ai_co_discuss 0.2.97 → 0.2.99

package/runner/discussion_adapters.mjs

@@ -2,11 +2,14 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, readdirSync, rmSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
-import { isAbsolute, join, relative, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { connect } from 'node:net';
 import { homedir } from 'node:os';
 import { createInterface } from 'node:readline';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { CodexAppClient } from './codex_app_client.mjs';
+import { agy_command_rule, runs_commands } from './expert_prompts.mjs';
+import { session_exists } from './session_cut.mjs';
 
 const CALL_TIMEOUT_MS = 30_000;
 const CLI_DIAGNOSTIC_CHARS = 1000;
@@ -14,14 +17,14 @@ const CLI_DIAGNOSTIC_CHARS = 1000;
 const CLI_EXIT_GRACE_MS = 1500;
 // A hung CLI keeps its lease renewed forever when the room sets no execution limit, so cap every process.
 const CLI_MAX_RUN_MS = 2 * 60 * 60_000;
+// A message posted to an open Claude window that has not started by then is reported, not failed.
+const INBOX_CHECK_MS = 90_000;
 const CODEX_PERMISSIONS_MIN_MINOR = 163;
 /** Website subcommands an automatic task may run; service, launch, run, api and setup stay unapproved. */
 export const TASK_SUBCOMMANDS = ['room', 'message', 'turn', 'state', 'execution', 'health', 'schema'];
 
-/** The agy project allows only codiscuss commands and headless agy ends the turn on a denied one, so every agy task states it; no member prompt can drop it. */
-export function agy_command_rule(adapter, cli) {
-  return adapter === 'antigravity_cli' ? `无人值守下 run_command 只能运行 ${cli} 的 subcommands 子命令，其他命令会被自动拒绝并使会话直接结束；列目录、搜索或读取文件用 list_dir、find_by_name、grep_search、view_file。` : '';
-}
+// Defined with the fixed task text so the expert prompt dialog shows the same rules; re-exported for existing callers.
+export { agy_command_rule, runs_commands };
 
 /** Only failures before a software invocation are safe for automatic redelivery. */
 function not_sent(error) { return Object.assign(error, { delivery_status: 'not_sent' }); }
@@ -63,6 +66,14 @@ async function codex_delivery(config, binding, task) {
   if (binding.session_id) {
     try { bind_access(task.access_path, binding.session_id); }
     catch (error) { throw not_sent(error); }
+    // `codex queue` reaches only a chat the App has loaded; a fork made after a rewind, or a chat after the App restarted,
+    // is not loaded until a message is sent through the App itself (tested on App tools, 2026-10).
+    if (await codex_unloaded(config, binding.session_id)) {
+      const app = new CodexAppClient(config.pipe_path);
+      try { await app.open(); await app.send_message(binding.session_id, task.prompt); }
+      finally { app.close(); }
+      return { session_id: binding.session_id, status: 'accepted' };
+    }
     const receipt = await run_program(config.executable, ['queue', '--thread', binding.session_id, '--message', task.prompt], { timeout: CALL_TIMEOUT_MS });
     return { session_id: binding.session_id, status: 'accepted', receipt };
   }
@@ -78,6 +89,14 @@ async function codex_delivery(config, binding, task) {
   } finally { app.close(); }
 }
 
+/** Whether the running App has not loaded a chat; when the App cannot tell, the queue is used as before. */
+async function codex_unloaded(config, thread_id) {
+  const app = new CodexAppClient(config.pipe_path);
+  try { await app.open(); return await app.thread_status(thread_id) === 'notLoaded'; }
+  catch { return false; }
+  finally { app.close(); }
+}
+
 /** Match the real saved project and its directory; a prompt cannot grant file access. */
 export async function codex_target(app, config) {
   if (!config.project_id && !config.project_name && !config.cwd) return { type: 'projectless' };
@@ -105,6 +124,57 @@ export function claude_exit_error(code, output) {
   return code === 0 ? '' : `Claude 退出码 ${code}`;
 }
 
+const DENIAL_FIELD = 300;
+const MAX_DENIALS = 20;
+const EDIT_TOOL_NAMES = /^(Edit|MultiEdit|Write|NotebookEdit)$/;
+
+/** The first program a shell command runs, skipping `cd` and `Set-Location` steps, for a prefix rule that also allows a retry. */
+function command_program(command) {
+  const steps = String(command).split(/&&|\|\||;|\|/).map(step => step.trim().split(/\s+/)[0]).filter(Boolean);
+  return steps.find(step => !/^(cd|Set-Location|sl|pushd)$/i.test(step)) || steps[0] || '';
+}
+
+/**
+ * The operations a headless Claude run refused, from the `permission_denials` of its final result line, each with the
+ * `--allowedTools` rule that would let the next run do it: a command prefix, an edit of that folder, or the tool itself.
+ */
+export function claude_denials(output) {
+  let result = null;
+  try { result = JSON.parse(output.trim().split(/\r?\n/).at(-1)); } catch { return []; }
+  const seen = new Set();
+  return (Array.isArray(result?.permission_denials) ? result.permission_denials : []).map(denial => {
+    const tool = String(denial.tool_name || '').slice(0, 40), input = denial.tool_input || {};
+    if (['Bash', 'PowerShell'].includes(tool) && input.command) {
+      const program = command_program(input.command);
+      return { tool, detail: String(input.command), rule: program ? `${tool}(${program} *)` : '' };
+    }
+    const path = input.file_path || input.notebook_path;
+    if (EDIT_TOOL_NAMES.test(tool) && path) return { tool, detail: String(path), rule: `Edit(${claude_rule_path(dirname(path))}/**)` };
+    return { tool, detail: JSON.stringify(input), rule: tool };
+  }).filter(item => item.tool && !seen.has(item.detail) && seen.add(item.detail))
+    .slice(0, MAX_DENIALS).map(item => ({ ...item, detail: item.detail.slice(0, DENIAL_FIELD), rule: item.rule.length <= DENIAL_FIELD ? item.rule : '' }));
+}
+
+/**
+ * One operation a headless agy run refused, from the failed tool step, with the project grant that would allow it.
+ * agy names the check that failed: a sandboxed or unsandboxed command, or a file write.
+ */
+export function agy_denial(step) {
+  const message = step.tool_info?.error?.message || '';
+  if (!/permission check failed/.test(message)) return null;
+  const parameters = step.tool_info.parameters || {};
+  // Older agy did not name the check; a refused step with a command line was a command.
+  const kind = message.match(/permission check failed for (\w+)/)?.[1] || (parameters.CommandLine ? 'command' : '');
+  if (!kind) return null;
+  if (kind === 'write_file') {
+    const path = String(parameters.Path || parameters.TargetFile || message.match(/write_file\(([^)]+)\)/)?.[1] || '');
+    return { tool: 'write_file', detail: path.slice(0, DENIAL_FIELD), rule: path ? `write_file(${resolve(dirname(path)).replaceAll('\\', '/')})` : '' };
+  }
+  const command = String(parameters.CommandLine || '');
+  const rule = `${kind === 'unsandboxed' ? 'unsandboxed_command' : 'command'}(${command})`;
+  return { tool: step.tool_name || 'run_command', detail: command.slice(0, DENIAL_FIELD), rule: command && rule.length <= DENIAL_FIELD ? rule : '' };
+}
+
 /**
  * Drop variables a hosting Claude session injects, so the spawned CLI uses its own login.
  * The host also hides the user's persisted login variables, which are read back on Windows.
@@ -181,14 +251,18 @@ function agy_project_grants(config, task, resources, user_home) {
     .filter(uri => uri?.startsWith('file:')).map(uri => fileURLToPath(uri));
   const projects = [...new Set([project_directory(config), ...folders].filter(directory => directory && !same_path(directory, task.draft_directory)))];
   const protected_paths = [task.directory, task.skills_directory, join(user_home, '.gemini'),
-    ...(config.project_access === 'write' ? [] : projects)];
+    ...(config.project_access === 'read' ? projects : [])];
   if (protected_paths.some(directory => within_directory(directory, task.draft_directory))) {
     throw new Error('agy 草稿目录不能位于只读项目、运行目录、技能或 .gemini 配置目录中，未交付讨论任务');
   }
   const write_rule = directory => `write_file(${resolve(directory).replaceAll('\\', '/')})`;
+  // 完全放开 also runs commands outside agy's sandbox and allows MCP tools; run data stays protected at every level.
+  const full = config.project_access === 'full';
   return { allow: [agy_rule(), write_rule(task.draft_directory),
-    ...(config.project_access === 'write' ? projects.map(write_rule) : [])],
-  deny: [...new Set(protected_paths.map(write_rule)), 'mcp(*)'] };
+    ...(config.project_access === 'read' ? [] : [...projects.map(write_rule), 'command(*)']), ...(full ? ['unsandboxed_command(*)'] : []),
+    // Grants the owner allowed from a refused operation on the page.
+    ...(config.allowed_tools || [])],
+  deny: [...new Set(protected_paths.map(write_rule)), ...(full ? [] : ['mcp(*)'])] };
 }
 
 /** Run agy only inside a private native project this tool created; external conversations keep their own project, so they are refused. */
@@ -235,12 +309,21 @@ export function remove_agy_projects(directory, user_home = homedir()) {
 }
 
 /**
- * Allow only listed codiscuss website subcommands and draft writes for this run; user rules are added after.
- * Claude Code on Windows may run commands through its PowerShell tool instead of Bash, so both are listed.
+ * Allow the listed codiscuss website subcommands and draft writes for this run; a writable member also edits its project
+ * and runs any command. User rules are added after. Claude Code on Windows may run commands through its PowerShell tool
+ * instead of Bash, so both are listed.
  */
 export function claude_permissions(config, task) {
-  const commands = TASK_SUBCOMMANDS.flatMap(command => [`Bash(codiscuss ${command} *)`, `PowerShell(codiscuss ${command} *)`]);
-  const writable = [task.draft_directory, ...(config.project_access === 'write' && project_directory(config) ? [project_directory(config)] : [])];
+  // A headless run cannot ask for approval: 自动 and a taken-over manual member use auto mode, as the original window
+  // does, and 完全放开 skips every check; the website commands and drafts stay pre-approved either way.
+  if (['own', 'auto', 'full'].includes(config.project_access)) {
+    const commands = TASK_SUBCOMMANDS.flatMap(command => [`Bash(codiscuss ${command} *)`, `PowerShell(codiscuss ${command} *)`]);
+    return ['--permission-mode', config.project_access === 'full' ? 'bypassPermissions' : 'auto', '--add-dir', task.directory, task.draft_directory, task.skills_directory, '--allowedTools',
+      ...commands, `Edit(${claude_rule_path(task.draft_directory)}/**)`, ...(config.allowed_tools || [])];
+  }
+  const commands = runs_commands(config) ? ['Bash', 'PowerShell']
+    : TASK_SUBCOMMANDS.flatMap(command => [`Bash(codiscuss ${command} *)`, `PowerShell(codiscuss ${command} *)`]);
+  const writable = [task.draft_directory, ...(runs_commands(config) ? [project_directory(config)] : [])];
   return ['--add-dir', task.directory, task.draft_directory, task.skills_directory, '--allowedTools',
     ...commands, ...writable.map(directory => `Edit(${claude_rule_path(directory)}/**)`), ...(config.allowed_tools || [])];
 }
@@ -438,12 +521,88 @@ function watch_activity(adapter, stream, task) {
   });
 }
 
+/**
+ * The open Claude Code window holding one session, with its cross-session inbox, or null when no live session holds it.
+ * Read from the registry each running session writes; `inbox` is null on a version without one. Not a public interface:
+ * the peer token and message line are what Claude's own sessions use (tested on 2.1.312).
+ */
+export function claude_window(session_id, env = process.env) {
+  const directory = join(env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'), 'sessions');
+  if (!session_id || !existsSync(directory)) return null;
+  for (const name of readdirSync(directory).filter(item => /^\d+\.json$/.test(item))) {
+    let record;
+    try { record = JSON.parse(readFileSync(join(directory, name), 'utf8')); } catch { continue; }
+    if (record.sessionId !== session_id) continue;
+    try { process.kill(Number(record.pid), 0); } catch { continue; }
+    const key = readdirSync(directory).find(item => item.startsWith(`${record.pid}.`) && item.endsWith('.key'));
+    let token = '';
+    try { token = key ? JSON.parse(readFileSync(join(directory, key), 'utf8')).peerToken || '' : ''; } catch { /* no inbox credential */ }
+    return { pid: Number(record.pid), inbox: record.messagingSocketPath && token ? { socket: record.messagingSocketPath, token } : null };
+  }
+  return null;
+}
+
+/** Whether this execution goes into a taken-over member's own open window rather than a background process. */
+export function claude_inbox_ready(profile, binding) {
+  return profile.adapter === 'claude' && profile.project_access === 'own' && Boolean(profile.session_id)
+    && binding.session_id === profile.session_id && Boolean(claude_window(profile.session_id)?.inbox);
+}
+
+/**
+ * A taken-over manual Claude member whose session a window without an inbox still holds: resuming that session from
+ * here would split its file into two branches neither side sees in full, so its first hosted turn forks it and later
+ * turns resume the fork; a fork whose session was never written is retried under the same ID. Once no window holds
+ * the session, it is resumed as it is.
+ */
+export function adopted_fork(config, binding, held, exists = id => session_exists('claude', id)) {
+  if (config.project_access !== 'own' || !config.session_id || binding.fork || !binding.session_id) return binding;
+  if (binding.session_id !== config.session_id) return exists(binding.session_id) ? binding : { ...binding, fork: { from: config.session_id, at: '' } };
+  return held ? { ...binding, session_id: randomUUID(), fork: { from: config.session_id, at: '' } } : binding;
+}
+
+/** Post one task into an open Claude window; it starts a turn there, or between tool calls of the turn it is in. */
+async function claude_inbox_delivery(config, inbox, task) {
+  try { bind_access(task.access_path, config.session_id); }
+  catch (error) { throw not_sent(error); }
+  const text = `CoDiscuss 本机服务代房间转达（你已注册为该房间成员，这是房间分派给你的任务）：\n${task.prompt}`;
+  const lines = [{ type: 'auth', token: inbox.token }, { type: 'user', message: { role: 'user', content: text } }];
+  await new Promise((resolve_sent, reject) => {
+    let written = false;
+    const socket = connect(inbox.socket, () => {
+      socket.end(lines.map(line => `${JSON.stringify(line)}\n`).join(''), () => { written = true; resolve_sent(); });
+    });
+    socket.on('error', error => written ? undefined : reject(not_sent(error)));
+  });
+  const marker = `${task.id}.task.json`;
+  setTimeout(() => {
+    if (!claude_session_mentions(config.session_id, marker)) {
+      task.on_note?.('已投递到原窗口，但它还没开始处理：原窗口可能处于跳过审批模式（需在窗口中批准这条消息）或仍在忙。');
+    }
+  }, INBOX_CHECK_MS).unref();
+  return { session_id: config.session_id, status: 'accepted' };
+}
+
+/** Whether a Claude session's log contains some text, e.g. the task file a delivered prompt names. */
+function claude_session_mentions(session_id, text, env = process.env) {
+  const projects = join(env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'), 'projects');
+  if (!existsSync(projects)) return false;
+  const file = readdirSync(projects).map(directory => join(projects, directory, `${session_id}.jsonl`)).find(existsSync);
+  try { return Boolean(file) && readFileSync(file, 'utf8').includes(text); } catch { return false; }
+}
+
 async function claude_delivery(config, binding, task, spawn_process = spawn) {
+  const window = config.project_access === 'own' && binding.session_id && binding.session_id === config.session_id ? claude_window(config.session_id) : null;
+  // Only a task written for the window names its credential file; a background process gets it through its environment.
+  if (window?.inbox && task.inbox) return claude_inbox_delivery(config, window.inbox, task);
+  binding = adopted_fork(config, binding, Boolean(window));
   const session_id = binding.session_id || randomUUID();
   try { bind_access(task.access_path, session_id); }
   catch (error) { throw not_sent(error); }
   // Streamed events show the turn's progress; the final line is still the result that decides success.
-  const args = ['-p', '--output-format', 'stream-json', '--verbose', binding.session_id ? '--resume' : '--session-id', session_id,
+  // A rewound or forked member first forks its earlier session into the ID it is now bound to, cut at `at` when given.
+  const fork = binding.fork ? ['--resume', binding.fork.from, '--fork-session', ...(binding.fork.at ? ['--resume-session-at', binding.fork.at] : []), '--session-id', session_id]
+    : [binding.session_id ? '--resume' : '--session-id', session_id];
+  const args = ['-p', '--output-format', 'stream-json', '--verbose', ...fork,
     ...(config.model ? ['--model', config.model] : []), ...(config.effort ? ['--effort', config.effort] : []), ...claude_permissions(config, task)];
   let child;
   try {
@@ -461,6 +620,8 @@ async function claude_delivery(config, binding, task, spawn_process = spawn) {
   watch_activity('claude', child.stdout, task);
   child.once('close', code => {
     if (!spawned) return;
+    const denials = claude_denials(output);
+    if (denials.length) task.on_denials?.(denials);
     const error = claude_exit_error(code, output);
     if (error) task.on_failure(error);
     else task.on_exit?.();
@@ -476,15 +637,26 @@ async function claude_delivery(config, binding, task, spawn_process = spawn) {
 }
 
 /** Build a per-invocation profile without inheriting a user's custom profile of the same name. */
-export function codex_permissions(config, task) {
+export function codex_permissions(config, task, platform = process.platform) {
+  // 完全放开 runs without approval or sandbox, so there is no profile to build or check.
+  if (config.project_access === 'full') return { name: '', args: ['--dangerously-bypass-approvals-and-sandbox'] };
   const name = `codiscuss-${randomUUID()}`;
-  const base = project_directory(config) && config.project_access === 'write' ? ':workspace' : ':read-only';
-  const filesystem = { ':root': 'read', [resolve(task.directory).replaceAll('\\', '/')]: 'read',
-    [resolve(task.draft_directory).replaceAll('\\', '/')]: 'write' };
+  // A taken-over manual member writes like 可写: its own config may sandbox read-only and then could not save its answer draft.
+  const base = ['auto', 'own'].includes(config.project_access) || (project_directory(config) && config.project_access === 'write')
+    ? ':workspace' : ':read-only';
+  const drafts = resolve(task.draft_directory).replaceAll('\\', '/');
+  const filesystem = { ':root': 'read', [resolve(task.directory).replaceAll('\\', '/')]: 'read', [drafts]: 'write' };
   const rules = Object.entries(filesystem).map(([path, access]) => `${JSON.stringify(path)}=${JSON.stringify(access)}`).join(',');
   const profile = `{extends=${JSON.stringify(base)},filesystem={${rules}},network={enabled=true}}`;
-  return { name, args: ['-c', `default_permissions=${JSON.stringify(name)}`, '-c', `permissions.${name}=${profile}`,
-    '-c', 'approval_policy="never"'] };
+  // The Windows sandbox account cannot write the user's TEMP, so PowerShell starts in ConstrainedLanguage and Codex's
+  // UTF-8 output setup fails silently, garbling Chinese; a TEMP inside the writable drafts keeps FullLanguage.
+  const temp = platform === 'win32' ? ['-c', `shell_environment_policy.set.TEMP=${JSON.stringify(drafts)}`,
+    '-c', `shell_environment_policy.set.TMP=${JSON.stringify(drafts)}`] : [];
+  // 自动 is what `codex exec --approve-for-me` sets (that flag is missing on `exec resume`): the model asks to escalate
+  // and Codex's automatic review answers instead of a person (tested 0.163).
+  const approval = config.project_access === 'auto' ? ['-c', 'approval_policy="on-request"', '-c', 'approvals_reviewer="auto_review"']
+    : ['-c', 'approval_policy="never"'];
+  return { name, args: ['-c', `default_permissions=${JSON.stringify(name)}`, '-c', `permissions.${name}=${profile}`, ...approval, ...temp] };
 }
 
 /** Read effective Codex config through its local CLI; no thread or model is started. */
@@ -583,15 +755,20 @@ function cli_event(adapter, state, event, task) {
   }
   if (event.event === 'init') bind_cli_session(state, event.conversation_id, task);
   const step = event.step_update;
-  // Headless agy ends its turn when a command needs approval; remember which one so the pause can name it.
-  if (step?.state === 'ERROR' && /permission/.test(step.tool_info?.error?.message || '')) {
-    const command = step.tool_info.parameters?.CommandLine || step.tool_name || '';
-    state.denial = `运行了未授权的命令「${String(command).slice(0, 120)}」，无人值守模式下无法确认权限而被自动拒绝，随后会话结束`;
+  // Headless agy ends its turn when an operation needs approval; remember which ones so the page can name and allow them.
+  const denied = step?.state === 'ERROR' ? agy_denial(step) : null;
+  if (denied) {
+    if (!state.denials.some(item => item.detail === denied.detail) && state.denials.length < MAX_DENIALS) state.denials.push(denied);
+    state.denial = `${denied.tool === 'write_file' ? '写入' : '运行'}了未授权的${denied.tool === 'write_file' ? '文件' : '命令'}「${denied.detail.slice(0, 120)}」，无人值守模式下无法确认权限而被自动拒绝，随后会话结束`;
   }
   if (event.event === 'result') {
     const result = event.result || {};
     if (result.conversation_id) bind_cli_session(state, result.conversation_id, task);
     state.completed = result.status === 'SUCCESS';
+    // A refused operation still ends with SUCCESS and an empty response; name it even when no failed step was seen.
+    if (!state.denial && Array.isArray(result.denied_actions) && result.denied_actions.length) {
+      state.denial = `的${result.denied_actions.map(item => item.display_name || item.action).join('、')}操作未获授权，无人值守模式下被自动拒绝，随后会话结束`;
+    }
     if (!state.completed) state.error = `Antigravity CLI ${result.status || '缺少结果状态'}：${result.error?.message || result.response || '执行未成功'}`;
   }
 }
@@ -623,7 +800,7 @@ function cli_exit_error(state, code, signal) {
 
 /** Parse complete UTF-8 JSON lines while keeping raw output in the private task log. */
 function monitor_cli(child, config, binding, task) {
-  const state = { child, session_id: binding.session_id || '', initialized: false, completed: false, error: '', diagnostic: '', responses: new Map() };
+  const state = { child, session_id: binding.session_id || '', initialized: false, completed: false, error: '', diagnostic: '', responses: new Map(), denials: [] };
   const log_path = resolve(task.directory, `${config.adapter}-${task.id}.log`);
   const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
   const max_run_ms = Number(process.env.CODISCUSS_CLI_MAX_MS) || CLI_MAX_RUN_MS;
@@ -653,6 +830,7 @@ function monitor_cli(child, config, binding, task) {
     clearTimeout(state.limit_timer);
     task.on_trace?.('cli_closed', { code, signal, killed_after_completed: Boolean(state.finished) });
     if (!state.spawned) return;
+    if (state.denials.length) task.on_denials?.(state.denials);
     const error = cli_exit_error(state, code, signal);
     if (error) task.on_failure(error);
     else task.on_exit?.(state.denial);
@@ -669,7 +847,7 @@ async function cli_delivery(config, binding, task, spawn_process, user_home) {
   let invocation;
   try { invocation = cli_invocation(config, binding, task, user_home); }
   catch (error) { throw not_sent(error); }
-  if (invocation.permissions) {
+  if (invocation.permissions?.name) {
     task.on_trace?.('permission_check_start');
     await check_codex_permissions(config, task, invocation.permissions, spawn_process);
     task.on_trace?.('permission_check_done');
@@ -704,7 +882,8 @@ async function antigravity_delivery(config, binding, task) {
   try {
     mkdirSync(directory, { recursive: true });
     const ready = JSON.parse(readFileSync(join(directory, 'ready.json'), 'utf8'));
-    if (config.project_id || config.project_name || config.cwd) {
+    // Only a new conversation is created in the Sidecar's project; an existing one is reached from any project.
+    if (!binding.session_id && (config.project_id || config.project_name || config.cwd)) {
       const project = antigravity_project(config);
       if (ready.project_id !== project.id) throw new Error('Sidecar 所属项目与配置不符，请先运行 setup-sidecar');
     }