@yeaft/webchat-agent 1.0.568 → 1.0.570

package/yeaft/tool-folding/index.js

@@ -5,7 +5,7 @@
  *   - Constants TOOL_LOOP_REFLECTION_INTERVAL, TURN_SUMMARY_THRESHOLD,
  *     DUP_TOOL_THRESHOLD
  *   - Reflector helpers (T1 sync, T2 async, fallback stub)
- *   - Helpers for collapsing message ranges into a single assistant
+ *   - Helpers for collapsing message ranges into a single synthetic user
  *     reflection message
  *   - Duplicate-reminder text formatter
  *
@@ -42,13 +42,13 @@ export { buildFallbackStub } from './fallback-stub.js';
 
 /**
  * Collapse messages[startIdx..endIdx] (inclusive) into a single
- * `{ role: 'user', content }` reflection message. Returns a NEW array; does
- * not mutate the input.
+ * `{ role: 'user', content }` reflection message. Returns an explicit
+ * replacement record; does not mutate the input.
  *
  * The original assistant+tool sequence (the action arc) is replaced by ONE
  * synthetic user message carrying the reflection summary. User messages
- * that happened to appear inside the range stay put (defensive — the caller
- * normally passes a range that contains only assistant+tool).
+ * inside the range are preserved before the summary, including appended
+ * prompts, async completion notifications and duplicate-call reminders.
  *
  * Why role='user' (not 'assistant'):
  *   The Anthropic Messages API requires the messages array to end with a
@@ -68,11 +68,13 @@ export { buildFallbackStub } from './fallback-stub.js';
  * @param {number} startIdx
  * @param {number} endIdx
  * @param {string} reflectionContent
- * @returns {Array}
+ * @returns {{messages: Array, reflection: object|null, foldedMessages: Array}}
  */
 export function collapseRangeToReflection(messages, startIdx, endIdx, reflectionContent) {
-  if (!Array.isArray(messages)) return messages;
-  if (startIdx < 0 || endIdx < startIdx || endIdx >= messages.length) return messages;
+  if (!Array.isArray(messages) || !Number.isInteger(startIdx) || !Number.isInteger(endIdx)
+      || startIdx < 0 || endIdx < startIdx || endIdx >= messages.length) {
+    return { messages, reflection: null, foldedMessages: [] };
+  }
   const before = messages.slice(0, startIdx);
   const collapsed = messages.slice(startIdx, endIdx + 1);
   const after = messages.slice(endIdx + 1);
@@ -101,7 +103,13 @@ export function collapseRangeToReflection(messages, startIdx, endIdx, reflection
     content: wrappedContent,
     _reflection: true,
   };
-  return [...before, ...preservedUsers, reflectionMsg, ...after];
+  return {
+    messages: [...before, ...preservedUsers, reflectionMsg, ...after],
+    reflection: reflectionMsg,
+    // Only replaced rows may be tombstoned. Preserved users include real
+    // appended prompts and internal completion/reminder messages.
+    foldedMessages: collapsed.filter(m => m && m.role !== 'user'),
+  };
 }
 
 /**

package/yeaft/tool-folding/t1-reflector.js

@@ -16,6 +16,7 @@
  */
 
 import { buildReflectionPrompt } from './reflection-prompt.js';
+import { normalizeTokenUsage } from '../llm/usage-accounting.js';
 
 /**
  * @param {{
@@ -26,22 +27,42 @@ import { buildReflectionPrompt } from './reflection-prompt.js';
  *   assistantText?: string,
  *   language?: string,
  *   signal?: AbortSignal,
+ *   onComplete?: (diagnostic: object) => void,
  * }} p
- * @returns {Promise<{ content: string, durationMs: number }>}
+ * @returns {Promise<{ content: string, durationMs: number, usage: object }>}
  */
-export async function runT1Reflection({ adapter, model, originalUserMsg, toolPairs, assistantText, language, signal }) {
+export async function runT1Reflection({ adapter, model, originalUserMsg, toolPairs, assistantText, language, signal, onComplete }) {
   const t0 = Date.now();
   const prompt = buildReflectionPrompt({ originalUserMsg, toolPairs, assistantText, language });
-  const result = await adapter.call({
-    model,
-    system: prompt,
-    messages: [{ role: 'user', content: 'Produce the reflection now.' }],
-    maxTokens: 2048,
-    signal,
-  });
-  const content = (result && typeof result.text === 'string') ? result.text.trim() : '';
-  if (!content) {
-    throw new Error('T1 reflection returned empty content');
+  let result;
+  let failure;
+  try {
+    result = await adapter.call({
+      model,
+      system: prompt,
+      messages: [{ role: 'user', content: 'Produce the reflection now.' }],
+      maxTokens: 2048,
+      signal,
+    });
+    const content = (result && typeof result.text === 'string') ? result.text.trim() : '';
+    if (!content) {
+      throw new Error('T1 reflection returned empty content');
+    }
+    return { content, durationMs: Date.now() - t0, usage: normalizeTokenUsage(result?.usage) };
+  } catch (error) {
+    failure = error;
+    throw error;
+  } finally {
+    // Diagnostic only; the adapter owns billing/usage accounting. Never
+    // double-charge it or fail a completed reflection on a logging error.
+    try {
+      onComplete?.({
+        status: failure ? 'error' : 'ready',
+        durationMs: Date.now() - t0,
+        usage: normalizeTokenUsage(result?.usage),
+        usageReported: !!result?.usage,
+        ...(failure ? { error: String(failure.message || failure).slice(0, 512) } : {}),
+      });
+    } catch { /* best-effort diagnostics */ }
   }
-  return { content, durationMs: Date.now() - t0 };
 }

package/yeaft/tool-folding/t2-reflector.js

@@ -9,6 +9,7 @@
  */
 
 import { buildReflectionPrompt } from './reflection-prompt.js';
+import { normalizeTokenUsage } from '../llm/usage-accounting.js';
 
 /**
  * @param {{
@@ -19,22 +20,42 @@ import { buildReflectionPrompt } from './reflection-prompt.js';
  *   assistantText?: string,
  *   language?: string,
  *   signal?: AbortSignal,
+ *   onComplete?: (diagnostic: object) => void,
  * }} p
- * @returns {Promise<{ content: string, durationMs: number }>}
+ * @returns {Promise<{ content: string, durationMs: number, usage: object }>}
  */
-export async function runT2Reflection({ adapter, model, originalUserMsg, toolPairs, assistantText, language, signal }) {
+export async function runT2Reflection({ adapter, model, originalUserMsg, toolPairs, assistantText, language, signal, onComplete }) {
   const t0 = Date.now();
   const prompt = buildReflectionPrompt({ originalUserMsg, toolPairs, assistantText, language });
-  const result = await adapter.call({
-    model,
-    system: prompt,
-    messages: [{ role: 'user', content: 'Produce the reflection now.' }],
-    maxTokens: 2048,
-    signal,
-  });
-  const content = (result && typeof result.text === 'string') ? result.text.trim() : '';
-  if (!content) {
-    throw new Error('T2 reflection returned empty content');
+  let result;
+  let failure;
+  try {
+    result = await adapter.call({
+      model,
+      system: prompt,
+      messages: [{ role: 'user', content: 'Produce the reflection now.' }],
+      maxTokens: 2048,
+      signal,
+    });
+    const content = (result && typeof result.text === 'string') ? result.text.trim() : '';
+    if (!content) {
+      throw new Error('T2 reflection returned empty content');
+    }
+    return { content, durationMs: Date.now() - t0, usage: normalizeTokenUsage(result?.usage) };
+  } catch (error) {
+    failure = error;
+    throw error;
+  } finally {
+    // Diagnostic only; the adapter owns billing/usage accounting. Never
+    // double-charge it or fail a completed reflection on a logging error.
+    try {
+      onComplete?.({
+        status: failure ? 'error' : 'ready',
+        durationMs: Date.now() - t0,
+        usage: normalizeTokenUsage(result?.usage),
+        usageReported: !!result?.usage,
+        ...(failure ? { error: String(failure.message || failure).slice(0, 512) } : {}),
+      });
+    } catch { /* best-effort diagnostics */ }
   }
-  return { content, durationMs: Date.now() - t0 };
 }

package/yeaft/tools/activation.js

@@ -26,6 +26,7 @@ export const ALWAYS_VISIBLE_TOOL_NAMES = Object.freeze([
 export const BACKGROUND_TASK_TOOL_NAMES = Object.freeze([
   'ListTasks',
   'ReadTaskLog',
+  'WaitTask',
   'CancelTask',
 ]);
 
@@ -44,6 +45,7 @@ export const CONDITIONAL_BUILTIN_TOOL_NAMES = new Set([
   'ApplyPatch',
   'ListTasks',
   'ReadTaskLog',
+  'WaitTask',
   'CancelTask',
   'SpawnAgent',
   'UpdateAgent',

package/yeaft/tools/agent.js

@@ -159,6 +159,8 @@ export function checkBudget(agent, now = Date.now()) {
 export function budgetExceededResult(agent, reason) {
   return {
     status: 'budget_exceeded',
+    outcome: 'incomplete',
+    complete: false,
     partial_output: agent.partial_output || agent.result || '',
     reason,
     usage: { ...(agent.usage || {}) },
@@ -168,7 +170,8 @@ export function budgetExceededResult(agent, reason) {
 /**
  * Apply an incremental delta to an agent's usage, then check budget.
  * If exceeded: abort the agent's signal, set result to the budget envelope,
- * flip status to 'completed', and return the envelope. Otherwise returns null.
+ * end the lifecycle as 'completed' with an explicitly incomplete outcome, and
+ * return the envelope. Otherwise returns null.
  *
  * Call this at each turn boundary inside the sub-agent's execution loop.
  *

package/yeaft/tools/bash.js

@@ -166,7 +166,7 @@ Guidelines:
     },
     required: ['command'],
   },
-  errorOutput: null,
+  errorOutput: 'json-error-envelope',
   // Foreground Bash owns a bounded timeout and process-tree cleanup state
   // machine. A second ToolRegistry timer can preempt that cleanup and turn an
   // owned exit 124 into a fatal orphan, so it must stay disabled for this tool.
@@ -217,7 +217,7 @@ Guidelines:
             threadId: ctx.threadId || 'main',
           },
         });
-        return `Started background task ${task.id}.\nWorking directory: ${cwd}\nStatus: ${task.status}\nLog: ${task.log?.path || ''}\nThe task is detached from this turn. Use ListTasks, ReadTaskLog, or CancelTask to inspect or control it.`;
+        return `Started background task ${task.id}.\nWorking directory: ${cwd}\nStatus: ${task.status}\nLog: ${task.log?.path || ''}\nThe task is detached from this turn. Use WaitTask for bounded waiting, ReadTaskLog for output, ListTasks for active status, or CancelTask when cancellation is intended.`;
       } catch (err) {
         throw new Error(err?.message || String(err));
       }
@@ -258,10 +258,35 @@ Guidelines:
       }
 
       const output = parts.join('\n');
-      if (result.exitCode !== 0) {
-        return `Exit code: ${result.exitCode}\nWorking directory: ${cwd}\n${output}`;
+      if (result.exitCode !== 0 || result.timedOut || result.terminationError) {
+        const failureType = result.timedOut
+          ? (result.terminationError ? 'timeout_unconfirmed' : 'timeout_confirmed')
+          : result.terminationError || result.exitCode === null ? 'exit_unconfirmed' : 'exit_nonzero';
+        return JSON.stringify({
+          error: result.timedOut
+            ? `Command timed out after ${timeout}ms${result.terminationError ? '; process-tree termination was not confirmed' : ''}.`
+            : `Command exited with code ${result.exitCode}.`,
+          code: `bash_${failureType}`,
+          errorEffect: 'unknown',
+          failureType,
+          exitCode: Number.isInteger(result.exitCode) ? result.exitCode : null,
+          status: `Exit code: ${result.exitCode}`,
+          workingDirectory: `Working directory: ${cwd}`,
+          timedOut: result.timedOut === true,
+          terminationConfirmed: result.timedOut ? !result.terminationError : null,
+          terminationError: result.terminationError || null,
+          cwd,
+          output: output || '(no output)',
+          replaySafe: false,
+        });
       }
-      return output || '(no output)';
+      // A successful command may print application JSON containing `error`.
+      // Do not let it masquerade as a tool-level failure envelope.
+      let successfulOutput = output || '(no output)';
+      try {
+        if (JSON.parse(successfulOutput)?.error) successfulOutput = `Exit code: 0\n${successfulOutput}`;
+      } catch { /* ordinary command output */ }
+      return successfulOutput;
     } catch (err) {
       err.message = `${err.message} (working directory: ${cwd})`;
       if (err?.name === 'ProcessTerminationError') err.fatalToolTimeout = true;

package/yeaft/tools/cancel-task.js

@@ -22,9 +22,12 @@ export default defineTool({
   isReadOnly: () => false,
   async execute(input = {}, ctx = {}) {
     if (!ctx.taskManager) return JSON.stringify({ error: 'task manager unavailable' });
+    if (ctx.sessionId && input.sessionId && input.sessionId !== ctx.sessionId) {
+      return JSON.stringify({ error: 'Task access is limited to the current Session', errorEffect: 'none' });
+    }
     const taskId = input.taskId;
     if (!taskId) return JSON.stringify({ error: 'taskId is required' });
     const sessionId = input.sessionId || ctx.sessionId || 'default';
-    return JSON.stringify(ctx.taskManager.cancelTask(sessionId, taskId), null, 2);
+    return JSON.stringify(ctx.taskManager.cancelTask(sessionId, taskId, ctx.currentVpId || null), null, 2);
   },
 });

package/yeaft/tools/close-agent.js

@@ -12,6 +12,7 @@ import { agentBelongsToCaller, getAgentRegistry } from './agent.js';
 import { isTerminalAgentStatus, STATUS } from '../sub-agent/status.js';
 import { consumeNotificationForAgent, enqueueTerminalNotification } from '../sub-agent/notifications.js';
 import { snapshotLiveness } from '../sub-agent/liveness.js';
+import { describeAgentLifecycle, describeAgentOutcome } from '../sub-agent/outcome.js';
 
 export default defineTool({
   name: 'CloseAgent',
@@ -73,7 +74,7 @@ Do NOT end your turn silently right after CloseAgent.`,
       return JSON.stringify({ next_steps: ERROR_NEXT_STEPS, error: `Agent not found: ${agent_id}` });
     }
 
-    if (result) {
+    if (result && !isTerminalAgentStatus(agent.status)) {
       agent.result = result;
     }
 
@@ -86,7 +87,7 @@ Do NOT end your turn silently right after CloseAgent.`,
 
     const finalResult = (typeof agent.result === 'string' && agent.result)
       ? agent.result
-      : (agent.lastResult || '');
+      : (agent.result?.partial_output || agent.lastResult || '');
 
     // If the agent had already gone terminal (e.g. failed) before we got
     // here, preserve that status; otherwise mark closed. Either way drain
@@ -139,6 +140,10 @@ Do NOT end your turn silently right after CloseAgent.`,
       agentId: agent_id,
       name: agent.name,
       status: agent.status,
+      lifecycle: describeAgentLifecycle(agent),
+      outcome: describeAgentOutcome(agent),
+      incomplete: !describeAgentOutcome(agent).complete,
+      final_report: agent.result?.final_report || agent.finalReport || null,
       result: finalResult,
       outputFile: agent.outputFile || null,
       liveness: snapshotLiveness(agent.liveness),

package/yeaft/tools/enter-worktree.js

@@ -32,7 +32,8 @@ development without file conflicts. Useful for:
 - Parallel feature development
 
 The worktree is created in .yeaft/worktrees/ with a new branch based on HEAD.
-Returns the worktree path and branch name.`,
+Returns the worktree path and branch name. Does NOT switch the execution cwd.
+Use the returned path explicitly for Bash/GitRead cwd, file paths, and child-agent cwd.`,
     zh: `创建一个独立的 git worktree 用于开发。
 
 创建带独立分支的新 git worktree，允许并行开发无文件冲突。适用于：
@@ -40,7 +41,7 @@ Returns the worktree path and branch name.`,
 - 合并前隔离测试改动
 - 并行功能开发
 
-Worktree 创建在 .yeaft/worktrees/ 中，基于 HEAD 创建新分支。返回 worktree 路径和分支名。`
+Worktree 创建在 .yeaft/worktrees/ 中，基于 HEAD 创建新分支。返回 worktree 路径和分支名，不切换执行 cwd；后续 Bash/GitRead、文件路径及子 Agent cwd 必须显式使用返回路径。`
   },
   parameters: {
     type: 'object',
@@ -107,6 +108,9 @@ Worktree 创建在 .yeaft/worktrees/ 中，基于 HEAD 创建新分支。返回
         branch: branchName,
         baseRef,
         name,
+        executionCwd: resolve(cwd),
+        cwdChanged: false,
+        nextStep: 'Use path explicitly as Bash/GitRead/SpawnAgent cwd or as the base for absolute file paths.',
         message: `Created worktree "${name}" at ${worktreeDir} on branch ${branchName}`,
       });
     } catch (err) {

package/yeaft/tools/git-read.js

@@ -1,4 +1,5 @@
 import { resolve } from 'node:path';
+import { realpath } from 'node:fs/promises';
 import { defineTool } from './types.js';
 import { runProcess } from './process-runner.js';
 
@@ -58,9 +59,9 @@ function errorOutput(message, operation) {
 // arguments belonging to another operation.
 function normalizeInput(input) {
   const result = { ...input };
-  for (const key of ['base', 'head', 'revision', 'paths', 'limit']) {
+  for (const key of ['cwd', 'base', 'head', 'revision', 'paths', 'limit']) {
     if (result[key] === null || result[key] === undefined
-        || (['base', 'head', 'revision'].includes(key) && result[key] === '')
+        || (['cwd', 'base', 'head', 'revision'].includes(key) && result[key] === '')
         || (key === 'paths' && Array.isArray(result[key]) && result[key].length === 0)
         || (key === 'limit' && result.operation !== 'log' && result[key] === DEFAULT_LOG_LIMIT)) {
       delete result[key];
@@ -101,18 +102,22 @@ export function buildGitReadArgs(input) {
 
   input = normalizeInput(input);
   const { operation } = input;
+  if (input.cwd !== undefined && (typeof input.cwd !== 'string'
+      || input.cwd.length > MAX_VALUE_LENGTH || /[\0\r\n]/u.test(input.cwd))) {
+    return { error: 'cwd must be a path of at most 4096 characters without NUL or newlines' };
+  }
   if (!['status', 'diff', 'show', 'log'].includes(operation)) {
     return { error: 'operation must be one of: status, diff, show, log' };
   }
 
   if (operation === 'status') {
-    const error = unexpectedInput(input, new Set(['operation']));
+    const error = unexpectedInput(input, new Set(['operation', 'cwd']));
     if (error) return { error };
     return { args: [...COMMON_ARGS, 'status', '--short', '--branch', '--untracked-files=normal', '--ignore-submodules=all'] };
   }
 
   if (operation === 'diff') {
-    const error = unexpectedInput(input, new Set(['operation', 'base', 'head', 'paths']))
+    const error = unexpectedInput(input, new Set(['operation', 'cwd', 'base', 'head', 'paths']))
       || validatePaths(input.paths)
       || (input.base !== undefined ? validateValue(input.base, 'base') : null)
       || (input.head !== undefined ? validateValue(input.head, 'head') : null);
@@ -133,7 +138,7 @@ export function buildGitReadArgs(input) {
   }
 
   if (operation === 'show') {
-    const error = unexpectedInput(input, new Set(['operation', 'revision', 'paths']))
+    const error = unexpectedInput(input, new Set(['operation', 'cwd', 'revision', 'paths']))
       || validatePaths(input.paths)
       || (input.revision !== undefined ? validateValue(input.revision, 'revision') : null);
     if (error) return { error };
@@ -146,7 +151,7 @@ export function buildGitReadArgs(input) {
     };
   }
 
-  const error = unexpectedInput(input, new Set(['operation', 'revision', 'limit']))
+  const error = unexpectedInput(input, new Set(['operation', 'cwd', 'revision', 'limit']))
     || (input.revision !== undefined ? validateValue(input.revision, 'revision') : null);
   if (error) return { error };
   const limit = input.limit === undefined ? DEFAULT_LOG_LIMIT : input.limit;
@@ -170,13 +175,15 @@ function takeUtf8(text, maxBytes) {
   return buffer.subarray(0, end).toString('utf8');
 }
 
-function formatSuccess(operation, result) {
+function formatSuccess(operation, result, resolvedCwd) {
   const sections = [];
   if (result.stdout) sections.push(`STDOUT:\n${result.stdout}`);
   if (result.stderr) sections.push(`STDERR:\n${result.stderr}`);
   const body = sections.join('\n');
   const baseHeader = truncated => [
     `operation: ${operation}`,
+    `resolvedCwd: ${JSON.stringify(takeUtf8(resolvedCwd ?? '', 1024))}`,
+    ...(Buffer.byteLength(resolvedCwd || '', 'utf8') > 1024 ? ['cwdTruncated: true'] : []),
     `exitCode: ${result.code}`,
     'timedOut: false',
     `truncated: ${truncated}`,
@@ -226,7 +233,7 @@ function boundedFailure(fields, output = '') {
 
 export function formatGitReadResult(operation, result, { resolvedCwd, stage = operation } = {}) {
   if (result.code === 0 && !result.timedOut && !result.truncated && !result.terminationError) {
-    return formatSuccess(operation, result);
+    return formatSuccess(operation, result, resolvedCwd);
   }
   const code = result.terminationError ? 'git_exit_unconfirmed'
     : result.timedOut ? 'git_timeout'
@@ -260,6 +267,8 @@ Supported operations are intentionally limited:
 - show: exactly one commit (HEAD by default; tags are peeled to commits), optionally narrowed by paths. Ranges and non-commit objects are rejected.
 - log: a compact bounded commit list (20 entries by default, maximum 50).
 
+cwd defaults to the execution directory; an override must resolve to the same repository (including linked worktrees). Creation does not switch cwd. Every result identifies the resolved directory.
+
 GitRead never fetches, writes Git state, or creates worktrees. It disables pagers, external diff, textconv, content filters, optional locks, fsmonitor, and submodule traversal. Filter-normalized files (such as LFS) show raw worktree bytes; submodule status needs separate inspection. Revisions and paths beginning with "-" are rejected. Output reports truncation. Git failures, timeouts and capture-limit stops return an error with bounded diagnostics.`,
     zh: `有界读取本地 Git 证据，不使用 shell，也不访问网络。
 
@@ -269,12 +278,15 @@ GitRead never fetches, writes Git state, or creates worktrees. It disables pager
 - show：显示唯一提交（默认 HEAD；tag 解析到 commit），可用 paths 缩小范围。拒绝范围及非 commit 对象。
 - log：紧凑且有界的提交列表（默认 20 条，最多 50 条）。
 
+cwd 默认执行目录；指定目录必须属于同一仓库（可为关联 worktree）。创建 worktree 不切换 cwd，需显式指定。结果始终标明实际目录。
+
 GitRead 不 fetch、不写 Git 状态、不创建 worktree。它禁用 pager、external diff、textconv、内容 filter、optional locks、fsmonitor 和子模块遍历。LFS 等 filter 文件显示原始工作区字节，子模块状态需单独检查。拒绝以 "-" 开头的 revision 与路径；结果明确标识是否截断；Git 失败、超时及捕获上限终止返回含有界诊断的错误。`,
   },
   parameters: {
     type: 'object',
     additionalProperties: false,
     properties: {
+      cwd: { type: 'string', maxLength: MAX_VALUE_LENGTH, description: 'Optional repository/worktree directory; relative to execution cwd. Must belong to the same repository. Empty means execution cwd.' },
       operation: { type: 'string', enum: ['status', 'diff', 'show', 'log'] },
       base: { type: 'string', maxLength: MAX_VALUE_LENGTH, description: 'diff only; empty/omitted means working-tree changes against HEAD' },
       head: { type: 'string', maxLength: MAX_VALUE_LENGTH, description: 'diff only; requires base, empty/omitted defaults to HEAD' },
@@ -296,11 +308,16 @@ GitRead 不 fetch、不写 Git 状态、不创建 worktree。它禁用 pager、e
     const built = buildGitReadArgs(input);
     if (built.error) return errorOutput(built.error, input?.operation);
     input = normalizeInput(input);
-    const cwd = resolve(ctx?.cwd || process.cwd());
+    const contextCwd = resolve(ctx?.cwd || process.cwd());
+    let cwd = resolve(contextCwd, input.cwd || '.');
     let stage = input.operation;
     try {
       const run = ctx?.[RUN_PROCESS_OVERRIDE] || runProcess;
       const startedAt = Date.now();
+      // Ambient Git location overrides must not redirect evidence elsewhere.
+      const env = { ...process.env };
+      for (const key of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
+        'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_NAMESPACE']) delete env[key];
       const options = {
         cwd,
         signal: ctx?.signal,
@@ -308,7 +325,7 @@ GitRead 不 fetch、不写 Git 状态、不创建 worktree。它禁用 pager、e
         maxBytes: MAX_CAPTURE_BYTES,
         requireExitConfirmation: true,
         env: {
-          ...process.env,
+          ...env,
           GIT_PAGER: 'cat',
           PAGER: 'cat',
           GIT_EXTERNAL_DIFF: '',
@@ -318,13 +335,38 @@ GitRead 不 fetch、不写 Git 状态、不创建 worktree。它禁用 pager、e
           NO_COLOR: '1',
         },
       };
-      const read = (command, args) => {
+      const read = (command, args, readCwd = cwd) => {
         const remaining = TIMEOUT_MS - (Date.now() - startedAt);
         if (remaining <= 0) {
           throw Object.assign(new Error('Git read timed out'), { code: 'git_timeout', timedOut: true });
         }
-        return run(command, args, { ...options, timeoutMs: remaining });
+        return run(command, args, { ...options, cwd: readCwd, timeoutMs: remaining });
       };
+      if (cwd !== contextCwd) {
+        stage = 'resolve_cwd';
+        cwd = await realpath(cwd);
+        const commonDirectory = async directory => {
+          const result = await read('git', [
+            ...COMMON_ARGS, 'rev-parse', '--git-common-dir',
+          ], directory);
+          if (result.code !== 0 || result.truncated || result.timedOut || result.terminationError) {
+            throw Object.assign(new Error('Cannot resolve Git repository identity'), { result });
+          }
+          const value = result.stdout.replace(/\r?\n$/, '');
+          if (!value) throw new Error('Missing Git common directory');
+          // --git-common-dir may be relative on older Git. Avoid
+          // --path-format (unsupported versions echo it as a path).
+          return realpath(resolve(directory, value));
+        };
+        const owner = await commonDirectory(contextCwd);
+        if (await commonDirectory(cwd) !== owner) {
+          return boundedFailure({
+            error: 'cwd must belong to the execution repository or one of its linked worktrees',
+            errorEffect: 'none', code: 'git_cwd_outside_repository', operation: input.operation,
+            stage, resolvedCwd: cwd,
+          });
+        }
+      }
       // Only these operations inspect worktree bytes. Object-only reads must
       // not pay for filter discovery or fail on an unusable worktree filter.
       const readsWorktree = input.operation === 'status'

package/yeaft/tools/index.js

@@ -43,6 +43,7 @@ import diskUsage from './disk-usage.js';
 import applyPatch from './apply-patch.js';
 import listTasks from './list-tasks.js';
 import readTaskLog from './read-task-log.js';
+import waitTask from './wait-task.js';
 import cancelTask from './cancel-task.js';
 
 // --- P1 Agent tools ---
@@ -109,6 +110,7 @@ export const allTools = [
   applyPatch,
   listTasks,
   readTaskLog,
+  waitTask,
   cancelTask,
 
   // P1 Agent

package/yeaft/tools/list-agents.js

@@ -4,6 +4,7 @@ import { defineTool } from './types.js';
 import { agentBelongsToCaller, getAgentRegistry } from './agent.js';
 import { isTerminalAgentStatus, STATUS } from '../sub-agent/status.js';
 import { diagnoseAgentLiveness } from '../sub-agent/liveness.js';
+import { describeAgentLifecycle, describeAgentOutcome } from '../sub-agent/outcome.js';
 
 function nextStepFor(agent, liveness) {
   if (isTerminalAgentStatus(agent.status)) {
@@ -69,6 +70,8 @@ By default terminal agents are omitted. Pass include_closed=true to include them
         id,
         name: agent.name,
         status: agent.status,
+        lifecycle: describeAgentLifecycle(agent),
+        outcome: describeAgentOutcome(agent),
         task: typeof agent.task === 'string' ? agent.task.slice(0, 200) : null,
         outputFile: agent.outputFile || null,
         activity: {

package/yeaft/tools/list-tasks.js

@@ -44,14 +44,21 @@ export default defineTool({
   cacheWithinQuery: false,
   async execute(input = {}, ctx = {}) {
     if (!ctx.taskManager) return JSON.stringify({ error: 'task manager unavailable' });
+    if (ctx.sessionId && input.sessionId && input.sessionId !== ctx.sessionId) {
+      return JSON.stringify({ error: 'Task access is limited to the current Session', errorEffect: 'none' });
+    }
     const sessionId = input.sessionId || ctx.sessionId || null;
-    const tasks = ctx.taskManager.listActiveTasks(sessionId)
+    const ownerVpId = ctx.currentVpId || null;
+    const activeTasks = ownerVpId
+      ? ctx.taskManager.listActiveTasks(sessionId, ownerVpId)
+      : ctx.taskManager.listActiveTasks(sessionId);
+    const tasks = activeTasks
       .map(compactTaskSnapshot)
       .filter(Boolean);
     return JSON.stringify({
       tasks,
       next_steps: tasks.length > 0
-        ? 'ReadTaskLog reads output by task id. For sub_agent tasks use WaitAgent/CloseAgent with agentId to collect/cancel; for shell tasks use CancelTask only when cancellation is intended. cancelPending is not proof the process has stopped.'
+        ? 'WaitTask waits by task id without reading the log. ReadTaskLog reads output by task id. For sub_agent tasks use WaitAgent/CloseAgent with agentId to collect/cancel; for shell tasks use CancelTask only when cancellation is intended. cancelPending is not proof the process has stopped.'
         : 'No active tasks require follow-up.',
     });
   },

package/yeaft/tools/read-task-log.js

@@ -27,6 +27,9 @@ export default defineTool({
   duplicateCallPolicy: () => 'allow',
   async execute(input = {}, ctx = {}) {
     if (!ctx.taskManager) return JSON.stringify({ error: 'task manager unavailable' });
+    if (ctx.sessionId && input.sessionId && input.sessionId !== ctx.sessionId) {
+      return JSON.stringify({ error: 'Task access is limited to the current Session', errorEffect: 'none' });
+    }
     const taskId = input.taskId;
     if (!taskId) return JSON.stringify({ error: 'taskId is required' });
     const sessionId = input.sessionId || ctx.sessionId || 'default';
@@ -35,7 +38,7 @@ export default defineTool({
       offset: input.offset,
       maxBytes: input.maxBytes,
       tail: typeof input.tail === 'boolean' ? input.tail : !hasOffset,
-    });
-    return JSON.stringify(result, null, 2);
+    }, ctx.currentVpId || null);
+    return JSON.stringify(result || { error: `Unknown task: ${taskId}` }, null, 2);
   },
 });