chainlesschain 0.162.156 → 0.162.158

package/src/repl/agent-repl.js

@@ -111,6 +111,7 @@ import {
   resolveAskIdleTimeoutMs,
   questionWithIdleTimeout,
 } from "./permission-prompt.js";
+import { describeAskContext, raceLocalAndRemote } from "./remote-approval.js";
 import {
   parsePermissionTier,
   parsePermissionModeArg,
@@ -448,6 +449,11 @@ export async function startAgentRepl(options = {}) {
   // gate is wired. The wrapper is installed only when settings customize the
   // map, and only bites while _sessionTier === "auto" (isActive predicate).
   let _autoModeResolved = null;
+  // `/remote-control` (批17/18 REPL 收口): paired-device approvals for this
+  // interactive session. Holds { bridge, pairing, close } while active; both
+  // interactive confirmers below race the terminal against the paired device
+  // (first answer wins). null = local-only (byte-identical prompt path).
+  let _remoteApproval = null;
   const baseUrl = options.baseUrl || "http://localhost:11434";
   const apiKey = options.apiKey || null;
   // Configured vision model (config.llm.visionModel) — used when a turn carries
@@ -617,54 +623,79 @@ export async function startAgentRepl(options = {}) {
       _autoModeResolved = null; // fail to the plain gate tiers
     }
     if (typeof _approvalGate.setConfirmer === "function") {
-      _approvalGate.setConfirmer(async ({ tool, args, riskLevel }) => {
-        if (_dontAskActive()) {
-          process.stdout.write(
-            chalk.yellow(
-              `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
-            ),
-          );
-          return false;
-        }
-        await _fireNotification(
-          `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
-        );
+      // The local prompt as a cancelable handle so an active /remote-control
+      // can race it against a paired device: cancel closes the readline when
+      // the device answers first, and `canceled` mutes the stranded
+      // idle-timeout leg so it can't print "auto-denied" after the fact.
+      const askGateApprovalLocally = ({ tool, args, riskLevel }) => {
         const rlConfirm = readline.createInterface({
           input: process.stdin,
           output: process.stdout,
         });
+        let canceled = false;
         const q = (p) => new Promise((res) => rlConfirm.question(p, res));
         const cmd = args?.command ? ` ${args.command}` : "";
-        const res = await questionWithIdleTimeout(
-          q,
-          chalk.yellow(
-            `\n[ApprovalGate] ${riskLevel || "medium"} risk command:${cmd}\n` +
-              `  Proceed? [y]es once / [a]lways allow / [N]o: `,
-          ),
-          _askIdleTimeoutMs,
-        );
-        rlConfirm.close();
-        if (res.timedOut) {
-          process.stdout.write(
+        const promise = (async () => {
+          const res = await questionWithIdleTimeout(
+            q,
             chalk.yellow(
-              `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
+              `\n[ApprovalGate] ${riskLevel || "medium"} risk command:${cmd}\n` +
+                `  Proceed? [y]es once / [a]lways allow / [N]o: `,
             ),
+            _askIdleTimeoutMs,
           );
-          return false;
-        }
-        const ans = res.answer.trim().toLowerCase();
-        if (ans === "a" || ans === "always") {
-          const saved = await _persistAlwaysAllow(tool || "run_shell", args);
-          if (saved) {
+          rlConfirm.close();
+          if (canceled) return false; // raced out — the device already decided
+          if (res.timedOut) {
             process.stdout.write(
-              chalk.green(
-                `  ✓ always allow: added ${saved.rule} → ${saved.file}\n`,
+              chalk.yellow(
+                `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
               ),
             );
+            return false;
+          }
+          const ans = res.answer.trim().toLowerCase();
+          if (ans === "a" || ans === "always") {
+            const saved = await _persistAlwaysAllow(tool || "run_shell", args);
+            if (saved) {
+              process.stdout.write(
+                chalk.green(
+                  `  ✓ always allow: added ${saved.rule} → ${saved.file}\n`,
+                ),
+              );
+            }
+            return true;
           }
-          return true;
+          return ans === "y" || ans === "yes";
+        })();
+        return {
+          promise,
+          cancel: () => {
+            canceled = true;
+            rlConfirm.close();
+          },
+        };
+      };
+      _approvalGate.setConfirmer(async ({ tool, args, riskLevel }) => {
+        if (_dontAskActive()) {
+          process.stdout.write(
+            chalk.yellow(
+              `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
+            ),
+          );
+          return false;
         }
-        return ans === "y" || ans === "yes";
+        await _fireNotification(
+          `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
+        );
+        const local = askGateApprovalLocally({ tool, args, riskLevel });
+        if (!_remoteApproval?.bridge) return local.promise;
+        return raceLocalAndRemote({
+          bridge: _remoteApproval.bridge,
+          ask: describeAskContext({ tool, args, riskLevel }),
+          local,
+          writeOut: (text) => process.stdout.write(chalk.cyan(text)),
+        });
       });
     }
   } catch (_err) {
@@ -693,45 +724,68 @@ export async function startAgentRepl(options = {}) {
       loaded.rules.ask.length +
       loaded.rules.deny.length;
     _permissionRules = total > 0 ? loaded.rules : null;
-    // Confirmer is shared by permission `ask` rules AND hook `ask` decisions,
-    // so define it unconditionally (a `hook:` rule label flows through too).
-    _permissionConfirm = async ({ tool, args, rule, reason }) => {
-      if (_dontAskActive()) {
-        process.stdout.write(
-          chalk.yellow(
-            `\n  ✕ denied without asking (dontAsk mode): ${tool}${rule ? ` (${rule})` : reason ? ` — ${reason}` : ""}\n`,
-          ),
-        );
-        return false;
-      }
-      await _fireNotification(
-        `Permission needed: ${tool}${rule ? " (" + rule + ")" : ""}`,
-      );
+    // Local prompt as a cancelable handle (same shape as the gate confirmer
+    // above) so /remote-control can race it against a paired device.
+    const askPermissionLocally = ({ tool, args, rule, reason }) => {
       const rl = readline.createInterface({
         input: process.stdin,
         output: process.stdout,
       });
+      let canceled = false;
       const q = (p) => new Promise((res) => rl.question(p, res));
       // Picks the right phrasing whether the caller passed a `rule`
       // (settings/hook ask) or a `reason` (destructive-git / sensitive-file
       // guards) — avoids the literal "null" the old template printed.
       const header = buildPermissionPrompt({ tool, args, rule, reason });
-      const res = await questionWithIdleTimeout(
-        q,
-        chalk.yellow(`\n${header}\n  Proceed? (y/N) `),
-        _askIdleTimeoutMs,
-      );
-      rl.close();
-      if (res.timedOut) {
+      const promise = (async () => {
+        const res = await questionWithIdleTimeout(
+          q,
+          chalk.yellow(`\n${header}\n  Proceed? (y/N) `),
+          _askIdleTimeoutMs,
+        );
+        rl.close();
+        if (canceled) return false; // raced out — the device already decided
+        if (res.timedOut) {
+          process.stdout.write(
+            chalk.yellow(
+              `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
+            ),
+          );
+          return false;
+        }
+        const ans = res.answer.trim().toLowerCase();
+        return ans === "y" || ans === "yes";
+      })();
+      return {
+        promise,
+        cancel: () => {
+          canceled = true;
+          rl.close();
+        },
+      };
+    };
+    // Confirmer is shared by permission `ask` rules AND hook `ask` decisions,
+    // so define it unconditionally (a `hook:` rule label flows through too).
+    _permissionConfirm = async ({ tool, args, rule, reason }) => {
+      if (_dontAskActive()) {
         process.stdout.write(
           chalk.yellow(
-            `\n  ⏱ no response in ${_askIdleTimeoutMs}ms — auto-denied\n`,
+            `\n  ✕ denied without asking (dontAsk mode): ${tool}${rule ? ` (${rule})` : reason ? ` — ${reason}` : ""}\n`,
           ),
         );
         return false;
       }
-      const ans = res.answer.trim().toLowerCase();
-      return ans === "y" || ans === "yes";
+      await _fireNotification(
+        `Permission needed: ${tool}${rule ? " (" + rule + ")" : ""}`,
+      );
+      const local = askPermissionLocally({ tool, args, rule, reason });
+      if (!_remoteApproval?.bridge) return local.promise;
+      return raceLocalAndRemote({
+        bridge: _remoteApproval.bridge,
+        ask: describeAskContext({ tool, args, rule, reason }),
+        local,
+        writeOut: (text) => process.stdout.write(chalk.cyan(text)),
+      });
     };
   } catch (_err) {
     if (_err?.code === "CC_MANAGED_SETTINGS_INVALID") throw _err;
@@ -900,6 +954,60 @@ export async function startAgentRepl(options = {}) {
     // Non-critical — SessionManager integration must not block startup
   }
 
+  // `/remote-control` start/stop (批17 slash 入口 + 批18 REPL 接线): reuses
+  // the headless assembly (self-hosted WS on an OS-assigned port + a
+  // RemoteApprovalBridge for this session); the interactive difference is
+  // purely how the confirmers consume it — they RACE the terminal prompt
+  // against the paired device instead of gating on the remote alone.
+  const _startRemoteApproval = async () => {
+    const { startHeadlessRemoteApproval } =
+      await import("../lib/remote-approval-bridge.js");
+    const started = await startHeadlessRemoteApproval({
+      agentSessionId:
+        sessionId || `repl-${process.pid}-${Date.now().toString(36)}`,
+      isText: false, // the REPL prints its own pairing lines below
+    });
+    _remoteApproval = {
+      bridge: started.bridge,
+      pairing: started.pairing,
+      close: started.close,
+    };
+    logger.log(
+      chalk.cyan(
+        "  remote-control: permission prompts can be answered from a paired device (first answer — terminal or device — wins)",
+      ),
+    );
+    logger.log(`  pairing: ${started.pairing.uri}`);
+    try {
+      const { renderQrCode } = await import("../lib/remote-control.js");
+      const qr = await renderQrCode(started.pairing.uri);
+      if (qr) logger.log(qr);
+    } catch (_err) {
+      // QR is progressive enhancement — the URI line is the contract
+    }
+  };
+  const _stopRemoteApproval = async () => {
+    const active = _remoteApproval;
+    _remoteApproval = null; // confirmers fall back to local-only immediately
+    if (active) await active.close().catch(() => undefined);
+  };
+
+  // --remote-control also applies to interactive sessions. Headless fails
+  // closed when the bridge can't start (approvals would silently fall
+  // closed); interactively the terminal still prompts, so a start failure
+  // degrades to local-only with a warning instead of aborting the session.
+  if (options.remoteControl === true) {
+    try {
+      await _startRemoteApproval();
+    } catch (err) {
+      logger.log(
+        chalk.yellow(
+          `  remote-control unavailable (${err.message}) — approvals stay local-only`,
+        ),
+      );
+    }
+  }
+
   // --system-prompt replaces the built-in prompt; --append-system-prompt
   // extends it (parity with the headless runners). The base is kept so an
   // output-style persona can be swapped in/out at runtime via /output-style.
@@ -1262,6 +1370,24 @@ export async function startAgentRepl(options = {}) {
     options.vimMode === true || process.env.CC_VIM === "1" ? true : false;
   let _vim = null;
 
+  // --disable-slash-commands (Claude-Code parity): built-in slash dispatch,
+  // custom command macros and MCP prompt expansion are all bypassed — a
+  // "/"-leading line reaches the model verbatim, the same fall-through an
+  // unmatched slash line already takes. /exit and /quit stay live so the
+  // session remains closable from the keyboard.
+  const _slashCommandsDisabled =
+    options.disableSlashCommands === true ||
+    /^(1|true|yes|on)$/i.test(
+      String(process.env.CC_DISABLE_SLASH_COMMANDS || "").trim(),
+    );
+
+  // --ax-screen-reader / CC_SCREEN_READER: force the mono theme (no ANSI
+  // color codes) so output linearizes cleanly. The repainting status line is
+  // already killed by the CC_STATUSLINE=0 switch agent.js applies.
+  const _screenReaderMode = /^(1|true|yes|on)$/i.test(
+    String(process.env.CC_SCREEN_READER || "").trim(),
+  );
+
   // Color theme (Claude-Code `/theme` parity). Capture chalk's auto-detected
   // level BEFORE any theme touches it so `mono`→level 0 stays reversible, then
   // apply the persisted theme (config `cli.theme`). `mono` strips all color;
@@ -1282,6 +1408,10 @@ export async function startAgentRepl(options = {}) {
   } catch (_e) {
     /* config optional — keep default */
   }
+  // Screen-reader mode overrides the persisted theme: colors are invisible to
+  // a reader and ANSI codes are noise, so run mono for this session (the
+  // stored cli.theme is untouched — /theme still shows and can change it).
+  if (_screenReaderMode) _theme = "mono";
   applyThemeChalk(_theme, chalk, _chalkBaselineLevel);
   const themedPrompt = (text) => {
     const a = promptAccent(_theme);
@@ -1316,65 +1446,70 @@ export async function startAgentRepl(options = {}) {
     // cwd left unset on purpose: the completer resolves process.cwd() lazily
     // so it follows `/cd` mid-session.
     // Keep in sync with the rl.on("line") handlers + /help below.
-    slashCommands: [
-      "/add-dir",
-      "/agents",
-      "/auto",
-      "/btw",
-      "/cd",
-      "/clear",
-      "/compact",
-      "/config",
-      "/context",
-      "/copy",
-      "/cost",
-      "/cowork",
-      "/doctor",
-      "/effort",
-      "/exit",
-      "/export",
-      "/help",
-      "/hooks",
-      "/ide",
-      "/init",
-      "/mcp",
-      "/memory",
-      "/microcompact",
-      "/model",
-      "/output-style",
-      "/permissions",
-      "/plan",
-      "/pr-comments",
-      "/profile",
-      "/provider",
-      "/quit",
-      "/reindex",
-      "/release-notes",
-      "/reload-plugins",
-      "/reload-skills",
-      "/review",
-      "/rewind",
-      "/search",
-      "/session",
-      "/sessions",
-      "/stats",
-      "/status",
-      "/statusline",
-      "/sub-agents",
-      "/task",
-      "/tasks",
-      "/terminal-setup",
-      "/theme",
-      "/think",
-      "/todos",
-      "/ultrathink",
-      "/vim",
-    ],
+    // --disable-slash-commands: nothing to complete — "/" input is plain text.
+    slashCommands: _slashCommandsDisabled
+      ? []
+      : [
+          "/add-dir",
+          "/agents",
+          "/auto",
+          "/btw",
+          "/cd",
+          "/clear",
+          "/compact",
+          "/config",
+          "/context",
+          "/copy",
+          "/cost",
+          "/cowork",
+          "/doctor",
+          "/effort",
+          "/exit",
+          "/export",
+          "/help",
+          "/hooks",
+          "/ide",
+          "/init",
+          "/mcp",
+          "/memory",
+          "/microcompact",
+          "/model",
+          "/output-style",
+          "/permissions",
+          "/plan",
+          "/pr-comments",
+          "/profile",
+          "/provider",
+          "/quit",
+          "/reindex",
+          "/release-notes",
+          "/reload-plugins",
+          "/reload-skills",
+          "/remote-control",
+          "/review",
+          "/rewind",
+          "/search",
+          "/session",
+          "/sessions",
+          "/stats",
+          "/status",
+          "/statusline",
+          "/sub-agents",
+          "/task",
+          "/tasks",
+          "/terminal-setup",
+          "/theme",
+          "/think",
+          "/todos",
+          "/ultrathink",
+          "/vim",
+        ],
     // User/project custom commands (.claude/commands/*.md) join TAB completion
     // alongside the built-ins above. Sync + best-effort; the completer
     // TTL-caches the result so this filesystem walk runs at most once per few
     // seconds, and process.cwd() makes it follow `/cd` mid-session.
     getDynamicSlashCommands: () => {
+      if (_slashCommandsDisabled) return [];
       try {
         return discoverCommands(process.cwd()).map((cmd) => `/${cmd.name}`);
       } catch {
@@ -1719,7 +1854,20 @@ export async function startAgentRepl(options = {}) {
       _mlBuffer.length = 0;
     }
 
-    const trimmed = input.trim();
+    const rawLine = input.trim();
+    // --disable-slash-commands: hide "/"-leading input from every built-in
+    // slash handler below by dispatching a sentinel no handler can match; the
+    // turn tail restores the user's real text (promptText), so the line goes
+    // to the model verbatim — the same fall-through an unmatched slash line
+    // already takes. /exit and /quit stay live so the session can be closed.
+    // Predicate + sentinel are pure (lib/slash-dispatch.js, unit-tested).
+    const { slashDispatchBypassed, slashBypassSentinel } =
+      await import("../lib/slash-dispatch.js");
+    const _slashBypassed = slashDispatchBypassed(
+      rawLine,
+      _slashCommandsDisabled,
+    );
+    const trimmed = _slashBypassed ? slashBypassSentinel() : rawLine;
     if (!trimmed) {
       prompt();
       return;
@@ -1870,6 +2018,9 @@ export async function startAgentRepl(options = {}) {
       logger.log(
         `  ${chalk.cyan("/permissions")} Allow/ask/deny rules; set/cycle tier (/permissions <tier> · Shift+Tab); /permissions denials to review blocked calls`,
       );
+      logger.log(
+        `  ${chalk.cyan("/remote-control")} Answer permission prompts from a paired phone/web device (on|off|status; alias /rc)`,
+      );
       logger.log(
         `  ${chalk.cyan("/export")}     Save this conversation to a Markdown file (/export [path])`,
       );
@@ -3989,6 +4140,57 @@ export async function startAgentRepl(options = {}) {
       return;
     }
 
+    // `/remote-control` — pair a phone/web device to answer this session's
+    // permission prompts (批17 slash 入口 + 批18 REPL 接线). First answer —
+    // terminal or device — wins; devices get permission.request cards + push.
+    if (
+      trimmed === "/remote-control" ||
+      trimmed.startsWith("/remote-control ") ||
+      trimmed === "/rc" ||
+      trimmed.startsWith("/rc ")
+    ) {
+      const arg = trimmed
+        .replace(/^\/(remote-control|rc)/, "")
+        .trim()
+        .toLowerCase();
+      if (arg === "off" || arg === "stop") {
+        if (!_remoteApproval) {
+          logger.info("remote-control is not active.");
+        } else {
+          await _stopRemoteApproval();
+          logger.info(
+            "remote-control stopped — approvals are local-only again.",
+          );
+        }
+      } else if (arg === "status") {
+        if (!_remoteApproval) {
+          logger.info("remote-control: off — start with /remote-control");
+        } else {
+          logger.log(`  pairing: ${_remoteApproval.pairing.uri}`);
+          const approvers = await _remoteApproval.bridge.approverCount();
+          logger.log(
+            `  paired approvers: ${approvers}${approvers === 0 ? "  (scan the pairing URI from the mobile app or web panel)" : ""}`,
+          );
+        }
+      } else if (arg === "" || arg === "on" || arg === "start") {
+        if (_remoteApproval) {
+          logger.info(
+            "remote-control already running — /remote-control status",
+          );
+        } else {
+          try {
+            await _startRemoteApproval();
+          } catch (err) {
+            logger.info(`remote-control failed to start: ${err.message}`);
+          }
+        }
+      } else {
+        logger.info("Usage: /remote-control [on|off|status]   (alias /rc)");
+      }
+      prompt();
+      return;
+    }
+
     // `/cost` — running token spend + estimated $ for this session (Claude-Code
     // parity). In-memory accumulation, so it works without session persistence.
     if (trimmed === "/cost" || trimmed.startsWith("/cost ")) {
@@ -4086,13 +4288,15 @@ export async function startAgentRepl(options = {}) {
     // parity. resolveSlashMacro maps a leading /name to a command macro and
     // expands its template; a non-match returns the line unchanged so a literal
     // prompt like "/etc/hosts" still reaches the LLM. Wire is unit-tested.
-    let promptText = trimmed;
+    // Under --disable-slash-commands the sentinel never reached a handler;
+    // restore the user's real text so the model sees it verbatim.
+    let promptText = _slashBypassed ? rawLine : trimmed;
 
     // MCP server-provided prompts (Claude-Code parity): `/mcp__<server>__<name>
     // [json-args]` fetches a rendered prompt template from the connected MCP
     // server and uses its text as this turn's input. Falls through unchanged
     // when the line isn't an MCP prompt command.
-    if (promptText.startsWith("/mcp__")) {
+    if (!_slashBypassed && promptText.startsWith("/mcp__")) {
       try {
         const expanded = await expandMcpPrompt(
           promptText,
@@ -4114,7 +4318,7 @@ export async function startAgentRepl(options = {}) {
     // `/pr-comments [<n>|<url>] [--repo owner/name]` (Claude-Code parity):
     // fetch a GitHub PR's reviews + conversation + inline comments via `gh` and
     // feed them as this turn's input so the agent can address the feedback.
-    if (promptText.startsWith("/pr-comments")) {
+    if (!_slashBypassed && promptText.startsWith("/pr-comments")) {
       try {
         const { expandPrComments } = await import("./pr-comments.js");
         const res = await expandPrComments(promptText);
@@ -4927,6 +5131,16 @@ export async function startAgentRepl(options = {}) {
       }
     }
 
+    // Tear down /remote-control (bridge + its self-hosted WS server) so the
+    // pairing endpoint doesn't outlive the session.
+    if (_remoteApproval) {
+      try {
+        await _stopRemoteApproval();
+      } catch (_e) {
+        // Non-critical
+      }
+    }
+
     // Kill any background run_shell tasks so a backgrounded command (e.g. a
     // dev server) doesn't outlive the REPL session.
     try {