agy-mcp-bridge 0.1.29 → 0.1.31

package/dist/src/decisions.js

@@ -0,0 +1,45 @@
+import { appendFile, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/**
+ * The owner's decisions about a finished task (apply its changes, discard its worktree), one line each. The task history keeps only the
+ * latest tasks, so this is the record of who changed the workspace and when. Trimmed when the file grows large.
+ */
+export const DECISIONS_FILE = 'decisions.jsonl';
+const MAX_FILE_BYTES = 512 * 1024;
+const KEEP_RECORDS = 500;
+export async function appendDecision(stateDirectory, decision) {
+    const file = path.join(stateDirectory, DECISIONS_FILE);
+    try {
+        await mkdir(stateDirectory, { recursive: true });
+        await appendFile(file, JSON.stringify(decision) + '\n', { mode: 0o600 });
+        if ((await stat(file)).size > MAX_FILE_BYTES) {
+            const lines = (await readFile(file, 'utf8')).split('\n').filter(Boolean);
+            await writeFile(file, lines.slice(-KEEP_RECORDS).join('\n') + '\n', { mode: 0o600 });
+        }
+    }
+    catch { /* the log is a convenience, never a reason to fail the action it describes */ }
+}
+/** Newest first. A damaged line is skipped. */
+export async function readDecisions(stateDirectory, limit = 50) {
+    let text;
+    try {
+        text = await readFile(path.join(stateDirectory, DECISIONS_FILE), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const records = [];
+    for (const line of text.split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            const value = JSON.parse(line);
+            if (typeof value.at === 'string' && typeof value.task_id === 'string' && (value.action === 'apply' || value.action === 'discard') && typeof value.ok === 'boolean') {
+                records.push({ at: value.at, task_id: value.task_id, action: value.action, ok: value.ok, detail: String(value.detail ?? '').slice(0, 500) });
+            }
+        }
+        catch { /* skip a damaged line */ }
+    }
+    return records.slice(-limit).reverse();
+}
+//# sourceMappingURL=decisions.js.map

package/dist/src/isolation/apply.js

@@ -0,0 +1,96 @@
+import { execFile } from 'node:child_process';
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { inside } from '../security/workspace.js';
+import { isOwned, normalizeOwn } from './worktree.js';
+/**
+ * Brings a finished worktree task's changes into the original workspace as plain, uncommitted edits.
+ *
+ * Deliberately not a branch merge: nothing is committed on the owner's behalf, no branch is switched, and the owner reviews and
+ * commits (or `git restore`s) what arrives. The patch is built from the worktree, checked against the workspace first, and only
+ * then applied, so a workspace that moved on since the task started is refused instead of half-written.
+ */
+const MAX_PATCH_BYTES = 8 * 1024 * 1024;
+const MAX_FILES = 500;
+export const gitEnvironment = () => ({
+    PATH: process.env.PATH, PATHEXT: process.env.PATHEXT, SystemRoot: process.env.SystemRoot, COMSPEC: process.env.COMSPEC,
+    TEMP: process.env.TEMP, TMP: process.env.TMP, TMPDIR: process.env.TMPDIR,
+    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+    GIT_ATTR_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_PAGER: 'cat', LC_ALL: 'C'
+});
+class Refusal extends Error {
+}
+function git(cwd, args, input) {
+    return new Promise((resolve, reject) => {
+        const child = execFile('git', ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=' + (process.platform === 'win32' ? 'NUL' : '/dev/null'), ...args], { cwd, env: gitEnvironment(), timeout: 30000, maxBuffer: MAX_PATCH_BYTES + 1024, encoding: 'utf8', windowsHide: true }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error((stderr || error.message).trim().split('\n')[0].slice(0, 300)));
+            else
+                resolve(stdout);
+        });
+        // A git that exits before reading its input (a bad patch) closes the pipe; that is reported through the exit status, not as a crash.
+        child.stdin?.on('error', () => undefined);
+        if (input !== undefined)
+            child.stdin?.end(input);
+    });
+}
+/** The directory's path inside the repository, forward slashes, no trailing slash ('' at the top). */
+async function prefixOf(toplevel, workspace) {
+    const [top, work] = await Promise.all([realpath(toplevel), realpath(workspace)]);
+    if (!inside(top, work))
+        throw new Refusal('The workspace is not inside the repository the worktree was made from');
+    return path.relative(top, work).split(path.sep).join('/');
+}
+/** The repository root of a directory, as an absolute canonical path. */
+export async function repositoryRoot(directory) {
+    try {
+        return await realpath((await git(directory, ['rev-parse', '--show-toplevel'])).trim());
+    }
+    catch (error) {
+        throw new Error('The workspace is not a git repository: ' + (error instanceof Error ? error.message : 'git failed'));
+    }
+}
+const literal = (file) => `:(literal)${file}`;
+export async function applyWorktreeChanges(input) {
+    try {
+        const prefix = await prefixOf(input.toplevel, input.workspace);
+        const scope = prefix ? [prefix] : ['.'];
+        const owns = input.owns.map(normalizeOwn);
+        if (!owns.length)
+            throw new Refusal('The task declared no owned paths, so there is nothing it was allowed to change');
+        // Staging is only a way to include new files in the diff: it touches the worktree's own index, never the workspace.
+        await git(input.worktree, ['add', '-A', '--', ...scope]);
+        const names = (await git(input.worktree, ['diff', '--cached', '--name-only', '-z', 'HEAD', '--', ...scope])).split('\0').filter(Boolean);
+        if (!names.length)
+            throw new Refusal('The worktree has no changes to apply');
+        if (names.length > MAX_FILES)
+            throw new Refusal(`The worktree changes ${names.length} files; apply is limited to ${MAX_FILES}`);
+        const relative = names.map(name => prefix && name.startsWith(`${prefix}/`) ? name.slice(prefix.length + 1) : name);
+        const outside = relative.filter(name => !isOwned(name, owns));
+        if (outside.length)
+            throw new Refusal(`Files outside the task's owned paths were changed (${outside.slice(0, 5).join(', ')}); review them in the worktree`);
+        // A symlink or a submodule pointer is more than text: it can point outside the workspace, so it is never applied from here.
+        const raw = (await git(input.worktree, ['diff', '--cached', '--raw', '-z', 'HEAD', '--', ...scope])).split('\0');
+        if (raw.some(field => /^:(?:12|16)0000 /.test(field) || /^:\d+ (?:12|16)0000 /.test(field)))
+            throw new Refusal('The change includes a symlink or a submodule, which is not applied from here; review it in the worktree');
+        const patch = await git(input.worktree, ['diff', '--cached', '--binary', '--full-index', '--no-ext-diff', '--no-textconv', 'HEAD', '--', ...scope]);
+        if (Buffer.byteLength(patch) > MAX_PATCH_BYTES)
+            throw new Refusal('The change is larger than the apply limit; review it in the worktree');
+        // A file the owner is editing right now is theirs to merge by hand, even if the patch would happen to fit.
+        const dirty = (await git(input.toplevel, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--', ...names.map(literal)])).split('\0').filter(Boolean);
+        if (dirty.length)
+            throw new Refusal(`The workspace already has uncommitted changes in: ${dirty.slice(0, 5).map(line => line.slice(3)).join(', ')}`);
+        try {
+            await git(input.toplevel, ['apply', '--check', '--whitespace=nowarn', '-'], patch);
+        }
+        catch (error) {
+            throw new Refusal(`The changes no longer fit the workspace: ${error instanceof Error ? error.message : 'git apply --check failed'}`);
+        }
+        await git(input.toplevel, ['apply', '--whitespace=nowarn', '-'], patch);
+        return { applied: true, files: relative.sort(), patch_bytes: Buffer.byteLength(patch) };
+    }
+    catch (error) {
+        return { applied: false, reason: error instanceof Error ? error.message : 'Apply failed' };
+    }
+}
+//# sourceMappingURL=apply.js.map

package/dist/src/isolation/diff.js

@@ -0,0 +1,44 @@
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+import { redact } from '../security/redact.js';
+import { gitEnvironment } from './apply.js';
+/**
+ * The content diff of one file in a task's worktree, for the owner to read before applying it. Read only: nothing is staged or written
+ * (`git add` would race with an agent that is still running), and the worktree is bridge-owned, so its files are not the owner's.
+ * Secrets are filtered the way task logs are.
+ */
+const MAX_DIFF_CHARS = 200_000;
+const NULL_DEVICE = process.platform === 'win32' ? 'NUL' : '/dev/null';
+/** A path inside the worktree, as the changes list reports it: relative, no drive, no `..`, no empty segment. */
+export function isRelativeFilePath(file) {
+    if (typeof file !== 'string' || !file || file.length > 512 || file.includes('\0'))
+        return false;
+    if (path.isAbsolute(file) || /^[A-Za-z]:/.test(file) || file.startsWith('/') || file.startsWith('\\'))
+        return false;
+    return !file.replace(/\\/g, '/').split('/').some(part => part === '' || part === '..');
+}
+function capture(cwd, args) {
+    return new Promise(resolve => {
+        execFile('git', ['-c', 'core.fsmonitor=false', ...args], { cwd, env: gitEnvironment(), timeout: 20000, maxBuffer: 1024 * 1024, encoding: 'utf8', windowsHide: true }, (error, stdout) => {
+            const code = error ? (typeof error.code === 'number' ? error.code : null) : 0;
+            resolve({ stdout: stdout ?? '', code, overflow: Boolean(error) && /maxBuffer/i.test(error.message) });
+        });
+    });
+}
+export async function worktreeFileDiff(worktree, file) {
+    if (!isRelativeFilePath(file))
+        throw new Error('path must be a relative path inside the worktree');
+    const literal = `:(literal)${file}`;
+    // Tracked files diff against the base commit; a file the agent created is not in the index, so it is shown as all added lines.
+    const tracked = (await capture(worktree, ['ls-files', '--error-unmatch', '-z', '--', literal])).code === 0;
+    const result = tracked
+        ? await capture(worktree, ['diff', 'HEAD', '--no-ext-diff', '--no-textconv', '--no-color', '--', literal])
+        : await capture(worktree, ['diff', '--no-index', '--no-ext-diff', '--no-textconv', '--no-color', '--', NULL_DEVICE, file]);
+    // `git diff --no-index` exits 1 when the files differ; 128 means the file is not there at all.
+    if (!result.stdout && !result.overflow)
+        return { path: file, diff: '', truncated: false, binary: false, changed: false };
+    const truncated = result.overflow || result.stdout.length > MAX_DIFF_CHARS;
+    const text = redact(result.stdout.slice(0, MAX_DIFF_CHARS));
+    return { path: file, diff: text, truncated, binary: /^Binary files .* differ$/m.test(text), changed: true };
+}
+//# sourceMappingURL=diff.js.map

package/dist/src/isolation/worktree.js

@@ -299,10 +299,10 @@ export async function pruneWorktrees(repo, worktreesRoot) {
         return { pruned: 0, reason: error instanceof Error ? error.message : 'could not prune worktree records' };
     }
 }
-function normalizeOwn(own) {
+export function normalizeOwn(own) {
     return path.posix.normalize(own.replace(/\\/g, '/')).replace(/^\.\//, '').replace(/\/+$/, '');
 }
-function isOwned(relative, owns) {
+export function isOwned(relative, owns) {
     return owns.some(own => relative === own || relative.startsWith(`${own}/`));
 }
 /** Compare the real diff with the declared ownership list. Any file outside it must be reviewed before merging. */

package/dist/src/tasks/manager.js

@@ -1,10 +1,13 @@
 import { existsSync, statSync } from 'node:fs';
-import { mkdir, readdir, readFile, rename, rmdir, unlink, writeFile } from 'node:fs/promises';
+import { mkdir, readdir, readFile, realpath, rename, rmdir, unlink, writeFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { StringDecoder } from 'node:string_decoder';
 import path from 'node:path';
 import { DEFAULT_MAX_WAIT_SECONDS, delegateSchema, promptFor } from '../security/input.js';
-import { validateWorkspace } from '../security/workspace.js';
+import { inside, validateWorkspace } from '../security/workspace.js';
+import { appendDecision } from '../decisions.js';
+import { applyWorktreeChanges, repositoryRoot } from '../isolation/apply.js';
+import { worktreeFileDiff } from '../isolation/diff.js';
 import { redact } from '../security/redact.js';
 import { delegationState } from '../delegation.js';
 import { startProcess, terminateOwned } from '../antigravity/process.js';
@@ -732,6 +735,104 @@ export class TaskManager {
         await this.persist(entry.task);
         entry.finish?.();
     }
+    /**
+     * The owner's decisions about a finished worktree task (never an MCP client's): bring its changes into the workspace, or throw the
+     * worktree away. One at a time, so two clicks cannot interleave two git operations on the same repository.
+     */
+    decisionQueue = Promise.resolve();
+    enqueueDecision(work) {
+        const run = this.decisionQueue.then(work);
+        this.decisionQueue = run.catch(() => undefined);
+        return run;
+    }
+    async reviewableTask(id, allowRunning = false) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            throw new Error('Unknown or expired task_id');
+        const task = entry.task;
+        if (task.isolation !== 'worktree' || !task.worktree)
+            throw new Error('This task did not run in a worktree');
+        if (!allowRunning && (task.status === 'queued' || task.status === 'running'))
+            throw new Error('The task is still running');
+        if (task.discarded_at)
+            throw new Error('This task worktree was already discarded');
+        const [root, canonical] = await Promise.all([
+            realpath(path.join(this.runtime.stateDirectory, 'worktrees')).catch(() => null),
+            realpath(task.worktree).catch(() => null)
+        ]);
+        if (!canonical)
+            throw new Error('The task worktree no longer exists');
+        if (!root || !inside(root, canonical))
+            throw new Error('The task worktree is not under the bridge state directory');
+        return task;
+    }
+    recordDecision(id, action, ok, detail) {
+        return appendDecision(this.runtime.stateDirectory, { at: new Date().toISOString(), task_id: id, action, ok, detail });
+    }
+    /** One file's content diff from a worktree task. Read only, so it is allowed while the task still runs. */
+    async fileDiff(id, file) {
+        const task = await this.reviewableTask(id, true);
+        return worktreeFileDiff(task.worktree, file);
+    }
+    applyTask(id) {
+        return this.enqueueDecision(async () => {
+            const task = await this.reviewableTask(id);
+            const refuse = async (reason) => { await this.recordDecision(id, 'apply', false, reason); throw new Error(reason); };
+            if (task.status !== 'completed')
+                return refuse(`Only a completed task can be applied (this one is ${task.status})`);
+            if (task.applied_at)
+                throw new Error('This task was already applied');
+            if (task.scope?.out_of_scope.length)
+                return refuse(`The task changed files outside its owned paths (${task.scope.out_of_scope.slice(0, 5).join(', ')}); review them in the worktree`);
+            let workspace;
+            try {
+                workspace = await validateWorkspace(task.workspace, this.config.allowed_workspaces);
+            }
+            catch (error) {
+                return refuse(`The workspace is no longer allowed: ${error instanceof Error ? error.message : 'invalid'}`);
+            }
+            let toplevel;
+            try {
+                toplevel = await repositoryRoot(workspace);
+            }
+            catch (error) {
+                return refuse(error instanceof Error ? error.message : 'The workspace is not a git repository');
+            }
+            const result = await applyWorktreeChanges({ worktree: task.worktree, toplevel, workspace, owns: task.owns });
+            if (!result.applied)
+                return refuse(result.reason);
+            task.applied_at = new Date().toISOString();
+            task.applied_files = result.files.slice(0, 100);
+            await this.persist(task);
+            await this.recordDecision(id, 'apply', true, `${result.files.length} file(s): ${result.files.slice(0, 5).join(', ')}`);
+            return { task: this.summary(id), files: result.files };
+        });
+    }
+    discardTask(id) {
+        return this.enqueueDecision(async () => {
+            const task = await this.reviewableTask(id);
+            let toplevel;
+            try {
+                toplevel = await repositoryRoot(await validateWorkspace(task.workspace, this.config.allowed_workspaces));
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : 'The workspace is not usable';
+                await this.recordDecision(id, 'discard', false, reason);
+                throw new Error(reason);
+            }
+            const worktree = { root: task.worktree, workspace: task.worktree, toplevel, branch: task.branch ?? '', prefix: '', base: '' };
+            const removal = await removeWorktree(worktree);
+            if (!removal.removed) {
+                const reason = removal.reason ?? 'The worktree could not be removed';
+                await this.recordDecision(id, 'discard', false, reason);
+                throw new Error(reason);
+            }
+            task.discarded_at = new Date().toISOString();
+            await this.persist(task);
+            await this.recordDecision(id, 'discard', true, task.applied_at ? 'worktree removed after its changes were applied' : 'worktree removed without applying its changes');
+            return this.summary(id);
+        });
+    }
     get(id) {
         const entry = this.entries.get(id);
         if (!entry)

package/dist/src/ui/routes.js

@@ -5,6 +5,8 @@ import { redact } from '../security/redact.js';
 import { paths } from '../paths.js';
 import { knownUpdate, readPackageInfo } from '../update.js';
 import { workspaceChanges } from '../changes.js';
+import { readDecisions } from '../decisions.js';
+import { isRelativeFilePath } from '../isolation/diff.js';
 import { validModelId, writeModel } from '../models.js';
 import { readProgress, writeProgress } from '../progress.js';
 import { readUsage, summarizeUsage } from '../usage.js';
@@ -171,6 +173,41 @@ export async function handleUi(req, res, ctx) {
             json(res, 200, await changesFor(ctx, changes[1]));
             return true;
         }
+        // Applying a finished task's changes edits the owner's workspace, so like stopping a plan it is a decision for a person at the page.
+        const apply = pathname.match(new RegExp(`^/ui/api/tasks/(${UUID})/apply$`));
+        if (apply && method === 'POST') {
+            const body = await readJson(req);
+            if (body.confirm !== true) {
+                json(res, 400, { error: 'confirm must be true' });
+                return true;
+            }
+            json(res, 200, await ctx.manager.applyTask(apply[1]));
+            return true;
+        }
+        const discard = pathname.match(new RegExp(`^/ui/api/tasks/(${UUID})/discard$`));
+        if (discard && method === 'POST') {
+            const body = await readJson(req);
+            if (body.confirm !== true) {
+                json(res, 400, { error: 'confirm must be true' });
+                return true;
+            }
+            json(res, 200, { task: await ctx.manager.discardTask(discard[1]) });
+            return true;
+        }
+        const fileDiff = pathname.match(new RegExp(`^/ui/api/tasks/(${UUID})/diff$`));
+        if (fileDiff && method === 'GET') {
+            const file = new URL(req.url ?? '', 'http://localhost').searchParams.get('path');
+            if (!isRelativeFilePath(file)) {
+                json(res, 400, { error: 'path must be a relative path inside the worktree' });
+                return true;
+            }
+            json(res, 200, await ctx.manager.fileDiff(fileDiff[1], file));
+            return true;
+        }
+        if (pathname === '/ui/api/decisions' && method === 'GET') {
+            json(res, 200, { decisions: await readDecisions(ctx.manager.stateDirectory) });
+            return true;
+        }
         const cancel = pathname.match(new RegExp(`^/ui/api/tasks/(${UUID})/cancel$`));
         if (cancel && method === 'POST') {
             await ctx.manager.cancel(cancel[1]);

package/docs/MULTI-AGENT-PLAN.md

@@ -239,6 +239,22 @@ ngân sách token theo mission — usage vẫn chỉ được ghi và tổng h
 - Hàng đợi duyệt cho hành động ngoài chính sách.
 - Nhật ký quyết định, diff theo task, nút hợp nhất nhánh.
 
+**Đã làm (lát cắt 1: duyệt kết quả worktree).** Trang Task có panel "Duyệt kết quả worktree" cho task chạy trong worktree:
+
+- `Áp dụng vào workspace` ghi thay đổi của worktree vào workspace gốc dưới dạng **chưa commit** (`git apply`; bridge không tạo commit,
+  không đổi nhánh). Bị từ chối, kèm lý do, khi: task chưa `completed`, có file ngoài `owns`, workspace không còn trong allowlist,
+  workspace đang có sửa đổi chưa commit trên cùng file, patch không còn khớp (workspace đã đi tiếp), hoặc thay đổi có symlink/submodule.
+- `Bỏ worktree` xóa thư mục và nhánh `bridge/<id>` của task (giữ nguyên workspace).
+- Diff nội dung từng file (lát cắt 2): bấm một file ở "Thay đổi trong workspace" của task worktree để đọc diff so với commit gốc
+  (`GET /ui/api/tasks/<id>/diff?path=<file>`). Chỉ đọc, không stage gì (an toàn khi task còn chạy), secret được lọc như log, chỉ nhận đường dẫn
+  tương đối trong worktree. Task không dùng worktree chưa có diff nội dung.
+- Nhật ký quyết định ở `<state>/decisions.jsonl` (mỗi dòng: thời điểm, task, apply/discard, ok, chi tiết), hiện trong panel và ở `GET /ui/api/decisions`.
+- Chỉ chủ bridge làm được việc này qua web UI (`POST /ui/api/tasks/<id>/apply|discard` với `confirm: true`). Không có tool MCP tương ứng, nên một
+  agent hay client không tự áp dụng kết quả của chính nó.
+
+Chưa làm của Phase 4: trang Settings cho agent ưu tiên / số task song song / autonomy mặc định (hiện là file cấu hình), hàng đợi duyệt hành động
+ngoài chính sách và nút hợp nhất theo nhánh (commit).
+
 ### Phase 5 — Tích hợp và hardening
 
 - Merge nhánh trung gian, kiểm tra xung đột, chạy test trên nhánh tích hợp.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agy-mcp-bridge",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Local loopback HTTP MCP bridge that delegates bounded coding tasks to multiple agent CLIs (Antigravity, Codex) with optional parallel git worktrees",
   "license": "MIT",
   "keywords": [

package/ui/app.css

@@ -126,6 +126,7 @@ button { cursor: pointer; }
 .callout { padding: 10px 12px; border-radius: 10px; font-weight: 550; overflow-wrap: anywhere; }
 .callout.bad { background: var(--bad-soft); color: var(--bad); }
 .callout.warn { background: var(--warn-soft); color: var(--warn); }
+.callout.good { background: var(--ok-soft); color: var(--ok); }
 .chips { display: flex; gap: 6px; flex-wrap: wrap; }
 .chip { padding: 2px 9px; border-radius: 8px; background: var(--surface); border: 1px solid var(--border); font-size: 12.5px; font-family: var(--mono); }
 .typing { display: flex; align-items: center; gap: 10px; color: var(--muted); }
@@ -149,6 +150,15 @@ details.more .body { padding: 10px 12px 12px; }
 .change-list { margin: 0; padding: 0; list-style: none; display: grid; max-height: 360px; overflow: auto; border: 1px solid var(--border); border-radius: 10px; }
 .change-row { display: grid; grid-template-columns: 64px minmax(0, 1fr) auto; gap: 10px; align-items: center; padding: 7px 12px; border-top: 1px solid var(--border); font-size: 13px; }
 .change-row:first-child { border-top: 0; }
+.change-row.clickable { cursor: pointer; }
+.change-row.clickable:hover, .change-row.clickable:focus-visible { background: var(--surface-2); outline: none; }
+.diff-box { margin-top: 12px; display: grid; gap: 8px; }
+.diff { white-space: pre; overflow: auto; max-height: 460px; }
+.diff span { display: block; min-height: 1.3em; }
+.diff .add { color: var(--ok); background: var(--ok-soft); }
+.diff .del { color: var(--bad); background: var(--bad-soft); }
+.diff .hunk { color: var(--warn); }
+.diff .meta { color: var(--muted); }
 .change-path { overflow-wrap: anywhere; }
 .change-count { color: var(--muted); white-space: nowrap; font-size: 12.5px; }
 .change-kind { text-align: center; padding: 1px 6px; border-radius: 6px; font-size: 11.5px; font-weight: 650; background: var(--idle-soft); color: var(--idle); }

package/ui/app.js

@@ -375,6 +375,36 @@ function collapsible(key, title, ...body) {
 function more(key, ...body) { return collapsible(key, 'Xem thêm', ...body); }
 
 const CHANGE_LABEL = {modified: 'Sửa', deleted: 'Xóa', added: 'Thêm', 'type-changed': 'Đổi kiểu'};
+/* ---------- Content diff of one changed file (worktree tasks only; read only, secrets filtered on the server) ---------- */
+async function loadDiff(task, file) {
+  state.diff = {task_id: task.task_id, path: file, loading: true}; patch();
+  try { state.diff = {task_id: task.task_id, path: file, data: await api(`tasks/${task.task_id}/diff?path=${encodeURIComponent(file)}`)}; }
+  catch (error) { state.diff = {task_id: task.task_id, path: file, error: error.message}; }
+  patch();
+}
+/** A row is a button only where a diff can be read: a task that ran in a worktree, which the bridge owns. */
+function rowProps(task, file) {
+  if (task.isolation !== 'worktree' || task.discarded_at) return {class: 'change-row'};
+  const open = () => loadDiff(task, file);
+  return {class: 'change-row clickable', tabindex: '0', role: 'button', 'aria-label': `Xem diff của ${file}`, onclick: open,
+    onkeydown: event => { if (event.key === 'Enter' || event.key === ' ') { event.preventDefault(); open(); } }};
+}
+const diffLineClass = line => line.startsWith('+++') || line.startsWith('---') || line.startsWith('diff ') || line.startsWith('index ') ? 'meta'
+  : line.startsWith('@@') ? 'hunk' : line.startsWith('+') ? 'add' : line.startsWith('-') ? 'del' : '';
+function diffViewer(task) {
+  const current = state.diff && state.diff.task_id === task.task_id ? state.diff : null;
+  if (!current) return null;
+  const close = h('button', {class: 'btn small', onclick: () => { state.diff = null; patch(); }, text: 'Đóng'});
+  const head = h('div', {class: 'change-head'}, h('strong', {class: 'mono', text: current.path}), close);
+  if (current.loading) return h('div', {class: 'diff-box'}, head, h('div', {class: 'typing'}, h('span', {class: 'spinner'}), 'Đang đọc diff…'));
+  if (current.error) return h('div', {class: 'diff-box'}, head, h('div', {class: 'callout bad', text: current.error}));
+  const data = current.data;
+  if (!data.changed) return h('div', {class: 'diff-box'}, head, h('p', {class: 'muted', text: 'File này không có thay đổi so với commit gốc của worktree.'}));
+  if (data.binary) return h('div', {class: 'diff-box'}, head, h('p', {class: 'muted', text: 'File nhị phân: chỉ biết là có thay đổi, không hiện được nội dung.'}));
+  return h('div', {class: 'diff-box'}, head,
+    h('pre', {class: 'log diff'}, data.diff.split('\n').map(line => h('span', {class: diffLineClass(line), text: line}))),
+    data.truncated ? h('div', {class: 'callout warn', text: 'Diff dài nên chỉ hiện phần đầu.'}) : null);
+}
 function changesBody(task) {
   const c = state.changes && state.changes.task_id === task.task_id ? state.changes : null;
   const refresh = h('button', {class: 'btn small', onclick: () => loadChanges(task.task_id), disabled: Boolean(c && c.loading), text: c && c.data ? 'Làm mới' : 'Xem thay đổi'});
@@ -384,19 +414,74 @@ function changesBody(task) {
   const d = c.data;
   if (!d.available) return [h('div', {class: 'callout warn', text: d.reason || 'Không đọc được thay đổi.'}), refresh];
   const rows = [
-    ...d.changes.map(item => h('li', {class: 'change-row'}, h('span', {class: `change-kind ${item.status}`, text: CHANGE_LABEL[item.status] || item.status}),
+    ...d.changes.map(item => h('li', rowProps(task, item.path), h('span', {class: `change-kind ${item.status}`, text: CHANGE_LABEL[item.status] || item.status}),
       h('span', {class: 'change-path mono', text: item.path}),
       h('span', {class: 'change-count mono', text: item.added === null ? 'nhị phân' : `+${item.added} −${item.deleted}`}))),
-    ...d.untracked.map(item => h('li', {class: 'change-row'}, h('span', {class: 'change-kind untracked', text: 'Mới'}),
+    ...d.untracked.map(item => h('li', rowProps(task, item.path), h('span', {class: 'change-kind untracked', text: 'Mới'}),
       h('span', {class: 'change-path mono', text: item.path}), h('span', {class: 'change-count mono', text: item.bytes === null ? '' : bytes(item.bytes)})))
   ];
   return [
     h('div', {class: 'change-head'}, h('strong', {text: rows.length ? `${d.changes.length} file đã sửa hoặc xóa · ${d.untracked.length} file mới chưa theo dõi` : 'Không có thay đổi nào so với HEAD.'}), refresh),
-    h('p', {class: 'muted', text: `So với commit ${d.head ? d.head.slice(0, 8) : '(repo chưa có commit)'}; gồm cả thay đổi đã có từ trước khi task chạy. Chỉ hiện tên file và số dòng, không có nội dung.`}),
+    h('p', {class: 'muted', text: `So với commit ${d.head ? d.head.slice(0, 8) : '(repo chưa có commit)'}; gồm cả thay đổi đã có từ trước khi task chạy. ${task.isolation === 'worktree' && !task.discarded_at ? 'Danh sách chỉ có tên file và số dòng; nội dung đọc ở diff từng file.' : 'Chỉ hiện tên file và số dòng, không có nội dung.'}`}),
+    rows.length && task.isolation === 'worktree' && !task.discarded_at ? h('p', {class: 'muted', text: 'Bấm một file để đọc nội dung thay đổi (đã lọc secret).'}) : null,
     rows.length ? h('ul', {class: 'change-list'}, rows) : null,
+    diffViewer(task),
     d.truncated ? h('div', {class: 'callout warn', text: 'Chỉ hiện 500 mục đầu tiên của mỗi nhóm.'}) : null
   ];
 }
+/* ---------- Review a finished worktree task: apply its changes, or throw the worktree away. Both are the owner's decision, never an agent's. ---------- */
+async function loadDecisions() {
+  try { state.decisions = (await api('decisions')).decisions; } catch { /* keep the list already on screen */ }
+  patch();
+}
+async function applyTask(task) {
+  if (!confirm(`Áp dụng thay đổi của task này vào workspace?\n\n${task.workspace}\n\nCác file được ghi thẳng vào thư mục làm việc ở dạng CHƯA COMMIT; bridge không tạo commit nào. Muốn bỏ thì dùng git restore.\nBị từ chối nếu workspace đang có sửa đổi chưa commit trên cùng file, hoặc thay đổi không còn khớp.`)) return;
+  try {
+    const result = await api(`tasks/${task.task_id}/apply`, {method: 'POST', body: {confirm: true}});
+    notify(`Đã áp dụng ${result.files.length} file vào workspace (chưa commit)`);
+    await refresh(true);
+  } catch (error) { notify(error.message); }
+  await loadDecisions();
+}
+async function discardTask(task) {
+  const note = task.applied_at ? 'Thay đổi đã được áp dụng vào workspace trước đó, nên không mất gì.' : 'Thay đổi của task CHƯA được áp dụng và sẽ mất cùng worktree.';
+  if (!confirm(`Bỏ worktree và nhánh ${task.branch || ''} của task này?\n\n${note}`)) return;
+  try { await api(`tasks/${task.task_id}/discard`, {method: 'POST', body: {confirm: true}}); notify('Đã bỏ worktree'); await refresh(true); }
+  catch (error) { notify(error.message); }
+  await loadDecisions();
+}
+/** Why the apply button is off, or null when it is available. Mirrors the checks the bridge repeats on the server. */
+function applyBlock(task) {
+  if (task.discarded_at) return 'Worktree đã bị bỏ.';
+  if (task.applied_at) return 'Đã áp dụng.';
+  if (task.status !== 'completed') return `Chỉ áp dụng được task đã hoàn tất (task này: ${task.status}).`;
+  if (task.scope && task.scope.out_of_scope.length) return `Task sửa file ngoài phạm vi được giao (${task.scope.out_of_scope.slice(0, 3).join(', ')}); xem trong worktree.`;
+  return null;
+}
+function reviewBody(task) {
+  const block = applyBlock(task);
+  const mine = (state.decisions || []).filter(item => item.task_id === task.task_id);
+  return [
+    h('p', {class: 'muted', text: 'Kết quả nằm trong worktree riêng, chưa đụng tới workspace của bạn. Áp dụng ghi thay đổi vào workspace dạng chưa commit; bỏ worktree xóa thư mục và nhánh của task.'}),
+    task.applied_at ? h('div', {class: 'callout good', text: `Đã áp dụng lúc ${clock(task.applied_at)}: ${(task.applied_files || []).join(', ') || '(không rõ file)'}. Xem git status trong workspace rồi commit hoặc git restore.`}) : null,
+    task.discarded_at ? h('div', {class: 'callout', text: `Đã bỏ worktree lúc ${clock(task.discarded_at)}.`}) : null,
+    h('div', {class: 'chips'},
+      h('button', {class: 'btn primary small', disabled: Boolean(block), title: block || 'Ghi thay đổi vào workspace', onclick: () => applyTask(task), text: 'Áp dụng vào workspace'}),
+      h('button', {class: 'btn danger small', disabled: Boolean(task.discarded_at), onclick: () => discardTask(task), text: 'Bỏ worktree'})),
+    block && !task.applied_at && !task.discarded_at ? h('p', {class: 'muted', text: block}) : null,
+    !task.applied_at && !task.discarded_at ? h('p', {class: 'muted', text: 'Đọc diff từng file ở mục "Thay đổi trong workspace" trước khi áp dụng.'}) : null,
+    mine.length ? h('div', {}, h('div', {class: 'msg-head', text: 'Nhật ký quyết định'}),
+      h('ul', {class: 'change-list'}, mine.map(item => h('li', {class: 'change-row'},
+        h('span', {class: `change-kind ${item.ok ? 'added' : 'deleted'}`, text: item.action === 'apply' ? 'Áp dụng' : 'Bỏ'}),
+        h('span', {class: 'change-path', text: `${item.ok ? '' : 'Bị từ chối: '}${item.detail}`}),
+        h('span', {class: 'change-count mono', text: clock(item.at)}))))) : null
+  ];
+}
+function reviewPanel(task) {
+  const el = details('review', 'Duyệt kết quả worktree', ...reviewBody(task));
+  el.addEventListener('toggle', () => { if (el.open && !state.decisions) void loadDecisions(); });
+  return el;
+}
 function changesPanel(task) {
   const el = details('changes', 'Thay đổi trong workspace', ...changesBody(task));
   el.addEventListener('toggle', () => { if (el.open && (!state.changes || state.changes.task_id !== task.task_id)) loadChanges(task.task_id); });
@@ -501,6 +586,7 @@ function detailView() {
 
   return h('article', {class: 'card detail'}, head, progress, h('div', {class: 'convo'}, asked, replied),
     changesPanel(task),
+    task.isolation === 'worktree' && task.status !== 'running' && task.status !== 'queued' ? reviewPanel(task) : null,
     details('steps', `Các bước ${agentName} báo cáo`, h('div', {id: 'steps-body'}, stepsBody(state.detail?.activity))),
     details('logs', `Log của tiến trình ${agentName}`, logs),
     collapsible('more:fact', 'Xem thêm thông số task', facts),
@@ -821,7 +907,7 @@ function patch() {
     setRegion('list', JSON.stringify([state.q, state.filter, state.selected, o.budget?.task_tokens, o.tasks.map(t => stable(t))]), () => taskItems(o));
     regions.count.textContent = taskCount(o);
     const d = state.detail;
-    const detailKey = JSON.stringify([state.selected, state.logTab, state.changes, d && {...d, activity: null, task: {...stable(d.task), stdout: '', stderr: '', stdout_bytes: 0, stderr_bytes: 0, stdout_truncated: false, stderr_truncated: false}}]);
+    const detailKey = JSON.stringify([state.selected, state.logTab, state.changes, state.decisions, state.diff, d && {...d, activity: null, task: {...stable(d.task), stdout: '', stderr: '', stdout_bytes: 0, stderr_bytes: 0, stdout_truncated: false, stderr_truncated: false}}]);
     const rebuilt = signatures.detail !== detailKey;
     setRegion('detail', detailKey, () => detailView());
     if (!rebuilt) patchLogs();