ai-project-manage-cli 7.1.5 → 7.1.7

package/dist/webide-message-worker.js

@@ -96,6 +96,10 @@ var requestConfig = {
       method: "PUT",
       path: "/cli/webide/plan"
     }),
+    webideReplaceTestCases: defineEndpoint({
+      method: "PUT",
+      path: "/cli/webide/test-cases"
+    }),
     branchBaseline: defineEndpoint({
       method: "GET",
       path: "/cli/tasks/branch-baseline"
@@ -128,6 +132,10 @@ var requestConfig = {
       method: "POST",
       path: "/cli/pull-requests"
     }),
+    createWebIdeDraftPullRequest: defineEndpoint({
+      method: "POST",
+      path: "/cli/webide/draft-pull-requests"
+    }),
     getRepositoryProjectDocumentManifest: defineEndpoint({
       method: "GET",
       path: "/cli/repository-project-documents/manifest"
@@ -196,76 +204,735 @@ async function tryReadApmConfig() {
     if (typeof rawCfg.baseUrl !== "string") {
       return null;
     }
-    const apiKey = resolveApiKey(rawCfg);
-    if (!apiKey) return null;
-    const cfg = v;
-    const clientMachineId = resolveClientMachineId(cfg);
-    return {
-      baseUrl: cfg.baseUrl.trim().replace(/\/+$/, ""),
-      apiKey,
-      ...clientMachineId ? { clientMachineId } : {}
-    };
-  } catch {
-    return null;
+    const apiKey = resolveApiKey(rawCfg);
+    if (!apiKey) return null;
+    const cfg = v;
+    const clientMachineId = resolveClientMachineId(cfg);
+    return {
+      baseUrl: cfg.baseUrl.trim().replace(/\/+$/, ""),
+      apiKey,
+      ...clientMachineId ? { clientMachineId } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/api/client.ts
+function createApmApiClient(cfg) {
+  const baseURL = `${cfg.baseUrl.trim().replace(/\/+$/, "")}/api/v1`;
+  return createApiClient(requestConfig, {
+    baseURL,
+    getToken: () => resolveApiKey(cfg) || void 0,
+    successCodes: [0],
+    unauthorizedCodes: [401]
+  });
+}
+
+// src/workdir-path.ts
+import { realpathSync } from "fs";
+import { platform } from "os";
+import { resolve } from "path";
+function toFsPath(inputPath) {
+  const absolute = resolve(inputPath);
+  if (platform() !== "win32") return absolute;
+  if (absolute.startsWith("\\\\?\\")) return absolute;
+  const normalized = absolute.replace(/\//g, "\\");
+  if (normalized.startsWith("\\\\")) {
+    return `\\\\?\\UNC\\${normalized.slice(2)}`;
+  }
+  return `\\\\?\\${normalized}`;
+}
+function normalizeWorkdirPath(path) {
+  let normalized = path.trim().replace(/\\/g, "/").normalize("NFC");
+  if (normalized.startsWith("//?/")) {
+    normalized = normalized.slice(4);
+  }
+  const windowsDrive = /^([A-Za-z]:)\/*(.*)$/.exec(normalized);
+  if (windowsDrive) {
+    const drive = windowsDrive[1].toLowerCase();
+    const rest = windowsDrive[2].replace(/\/+/g, "/").replace(/\/$/, "");
+    return rest ? `${drive}/${rest}` : drive;
+  }
+  normalized = normalized.replace(/\/+/g, "/");
+  if (normalized.length > 1 && normalized.endsWith("/")) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
+}
+function resolveWorkdirPath(cwd = process.cwd()) {
+  const absolute = resolve(cwd);
+  try {
+    return normalizeWorkdirPath(realpathSync.native(absolute));
+  } catch {
+    return normalizeWorkdirPath(absolute);
+  }
+}
+function requireRemoteWorkdir(workdir) {
+  const trimmed = typeof workdir === "string" ? workdir.trim() : "";
+  if (!trimmed) {
+    throw new Error("[apm] \u8FDC\u7A0B\u6D88\u606F\u7F3A\u5C11\u5DE5\u4F5C\u76EE\u5F55 workdir");
+  }
+  return resolveWorkdirPath(trimmed);
+}
+
+// src/git-remote.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+async function tryReadGitOriginUrl(cwd) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["config", "--get", "remote.origin.url"],
+      { cwd, encoding: "utf8", maxBuffer: 1024 * 1024 }
+    );
+    const url = stdout.trim();
+    return url || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/git-utils.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+async function execGit(cwd, args, quiet = false) {
+  try {
+    const { stdout, stderr } = await execFileAsync2("git", args, {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 10 * 1024 * 1024
+    });
+    if (!quiet && stderr.trim()) {
+      process.stderr.write(stderr);
+    }
+    return stdout;
+  } catch (err) {
+    const e = err;
+    const detail = (e.stderr ?? e.message ?? String(err)).trim();
+    throw new Error(
+      `[apm] git ${args.join(" ")} \u5931\u8D25${detail ? `: ${detail}` : ""}`
+    );
+  }
+}
+async function isGitRepo(cwd) {
+  try {
+    await execGit(cwd, ["rev-parse", "--git-dir"], true);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureGitRepo(cwd) {
+  await execGit(cwd, ["rev-parse", "--git-dir"], true);
+}
+async function getCurrentBranch(cwd) {
+  return (await execGit(cwd, ["rev-parse", "--abbrev-ref", "HEAD"], true)).trim();
+}
+async function isWorkingTreeDirty(cwd) {
+  const out = await execGit(cwd, ["status", "--porcelain"], true);
+  return out.trim().length > 0;
+}
+async function remoteBranchExists(cwd, branch) {
+  const out = await execGit(
+    cwd,
+    ["ls-remote", "--heads", "origin", branch],
+    true
+  );
+  return out.trim().length > 0;
+}
+async function resolveGitRepoRoot(cwd) {
+  return (await execGit(cwd, ["rev-parse", "--show-toplevel"], true)).trim();
+}
+async function ensureRemoteBaselineBranch(cwd, baselineBranch) {
+  await execGit(cwd, ["fetch", "origin", baselineBranch], true);
+  if (await remoteBranchExists(cwd, baselineBranch)) {
+    return;
+  }
+  throw new Error(
+    `[apm] \u8FDC\u7A0B\u4E0D\u5B58\u5728\u57FA\u7EBF\u5206\u652F origin/${baselineBranch}\uFF0C\u8BF7\u786E\u8BA4\u4ED3\u5E93\u9ED8\u8BA4\u5206\u652F\u5DF2\u63A8\u9001\u5230 origin`
+  );
+}
+async function resolveDefaultRemoteBranch(cwd) {
+  try {
+    const ref = (await execGit(cwd, ["symbolic-ref", "refs/remotes/origin/HEAD"], true)).trim();
+    const match = ref.match(/^refs\/remotes\/origin\/(.+)$/);
+    if (match?.[1]) {
+      return match[1];
+    }
+  } catch {
+  }
+  for (const candidate of ["main", "master"]) {
+    if (await remoteBranchExists(cwd, candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    "[apm] \u65E0\u6CD5\u786E\u5B9A\u8FDC\u7A0B\u9ED8\u8BA4\u5206\u652F\uFF08origin/HEAD\u3001main\u3001master \u5747\u4E0D\u53EF\u7528\uFF09"
+  );
+}
+async function hasUpstream(cwd) {
+  try {
+    await execGit(cwd, ["rev-parse", "--abbrev-ref", "@{upstream}"], true);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var GITIGNORE_COMMIT_MESSAGE = "chore(apm): ignore .apm directory";
+async function commitAndPushGitignore(workdir) {
+  if (!await isGitRepo(workdir)) {
+    console.log("[apm] \u5F53\u524D\u76EE\u5F55\u4E0D\u662F git \u4ED3\u5E93\uFF0C\u8BF7\u624B\u52A8\u63D0\u4EA4 .gitignore");
+    return;
+  }
+  await execGit(workdir, ["add", "--", ".gitignore"]);
+  await execGit(workdir, ["commit", "-m", GITIGNORE_COMMIT_MESSAGE]);
+  console.log(`[apm] \u5DF2\u63D0\u4EA4 .gitignore: ${GITIGNORE_COMMIT_MESSAGE}`);
+  const originUrl = await tryReadGitOriginUrl(workdir);
+  if (!originUrl) {
+    console.log("[apm] \u672A\u914D\u7F6E remote.origin\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8 push .gitignore");
+    return;
+  }
+  if (await hasUpstream(workdir)) {
+    await execGit(workdir, ["push"]);
+  } else {
+    await execGit(workdir, ["push", "-u", "origin", "HEAD"]);
+  }
+  console.log("[apm] \u5DF2\u63A8\u9001 .gitignore");
+}
+
+// src/baseline-resolve.ts
+function formatBaselineDiagnostic(workdirPath, baselineWorkdirPath, diagnostic) {
+  return diagnostic?.message ?? `\u672A\u5728\u5E73\u53F0\u627E\u5230\u4E0E\u5F53\u524D\u76EE\u5F55\u5339\u914D\u7684\u5DE5\u4F5C\u76EE\u5F55\u767B\u8BB0\uFF1A${workdirPath}\uFF08\u89C4\u8303\u5316\uFF1A${baselineWorkdirPath}\uFF09
+\u8BF7\u5148\u5728\u5E73\u53F0\u767B\u8BB0\u8BE5\u8DEF\u5F84\u5BF9\u5E94\u7684\u5DE5\u4F5C\u76EE\u5F55\u4E0E\u4ED3\u5E93\u3002`;
+}
+async function matchRepositoryByGitRemote(api, workdirPath) {
+  const gitRoot = await resolveGitRepoRoot(workdirPath);
+  const gitUrl = await tryReadGitOriginUrl(gitRoot);
+  if (!gitUrl) {
+    return null;
+  }
+  const matched = await api.cli.matchRepository({ url: gitUrl });
+  const repositoryId = matched.repositoryId?.trim();
+  const defaultBranch = matched.defaultBranch?.trim();
+  if (!repositoryId || !defaultBranch) {
+    return null;
+  }
+  console.log(
+    `[apm] \u5DE5\u4F5C\u7A7A\u95F4\u8DEF\u5F84\u672A\u5339\u914D\uFF0C\u5DF2\u901A\u8FC7 git remote \u5173\u8054\u4ED3\u5E93: ${gitUrl}`
+  );
+  return { repositoryId, defaultBranch };
+}
+async function resolveWorkspaceBaseline(api, workdirPath) {
+  const baseline = await api.cli.workspaceBaseline({ workdirPath });
+  const repositoryId = baseline.repositoryId?.trim();
+  const defaultBranch = baseline.defaultBranch?.trim();
+  if (repositoryId && defaultBranch) {
+    return {
+      repositoryId,
+      defaultBranch,
+      workdirPath: baseline.workdirPath,
+      matchedViaGitRemote: false
+    };
+  }
+  const viaGit = await matchRepositoryByGitRemote(api, workdirPath);
+  if (viaGit) {
+    return {
+      ...viaGit,
+      workdirPath: baseline.workdirPath,
+      matchedViaGitRemote: true
+    };
+  }
+  throw new Error(
+    `[apm] ${formatBaselineDiagnostic(
+      workdirPath,
+      baseline.workdirPath,
+      baseline.diagnostic
+    )}`
+  );
+}
+
+// src/command-utils.ts
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { basename, dirname, extname, join as join2, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var CLI_TEMPLATE_DIR = resolve2(__dirname, "../template");
+function workspaceApmDir(cwd = resolveWorkdirPath()) {
+  return resolve2(resolve2(cwd), ".apm");
+}
+function isWorkspaceApmInitialized(workdir) {
+  const apmDir = workspaceApmDir(workdir);
+  const fsApmDir = toFsPath(apmDir);
+  if (!existsSync(fsApmDir)) {
+    return false;
+  }
+  const st = statSync(fsApmDir);
+  if (!st.isDirectory()) {
+    throw new Error(
+      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u4E0B\u7684 .apm \u4E0D\u662F\u76EE\u5F55\uFF0C\u8BF7\u68C0\u67E5\u672C\u5730\u63A5\u5165\u72B6\u6001\u3002`
+    );
+  }
+  return readdirSync(fsApmDir).length > 0;
+}
+var APM_GITIGNORE_PATTERNS = [
+  /^\.apm\/?$/,
+  /^\.apm\/\*\*$/,
+  /^\*\*\/\.apm\/?$/,
+  /^\*\*\/\.apm\/\*\*$/,
+  /^\/\.apm\/?$/,
+  /^\/\.apm\/\*\*$/
+];
+function normalizeGitignorePattern(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return "";
+  if (trimmed.startsWith("!")) return "";
+  const hashIndex = trimmed.indexOf("#");
+  return (hashIndex >= 0 ? trimmed.slice(0, hashIndex) : trimmed).trim();
+}
+function gitignoreIgnoresApm(line) {
+  const pattern = normalizeGitignorePattern(line);
+  if (!pattern) return false;
+  return APM_GITIGNORE_PATTERNS.some((re) => re.test(pattern));
+}
+var APM_GITIGNORE_LINE = "**/.apm/**";
+function ensureApmGitignoredInRepo(workdir) {
+  const gitignorePath = join2(workdir, ".gitignore");
+  const fsGitignorePath = toFsPath(gitignorePath);
+  if (!existsSync(fsGitignorePath)) {
+    writeFileSync2(fsGitignorePath, `${APM_GITIGNORE_LINE}
+`, "utf8");
+    return true;
+  }
+  const content = readFileSync2(fsGitignorePath, "utf8");
+  if (content.split(/\r?\n/).some(gitignoreIgnoresApm)) {
+    return false;
+  }
+  const suffix = content.endsWith("\n") || content.length === 0 ? "" : "\n";
+  writeFileSync2(
+    fsGitignorePath,
+    `${content}${suffix}${APM_GITIGNORE_LINE}
+`,
+    "utf8"
+  );
+  return true;
+}
+function assertApmGitignoredInRepo(workdir) {
+  const gitignorePath = join2(workdir, ".gitignore");
+  const fsGitignorePath = toFsPath(gitignorePath);
+  if (!existsSync(fsGitignorePath)) {
+    throw new Error(
+      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u7F3A\u5C11 .gitignore \u6587\u4EF6\uFF0C\u8BF7\u6DFB\u52A0\u5BF9 .apm \u7684\u5FFD\u7565\u89C4\u5219\uFF08\u4F8B\u5982 **/.apm/**\uFF09\uFF0C\u907F\u514D\u672C\u5730\u4F1A\u8BDD\u4E0E\u90E8\u7F72\u51ED\u636E\u88AB\u63D0\u4EA4\u3002`
+    );
+  }
+  const content = readFileSync2(fsGitignorePath, "utf8");
+  if (!content.split(/\r?\n/).some(gitignoreIgnoresApm)) {
+    throw new Error(
+      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u7684 .gitignore \u672A\u5FFD\u7565 .apm\uFF0C\u8BF7\u6DFB\u52A0 **/.apm/** \u6216 .apm/\uFF0C\u907F\u514D\u672C\u5730\u4F1A\u8BDD\u4E0E\u90E8\u7F72\u51ED\u636E\u88AB\u63D0\u4EA4\u3002`
+    );
+  }
+}
+async function ensureDirExists(dir) {
+  mkdirSync2(dir, { recursive: true });
+}
+async function ensureWorkspaceApmDirForInit(cwd = resolveWorkdirPath()) {
+  const dir = workspaceApmDir(cwd);
+  const fsDir = toFsPath(dir);
+  if (!existsSync(fsDir)) {
+    mkdirSync2(fsDir, { recursive: true });
+    return;
+  }
+  const st = statSync(fsDir);
+  if (!st.isDirectory()) {
+    throw new Error(`[apm] \u8DEF\u5F84\u5DF2\u5B58\u5728\u4F46\u4E0D\u662F\u76EE\u5F55: ${dir}`);
+  }
+  if (readdirSync(fsDir).length > 0) {
+    throw new Error(
+      "[apm] .apm \u76EE\u5F55\u5DF2\u5B58\u5728\u4E14\u975E\u7A7A\uFF0C\u8BF7\u5148\u5907\u4EFD\u3001\u6E05\u7A7A\u6216\u5220\u9664\u540E\u518D\u6267\u884C init"
+    );
+  }
+}
+var WORKSPACE_TEMPLATE_SUBDIRS = [
+  "sessions",
+  "skills",
+  "rules",
+  "deploy"
+];
+function shouldSkipTemplateEntry(name) {
+  return name === ".DS_Store" || name === "Thumbs.db";
+}
+function copyTemplateEntry(src, dest) {
+  const fsSrc = toFsPath(src);
+  const fsDest = toFsPath(dest);
+  const st = statSync(fsSrc);
+  if (st.isDirectory()) {
+    mkdirSync2(fsDest, { recursive: true });
+    for (const name of readdirSync(fsSrc)) {
+      if (shouldSkipTemplateEntry(name)) continue;
+      copyTemplateEntry(join2(src, name), join2(dest, name));
+    }
+    return;
+  }
+  if (!st.isFile()) return;
+  mkdirSync2(toFsPath(dirname(dest)), { recursive: true });
+  copyFileSync(fsSrc, fsDest);
+}
+function assertTemplateCopiedToApm(apmDir, workdir) {
+  const required = [
+    "AGENTS.md",
+    "apm.config.json",
+    "rules",
+    "skills",
+    "sessions"
+  ];
+  for (const item of required) {
+    const path = join2(apmDir, item);
+    if (!existsSync(toFsPath(path))) {
+      throw new Error(`[apm] \u521D\u59CB\u5316\u4E0D\u5B8C\u6574\uFF0C\u7F3A\u5C11: ${path}`);
+    }
+  }
+  const leakedRules = join2(workdir, "rules");
+  const apmRules = join2(apmDir, "rules");
+  if (existsSync(toFsPath(leakedRules)) && !existsSync(toFsPath(join2(apmRules, "reply.md")))) {
+    throw new Error(
+      `[apm] \u6A21\u677F\u88AB\u590D\u5236\u5230\u9519\u8BEF\u4F4D\u7F6E: ${leakedRules}\uFF08\u5E94\u5728 ${apmRules}\uFF09`
+    );
+  }
+}
+async function copyTemplateFiles(targetDir, workdir = resolveWorkdirPath()) {
+  const resolvedTarget = resolve2(targetDir);
+  const templateDir = resolve2(CLI_TEMPLATE_DIR);
+  const fsTemplateDir = toFsPath(templateDir);
+  if (!existsSync(fsTemplateDir)) {
+    throw new Error(`[apm] \u672A\u627E\u5230 CLI \u6A21\u677F\u76EE\u5F55: ${templateDir}`);
+  }
+  const dirStat = statSync(fsTemplateDir);
+  if (!dirStat.isDirectory()) {
+    throw new Error(`[apm] CLI \u6A21\u677F\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55: ${templateDir}`);
+  }
+  const entries = readdirSync(fsTemplateDir).filter(
+    (name) => !shouldSkipTemplateEntry(name)
+  );
+  if (entries.length === 0) {
+    throw new Error(`[apm] CLI \u6A21\u677F\u76EE\u5F55\u4E3A\u7A7A: ${templateDir}`);
+  }
+  mkdirSync2(toFsPath(resolvedTarget), { recursive: true });
+  for (const name of entries) {
+    copyTemplateEntry(join2(templateDir, name), join2(resolvedTarget, name));
+  }
+  for (const subdir of WORKSPACE_TEMPLATE_SUBDIRS) {
+    mkdirSync2(toFsPath(join2(resolvedTarget, subdir)), { recursive: true });
+  }
+  assertTemplateCopiedToApm(resolvedTarget, resolve2(workdir));
+}
+
+// src/workspace-repos.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  readdirSync as readdirSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { basename as basename2, join as join3, relative, resolve as resolve3 } from "path";
+var WORKSPACE_REPOS_MANIFEST = "workspace-repos.json";
+var WORKSPACE_REPOS_VERSION = 1;
+var SKIP_DIR_NAMES = /* @__PURE__ */ new Set([".apm", "node_modules"]);
+function hasGitAt(dir) {
+  return existsSync2(toFsPath(join3(dir, ".git")));
+}
+function isSkippableChildName(name) {
+  if (SKIP_DIR_NAMES.has(name)) return true;
+  if (name.startsWith(".")) return true;
+  return false;
+}
+function manifestPath(workdir) {
+  return join3(workspaceApmDir(workdir), WORKSPACE_REPOS_MANIFEST);
+}
+function absoluteRepoPath(workdir, entry) {
+  if (entry.path === "." || entry.path === "") {
+    return workdir;
+  }
+  return resolve3(workdir, entry.path);
+}
+function toRelativeRepoPath(workdir, repoAbs) {
+  const rel = relative(workdir, repoAbs).replace(/\\/g, "/");
+  return rel === "" ? "." : rel;
+}
+function readManifest(workdir) {
+  const path = toFsPath(manifestPath(workdir));
+  if (!existsSync2(path)) {
+    return null;
+  }
+  try {
+    const raw = JSON.parse(
+      readFileSync3(path, "utf8")
+    );
+    if (raw?.version !== WORKSPACE_REPOS_VERSION) {
+      return null;
+    }
+    if (raw.kind !== "single" && raw.kind !== "multi") {
+      return null;
+    }
+    if (!Array.isArray(raw.repos) || raw.repos.length === 0) {
+      return null;
+    }
+    if (typeof raw.workdir !== "string" || !raw.workdir.trim()) {
+      return null;
+    }
+    return raw;
+  } catch {
+    return null;
+  }
+}
+function writeManifest(workdir, manifest) {
+  const apmDir = toFsPath(workspaceApmDir(workdir));
+  mkdirSync3(apmDir, { recursive: true });
+  const path = toFsPath(manifestPath(workdir));
+  writeFileSync3(path, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+}
+function manifestStillValid(workdir, manifest) {
+  if (normalizeWorkdirPath(manifest.workdir) !== normalizeWorkdirPath(workdir)) {
+    return false;
+  }
+  for (const entry of manifest.repos) {
+    if (typeof entry?.path !== "string" || !entry.path.trim()) {
+      return false;
+    }
+    const abs = absoluteRepoPath(workdir, entry);
+    if (!hasGitAt(abs)) {
+      return false;
+    }
+  }
+  return true;
+}
+function scanWorkspaceRepos(workdirInput) {
+  const workdir = resolveWorkdirPath(workdirInput);
+  if (hasGitAt(workdir)) {
+    return {
+      version: WORKSPACE_REPOS_VERSION,
+      kind: "single",
+      workdir,
+      repos: [{ path: "." }],
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  const fsWorkdir = toFsPath(workdir);
+  if (!existsSync2(fsWorkdir) || !statSync2(fsWorkdir).isDirectory()) {
+    throw new Error(`[apm] \u5DE5\u4F5C\u533A\u76EE\u5F55\u4E0D\u5B58\u5728\u6216\u4E0D\u662F\u76EE\u5F55: ${workdir}`);
+  }
+  const repos = [];
+  for (const name of readdirSync2(fsWorkdir)) {
+    if (isSkippableChildName(name)) {
+      continue;
+    }
+    const childAbs = resolve3(workdir, name);
+    const childFs = toFsPath(childAbs);
+    if (!existsSync2(childFs) || !statSync2(childFs).isDirectory()) {
+      continue;
+    }
+    if (!hasGitAt(childAbs)) {
+      continue;
+    }
+    repos.push({ path: toRelativeRepoPath(workdir, childAbs) });
+  }
+  repos.sort((a, b) => a.path.localeCompare(b.path));
+  if (repos.length === 0) {
+    throw new Error(
+      `[apm] \u5DE5\u4F5C\u533A ${workdir} \u6839\u76EE\u5F55\u65E0 .git\uFF0C\u4E14\u4E00\u7EA7\u5B50\u76EE\u5F55\u4E2D\u672A\u53D1\u73B0 git \u4ED3\u5E93`
+    );
+  }
+  return {
+    version: WORKSPACE_REPOS_VERSION,
+    kind: "multi",
+    workdir,
+    repos,
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function loadWorkspaceReposCache(workdirInput) {
+  const workdir = resolveWorkdirPath(workdirInput);
+  const cached = readManifest(workdir);
+  if (!cached) {
+    throw new Error(
+      `[apm] \u672A\u627E\u5230\u5DE5\u4F5C\u533A\u4ED3\u5E93\u7F13\u5B58 .apm/${WORKSPACE_REPOS_MANIFEST}\uFF0C\u8BF7\u5148\u6267\u884C\u4ED3\u5E93\u68C0\u6D4B`
+    );
+  }
+  if (normalizeWorkdirPath(cached.workdir) !== normalizeWorkdirPath(workdir)) {
+    throw new Error(
+      `[apm] \u5DE5\u4F5C\u533A\u4ED3\u5E93\u7F13\u5B58 workdir \u4E0D\u5339\u914D\uFF1A\u7F13\u5B58=${cached.workdir} \u5F53\u524D=${workdir}\uFF0C\u8BF7\u5F3A\u5236\u91CD\u65B0\u626B\u63CF`
+    );
+  }
+  if (!Array.isArray(cached.repos) || cached.repos.length === 0) {
+    throw new Error(`[apm] \u5DE5\u4F5C\u533A\u4ED3\u5E93\u7F13\u5B58\u65E0\u6548\uFF08repos \u4E3A\u7A7A\uFF09\uFF0C\u8BF7\u5F3A\u5236\u91CD\u65B0\u626B\u63CF`);
+  }
+  console.log(
+    `[apm] \u8BFB\u53D6\u5DE5\u4F5C\u533A\u4ED3\u5E93\u7F13\u5B58 kind=${cached.kind} repos=${cached.repos.map((r) => r.path).join(", ")}`
+  );
+  return {
+    ...cached,
+    workdir
+  };
+}
+function resolveWorkspaceRepos(workdirInput, options) {
+  const workdir = resolveWorkdirPath(workdirInput);
+  if (!options?.forceRescan) {
+    const cached = readManifest(workdir);
+    if (cached && manifestStillValid(workdir, cached)) {
+      console.log(
+        `[apm] \u4F7F\u7528\u7F13\u5B58\u7684\u5DE5\u4F5C\u533A\u4ED3\u5E93\u6E05\u5355 kind=${cached.kind} repos=${cached.repos.length}`
+      );
+      return cached;
+    }
   }
+  const scanned = scanWorkspaceRepos(workdir);
+  writeManifest(workdir, scanned);
+  console.log(
+    `[apm] \u5DF2\u626B\u63CF\u5DE5\u4F5C\u533A\u4ED3\u5E93 kind=${scanned.kind} repos=${scanned.repos.map((r) => r.path).join(", ")} \u2192 .apm/${WORKSPACE_REPOS_MANIFEST}`
+  );
+  return scanned;
 }
-
-// src/api/client.ts
-function createApmApiClient(cfg) {
-  const baseURL = `${cfg.baseUrl.trim().replace(/\/+$/, "")}/api/v1`;
-  return createApiClient(requestConfig, {
-    baseURL,
-    getToken: () => resolveApiKey(cfg) || void 0,
-    successCodes: [0],
-    unauthorizedCodes: [401]
-  });
+function resolveWorkspaceRepoAbsolutePaths(manifest) {
+  return manifest.repos.map(
+    (entry) => absoluteRepoPath(manifest.workdir, entry)
+  );
+}
+function formatRepoLabel(workdir, repoAbs) {
+  const rel = toRelativeRepoPath(resolveWorkdirPath(workdir), repoAbs);
+  return rel === "." ? basename2(repoAbs) || repoAbs : rel;
 }
 
-// src/workdir-path.ts
-import { realpathSync } from "fs";
-import { platform } from "os";
-import { resolve } from "path";
-function toFsPath(inputPath) {
-  const absolute = resolve(inputPath);
-  if (platform() !== "win32") return absolute;
-  if (absolute.startsWith("\\\\?\\")) return absolute;
-  const normalized = absolute.replace(/\//g, "\\");
-  if (normalized.startsWith("\\\\")) {
-    return `\\\\?\\UNC\\${normalized.slice(2)}`;
+// src/commands/branch.ts
+var TASK_BRANCH_PREFIX = "feat/task-";
+async function localBranchExists(cwd, branch) {
+  try {
+    await execGit(
+      cwd,
+      ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`],
+      true
+    );
+    return true;
+  } catch {
+    return false;
   }
-  return `\\\\?\\${normalized}`;
 }
-function normalizeWorkdirPath(path) {
-  let normalized = path.trim().replace(/\\/g, "/").normalize("NFC");
-  if (normalized.startsWith("//?/")) {
-    normalized = normalized.slice(4);
+async function commitWorkingTreeIfDirty(cwd, message) {
+  await ensureGitRepo(cwd);
+  if (!await isWorkingTreeDirty(cwd)) {
+    return false;
   }
-  const windowsDrive = /^([A-Za-z]:)\/*(.*)$/.exec(normalized);
-  if (windowsDrive) {
-    const drive = windowsDrive[1].toLowerCase();
-    const rest = windowsDrive[2].replace(/\/+/g, "/").replace(/\/$/, "");
-    return rest ? `${drive}/${rest}` : drive;
+  const commitMessage = message?.trim() || `chore(apm): \u540C\u6B65\u5DE5\u4F5C\u533A (${await getCurrentBranch(cwd)})`;
+  await execGit(cwd, ["add", "-A"]);
+  await execGit(cwd, ["commit", "-m", commitMessage]);
+  console.log(`[apm] \u5DF2\u63D0\u4EA4\u5DE5\u4F5C\u533A\u53D8\u66F4: ${commitMessage}`);
+  return true;
+}
+function branchNameForTask(taskId) {
+  const id = taskId.trim();
+  if (!id) {
+    throw new Error("[apm] \u4EFB\u52A1 ID \u4E0D\u80FD\u4E3A\u7A7A");
   }
-  normalized = normalized.replace(/\/+/g, "/");
-  if (normalized.length > 1 && normalized.endsWith("/")) {
-    normalized = normalized.slice(0, -1);
+  if (/[\s/\\]/.test(id)) {
+    throw new Error(
+      "[apm] \u4EFB\u52A1 ID \u4E0D\u80FD\u5305\u542B\u7A7A\u767D\u6216\u8DEF\u5F84\u5206\u9694\u7B26\uFF0C\u8BF7\u4F7F\u7528\u5B57\u6BCD\u3001\u6570\u5B57\u3001._- \u7B49"
+    );
   }
-  return normalized;
-}
-function resolveWorkdirPath(cwd = process.cwd()) {
-  const absolute = resolve(cwd);
-  try {
-    return normalizeWorkdirPath(realpathSync.native(absolute));
-  } catch {
-    return normalizeWorkdirPath(absolute);
+  return `${TASK_BRANCH_PREFIX}${id}`;
+}
+async function ensureFeatureBranch(branch, baselineBranch, options) {
+  const cwd = options.cwd ?? process.cwd();
+  const gitRoot = await resolveGitRepoRoot(cwd);
+  const commitMessage = options.message?.trim() || `chore(apm): \u540C\u6B65\u5DE5\u4F5C\u533A (${branch})`;
+  await ensureGitRepo(gitRoot);
+  await ensureRemoteBaselineBranch(gitRoot, baselineBranch);
+  const current = await getCurrentBranch(gitRoot);
+  const dirty = await isWorkingTreeDirty(gitRoot);
+  if (dirty) {
+    if (current === branch) {
+      await commitWorkingTreeIfDirty(gitRoot, commitMessage);
+    } else {
+      await execGit(gitRoot, [
+        "stash",
+        "push",
+        "-u",
+        "-m",
+        `apm: switch to ${branch}`
+      ]);
+    }
   }
-}
-function requireRemoteWorkdir(workdir) {
-  const trimmed = typeof workdir === "string" ? workdir.trim() : "";
-  if (!trimmed) {
-    throw new Error("[apm] \u8FDC\u7A0B\u6D88\u606F\u7F3A\u5C11\u5DE5\u4F5C\u76EE\u5F55 workdir");
+  const onTargetBranch = await getCurrentBranch(gitRoot) === branch;
+  if (onTargetBranch) {
+    await execGit(gitRoot, ["fetch", "origin", baselineBranch]);
+    await execGit(gitRoot, ["merge", `origin/${baselineBranch}`, "--no-edit"]);
+  } else {
+    const remoteExists = await remoteBranchExists(gitRoot, branch);
+    if (remoteExists) {
+      await execGit(gitRoot, ["fetch", "origin", branch]);
+      await execGit(gitRoot, ["checkout", "-B", branch, `origin/${branch}`]);
+    } else if (await localBranchExists(gitRoot, branch)) {
+      if (await getCurrentBranch(gitRoot) !== branch) {
+        await execGit(gitRoot, ["checkout", branch]);
+      }
+      console.log(`[apm] \u5206\u652F ${branch} \u5DF2\u5B58\u5728\uFF0C\u8DF3\u8FC7\u521B\u5EFA`);
+    } else {
+      await execGit(gitRoot, ["fetch", "origin", baselineBranch]);
+      try {
+        await execGit(gitRoot, [
+          "checkout",
+          "-b",
+          branch,
+          `origin/${baselineBranch}`
+        ]);
+        await execGit(gitRoot, ["push", "-u", "origin", branch]);
+      } catch (err) {
+        if (await localBranchExists(gitRoot, branch)) {
+          if (await getCurrentBranch(gitRoot) !== branch) {
+            await execGit(gitRoot, ["checkout", branch]);
+          }
+          console.log(`[apm] \u5206\u652F ${branch} \u5DF2\u5B58\u5728\uFF0C\u8DF3\u8FC7\u521B\u5EFA`);
+        } else {
+          throw err;
+        }
+      }
+    }
   }
-  return resolveWorkdirPath(trimmed);
+  console.log(`[apm] \u5DF2\u5C31\u7EEA\u5206\u652F ${branch}`);
+  return branch;
+}
+async function runTaskBranch(taskId, options = {}) {
+  const trimmedTaskId = taskId.trim();
+  if (!trimmedTaskId) {
+    throw new Error("[apm] taskId \u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  const cwd = options.cwd ?? process.cwd();
+  const workdirPath = resolveWorkdirPath(cwd);
+  const manifest = loadWorkspaceReposCache(workdirPath);
+  const repoRoots = resolveWorkspaceRepoAbsolutePaths(manifest);
+  const branch = branchNameForTask(trimmedTaskId);
+  for (const gitRoot of repoRoots) {
+    const label = formatRepoLabel(workdirPath, gitRoot);
+    const baselineBranch = await resolveDefaultRemoteBranch(gitRoot);
+    console.log(
+      `[apm] \u4EFB\u52A1\u5206\u652F ${branch} @ ${label} (baseline=${baselineBranch})`
+    );
+    await ensureFeatureBranch(branch, baselineBranch, {
+      ...options,
+      cwd: gitRoot
+    });
+  }
+  return { branch, kind: manifest.kind, repos: repoRoots };
 }
 
 // src/commands/connect/cursor-agent.ts
@@ -532,17 +1199,17 @@ ${JSON.stringify(event, null, 2)}
 }
 
 // src/commands/connect/agent-session-registry.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname2, resolve as resolve4 } from "node:path";
 function registryPath(workdir, sessionId) {
-  return resolve2(workdir, ".apm", "sessions", sessionId, "cursor-agents.json");
+  return resolve4(workdir, ".apm", "sessions", sessionId, "cursor-agents.json");
 }
 function readRegistry(path) {
-  if (!existsSync(path)) {
+  if (!existsSync3(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       const result = {};
       for (const [key, value] of Object.entries(
@@ -559,8 +1226,8 @@ function readRegistry(path) {
   return {};
 }
 function writeRegistry(path, registry) {
-  mkdirSync2(dirname(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify(registry, null, 2)}
+  mkdirSync4(dirname2(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(registry, null, 2)}
 `, "utf8");
 }
 function loadSessionAgentId(workdir, sessionId, user) {
@@ -713,193 +1380,11 @@ function installAbortSignalDebug() {
 ${stack}`
       );
     }
-    return original.call(this, type, listener, options);
-  };
-  console.log(
-    "[apm:abort-debug] \u5DF2\u542F\u7528 AbortSignal \u8C03\u8BD5\uFF08APM_DEBUG_ABORT_SIGNAL\uFF09"
-  );
-}
-
-// src/command-utils.ts
-import {
-  copyFileSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  readdirSync,
-  statSync,
-  writeFileSync as writeFileSync3
-} from "fs";
-import { basename, dirname as dirname2, extname, join as join2, resolve as resolve3 } from "path";
-import { fileURLToPath } from "url";
-var __dirname = dirname2(fileURLToPath(import.meta.url));
-var CLI_TEMPLATE_DIR = resolve3(__dirname, "../template");
-function workspaceApmDir(cwd = resolveWorkdirPath()) {
-  return resolve3(resolve3(cwd), ".apm");
-}
-function isWorkspaceApmInitialized(workdir) {
-  const apmDir = workspaceApmDir(workdir);
-  const fsApmDir = toFsPath(apmDir);
-  if (!existsSync2(fsApmDir)) {
-    return false;
-  }
-  const st = statSync(fsApmDir);
-  if (!st.isDirectory()) {
-    throw new Error(
-      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u4E0B\u7684 .apm \u4E0D\u662F\u76EE\u5F55\uFF0C\u8BF7\u68C0\u67E5\u672C\u5730\u63A5\u5165\u72B6\u6001\u3002`
-    );
-  }
-  return readdirSync(fsApmDir).length > 0;
-}
-var APM_GITIGNORE_PATTERNS = [
-  /^\.apm\/?$/,
-  /^\.apm\/\*\*$/,
-  /^\*\*\/\.apm\/?$/,
-  /^\*\*\/\.apm\/\*\*$/,
-  /^\/\.apm\/?$/,
-  /^\/\.apm\/\*\*$/
-];
-function normalizeGitignorePattern(line) {
-  const trimmed = line.trim();
-  if (!trimmed || trimmed.startsWith("#")) return "";
-  if (trimmed.startsWith("!")) return "";
-  const hashIndex = trimmed.indexOf("#");
-  return (hashIndex >= 0 ? trimmed.slice(0, hashIndex) : trimmed).trim();
-}
-function gitignoreIgnoresApm(line) {
-  const pattern = normalizeGitignorePattern(line);
-  if (!pattern) return false;
-  return APM_GITIGNORE_PATTERNS.some((re) => re.test(pattern));
-}
-var APM_GITIGNORE_LINE = "**/.apm/**";
-function ensureApmGitignoredInRepo(workdir) {
-  const gitignorePath = join2(workdir, ".gitignore");
-  const fsGitignorePath = toFsPath(gitignorePath);
-  if (!existsSync2(fsGitignorePath)) {
-    writeFileSync3(fsGitignorePath, `${APM_GITIGNORE_LINE}
-`, "utf8");
-    return true;
-  }
-  const content = readFileSync3(fsGitignorePath, "utf8");
-  if (content.split(/\r?\n/).some(gitignoreIgnoresApm)) {
-    return false;
-  }
-  const suffix = content.endsWith("\n") || content.length === 0 ? "" : "\n";
-  writeFileSync3(
-    fsGitignorePath,
-    `${content}${suffix}${APM_GITIGNORE_LINE}
-`,
-    "utf8"
-  );
-  return true;
-}
-function assertApmGitignoredInRepo(workdir) {
-  const gitignorePath = join2(workdir, ".gitignore");
-  const fsGitignorePath = toFsPath(gitignorePath);
-  if (!existsSync2(fsGitignorePath)) {
-    throw new Error(
-      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u7F3A\u5C11 .gitignore \u6587\u4EF6\uFF0C\u8BF7\u6DFB\u52A0\u5BF9 .apm \u7684\u5FFD\u7565\u89C4\u5219\uFF08\u4F8B\u5982 **/.apm/**\uFF09\uFF0C\u907F\u514D\u672C\u5730\u4F1A\u8BDD\u4E0E\u90E8\u7F72\u51ED\u636E\u88AB\u63D0\u4EA4\u3002`
-    );
-  }
-  const content = readFileSync3(fsGitignorePath, "utf8");
-  if (!content.split(/\r?\n/).some(gitignoreIgnoresApm)) {
-    throw new Error(
-      `\u5DE5\u4F5C\u76EE\u5F55 ${workdir} \u7684 .gitignore \u672A\u5FFD\u7565 .apm\uFF0C\u8BF7\u6DFB\u52A0 **/.apm/** \u6216 .apm/\uFF0C\u907F\u514D\u672C\u5730\u4F1A\u8BDD\u4E0E\u90E8\u7F72\u51ED\u636E\u88AB\u63D0\u4EA4\u3002`
-    );
-  }
-}
-async function ensureDirExists(dir) {
-  mkdirSync3(dir, { recursive: true });
-}
-async function ensureWorkspaceApmDirForInit(cwd = resolveWorkdirPath()) {
-  const dir = workspaceApmDir(cwd);
-  const fsDir = toFsPath(dir);
-  if (!existsSync2(fsDir)) {
-    mkdirSync3(fsDir, { recursive: true });
-    return;
-  }
-  const st = statSync(fsDir);
-  if (!st.isDirectory()) {
-    throw new Error(`[apm] \u8DEF\u5F84\u5DF2\u5B58\u5728\u4F46\u4E0D\u662F\u76EE\u5F55: ${dir}`);
-  }
-  if (readdirSync(fsDir).length > 0) {
-    throw new Error(
-      "[apm] .apm \u76EE\u5F55\u5DF2\u5B58\u5728\u4E14\u975E\u7A7A\uFF0C\u8BF7\u5148\u5907\u4EFD\u3001\u6E05\u7A7A\u6216\u5220\u9664\u540E\u518D\u6267\u884C init"
-    );
-  }
-}
-var WORKSPACE_TEMPLATE_SUBDIRS = [
-  "sessions",
-  "skills",
-  "rules",
-  "deploy"
-];
-function shouldSkipTemplateEntry(name) {
-  return name === ".DS_Store" || name === "Thumbs.db";
-}
-function copyTemplateEntry(src, dest) {
-  const fsSrc = toFsPath(src);
-  const fsDest = toFsPath(dest);
-  const st = statSync(fsSrc);
-  if (st.isDirectory()) {
-    mkdirSync3(fsDest, { recursive: true });
-    for (const name of readdirSync(fsSrc)) {
-      if (shouldSkipTemplateEntry(name)) continue;
-      copyTemplateEntry(join2(src, name), join2(dest, name));
-    }
-    return;
-  }
-  if (!st.isFile()) return;
-  mkdirSync3(toFsPath(dirname2(dest)), { recursive: true });
-  copyFileSync(fsSrc, fsDest);
-}
-function assertTemplateCopiedToApm(apmDir, workdir) {
-  const required = [
-    "AGENTS.md",
-    "apm.config.json",
-    "rules",
-    "skills",
-    "sessions"
-  ];
-  for (const item of required) {
-    const path = join2(apmDir, item);
-    if (!existsSync2(toFsPath(path))) {
-      throw new Error(`[apm] \u521D\u59CB\u5316\u4E0D\u5B8C\u6574\uFF0C\u7F3A\u5C11: ${path}`);
-    }
-  }
-  const leakedRules = join2(workdir, "rules");
-  const apmRules = join2(apmDir, "rules");
-  if (existsSync2(toFsPath(leakedRules)) && !existsSync2(toFsPath(join2(apmRules, "reply.md")))) {
-    throw new Error(
-      `[apm] \u6A21\u677F\u88AB\u590D\u5236\u5230\u9519\u8BEF\u4F4D\u7F6E: ${leakedRules}\uFF08\u5E94\u5728 ${apmRules}\uFF09`
-    );
-  }
-}
-async function copyTemplateFiles(targetDir, workdir = resolveWorkdirPath()) {
-  const resolvedTarget = resolve3(targetDir);
-  const templateDir = resolve3(CLI_TEMPLATE_DIR);
-  const fsTemplateDir = toFsPath(templateDir);
-  if (!existsSync2(fsTemplateDir)) {
-    throw new Error(`[apm] \u672A\u627E\u5230 CLI \u6A21\u677F\u76EE\u5F55: ${templateDir}`);
-  }
-  const dirStat = statSync(fsTemplateDir);
-  if (!dirStat.isDirectory()) {
-    throw new Error(`[apm] CLI \u6A21\u677F\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55: ${templateDir}`);
-  }
-  const entries = readdirSync(fsTemplateDir).filter(
-    (name) => !shouldSkipTemplateEntry(name)
-  );
-  if (entries.length === 0) {
-    throw new Error(`[apm] CLI \u6A21\u677F\u76EE\u5F55\u4E3A\u7A7A: ${templateDir}`);
-  }
-  mkdirSync3(toFsPath(resolvedTarget), { recursive: true });
-  for (const name of entries) {
-    copyTemplateEntry(join2(templateDir, name), join2(resolvedTarget, name));
-  }
-  for (const subdir of WORKSPACE_TEMPLATE_SUBDIRS) {
-    mkdirSync3(toFsPath(join2(resolvedTarget, subdir)), { recursive: true });
-  }
-  assertTemplateCopiedToApm(resolvedTarget, resolve3(workdir));
+    return original.call(this, type, listener, options);
+  };
+  console.log(
+    "[apm:abort-debug] \u5DF2\u542F\u7528 AbortSignal \u8C03\u8BD5\uFF08APM_DEBUG_ABORT_SIGNAL\uFF09"
+  );
 }
 
 // src/commands/append-message.ts
@@ -1078,11 +1563,99 @@ function createUpsertWebIdePlanTool(options) {
   };
 }
 
+// src/commands/connect/webide-test-case-tools.ts
+function asString2(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function asStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => typeof item === "string" ? item.trim() : String(item)).filter(Boolean);
+}
+function parseCases(raw) {
+  if (!Array.isArray(raw)) return [];
+  const cases = [];
+  for (const [index, item] of raw.entries()) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const row = item;
+    const name = asString2(row.name);
+    if (!name) continue;
+    const steps = asStringArray(row.steps);
+    if (steps.length === 0) continue;
+    cases.push({
+      name,
+      description: asString2(row.description),
+      steps,
+      sortOrder: typeof row.sortOrder === "number" && Number.isFinite(row.sortOrder) ? row.sortOrder : index
+    });
+  }
+  return cases;
+}
+function createUpsertWebIdeTestCasesTool(options) {
+  const { cfg, taskId } = options;
+  return {
+    description: "Persist generated automated test cases for this WebIDE task (full replace) and mark the workflow TEST_READY. Call once with the complete case list after reviewing the task and code changes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        cases: {
+          type: "array",
+          description: "Complete list of test cases to store on the platform",
+          items: {
+            type: "object",
+            properties: {
+              name: {
+                type: "string",
+                description: "Short stable case id / name"
+              },
+              description: {
+                type: "string",
+                description: "What this case verifies (Chinese ok)"
+              },
+              steps: {
+                type: "array",
+                items: { type: "string" },
+                description: "Ordered human-readable steps"
+              },
+              sortOrder: {
+                type: "number",
+                description: "Optional display order (0-based)"
+              }
+            },
+            required: ["name", "description", "steps"]
+          }
+        }
+      },
+      required: ["cases"]
+    },
+    execute: async (args) => {
+      const cases = parseCases(args.cases);
+      if (cases.length === 0) {
+        throw new Error(
+          "UpsertWebIdeTestCases \u7F3A\u5C11\u6709\u6548 cases\uFF08\u6BCF\u6761\u9700 name \u4E0E\u975E\u7A7A steps\uFF09"
+        );
+      }
+      const api = createApmApiClient(cfg);
+      const result = await api.cli.webideReplaceTestCases({ taskId, cases });
+      console.log(
+        `[apm] UpsertWebIdeTestCases taskId=${taskId} count=${cases.length}`
+      );
+      return JSON.stringify(
+        { ok: true, count: result.count ?? cases.length },
+        null,
+        2
+      );
+    }
+  };
+}
+
 // src/commands/connect/cursor-custom-tools.ts
 var PLAN_MODE_ASK_QUESTION_HINT = `[SDK \u73AF\u5883\u8BF4\u660E]
 AskQuestion \u5DF2\u901A\u8FC7 MCP \u670D\u52A1\u5668 custom-user-tools \u6CE8\u518C\uFF0C\u5DE5\u5177\u540D\u4E3A AskQuestion\u3002
 \u9700\u8981\u5411\u7528\u6237\u786E\u8BA4\u65F6\uFF0C\u8BF7\u8C03\u7528 AskQuestion\uFF08\u7ECF CallMcpTool / custom-user-tools\uFF09\uFF0C\u4E0D\u8981\u5047\u8BBE IDE \u5185\u7F6E AskQuestion \u4E0D\u53EF\u7528\u3002
 \u975E\u5FC5\u987B\u7684\u95EE\u9898\u53EF\u8DF3\u8FC7\uFF0C\u76F4\u63A5\u5B8C\u6210 createPlan\u3002`;
+var WORKSPACE_BOUNDARY_HINT = `[\u5DE5\u4F5C\u533A\u8FB9\u754C]
+\u6240\u6709\u6587\u4EF6\u8BFB\u5199\u3001\u641C\u7D22\uFF08Grep/Glob/Read\uFF09\u3001Shell \u5FC5\u987B\u4E25\u683C\u9650\u5236\u5728\u5F53\u524D\u5DE5\u4F5C\u533A cwd \u5185\u3002
+\u7981\u6B62\u8BBF\u95EE\u5DE5\u4F5C\u533A\u5916\u8DEF\u5F84\uFF08\u5982\u5176\u5B83\u9879\u76EE\u3001~/.cursor\u3001agent-transcripts\u3001\u7CFB\u7EDF\u76EE\u5F55\u7B49\uFF09\u3002`;
 function createCursorCustomTools(cfg, messageId, options) {
   const tools = {
     ...createAppendMessageCustomTools(
@@ -1104,6 +1677,10 @@ function createCursorCustomTools(cfg, messageId, options) {
       cfg,
       taskId: options.taskId
     });
+    tools.UpsertWebIdeTestCases = createUpsertWebIdeTestCasesTool({
+      cfg,
+      taskId: options.taskId
+    });
   }
   return tools;
 }
@@ -1115,14 +1692,19 @@ function withPlanModeToolHint(prompt, mode) {
 
 ${PLAN_MODE_ASK_QUESTION_HINT}`;
 }
+function withWorkspaceBoundaryHint(prompt) {
+  return `${prompt.trim()}
+
+${WORKSPACE_BOUNDARY_HINT}`;
+}
 
 // src/commands/connect/local-agent-store.ts
-import { mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join3 } from "node:path";
+import { mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join4 } from "node:path";
 import { JsonlLocalAgentStore } from "@cursor/sdk";
 function createWorkspaceLocalAgentStore(workdir) {
-  const rootDir = join3(workdir, ".apm", "cursor-agent-store");
-  mkdirSync4(rootDir, { recursive: true });
+  const rootDir = join4(workdir, ".apm", "cursor-agent-store");
+  mkdirSync5(rootDir, { recursive: true });
   return new JsonlLocalAgentStore(rootDir);
 }
 
@@ -1160,7 +1742,8 @@ async function obtainAgent(ctx) {
     local: {
       cwd: ctx.cwd,
       store: createWorkspaceLocalAgentStore(ctx.workdir),
-      ...ctx.customTools ? { customTools: ctx.customTools } : {}
+      ...ctx.customTools ? { customTools: ctx.customTools } : {},
+      ...ctx.enableSandbox ? { sandboxOptions: { enabled: true } } : {}
     },
     ...ctx.mode ? { mode: ctx.mode } : {}
     // mcpServers: createPlaywrightMcpServers(),
@@ -1169,14 +1752,14 @@ async function obtainAgent(ctx) {
   const savedAgentId = explicitAgentId || (ctx.user ? loadSessionAgentId(ctx.workdir, ctx.sessionId, ctx.user) : void 0);
   if (savedAgentId) {
     try {
-      const agent2 = await Agent.resume(savedAgentId, agentOptions);
+      const agent = await Agent.resume(savedAgentId, agentOptions);
       console.log(
         `[apm] \u590D\u7528 Agent user=${ctx.user} agentId=${savedAgentId}${explicitAgentId ? "\uFF08\u53C2\u6570\u6307\u5B9A\uFF09" : ""}`
       );
       if (ctx.user) {
-        saveSessionAgentId(ctx.workdir, ctx.sessionId, ctx.user, agent2.agentId);
+        saveSessionAgentId(ctx.workdir, ctx.sessionId, ctx.user, agent.agentId);
       }
-      return { agent: agent2, resumed: true };
+      return { agent, resumed: true };
     } catch (err) {
       console.warn(
         `[apm] \u590D\u7528 Agent \u5931\u8D25\uFF08agentId=${savedAgentId}\uFF09\uFF0C\u56DE\u9000\u4E3A\u65B0\u5EFA:`,
@@ -1187,11 +1770,19 @@ async function obtainAgent(ctx) {
       }
     }
   }
-  const agent = await Agent.create(agentOptions);
-  if (ctx.user) {
-    saveSessionAgentId(ctx.workdir, ctx.sessionId, ctx.user, agent.agentId);
+  try {
+    const agent = await Agent.create(agentOptions);
+    if (ctx.user) {
+      saveSessionAgentId(ctx.workdir, ctx.sessionId, ctx.user, agent.agentId);
+    }
+    return { agent, resumed: false };
+  } catch (err) {
+    if (ctx.enableSandbox && err instanceof Error && /sandbox/i.test(err.message)) {
+      console.warn("[apm] sandbox \u4E0D\u53EF\u7528\uFF0C\u56DE\u9000\u4E3A\u65E0 sandbox:", err.message);
+      return obtainAgent({ ...ctx, enableSandbox: false });
+    }
+    throw err;
   }
-  return { agent, resumed: false };
 }
 async function runCursorAgent(cfg, ctx, options) {
   const signal = options?.signal;
@@ -1211,9 +1802,13 @@ async function runCursorAgent(cfg, ctx, options) {
     enableWebIdePlanTools: options?.enableWebIdePlanTools,
     taskId: options?.taskId
   });
-  const prompt = withPlanModeToolHint(ctx.prompt, ctx.mode);
+  const enableSandbox = Boolean(options?.enableSandbox);
+  let prompt = withPlanModeToolHint(ctx.prompt, ctx.mode);
+  if (enableSandbox) {
+    prompt = withWorkspaceBoundaryHint(prompt);
+  }
   console.log(
-    `[apm] Cursor Agent \u5F00\u59CB messageId=${ctx.messageId} sessionId=${ctx.sessionId} cwd=${workdir}`
+    `[apm] Cursor Agent \u5F00\u59CB messageId=${ctx.messageId} sessionId=${ctx.sessionId} cwd=${workdir} sandbox=${enableSandbox}`
   );
   const { agent, resumed } = await obtainAgent({
     apiKey,
@@ -1224,7 +1819,8 @@ async function runCursorAgent(cfg, ctx, options) {
     user: ctx.user,
     mode: ctx.mode,
     resumeAgentId: ctx.resumeAgentId,
-    customTools
+    customTools,
+    enableSandbox
   });
   const eventSession = new EventSession(prompt);
   const syncRemoteLog = options?.createRemoteLogSync ? options.createRemoteLogSync(agent.agentId) : options?.skipRemoteLogSync ? noopRemoteLogSync : createThrottledCursorMessageLogSync(
@@ -1348,17 +1944,17 @@ async function runCursorAgent(cfg, ctx, options) {
 }
 
 // src/commands/connect/webide-agent-registry.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname3, resolve as resolve5 } from "node:path";
 function registryPath2(workdir, taskId) {
-  return resolve4(workdir, ".apm", "webide", taskId, "cursor-agent.json");
+  return resolve5(workdir, ".apm", "webide", taskId, "cursor-agent.json");
 }
 function readRegistry2(path) {
-  if (!existsSync3(path)) {
+  if (!existsSync4(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       const agentId = parsed.agentId;
       if (typeof agentId === "string" && agentId.trim()) {
@@ -1370,8 +1966,8 @@ function readRegistry2(path) {
   return {};
 }
 function writeRegistry2(path, registry) {
-  mkdirSync5(dirname3(path), { recursive: true });
-  writeFileSync4(path, `${JSON.stringify(registry, null, 2)}
+  mkdirSync6(dirname3(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(registry, null, 2)}
 `, "utf8");
 }
 function loadWebIdeAgentId(workdir, taskId) {
@@ -1382,18 +1978,18 @@ function saveWebIdeAgentId(workdir, taskId, agentId) {
 }
 function clearWebIdeAgentId(workdir, taskId) {
   const path = registryPath2(workdir, taskId);
-  if (!existsSync3(path)) return;
+  if (!existsSync4(path)) return;
   writeRegistry2(path, {});
 }
 
 // src/commands/connect/webide-ask-question.ts
 import { setTimeout as delay } from "node:timers/promises";
 var POLL_INTERVAL_MS = 2e3;
-function asString2(value) {
+function asString3(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function parseQuestions(args) {
-  const title = asString2(args.title) || void 0;
+  const title = asString3(args.title) || void 0;
   const raw = args.questions;
   if (!Array.isArray(raw) || raw.length === 0) {
     throw new Error("AskQuestion \u7F3A\u5C11 questions");
@@ -1402,16 +1998,16 @@ function parseQuestions(args) {
   for (const item of raw) {
     if (!item || typeof item !== "object" || Array.isArray(item)) continue;
     const row = item;
-    const id = asString2(row.id);
-    const prompt = asString2(row.prompt);
+    const id = asString3(row.id);
+    const prompt = asString3(row.prompt);
     const optionsRaw = row.options;
     if (!id || !prompt || !Array.isArray(optionsRaw)) continue;
     const options = [];
     for (const opt of optionsRaw) {
       if (!opt || typeof opt !== "object" || Array.isArray(opt)) continue;
       const o = opt;
-      const oid = asString2(o.id);
-      const label = asString2(o.label);
+      const oid = asString3(o.id);
+      const label = asString3(o.label);
       if (oid && label) options.push({ id: oid, label });
     }
     if (options.length < 2) {
@@ -1500,14 +2096,14 @@ var MinioClient = class {
   async deleteObjectsByPrefix(bucket, prefix) {
     const objectsStream = this.inner.listObjectsV2(bucket, prefix, true);
     const keys = [];
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       objectsStream.on("data", (obj) => {
         if (obj.name) {
           keys.push(obj.name);
         }
       });
       objectsStream.on("error", reject);
-      objectsStream.on("end", resolve5);
+      objectsStream.on("end", resolve6);
     });
     const chunkSize = 500;
     for (let i = 0; i < keys.length; i += chunkSize) {
@@ -1675,147 +2271,12 @@ function resolveMessageReplyFallback(fallback) {
 }
 
 // src/commands/init.ts
-import { join as join6 } from "path";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
-
-// src/deployment-config-sync.ts
-import { join as join4 } from "path";
-import { writeFileSync as writeFileSync5 } from "fs";
-
-// src/git-remote.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-async function tryReadGitOriginUrl(cwd) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["config", "--get", "remote.origin.url"],
-      { cwd, encoding: "utf8", maxBuffer: 1024 * 1024 }
-    );
-    const url = stdout.trim();
-    return url || null;
-  } catch {
-    return null;
-  }
-}
-
-// src/git-utils.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
-async function execGit(cwd, args, quiet = false) {
-  try {
-    const { stdout, stderr } = await execFileAsync2("git", args, {
-      cwd,
-      encoding: "utf8",
-      maxBuffer: 10 * 1024 * 1024
-    });
-    if (!quiet && stderr.trim()) {
-      process.stderr.write(stderr);
-    }
-    return stdout;
-  } catch (err) {
-    const e = err;
-    const detail = (e.stderr ?? e.message ?? String(err)).trim();
-    throw new Error(
-      `[apm] git ${args.join(" ")} \u5931\u8D25${detail ? `: ${detail}` : ""}`
-    );
-  }
-}
-async function isGitRepo(cwd) {
-  try {
-    await execGit(cwd, ["rev-parse", "--git-dir"], true);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function resolveGitRepoRoot(cwd) {
-  return (await execGit(cwd, ["rev-parse", "--show-toplevel"], true)).trim();
-}
-async function hasUpstream(cwd) {
-  try {
-    await execGit(cwd, ["rev-parse", "--abbrev-ref", "@{upstream}"], true);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var GITIGNORE_COMMIT_MESSAGE = "chore(apm): ignore .apm directory";
-async function commitAndPushGitignore(workdir) {
-  if (!await isGitRepo(workdir)) {
-    console.log("[apm] \u5F53\u524D\u76EE\u5F55\u4E0D\u662F git \u4ED3\u5E93\uFF0C\u8BF7\u624B\u52A8\u63D0\u4EA4 .gitignore");
-    return;
-  }
-  await execGit(workdir, ["add", "--", ".gitignore"]);
-  await execGit(workdir, ["commit", "-m", GITIGNORE_COMMIT_MESSAGE]);
-  console.log(`[apm] \u5DF2\u63D0\u4EA4 .gitignore: ${GITIGNORE_COMMIT_MESSAGE}`);
-  const originUrl = await tryReadGitOriginUrl(workdir);
-  if (!originUrl) {
-    console.log("[apm] \u672A\u914D\u7F6E remote.origin\uFF0C\u8BF7\u7A0D\u540E\u624B\u52A8 push .gitignore");
-    return;
-  }
-  if (await hasUpstream(workdir)) {
-    await execGit(workdir, ["push"]);
-  } else {
-    await execGit(workdir, ["push", "-u", "origin", "HEAD"]);
-  }
-  console.log("[apm] \u5DF2\u63A8\u9001 .gitignore");
-}
-
-// src/baseline-resolve.ts
-function formatBaselineDiagnostic(workdirPath, baselineWorkdirPath, diagnostic) {
-  return diagnostic?.message ?? `\u672A\u5728\u5E73\u53F0\u627E\u5230\u4E0E\u5F53\u524D\u76EE\u5F55\u5339\u914D\u7684\u5DE5\u4F5C\u76EE\u5F55\u767B\u8BB0\uFF1A${workdirPath}\uFF08\u89C4\u8303\u5316\uFF1A${baselineWorkdirPath}\uFF09
-\u8BF7\u5148\u5728\u5E73\u53F0\u767B\u8BB0\u8BE5\u8DEF\u5F84\u5BF9\u5E94\u7684\u5DE5\u4F5C\u76EE\u5F55\u4E0E\u4ED3\u5E93\u3002`;
-}
-async function matchRepositoryByGitRemote(api, workdirPath) {
-  const gitRoot = await resolveGitRepoRoot(workdirPath);
-  const gitUrl = await tryReadGitOriginUrl(gitRoot);
-  if (!gitUrl) {
-    return null;
-  }
-  const matched = await api.cli.matchRepository({ url: gitUrl });
-  const repositoryId = matched.repositoryId?.trim();
-  const defaultBranch = matched.defaultBranch?.trim();
-  if (!repositoryId || !defaultBranch) {
-    return null;
-  }
-  console.log(
-    `[apm] \u5DE5\u4F5C\u7A7A\u95F4\u8DEF\u5F84\u672A\u5339\u914D\uFF0C\u5DF2\u901A\u8FC7 git remote \u5173\u8054\u4ED3\u5E93: ${gitUrl}`
-  );
-  return { repositoryId, defaultBranch };
-}
-async function resolveWorkspaceBaseline(api, workdirPath) {
-  const baseline = await api.cli.workspaceBaseline({ workdirPath });
-  const repositoryId = baseline.repositoryId?.trim();
-  const defaultBranch = baseline.defaultBranch?.trim();
-  if (repositoryId && defaultBranch) {
-    return {
-      repositoryId,
-      defaultBranch,
-      workdirPath: baseline.workdirPath,
-      matchedViaGitRemote: false
-    };
-  }
-  const viaGit = await matchRepositoryByGitRemote(api, workdirPath);
-  if (viaGit) {
-    return {
-      ...viaGit,
-      workdirPath: baseline.workdirPath,
-      matchedViaGitRemote: true
-    };
-  }
-  throw new Error(
-    `[apm] ${formatBaselineDiagnostic(
-      workdirPath,
-      baseline.workdirPath,
-      baseline.diagnostic
-    )}`
-  );
-}
+import { join as join7 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
 
 // src/deployment-config-sync.ts
+import { join as join5 } from "path";
+import { writeFileSync as writeFileSync6 } from "fs";
 var TEMPLATE_HINT = "\u4FDD\u7559\u6A21\u677F .apm/apm.config.json";
 var SYNC_HINT = "\u767B\u8BB0\u5DE5\u4F5C\u7A7A\u95F4\u8DEF\u5F84\u3001\u7ED1\u5B9A\u4ED3\u5E93\u540E\uFF0C\u53EF\u6267\u884C: apm sync-deploy-config";
 async function resolveRepositoryIdForSync(api, workdirPath) {
@@ -1870,8 +2331,8 @@ ${diagnostic ?? ""}
     return { synced: false, repositoryId };
   }
   const targetApmDir = apmDir ?? workspaceApmDir(workdirPath);
-  const apmConfigPath = toFsPath(join4(targetApmDir, "apm.config.json"));
-  writeFileSync5(apmConfigPath, `${JSON.stringify(parsed, null, 2)}
+  const apmConfigPath = toFsPath(join5(targetApmDir, "apm.config.json"));
+  writeFileSync6(apmConfigPath, `${JSON.stringify(parsed, null, 2)}
 `, "utf8");
   console.log(`[apm] \u5DF2\u540C\u6B65\u5E73\u53F0\u90E8\u7F72\u914D\u7F6E: ${config.name}`);
   console.log("[apm] \u5DF2\u5199\u5165 .apm/apm.config.json");
@@ -1880,20 +2341,20 @@ ${diagnostic ?? ""}
 
 // src/repository-project-documents-sync.ts
 import {
-  existsSync as existsSync4,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
+  existsSync as existsSync5,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync6,
   rmSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname4, join as join5, relative, sep } from "path";
+import { dirname as dirname4, join as join6, relative as relative2, sep } from "path";
 var MANIFEST_FILE = "manifest.json";
 function projectDocumentsDir(apmRoot) {
-  return join5(apmRoot ?? workspaceApmDir(), "project");
+  return join6(apmRoot ?? workspaceApmDir(), "project");
 }
 function projectDocumentLocalPath(apmRoot, documentPath) {
   const normalized = normalizeLocalDocumentPath(documentPath);
-  return join5(projectDocumentsDir(apmRoot), ...normalized.split("/"));
+  return join6(projectDocumentsDir(apmRoot), ...normalized.split("/"));
 }
 function normalizeLocalDocumentPath(path) {
   const trimmed = path.trim().replace(/\\/g, "/");
@@ -1907,13 +2368,13 @@ function normalizeLocalDocumentPath(path) {
   return segments.join("/");
 }
 function readLocalManifest(apmRoot) {
-  const manifestPath = join5(projectDocumentsDir(apmRoot), MANIFEST_FILE);
-  if (!existsSync4(manifestPath)) {
+  const manifestPath2 = join6(projectDocumentsDir(apmRoot), MANIFEST_FILE);
+  if (!existsSync5(manifestPath2)) {
     return null;
   }
   try {
     return JSON.parse(
-      readFileSync5(manifestPath, "utf8")
+      readFileSync6(manifestPath2, "utf8")
     );
   } catch {
     return null;
@@ -1990,20 +2451,20 @@ ${diagnostic ?? ""}`
     for (const doc of list) {
       const absPath = toFsPath(projectDocumentLocalPath(targetApmDir, doc.path));
       await ensureDirExists(dirname4(absPath));
-      writeFileSync6(absPath, doc.content, "utf8");
+      writeFileSync7(absPath, doc.content, "utf8");
       downloaded += 1;
     }
   }
   let deleted = 0;
   for (const path of deleteLocal) {
     const absPath = toFsPath(projectDocumentLocalPath(targetApmDir, path));
-    if (existsSync4(absPath)) {
+    if (existsSync5(absPath)) {
       rmSync(absPath, { force: true });
       deleted += 1;
     }
   }
-  writeFileSync6(
-    toFsPath(join5(projectDir, MANIFEST_FILE)),
+  writeFileSync7(
+    toFsPath(join6(projectDir, MANIFEST_FILE)),
     `${JSON.stringify(remoteManifest, null, 2)}
 `,
     "utf8"
@@ -2038,11 +2499,11 @@ async function ensureWorkspaceInitialized(workdir, options) {
   await syncRepositoryProjectDocumentsPull(workdir, apmDir);
   const trimmedName = options?.name?.trim();
   if (trimmedName) {
-    const apmConfigPath = toFsPath(join6(apmDir, "apm.config.json"));
-    const config = readFileSync6(apmConfigPath, "utf8");
+    const apmConfigPath = toFsPath(join7(apmDir, "apm.config.json"));
+    const config = readFileSync7(apmConfigPath, "utf8");
     const configJson = JSON.parse(config);
     configJson.name = trimmedName;
-    writeFileSync7(
+    writeFileSync8(
       apmConfigPath,
       `${JSON.stringify(configJson, null, 2)}
 `,
@@ -2053,6 +2514,149 @@ async function ensureWorkspaceInitialized(workdir, options) {
   return { didInit: true, syncResult };
 }
 
+// src/commands/connect/pre-step-cache.ts
+function sessionWorkdirKey(sessionId, workdir) {
+  return `${sessionId}\0${workdir}`;
+}
+var lastBranchKey = null;
+function shouldRunBranch(sessionId, workdir) {
+  return lastBranchKey !== sessionWorkdirKey(sessionId, workdir);
+}
+function markBranchDone(sessionId, workdir) {
+  lastBranchKey = sessionWorkdirKey(sessionId, workdir);
+}
+
+// src/commands/connect/webide-draft-prs.ts
+var DEVELOP_ACTIONS = /* @__PURE__ */ new Set(["start-develop", "skip-plan"]);
+function shouldEnsureWebIdeDraftPullRequests(action) {
+  return DEVELOP_ACTIONS.has(action);
+}
+async function ensureWebIdeDraftPullRequests(cfg, taskId, workdir) {
+  const api = createApmApiClient(cfg);
+  let repoRoots;
+  try {
+    const manifest = loadWorkspaceReposCache(workdir);
+    repoRoots = resolveWorkspaceRepoAbsolutePaths(manifest);
+  } catch (err) {
+    console.warn(
+      "[apm] WebIDE \u8349\u7A3F PR\uFF1A\u8BFB\u53D6\u4ED3\u5E93\u6E05\u5355\u5931\u8D25:",
+      err instanceof Error ? err.message : err
+    );
+    return;
+  }
+  console.log(
+    `[apm] WebIDE \u8349\u7A3F PR\uFF1A\u51C6\u5907\u4E3A ${repoRoots.length} \u4E2A\u4ED3\u5E93\u521B\u5EFA feat/task-${taskId}`
+  );
+  for (const gitRoot of repoRoots) {
+    const label = formatRepoLabel(workdir, gitRoot);
+    try {
+      const originUrl = await tryReadGitOriginUrl(gitRoot);
+      if (!originUrl) {
+        console.warn(
+          `[apm] WebIDE \u8349\u7A3F PR\uFF1A\u8DF3\u8FC7 ${label}\uFF08\u65E0 remote.origin.url\uFF09`
+        );
+        continue;
+      }
+      const matched = await api.cli.matchRepository({ url: originUrl });
+      const repositoryId = matched.repositoryId?.trim();
+      if (!repositoryId) {
+        console.warn(
+          `[apm] WebIDE \u8349\u7A3F PR\uFF1A\u8DF3\u8FC7 ${label}\uFF08\u5E73\u53F0\u672A\u767B\u8BB0\u4ED3\u5E93 ${originUrl}\uFF09`
+        );
+        continue;
+      }
+      const pr = await api.cli.createWebIdeDraftPullRequest({
+        taskId,
+        repositoryId
+      });
+      console.log(
+        `[apm] WebIDE \u8349\u7A3F PR\uFF1A${label} \u2192 #${pr.number} ${pr.state} ${pr.url || ""}`
+      );
+    } catch (err) {
+      console.warn(
+        `[apm] WebIDE \u8349\u7A3F PR\uFF1A${label} \u5931\u8D25:`,
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+
+// src/commands/connect/ensure-workspace-permissions.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
+import { join as join8 } from "path";
+var WEBIDE_MCP_ALLOWLIST = ["custom-user-tools:*"];
+function parsePermissionsConfig(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function mergeMcpAllowlist(existing) {
+  const merged = /* @__PURE__ */ new Set([
+    ...existing ?? [],
+    ...WEBIDE_MCP_ALLOWLIST
+  ]);
+  return [...merged];
+}
+function needsMcpAllowlistUpdate(existing) {
+  const current = existing ?? [];
+  return WEBIDE_MCP_ALLOWLIST.some((entry) => !current.includes(entry));
+}
+function ensureWorkspacePermissionsConfig(workdir) {
+  const cursorDir = toFsPath(join8(workdir, ".cursor"));
+  const permissionsPath = toFsPath(join8(cursorDir, "permissions.json"));
+  let config = {};
+  if (existsSync6(permissionsPath)) {
+    const raw = readFileSync8(permissionsPath, "utf8");
+    const parsed = parsePermissionsConfig(raw);
+    if (!parsed) {
+      console.warn(
+        `[apm] \u5DE5\u4F5C\u533A permissions.json \u65E0\u6CD5\u89E3\u6790\uFF0C\u8DF3\u8FC7\u5199\u5165\uFF1A${permissionsPath}`
+      );
+      return;
+    }
+    config = parsed;
+  }
+  if (!needsMcpAllowlistUpdate(config.mcpAllowlist)) {
+    return;
+  }
+  config.mcpAllowlist = mergeMcpAllowlist(config.mcpAllowlist);
+  mkdirSync7(cursorDir, { recursive: true });
+  writeFileSync9(
+    permissionsPath,
+    `${JSON.stringify(config, null, 2)}
+`,
+    "utf8"
+  );
+  console.log(
+    `[apm] \u5DF2\u66F4\u65B0\u5DE5\u4F5C\u533A permissions \u914D\u7F6E\uFF08mcpAllowlist\uFF09\uFF1A${permissionsPath}`
+  );
+}
+
+// src/commands/connect/ensure-workspace-sandbox.ts
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync10, existsSync as existsSync7 } from "fs";
+import { join as join9 } from "path";
+var DEFAULT_SANDBOX_JSON = `{
+  "type": "workspace_readwrite",
+  "networkPolicy": {
+    "default": "allow"
+  }
+}
+`;
+function ensureWorkspaceSandboxConfig(workdir) {
+  const cursorDir = toFsPath(join9(workdir, ".cursor"));
+  const sandboxPath = toFsPath(join9(cursorDir, "sandbox.json"));
+  if (existsSync7(sandboxPath)) return;
+  mkdirSync8(cursorDir, { recursive: true });
+  writeFileSync10(sandboxPath, DEFAULT_SANDBOX_JSON, "utf8");
+  console.log(`[apm] \u5DF2\u5199\u5165\u5DE5\u4F5C\u533A sandbox \u914D\u7F6E\uFF1A${sandboxPath}`);
+}
+
 // src/commands/connect/handle-webide-message.ts
 async function updateStatus(cfg, messageId, status) {
   const api = createApmApiClient(cfg);
@@ -2070,6 +2674,7 @@ async function handleWebIdeInboundMessage(cfg, msg, signal) {
   const workdir = requireRemoteWorkdir(msg.workdir);
   const messageId = msg.messageId;
   const taskId = msg.taskId;
+  const branchCacheKey = `webide:${taskId}`;
   console.log(
     `[apm] webide-message action=${msg.action} taskId=${taskId} messageId=${messageId}`
   );
@@ -2080,6 +2685,25 @@ async function handleWebIdeInboundMessage(cfg, msg, signal) {
     if (!didInit) {
       assertApmGitignoredInRepo(workdir);
     }
+    ensureWorkspaceSandboxConfig(workdir);
+    ensureWorkspacePermissionsConfig(workdir);
+    resolveWorkspaceRepos(workdir);
+    if (shouldRunBranch(branchCacheKey, workdir)) {
+      if (signal.aborted) throw new Error("\u4EFB\u52A1\u5DF2\u53D6\u6D88");
+      const branchResult = await runTaskBranch(taskId, { cwd: workdir });
+      markBranchDone(branchCacheKey, workdir);
+      console.log(
+        `[apm] webide branch ready kind=${branchResult.kind} branch=${branchResult.branch} repos=${branchResult.repos.length}`
+      );
+    } else {
+      console.log(
+        `[apm] step=branch skipped taskId=${taskId} workdir=${workdir}`
+      );
+    }
+    if (shouldEnsureWebIdeDraftPullRequests(msg.action)) {
+      if (signal.aborted) throw new Error("\u4EFB\u52A1\u5DF2\u53D6\u6D88");
+      await ensureWebIdeDraftPullRequests(cfg, taskId, workdir);
+    }
     const savedAgentId = loadWebIdeAgentId(workdir, taskId);
     const logSyncRef = { current: null };
     const outcome = await runCursorAgent(
@@ -2103,6 +2727,7 @@ async function handleWebIdeInboundMessage(cfg, msg, signal) {
           signal
         }),
         enableWebIdePlanTools: true,
+        enableSandbox: true,
         taskId,
         createRemoteLogSync: (agentId) => {
           saveWebIdeAgentId(workdir, taskId, agentId);