUrl;
+    const token = hostManaged ? hostConnection?.accessToken : process.env.WORKFLOW_SERVER_ADMIN_KEY ?? config.apiKey;
+    if (token) {
+      sensitiveTokens.add(token);
+    }
     const identity = signedOut ? "" : `${serverUrl}
 ${token}`;
-    if (!force && identity === authIdentity && account.status !== "checking") {
+    const expired = account.expiresAt && Date.parse(account.expiresAt) <= Date.now();
+    if (!force && identity === authIdentity && account.status !== "error" && !expired) {
       return;
     }
+    const epoch = ++authEpoch;
+    authCheck?.abort();
+    const check = authCheck = new AbortController();
     const changed = identity !== authIdentity;
     authIdentity = identity;
-    connection = !signedOut && serverUrl && token ? { serverUrl: serverUrl.replace(/\/+$/, ""), accessToken: token } : void 0;
+    const candidate = !signedOut && serverUrl && token ? { serverUrl: serverUrl.replace(/\/+$/, ""), accessToken: token } : void 0;
     if (changed) {
+      connection = void 0;
       authRevision++;
       parameterStates.clear();
       for (const session of controller.sessions) {
         controller.stop(session);
       }
     }
-    account = { status: connection ? "checking" : "signed-out", serverUrl: serverUrl || "http://localhost:7126", user: connection ? config.user ?? account.user : void 0, revision: account.revision + 1 };
-    if (connection) {
+    account = { status: candidate ? "checking" : "signed-out", serverUrl: serverUrl || "http://localhost:7126", user: candidate ? changed ? hostManaged ? void 0 : config.user : account.user : void 0, revision: account.revision + 1 };
+    if (candidate) {
+      let unauthorized = false;
       try {
-        const response = await fetch(`${connection.serverUrl}/api/auth/me`, { headers: { Authorization: `Bearer ${connection.accessToken}` }, signal: AbortSignal.timeout(1e4), redirect: "error" });
+        const response = await fetch(`${candidate.serverUrl}/api/auth/me`, { headers: { Authorization: `Bearer ${candidate.accessToken}` }, signal: AbortSignal.any([check.signal, AbortSignal.timeout(1e4)]), redirect: "error" });
+        unauthorized = response.status === 401;
         const result = await response.json();
-        if (!response.ok || result.errCode !== 0 || !result.data?.profile) {
+        if (epoch !== authEpoch) {
+          return;
+        }
+        const profile = result.data?.profile;
+        if (!response.ok || result.errCode !== 0 || typeof profile?.userId !== "string" || !profile.userId || typeof profile.email !== "string" || typeof profile.displayName !== "string") {
           throw new Error("Workflow login is invalid or expired.");
         }
-        account = { ...account, status: "authenticated", user: result.data.profile, expiresAt: result.data.principal?.expiresAt ?? config.expiresAt };
+        if (!connection) {
+          authRevision++;
+          parameterStates.clear();
+        }
+        connection = candidate;
+        account = { ...account, status: "authenticated", user: profile, expiresAt: result.data.principal?.expiresAt ?? config.expiresAt };
       } catch (error) {
+        if (epoch !== authEpoch) {
+          return;
+        }
         connection = void 0;
         if (!changed) {
           authRevision++;
@@ -1094,8 +1154,10 @@ ${token}`;
             controller.stop(session);
           }
         }
-        account = { ...account, status: "error", error: String(error.message) };
+        account = { ...account, status: unauthorized ? "expired" : "error", error: String(error.message) };
       }
+    } else {
+      connection = void 0;
     }
     broadcast();
   };
@@ -1341,7 +1403,7 @@ ${token}`;
         break;
       }
       case "login": {
-        if (process.env.WORKFLOW_SERVER_ADMIN_KEY !== void 0) {
+        if (!options.host && process.env.WORKFLOW_SERVER_ADMIN_KEY !== void 0) {
           throw new Error("This session is supplied by the host. Sign in through the host.");
         }
         if (login || passwordLogin) {
@@ -1355,15 +1417,23 @@ ${token}`;
         account = { ...account, status: "checking" };
         broadcast();
         if (message.email !== void 0 || message.password !== void 0) {
+          const epoch = ++authEpoch;
           passwordLogin = true;
           try {
             if (typeof message.email !== "string" || typeof message.password !== "string") {
               throw new Error("Invalid login credentials.");
             }
             await loginWebAccount(url.toString().replace(/\/+$/, ""), message.email, message.password);
+            if (epoch !== authEpoch) {
+              break;
+            }
+            hostManaged = false;
+            hostConnection = void 0;
           } catch (error) {
-            account = { ...account, status: "error", error: String(error.message) };
-            broadcast();
+            if (epoch === authEpoch) {
+              account = { ...account, status: "error", error: String(error.message) };
+              broadcast();
+            }
             throw error;
           } finally {
             passwordLogin = false;
@@ -1391,7 +1461,7 @@ ${token}`;
       case "logout":
         signedOut = true;
         login?.kill();
-        if (process.env.WORKFLOW_SERVER_ADMIN_KEY === void 0) {
+        if (!hostManaged && process.env.WORKFLOW_SERVER_ADMIN_KEY === void 0) {
           await clearCliAuthConfig();
         }
         authIdentity = "signed-out";
@@ -1407,7 +1477,9 @@ ${token}`;
     void (async () => {
       response.setHeader("X-Content-Type-Options", "nosniff");
       response.setHeader("Referrer-Policy", "no-referrer");
-      if (request.headers.host !== new URL(origin).host || request.headers.origin && request.headers.origin !== origin || request.headers["sec-fetch-site"] === "cross-site") {
+      const host = new URL(`http://${request.headers.host ?? ""}`);
+      const forwarded = !!options.host && ["127.0.0.1", "localhost", "[::1]"].includes(host.hostname) && !host.username && !host.password && host.pathname === "/" && !host.search && !host.hash;
+      if (request.headers.host !== new URL(origin).host && !forwarded || request.headers.origin && request.headers.origin !== (forwarded ? host.origin : origin)) {
         json(response, 403, { message: "Invalid request origin." });
         return;
       }
@@ -1422,8 +1494,14 @@ ${token}`;
         return;
       }
       if (url.pathname.startsWith("/api/")) {
+        if (request.headers["sec-fetch-site"] === "cross-site") {
+          json(response, 403, { message: "Invalid request origin." });
+          return;
+        }
         const value = String(request.headers.cookie ?? "").split(";").map((value2) => value2.trim()).find((value2) => value2.startsWith(`${cookie}=`))?.slice(cookie.length + 1) ?? "";
-        if (!authMatches(value)) {
+        const bearer = String(request.headers.authorization ?? "").replace(/^Bearer /, "");
+        const readSession = request.method === "GET" && (url.pathname === "/api/events" || url.pathname.startsWith("/api/file/")) ? url.searchParams.get("session") ?? "" : "";
+        if (!authMatches(value) && !authMatches(bearer) && !authMatches(readSession)) {
           json(response, 401, { message: "Open the URL printed by workflow-code web." });
           return;
         }
@@ -1455,7 +1533,7 @@ ${token}`;
             mutations = task;
           }
           await task;
-          json(response, 200, { messages: redactWorkflowData(messages, [connection?.accessToken ?? ""]) });
+          json(response, 200, { messages: redactWorkflowData(messages, [...sensitiveTokens]) });
           return;
         }
         if (url.pathname.startsWith("/api/file/") && request.method === "GET") {
@@ -1479,8 +1557,9 @@ ${token}`;
         return;
       }
       if (url.pathname === "/") {
-        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors 'self' vscode-webview:; form-action 'self'" });
-        response.end(`<!doctype html><html lang="zh-CN" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/workflow-ui.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="editor"><div id="app"></div><script src="/assets/workflow-ui.js" defer></script></body></html>`);
+        const ancestors = options.host ? "'self' vscode-webview: vscode-file: https://*.vscode-cdn.net https://*.vscode-webview.net http://127.0.0.1:* http://localhost:*" : "'self' vscode-webview:";
+        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
+        response.end(`<!doctype html><html lang="zh-CN" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/workflow-ui.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="${options.host?.surface ?? "editor"}"><div id="app"></div><script src="/assets/workflow-ui.js" defer></script></body></html>`);
         return;
       }
       const assets = { "/assets/workflow-ui.js": "application/javascript", "/assets/workflow-ui.css": "text/css", "/assets/theme.css": "text/css", "/assets/codicons/codicon.css": "text/css", "/assets/codicons/codicon.ttf": "font/ttf" };
@@ -1493,7 +1572,7 @@ ${token}`;
       response.end(content);
     })().catch((error) => {
       if (!response.headersSent) {
-        json(response, 400, { message: String(redactWorkflowData(error.message, [connection?.accessToken ?? ""])) });
+        json(response, 400, { message: String(redactWorkflowData(error.message, [...sensitiveTokens])) });
       } else {
         response.end();
       }
@@ -1520,7 +1599,17 @@ ${token}`;
     url: `${origin}/#session=${capability}`,
     project,
     controller,
+    setHostConnection: async (value) => {
+      authEpoch++;
+      authCheck?.abort();
+      hostConnection = value;
+      hostManaged = true;
+      signedOut = !value;
+      await refreshAuth(true);
+    },
     close: () => closing ??= (async () => {
+      authEpoch++;
+      authCheck?.abort();
       clearInterval(authPoll);
       if (broadcastTimer) {
         clearTimeout(broadcastTimer);
@@ -1539,9 +1628,43 @@ ${token}`;
   };
 }
 
+// src/web.ts
+import { createInterface } from "readline";
+
+// src/web/host-config.ts
+import path3 from "path";
+function parseHostConnection(value) {
+  if (value === null || value === void 0) {
+    return;
+  }
+  const connection = value;
+  if (typeof connection.serverUrl !== "string" || typeof connection.accessToken !== "string" || !connection.accessToken || connection.accessToken.length > 16384) {
+    throw new Error("Invalid host login.");
+  }
+  const url = new URL(connection.serverUrl);
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error("Invalid host server URL.");
+  }
+  return { serverUrl: url.toString().replace(/\/+$/, ""), accessToken: connection.accessToken };
+}
+function parseHostConfiguration(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid web host configuration.");
+  }
+  const configuration = value;
+  if (configuration.type !== "configure" || !["editor", "assistant"].includes(configuration.surface)) {
+    throw new Error("Invalid web host configuration.");
+  }
+  const assistant = configuration.assistant;
+  if (assistant && (typeof assistant.workdir !== "string" || !path3.isAbsolute(assistant.workdir) || !Array.isArray(assistant.roots) || !assistant.roots.length || assistant.roots.length > 100 || assistant.roots.some((root) => typeof root.uri !== "string" || typeof root.name !== "string" || typeof root.folderPath !== "string" || !path3.isAbsolute(root.folderPath)) || !assistant.roots.some((root) => root.folderPath === assistant.workdir))) {
+    throw new Error("Invalid assistant workspace.");
+  }
+  return { surface: configuration.surface, assistant, connection: parseHostConnection(configuration.connection) };
+}
+
 // src/web.ts
 function parseWebArgs(argv) {
-  const options = { projectDir: process.cwd(), port: 0, theme: "auto", open: true, json: false, help: false };
+  const options = { projectDir: process.cwd(), port: 0, theme: "auto", dataDir: void 0, open: true, json: false, help: false, inspect: false, hostStdio: false };
   let projectSet = false;
   for (let index = 0; index < argv.length; index++) {
     const arg = argv[index];
@@ -1549,6 +1672,10 @@ function parseWebArgs(argv) {
       options.open = false;
     } else if (arg === "--json") {
       options.json = true;
+    } else if (arg === "--inspect") {
+      options.inspect = true;
+    } else if (arg === "--host-stdio") {
+      options.hostStdio = true;
     } else if (["--help", "-h"].includes(arg)) {
       options.help = true;
     } else if (["--port", "--data-dir", "--theme"].includes(arg)) {
@@ -1567,12 +1694,12 @@ function parseWebArgs(argv) {
         }
         options.theme = value;
       } else {
-        options.dataDir = path3.resolve(value);
+        options.dataDir = path4.resolve(value);
       }
     } else if (arg.startsWith("-") || projectSet) {
       throw new Error(`Unknown web argument: ${arg}`);
     } else {
-      options.projectDir = path3.resolve(arg);
+      options.projectDir = path4.resolve(arg);
       projectSet = true;
     }
   }
@@ -1584,10 +1711,39 @@ async function main(argv) {
     console.log(i18n.language.startsWith("zh") ? "workflow-code web [\u9879\u76EE\u76EE\u5F55]\n  --port <0-65535>   \u76D1\u542C\u7AEF\u53E3\uFF0C0 \u81EA\u52A8\u5206\u914D\n  --no-open          \u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\n  --theme <auto|light|dark>\n  --data-dir <\u76EE\u5F55>   \u5BF9\u8BDD\u548C\u6587\u4EF6\u5B58\u50A8\u4F4D\u7F6E\n  --json             \u8F93\u51FA\u7ED3\u6784\u5316\u542F\u52A8\u4FE1\u606F" : "workflow-code web [project-directory]\n  --port <0-65535>   Listen port; 0 selects an available port\n  --no-open          Do not open a browser\n  --theme <auto|light|dark>\n  --data-dir <path>   Conversation and file storage directory\n  --json             Print structured startup information");
     return 0;
   }
-  const app = await startWebServer(options);
+  if (options.inspect) {
+    const runtime = createWebRuntime(options.projectDir, options.dataDir ?? "", () => void 0);
+    try {
+      console.log(JSON.stringify(await runtime.inspect([options.projectDir])));
+    } finally {
+      runtime.dispose();
+    }
+    return 0;
+  }
+  const input = options.hostStdio ? createInterface({ input: process.stdin, crlfDelay: Infinity }) : void 0;
+  const lines = input?.[Symbol.asyncIterator]();
+  let host;
+  try {
+    if (lines) {
+      const initial = await lines.next();
+      if (initial.done || initial.value.length > 256e3) {
+        throw new Error("Web host configuration is missing or too large.");
+      }
+      host = parseHostConfiguration(JSON.parse(initial.value));
+    }
+  } catch (error) {
+    input?.close();
+    throw error;
+  }
+  const app = await startWebServer({ ...options, host }).catch((error) => {
+    input?.close();
+    throw error;
+  });
   const close = () => {
     process.off("SIGINT", close);
     process.off("SIGTERM", close);
+    input?.close();
+    process.stdin.pause();
     void app.close().catch((error) => {
       console.error(error);
       process.exitCode = 1;
@@ -1595,7 +1751,35 @@ async function main(argv) {
   };
   process.once("SIGINT", close);
   process.once("SIGTERM", close);
-  console.log(options.json ? JSON.stringify({ type: "ready", protocolVersion: 1, url: app.url, project: { id: app.project.id, name: app.project.name, projectType: app.project.projectType }, runtime: app.project.runtime }) : `Workflow Web: ${app.url}`);
+  console.log(options.json ? JSON.stringify({ type: "ready", protocolVersion: 1, hostProtocolVersion: 1, url: app.url, project: { id: app.project.id, name: app.project.name, projectType: app.project.projectType }, runtime: app.project.runtime }) : `Workflow Web: ${app.url}`);
+  if (lines) {
+    void (async () => {
+      try {
+        for await (const line of { [Symbol.asyncIterator]: () => lines }) {
+          if (line.length > 256e3) {
+            throw new Error("Web host message is too large.");
+          }
+          const message = JSON.parse(line);
+          if (message.type === "auth") {
+            void app.setHostConnection(parseHostConnection(message.connection)).catch(() => {
+              console.error("Workflow web host connection failed.");
+              process.exitCode = 1;
+              close();
+            });
+          } else if (message.type === "close") {
+            break;
+          } else {
+            throw new Error("Unknown web host message.");
+          }
+        }
+      } catch {
+        console.error("Workflow web host connection failed.");
+        process.exitCode = 1;
+      } finally {
+        close();
+      }
+    })();
+  }
   if (options.open) {
     const invocation = process.platform === "darwin" ? { command: "open", args: [app.url] } : process.platform === "win32" ? { command: "rundll32.exe", args: ["url.dll,FileProtocolHandler", app.url] } : { command: "xdg-open", args: [app.url] };
     const browser = spawn3(invocation.command, invocation.args, { detached: true, shell: false, stdio: "ignore" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workflow-code/cli",
-  "version": "0.2.4-20261010003.codex-cli-web",
+  "version": "0.2.4-20261011001.codex-cli-web",
   "type": "module",
   "bin": {
     "workflow-code": "./dist/index.js"
@@ -39,12 +39,12 @@
     "@workflow-code/execution-targets": "0.1.0",
     "@workflow-code/i18n": "0.1.0",
     "@workflow-code/openai-responses": "0.1.0",
-    "@workflow-code/project-dependencies": "0.1.0",
     "@workflow-code/project-info": "0.1.0",
+    "@workflow-code/project-dependencies": "0.1.0",
     "@workflow-code/project-upload": "0.1.0",
-    "@workflow-code/runtime-compatibility": "0.1.0",
     "@workflow-code/workflow-ids": "0.1.0",
-    "@workflow-code/workflow-mcp": "0.1.0"
+    "@workflow-code/workflow-mcp": "0.1.0",
+    "@workflow-code/runtime-compatibility": "0.1.0"
   },
   "scripts": {
     "bootstrap": "node scripts/bootstrap.mjs",