ai_co_discuss 0.3.73 → 0.3.74

package/README.md

@@ -115,7 +115,7 @@ Details: [Architecture](docs/en/architecture.md) · [Setup](docs/en/runner.md)
 The site can be self-hosted on **Cloudflare Pages + D1** or **Docker**; agents and the runner still run on your own machine. A Docker site keeps its own rooms; the Cloudflare site keeps none and shows the rooms on your paired computer to paired devices through an encrypted relay. See [Deployment](docs/en/deployment.md).
 
 > [!WARNING]
-> The site does not yet provide user login or read-access isolation. Anyone who can reach the site can read its rooms. Read the [security policy](.github/SECURITY.md) before exposing it publicly.
+> Sites that store rooms (local or Docker) do not yet provide user login or read-access isolation: anyone who can reach such a site can read its rooms. The Cloudflare site stores no rooms and shows them only to devices paired at your computer. Read the [security policy](.github/SECURITY.md) before exposing a site publicly.
 
 ## Documentation
 

package/README.zh-CN.md

@@ -109,7 +109,7 @@ flowchart LR
 网站支持自托管于 **Cloudflare Pages + D1** 或 **Docker**；AI 与接入服务仍在你的电脑运行。Docker 站点自己保存房间；Cloudflare 站点不保存房间，已配对的设备经加密中转看到电脑上的房间。见 [部署指南](docs/deployment.md)。
 
 > [!WARNING]
-> 网站暂无用户登录与读取权限隔离，能访问站点的人即可阅读其中的房间。公开部署前请阅读 [安全说明](.github/SECURITY.md)。
+> 保存房间的站点（本机或 Docker）暂无用户登录与读取权限隔离，能访问该站点的人即可阅读其中的房间。Cloudflare 站点不保存房间，只向在电脑前配对过的设备显示。公开部署前请阅读 [安全说明](.github/SECURITY.md)。
 
 ## 文档
 

package/backend/free_room.py

@@ -1885,6 +1885,9 @@ def inbox(connection, room_id, token):
         # The runner compares this with its adapter's effect and reports a change.
         reported = connection.execute("SELECT rewind FROM member_capabilities WHERE member_id=?", (row["id"],)).fetchone()
         member_view["rewind"] = reported[0] if reported else ""
+        # Private chat lines the runner still has to run in this member's session (backend/private_chat.py).
+        member_view["chats"] = [dict(item) for item in connection.execute(
+            "SELECT id,text,status FROM private_chats WHERE member_id=? AND status IN ('pending','running') ORDER BY id", (row["id"],))]
         pending = [{**request, **review_request_context(connection, request), **sequence_request_context(connection, request)} for request in pending]
         (members if row["access"] == "runner" else observers).append({**member_view, "pending": pending})
     # Pending interjections ride along so the runner hands them to the running software at its next check.

package/backend/private_chat.py

@@ -0,0 +1,108 @@
+"""
+Private chat: the owner talks to one room member directly, in the member's own session, outside the room's messages.
+
+Each row of `private_chats` is one thing the owner said and the member's reply. While the member works on a room
+execution that takes interjections, a new line goes in as an interjection of that execution; otherwise it waits until
+the member is idle and the runner runs it as a turn of its own, taking the reply from the software's output. Only the
+owner reads or writes chats; the runner, which holds the owner credential, reports their progress.
+"""
+import time
+
+from .free_room import ACTIVE, add_interjection
+from .runtime import begin_write, require_owner
+
+MAX_CHAT_LENGTH = 4000
+MAX_REPLY_LENGTH = 20000
+MAX_REASON_LENGTH = 500
+SHOWN_CHATS = 200
+# Interjections made from a chat line carry its submission id under this prefix, so the two are found together.
+INTERJECTION_PREFIX = "chat-"
+# Runner reports and the owner's stop, each with the states it may leave.
+TRANSITIONS = {"start": ("pending", "running"), "steered": ("pending", "interjected"), "reply": ("running", "answered"),
+               "fail": (("pending", "running"), "failed"), "stop": (("pending", "running"), "stopped")}
+
+
+def chat_member(connection, room_id, member_id):
+    """The active member the runner wakes; a manual member is reached only in its own window."""
+    member = connection.execute("SELECT * FROM room_members WHERE room_id=? AND id=? AND status='active'", (room_id, member_id)).fetchone()
+    if not member:
+        raise LookupError("成员不存在或已离开")
+    if member["access"] != "runner":
+        raise FileExistsError("这位成员是手动接入的，只能在它自己的窗口里对话")
+    return member
+
+
+def public_chat(connection, row):
+    """One chat line as the page shows it; a line passed in as an interjection shows how that went."""
+    chat = {key: row[key] for key in ("id", "member_id", "text", "status", "reply", "reason", "execution_id", "created_at", "updated_at")}
+    if row["status"] == "interjected":
+        interjection = connection.execute("""SELECT i.status,i.reason,e.status AS execution_status FROM execution_interjections i
+            JOIN member_executions e ON e.id=i.execution_id WHERE i.room_id=? AND i.submission_id=?""",
+                                          (row["room_id"], INTERJECTION_PREFIX + row["submission_id"])).fetchone()
+        if interjection:
+            ended = interjection["status"] == "pending" and interjection["execution_status"] not in ACTIVE
+            chat["interjection"] = "failed" if ended else interjection["status"]
+            chat["reason"] = "送达前那次执行已结束" if ended else interjection["reason"]
+    return chat
+
+
+def member_chat(connection, room_id, member_id, token, payload=None):
+    """Read one member's private chat, or add the owner's next line to it."""
+    require_owner(connection, room_id, token)
+    if payload is None:
+        chat_member(connection, room_id, member_id)
+        rows = connection.execute("SELECT * FROM (SELECT * FROM private_chats WHERE room_id=? AND member_id=? ORDER BY id DESC LIMIT ?) ORDER BY id",
+                                  (room_id, member_id, SHOWN_CHATS)).fetchall()
+        return {"member_id": member_id, "chats": [public_chat(connection, row) for row in rows]}
+    begin_write(connection)
+    member = chat_member(connection, room_id, member_id)
+    text, submission_id = payload.get("text"), payload.get("submission_id")
+    if not isinstance(text, str) or not 0 < len(text.strip()) <= MAX_CHAT_LENGTH:
+        raise ValueError(f"私聊内容须为 1–{MAX_CHAT_LENGTH} 字")
+    if not isinstance(submission_id, str) or not 0 < len(submission_id) <= 100:
+        raise ValueError("私聊须带 submission_id；重试沿用原编号")
+    earlier = connection.execute("SELECT * FROM private_chats WHERE room_id=? AND submission_id=?", (room_id, submission_id)).fetchone()
+    if earlier:
+        if earlier["member_id"] != member_id or earlier["text"] != text:
+            raise FileExistsError("submission_id 已用于另一句私聊")
+        return public_chat(connection, earlier)
+    now = int(time.time())
+    # A room execution that takes interjections hears it now; one that cannot waits, like a turn already running.
+    execution = connection.execute("""SELECT e.* FROM member_executions e JOIN execution_capabilities c ON c.execution_id=e.id
+        WHERE e.member_id=? AND e.status IN ('dispatched','started') AND c.steer=1 ORDER BY e.id DESC LIMIT 1""", (member["id"],)).fetchone()
+    status, execution_id = "pending", None
+    if execution:
+        add_interjection(connection, room_id, execution, {"text": text, "submission_id": INTERJECTION_PREFIX + submission_id}, now)
+        status, execution_id = "interjected", execution["id"]
+    cursor = connection.execute("""INSERT INTO private_chats (room_id,member_id,submission_id,text,status,execution_id,created_at,updated_at)
+        VALUES (?,?,?,?,?,?,?,?)""", (room_id, member_id, submission_id, text, status, execution_id, now, now))
+    return public_chat(connection, connection.execute("SELECT * FROM private_chats WHERE id=?", (cursor.lastrowid,)).fetchone())
+
+
+def chat_action(connection, room_id, chat_id, token, payload):
+    """The runner's progress on one chat line (start, steered, reply, fail), or the owner's stop."""
+    require_owner(connection, room_id, token)
+    begin_write(connection)
+    action = payload.get("action")
+    if action not in TRANSITIONS:
+        raise ValueError(f"action 须为 {'、'.join(TRANSITIONS)}")
+    row = connection.execute("SELECT * FROM private_chats WHERE room_id=? AND id=?", (room_id, chat_id)).fetchone()
+    if not row:
+        raise LookupError("私聊不存在")
+    allowed, target = TRANSITIONS[action]
+    if row["status"] == target:
+        return public_chat(connection, row)
+    if row["status"] not in (allowed if isinstance(allowed, tuple) else (allowed,)):
+        raise FileExistsError(f"这句私聊当前为 {row['status']}，不能 {action}")
+    reply, reason = payload.get("text", ""), payload.get("reason", "")
+    if not isinstance(reply, str) or len(reply) > MAX_REPLY_LENGTH or not isinstance(reason, str) or len(reason) > MAX_REASON_LENGTH:
+        raise ValueError(f"text 最多 {MAX_REPLY_LENGTH} 字，reason 最多 {MAX_REASON_LENGTH} 字")
+    connection.execute("UPDATE private_chats SET status=?,reply=?,reason=?,updated_at=? WHERE id=?",
+                       (target, reply if action == "reply" else row["reply"], reason, int(time.time()), chat_id))
+    return public_chat(connection, connection.execute("SELECT * FROM private_chats WHERE id=?", (chat_id,)).fetchone())
+
+
+def open_chats(connection, member_id):
+    """The lines the runner still has to run or is running for one member, in order."""
+    return [dict(row) for row in connection.execute(
+        "SELECT id,text,status FROM private_chats WHERE member_id=? AND status IN ('pending','running') ORDER BY id", (member_id,))]

package/backend/schema.sql

@@ -461,6 +461,26 @@ CREATE TABLE IF NOT EXISTS execution_interjections (
     UNIQUE(room_id,submission_id)
 );
 CREATE INDEX IF NOT EXISTS execution_interjections_execution ON execution_interjections(execution_id);
+-- The owner's private chat with one room member: each row is one thing the owner said and the member's reply, outside
+-- the room's messages, so other members never read it. It runs in the member's own session: while the member works on
+-- a room execution that takes interjections it goes in as one (`interjected`, execution_id); otherwise it waits
+-- (`pending`) until the member is idle and the runner runs it as its own turn (`running`), taking the reply from the
+-- software's own output (`answered`). The owner may stop it (`stopped`); the runner reports `failed` with a reason.
+CREATE TABLE IF NOT EXISTS private_chats (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    room_id TEXT NOT NULL REFERENCES rooms(id) ON DELETE CASCADE,
+    member_id INTEGER NOT NULL REFERENCES room_members(id) ON DELETE CASCADE,
+    submission_id TEXT NOT NULL,
+    text TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending','running','answered','failed','stopped','interjected')),
+    reply TEXT NOT NULL DEFAULT '',
+    reason TEXT NOT NULL DEFAULT '',
+    execution_id INTEGER,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE(room_id,submission_id)
+);
+CREATE INDEX IF NOT EXISTS private_chats_member ON private_chats(member_id,id);
 -- What a rewind does to each runner member's session, as its adapter reported: cut by the runner, rebuilt each time
 -- (fresh), or kept as it is. A member without a report is kept; manual and online members are always kept.
 CREATE TABLE IF NOT EXISTS member_capabilities (
@@ -1131,6 +1151,19 @@ BEGIN
     INSERT INTO room_revisions (room_id,revision) SELECT NEW.room_id,(SELECT COALESCE(MAX(revision),0)+1 FROM room_revisions)
         WHERE NOT EXISTS (SELECT 1 FROM room_revisions WHERE room_id=NEW.room_id);
 END;
+CREATE TRIGGER IF NOT EXISTS revision_chat_insert AFTER INSERT ON private_chats
+BEGIN
+    UPDATE room_revisions SET revision=(SELECT MAX(revision)+1 FROM room_revisions) WHERE room_id=NEW.room_id;
+    INSERT INTO room_revisions (room_id,revision) SELECT NEW.room_id,(SELECT COALESCE(MAX(revision),0)+1 FROM room_revisions)
+        WHERE NOT EXISTS (SELECT 1 FROM room_revisions WHERE room_id=NEW.room_id);
+END;
+CREATE TRIGGER IF NOT EXISTS revision_chat_update AFTER UPDATE OF status ON private_chats
+WHEN OLD.status IS NOT NEW.status
+BEGIN
+    UPDATE room_revisions SET revision=(SELECT MAX(revision)+1 FROM room_revisions) WHERE room_id=NEW.room_id;
+    INSERT INTO room_revisions (room_id,revision) SELECT NEW.room_id,(SELECT COALESCE(MAX(revision),0)+1 FROM room_revisions)
+        WHERE NOT EXISTS (SELECT 1 FROM room_revisions WHERE room_id=NEW.room_id);
+END;
 CREATE TRIGGER IF NOT EXISTS revision_interjection_insert AFTER INSERT ON execution_interjections
 BEGIN
     UPDATE room_revisions SET revision=(SELECT MAX(revision)+1 FROM room_revisions) WHERE room_id=NEW.room_id;

package/backend/server.py

@@ -32,6 +32,7 @@ from .free_room import (add_member, after_free_message, after_proactive, authori
                         save_room_access, view_execution)
 from .free_room import convert_suggestion, message_suggestions, save_suggestions, sync_participants
 from .free_room import adopt_recommendation, recommend_member, register_member, require_member
+from .private_chat import chat_action, member_chat
 from .free_room import describe_members, execution_notes, label_members, member_descriptions, member_display_names, member_labels, reorder_speakers, resolve_member_fields, set_chain_rounds, speaking_order, stop_room, stop_room_work
 from .free_room import (ADAPTER_VALUE, ANCHOR_SQL, continue_chain, execution_timeline, group_route_plan, retract_message, rewind_plan, rewind_room,
                         room_event_log, withdrawals)
@@ -2294,7 +2295,7 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             result = queue_action(connection, room_id, token, self.read_payload(), post_queued, check_queued, interrupt_for_message)
             connection.commit()
             return self.respond(result)
-        if parts[3:4] in (["inbox"], ["executions"], ["members"], ["suggestions"], ["recommendations"], ["stop"]):
+        if parts[3:4] in (["inbox"], ["executions"], ["members"], ["chats"], ["suggestions"], ["recommendations"], ["stop"]):
             return self.handle_free_api(connection, parts, method)
         if parts[3:4] == ["attachments"]:
             return self.handle_attachments(connection, parts, params, method)
@@ -2495,6 +2496,10 @@ class DiscussionHandler(BaseHTTPRequestHandler):
             result = member_action(connection, room_id, int(parts[4]), token, self.read_payload())
         elif len(parts) == 6 and parts[3] == "members" and parts[5] == "interrupt" and method == "POST":
             result = interrupt_member(connection, room_id, int(parts[4]), token)
+        elif len(parts) == 6 and parts[3] == "members" and parts[5] == "chat" and method in ("GET", "POST"):
+            result = member_chat(connection, room_id, int(parts[4]), token, self.read_payload() if method == "POST" else None)
+        elif len(parts) == 5 and parts[3] == "chats" and method == "POST":
+            result = chat_action(connection, room_id, int(parts[4]), token, self.read_payload())
         elif len(parts) == 6 and parts[3] == "members" and parts[5] == "capabilities" and method == "POST":
             result = member_capability(connection, room_id, int(parts[4]), token, self.read_payload())
         elif parts[3:] == ["stop"] and method == "POST":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai_co_discuss",
-  "version": "0.3.73",
+  "version": "0.3.74",
   "bin": {
     "codiscuss": "runner/codiscuss.mjs"
   },

package/runner/adapters/antigravity_app.mjs

@@ -1,21 +1,30 @@
 /**
  * Antigravity App adapter: each task is written as a request file for the CoDiscuss Sidecar the App runs
- * (`antigravity_sidecar.mjs`), which starts the turn in the App; its receipt is read back on a later check. The turn runs
- * inside the App, so the runner can neither stop it nor see its progress. Conversations are read through the agy adapter.
+ * (`antigravity_sidecar.mjs`), which starts the turn in the App; its receipt is read back on a later check. A room turn
+ * runs inside the App, so the runner can neither stop it nor see its progress. A private chat turn is followed through
+ * the App's local language server, whose address and token the Sidecar hands over (unpublished internal RPC, tested on
+ * App 2.29.0, 2026-11-06). Conversations are read through the agy adapter.
  */
 import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
 import { fileURLToPath } from 'node:url';
 import { atomic_json } from '../files.mjs';
 import { antigravity_project, database_settings } from './antigravity_cli.mjs';
-import { bind_access, not_sent } from './common.mjs';
+import { bind_access, EDIT_TOOLS, not_sent } from './common.mjs';
 
 const IN_APP = { stoppable: false, progress: false };
+const FOLLOWED = { stoppable: true, progress: true };
+const SERVICE = 'exa.language_server_pb.LanguageServerService';
+const UNPUBLISHED = 'App 内部接口未公开，App 版本可能已变';
+// How a chat turn is waited for; tests shorten these.
+export const CHAT_TIMING = { receipt_ms: 30000, poll_ms: 1000, start_ms: 30000, report_ms: 60000, wait_ms: 2 * 60 * 60 * 1000, rpc_ms: 15000, read_failures: 3 };
 
-/** Queue one immutable request for the official App-managed Sidecar. */
-async function deliver(config, binding, task) {
+/** The running Sidecar's ready record, checked before anything is queued; errors mean nothing was sent. */
+function ready_sidecar(config, binding, task) {
   const directory = resolve(config.ipc_directory);
   try {
     mkdirSync(directory, { recursive: true });
@@ -27,15 +36,195 @@ async function deliver(config, binding, task) {
     }
     try { process.kill(ready.pid, 0); } catch { throw new Error('Antigravity Sidecar 尚未运行'); }
     if (binding.session_id) bind_access(task.access_path, binding.session_id);
+    return ready;
   } catch (error) { throw not_sent(error); }
-  const path = join(directory, `${task.id}.request.json`);
+}
+
+/** Write one immutable request; an existing one must be settled by its receipt, never sent twice. */
+function queue_request(config, request) {
+  const path = join(resolve(config.ipc_directory), `${request.id}.request.json`);
   if (existsSync(path)) throw new Error('Sidecar 请求已存在；必须核对回执，不自动重复发送');
-  atomic_json(path, { id: task.id,
-    event_id: Number(task.id.replace(/^free-/, '')), prompt: task.prompt,
+  atomic_json(path, request);
+}
+
+/** Queue one immutable request for the official App-managed Sidecar. */
+async function deliver(config, binding, task) {
+  ready_sidecar(config, binding, task);
+  queue_request(config, { id: task.id, event_id: Number(task.id.replace(/^free-/, '')), prompt: task.prompt,
     session_id: binding.session_id || '', access_path: task.access_path });
   return { session_id: binding.session_id || '', status: 'sidecar_pending', capabilities: IN_APP };
 }
 
+/** Queue a chat message and wait for the Sidecar to pass it to the App; the conversation ID it went into. */
+async function send_chat(config, request) {
+  queue_request(config, { ...request, chat: true });
+  for (const until = Date.now() + CHAT_TIMING.receipt_ms; Date.now() < until; await sleep(Math.min(CHAT_TIMING.poll_ms, 500))) {
+    const result = receipt(config, request.id);
+    if (result?.status === 'accepted') return result.session_id;
+    if (result) throw new Error(`Antigravity Sidecar 未能发送：${result.error || '状态不明'}`);
+  }
+  throw new Error(`Antigravity Sidecar ${Math.round(CHAT_TIMING.receipt_ms / 1000)} 秒内没有回执，发送状态不明；它稍后仍可能发到 App`);
+}
+
+/** Call one method of the App's language server; every failure names the method and why. */
+async function app_rpc(server, method, body) {
+  const base = /^https?:\/\//.test(server.address) ? server.address : `http://${server.address}`;
+  let response;
+  try {
+    response = await fetch(`${base}/${SERVICE}/${method}`, { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(CHAT_TIMING.rpc_ms),
+      headers: { 'Content-Type': 'application/json', 'Connect-Protocol-Version': '1', 'x-codeium-csrf-token': server.csrf_token },
+      body: JSON.stringify(body) });
+  } catch (error) { throw new Error(`连不上 Antigravity App 的本机服务（${method}：${error.cause?.code || error.message}）；App 可能已退出或重启`); }
+  const text = await response.text();
+  if (!response.ok) throw new Error(`Antigravity App 的 ${method} 返回 HTTP ${response.status}${text ? `：${text.slice(0, 200)}` : ''}（${UNPUBLISHED}）`);
+  try { return JSON.parse(text || '{}'); }
+  catch { throw new Error(`Antigravity App 的 ${method} 返回的不是 JSON（${UNPUBLISHED}）`); }
+}
+
+/** A conversation's run status and steps, read from the App; a missing field means the App changed. */
+async function read_conversation(server, id) {
+  const { status } = await app_rpc(server, 'GetCascadeTrajectory', { cascadeId: id });
+  const { steps } = await app_rpc(server, 'GetCascadeTrajectorySteps', { cascadeId: id });
+  if (typeof status !== 'string' || !Array.isArray(steps)) throw new Error(`Antigravity App 返回的对话状态缺少 status 或 steps（${UNPUBLISHED}）`);
+  return { running: status === 'CASCADE_RUN_STATUS_RUNNING', idle: status === 'CASCADE_RUN_STATUS_IDLE', steps };
+}
+
+function step_state(step, failed = false) {
+  if (/CANCELED|ERROR/.test(step.status || '') || failed) return 'failed';
+  return step.status === 'CORTEX_STEP_STATUS_DONE' ? 'done' : 'running';
+}
+
+/** One App step as process log entries: a response's remark and tool calls (commands show as their own step), commands run. */
+function step_entries(step, index) {
+  // A command moved to the background shows as a generic running step until it finishes, then as the command itself.
+  if (step.type === 'CORTEX_STEP_TYPE_GENERIC' && step.taskDetails) {
+    return [{ id: `step-${index}`, kind: 'command', title: String(step.taskDetails.description || step.taskDetails.title || ''), state: step_state(step) }];
+  }
+  if (step.type === 'CORTEX_STEP_TYPE_RUN_COMMAND') {
+    const command = step.runCommand || {};
+    return [{ id: `step-${index}`, kind: 'command', title: String(command.commandLine || ''), body: String(command.combinedOutput?.full || ''),
+      state: step_state(step, step.status === 'CORTEX_STEP_STATUS_DONE' && (command.exitCode ?? 0) !== 0) }];
+  }
+  if (step.type !== 'CORTEX_STEP_TYPE_PLANNER_RESPONSE') return [];
+  const response = step.plannerResponse || {};
+  const calls = (response.toolCalls || []).filter(call => call.name !== 'run_command');
+  return [...((response.toolCalls || []).length && response.response ? [{ id: `step-${index}`, kind: 'message', body: response.response, state: 'done' }] : []),
+    ...calls.map(call => ({ id: `step-${index}-${call.id}`, kind: EDIT_TOOLS.test(call.name || '') ? 'edit' : 'tool',
+      title: `${call.name} ${call.argumentsJson || ''}`.trim(), state: step_state(step) }))];
+}
+
+/**
+ * Whether an idle App is still inside this turn. A command moved to the background leaves the App idle with an interim
+ * remark; when it finishes, the App reports it as a message from `<conversation>/task-N` and runs again for the reply.
+ * So the turn goes on while a command or task step runs, while a finished task has not reported back (up to
+ * `report_ms` after it was first seen finished, as a report may never come), or while the last step is an unanswered
+ * message. `finished` remembers when each task was first seen finished.
+ */
+function turn_pending(steps, finished, now = Date.now()) {
+  if (steps.at(-1)?.type === 'CORTEX_STEP_TYPE_SYSTEM_MESSAGE') return true;
+  const messages = steps.filter(step => step.type === 'CORTEX_STEP_TYPE_SYSTEM_MESSAGE').map(step => String(step.systemMessage?.message || ''));
+  return steps.some(step => {
+    if (!['CORTEX_STEP_TYPE_GENERIC', 'CORTEX_STEP_TYPE_RUN_COMMAND'].includes(step.type)) return false;
+    if (/RUNNING|GENERATING|PENDING/.test(step.status || '')) return true;
+    const task = step.taskDetails?.id;
+    if (!task || /CANCELED|ERROR/.test(step.status || '') || messages.some(message => message.includes(`sender=${task} `))) return false;
+    if (!finished.has(task)) finished.set(task, now);
+    return now - finished.get(task) < CHAT_TIMING.report_ms;
+  });
+}
+
+/** Follow the turn from its first step until the App goes idle with nothing pending, it is stopped, or the wait runs out. */
+async function follow_chat(context) {
+  const { server, task, state, start } = context;
+  const log_path = resolve(task.directory, `antigravity-${task.id}.log`);
+  const logged = new Map(), noted = new Set(), finished = new Map();
+  const log = entry => {
+    const line = JSON.stringify({ type: 'codiscuss.entry', entry });
+    if (logged.get(entry.id) !== line) { logged.set(entry.id, line); task.on_output?.(log_path, `${line}\n`); }
+  };
+  const began = Date.now();
+  let failures = 0, started = false;
+  try {
+    for (;;) {
+      if (state.stop) return task.on_failure?.(await state.stop);
+      if (Date.now() - began > CHAT_TIMING.wait_ms) return task.on_failure?.('私聊超过等待上限（2 小时）仍未结束，已不再等待；这一轮可能仍在 Antigravity App 中运行');
+      let conversation = null;
+      try { conversation = await read_conversation(server, state.session_id); failures = 0; }
+      catch (error) { if (++failures >= CHAT_TIMING.read_failures) return task.on_failure?.(`读取 Antigravity App 对话失败：${error.message}`); }
+      if (conversation) {
+        conversation.steps.slice(start).forEach((step, offset) => {
+          const index = start + offset;
+          for (const entry of step_entries(step, index)) log(entry);
+          const text = step.type === 'CORTEX_STEP_TYPE_PLANNER_RESPONSE' && step.status === 'CORTEX_STEP_STATUS_DONE' && step.plannerResponse?.response?.trim();
+          if (text && !noted.has(index)) { noted.add(index); task.on_note?.(text); }
+        });
+        started ||= conversation.running || noted.size > 0;
+        if (started && conversation.idle && !turn_pending(conversation.steps.slice(start), finished)) return state.stop ? task.on_failure?.(await state.stop) : task.on_exit?.();
+        if (!started && Date.now() - began > CHAT_TIMING.start_ms) {
+          return task.on_failure?.(`Antigravity App 受理了消息，但 ${Math.round(CHAT_TIMING.start_ms / 1000)} 秒内没有开始这一轮；请在 App 里查看`);
+        }
+      }
+      await sleep(CHAT_TIMING.poll_ms);
+    }
+  } catch (error) { return task.on_failure?.(error.message); }
+}
+
+/**
+ * Stop the turn and its background commands: Cancel ends a running turn (it refuses an idle one), ForceStopCascadeTree
+ * also ends commands moved to the background, which Cancel leaves running. Resolves to the reason the turn reports.
+ */
+async function stop_turn(server, session_id) {
+  const cancel = await app_rpc(server, 'CancelCascadeInvocation', { cascadeId: session_id }).then(() => null, error => error);
+  try { await app_rpc(server, 'ForceStopCascadeTree', { conversationId: session_id }); return '已停止'; }
+  catch (error) {
+    return cancel ? `未能停止：${error.message}；这一轮可能仍在 Antigravity App 中运行`
+      : `已停止这一轮，但未能停止后台命令（${error.message}），后台命令可能仍在运行`;
+  }
+}
+
+/**
+ * A private chat turn in the member's App conversation: the line goes in through the Sidecar's agentapi, and the turn is
+ * followed, stopped and steered through the App's language server. A line sent while the turn runs joins it at the next
+ * step boundary. Without the server's address and token (an older Sidecar, or an App that no longer passes them) the line
+ * is still sent, but the turn reports that no reply can be read.
+ */
+async function chat(config, binding, task) {
+  const ready = ready_sidecar(config, binding, task);
+  const server = ready.language_server?.address && ready.language_server?.csrf_token ? ready.language_server : null;
+  let start = 0;
+  if (server && binding.session_id) {
+    let conversation;
+    try { conversation = await read_conversation(server, binding.session_id); }
+    catch (error) { throw not_sent(error); }
+    if (conversation.running) throw not_sent(new Error('这个 Antigravity App 对话正在运行，等它结束再私聊，或直接在 App 里对话'));
+    start = conversation.steps.length;
+  }
+  const session_id = await send_chat(config, { id: task.id, prompt: task.prompt, session_id: binding.session_id || '', access_path: task.access_path });
+  if (!server) {
+    setImmediate(() => task.on_failure?.('消息已发到 Antigravity App 对话，但拿不到回复：Sidecar 没有提供 App 本机服务的地址与令牌'
+      + '（旧版 Sidecar 需重启 App 后更新，或 App 版本已变）；请在 App 里查看这一轮'));
+    return { session_id, status: 'accepted', capabilities: IN_APP };
+  }
+  const state = { session_id, running: true, stop: null, steers: 0 };
+  const child = new EventEmitter();
+  child.kill = () => {
+    state.stop ||= stop_turn(server, session_id);
+    return true;
+  };
+  task.on_process?.(child);
+  follow_chat({ server, task, state, start }).finally(() => { state.running = false; child.emit('close', 0); });
+  // An interjection the App cannot take now (the turn ended, or reading or sending failed) waits as the next chat line.
+  const steer = async text => {
+    try {
+      if (!state.running || state.stop || !(await read_conversation(server, session_id)).running) return false;
+      await send_chat(config, { id: `${task.id}-steer-${++state.steers}`, prompt: text, session_id, access_path: task.access_path });
+    } catch { return false; }
+    task.on_output?.(resolve(task.directory, `antigravity-${task.id}.log`), `${JSON.stringify({ type: 'codiscuss.interjection', text })}\n`);
+    return true;
+  };
+  return { session_id, status: 'accepted', capabilities: FOLLOWED, steer };
+}
+
 /** The App keeps its own conversation store, apart from agy's. */
 function session_path(session_id, env = process.env, home = homedir()) {
   const file = join(home, '.gemini', 'antigravity', 'conversations', `${session_id}.db`);
@@ -82,7 +271,7 @@ export const antigravity = {
   },
   // Explicit install of the Sidecar the App runs for this member (the setup-sidecar command).
   setup: setup_sidecar,
-  deliver, receipt,
+  deliver, receipt, chat,
   // The App's conversations are read like agy's for the model they ran with; they cannot be branched from here.
   session: { path: session_path, exists: session_exists, owns: session_exists, branch: null,
     settings: (id, { env = process.env, home = homedir() } = {}) => database_settings(session_path(id, env, home)) },