chainlesschain 0.162.156 → 0.162.158

package/src/repl/remote-approval.js

@@ -0,0 +1,111 @@
+/**
+ * REPL-side remote-approval glue (gap-analysis 批26 — 批17/18 REPL 遗留收口).
+ *
+ * Interactive sessions race the LOCAL terminal prompt against a paired
+ * device's decision (headless gates on the remote decision alone):
+ *
+ *   - local answer first  → settle the device card too (resolveLocally
+ *     publishes permission.resolved so the phone/web UI clears it)
+ *   - remote answer first → cancel the local readline prompt and print
+ *     the outcome
+ *   - remote leg times out or the bridge closes mid-ask → NOT a decision:
+ *     keep waiting on the terminal. A silent phone must never auto-deny a
+ *     user sitting at the keyboard — the fail-closed timeout is headless
+ *     semantics only.
+ *
+ * Pure over an injected bridge + local prompt handle ({promise, cancel}),
+ * so the race is unit-testable without a WS server or readline.
+ */
+
+/**
+ * Normalize the shapes the REPL's two confirmers receive (ApprovalGate
+ * `{tool, args, riskLevel}` / settings-hook `{tool, args, rule, reason}`)
+ * into the bridge's `{tool, action, detail}` ask payload.
+ */
+export function describeAskContext({
+  tool,
+  args,
+  rule = null,
+  reason = null,
+  riskLevel = null,
+} = {}) {
+  const detail =
+    typeof args?.command === "string"
+      ? args.command
+      : typeof args?.path === "string"
+        ? args.path
+        : args
+          ? JSON.stringify(args).slice(0, 2000)
+          : null;
+  return {
+    tool: tool || null,
+    action: rule
+      ? `ask-rule:${rule}`
+      : reason || (riskLevel ? `${riskLevel}-risk` : null),
+    detail,
+  };
+}
+
+// Remote outcomes that are NOT a decision for an interactive session: the
+// devices went silent (timeout) or the bridge was torn down mid-ask (closed).
+const NON_DECISIVE_REMOTE = new Set(["timeout", "closed"]);
+
+/**
+ * Race the local interactive prompt against the paired-device decision.
+ *
+ * @param {object} opts
+ * @param {import("../lib/remote-approval-bridge.js").RemoteApprovalBridge} opts.bridge
+ * @param {{tool?, action?, detail?}} opts.ask - describeAskContext() payload
+ * @param {{promise: Promise<boolean>, cancel?: () => void}} opts.local -
+ *   the already-started local prompt; `cancel` closes its readline when the
+ *   device answers first (implementations must mute their idle-timeout
+ *   message after cancel).
+ * @param {(text: string) => void} [opts.writeOut]
+ * @returns {Promise<boolean>} approved
+ */
+export async function raceLocalAndRemote({
+  bridge,
+  ask = {},
+  local,
+  writeOut = () => {},
+}) {
+  let requestId = null;
+  const remoteLeg = bridge
+    .requestDecision({
+      ...ask,
+      onRequestId: (id) => {
+        requestId = id;
+      },
+    })
+    .then((decision) => ({ src: "remote", decision }));
+  const localLeg = local.promise.then(
+    (approved) => ({ src: "local", approved: approved === true }),
+    () => ({ src: "local", approved: false }),
+  );
+  let winner = await Promise.race([remoteLeg, localLeg]);
+  if (
+    winner.src === "remote" &&
+    NON_DECISIVE_REMOTE.has(winner.decision?.via)
+  ) {
+    winner = await localLeg;
+  }
+  if (winner.src === "local") {
+    if (requestId) {
+      try {
+        bridge.resolveLocally(requestId, winner.approved);
+      } catch {
+        // clearing the device card is best-effort
+      }
+    }
+    return winner.approved;
+  }
+  try {
+    local.cancel?.();
+  } catch {
+    // readline already closed
+  }
+  writeOut(
+    `\n  ✓ ${winner.decision.approved ? "allowed" : "denied"} from paired device\n`,
+  );
+  return winner.decision.approved === true;
+}

package/src/runtime/agent-core.js

@@ -1041,6 +1041,7 @@ async function tryIdeDiffApprovalForEdit(
       hasIdeOpenDiff,
       requestIdeDiffApproval,
       formatReviewComments,
+      summarizeUserAmendments,
     } = await import("../lib/ide-context.js");
     const mcpLike = {
       mcpClient: context.mcpClient,
@@ -1056,15 +1057,22 @@ async function tryIdeDiffApprovalForEdit(
       title: `cc agent: ${name} ${path.basename(proposal.filePath)}`,
     });
     if (verdict?.outcome === "accepted") {
+      // When the reviewer amended the proposal in the diff before accepting,
+      // hand the agent the actual -/+ delta — not just a flag — so its model
+      // of the file matches what was really written (gap #4: the agent
+      // perceives the user's edits).
+      const amendments =
+        verdict.finalText != null && verdict.finalText !== proposal.newContent
+          ? summarizeUserAmendments(proposal.newContent, verdict.finalText)
+          : null;
       return {
         outcome: "accepted",
         result: {
           success: true,
           path: proposal.filePath,
           appliedVia: "ide-diff",
-          ...(verdict.finalText != null &&
-          verdict.finalText !== proposal.newContent
-            ? { userEdited: true }
+          ...(amendments
+            ? { userEdited: true, userAmendments: amendments }
             : {}),
           policy: { decision: "allow", rule, via: "ide-diff" },
         },
@@ -2431,6 +2439,24 @@ async function executeToolInner(
         }
       }
 
+      // P1 #8 Windows/PowerShell first-class: per-call args.shell or the
+      // configured settings `shell.windowsDefault` may route this command
+      // through PowerShell via explicit argv (`powershell.exe -NoProfile
+      // [-ExecutionPolicy <p>] -Command <cmd>`). The unconfigured path keeps
+      // the historical default shell byte-identical (useDefaultShell=true).
+      const { resolveShellInvocation } =
+        await import("../lib/shell-selector.cjs");
+      const shellInv = resolveShellInvocation({
+        command: args.command,
+        requested: args.shell,
+        cwd: args.cwd || cwd,
+      });
+      const shellMeta = shellInv.useDefaultShell
+        ? shellInv.note
+          ? { shell_note: shellInv.note }
+          : {}
+        : { shell: shellInv.kind };
+
       // Background: spawn, register, return a task_id immediately. The agent
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
@@ -2463,9 +2489,9 @@ async function executeToolInner(
           child: null,
         };
         try {
-          const child = spawn(args.command, {
+          const bgSpawnOpts = {
             cwd: task.cwd,
-            shell: true,
+            shell: shellInv.useDefaultShell,
             windowsHide: true,
             // Same agent-identity env as the foreground path: CLAUDECODE marks
             // "running under the agent"; the session id correlates work to the
@@ -2484,7 +2510,12 @@ async function executeToolInner(
             // the whole tree (shell + its grandchild command). No-op on Windows
             // where the tree is killed via taskkill /T instead.
             detached: process.platform !== "win32",
-          });
+          };
+          // PowerShell route: explicit argv (shell:false above); default route
+          // is the historical spawn(command, {shell:true}) byte-for-byte.
+          const child = shellInv.useDefaultShell
+            ? spawn(args.command, bgSpawnOpts)
+            : spawn(shellInv.file, shellInv.argv, bgSpawnOpts);
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
@@ -2532,6 +2563,7 @@ async function executeToolInner(
             task_id: id,
             status: task.status,
             command: task.command,
+            ...shellMeta,
             hint: "Poll output and completion with the check_shell tool using this task_id. Kill long-lived servers with check_shell { task_id, kill: true } when done.",
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
@@ -2630,7 +2662,7 @@ async function executeToolInner(
       }
 
       try {
-        const output = execSync(args.command, {
+        const fgExecOpts = {
           cwd: args.cwd || cwd,
           encoding: "utf8",
           timeout: _resolveShellTimeout(args.timeout),
@@ -2649,10 +2681,35 @@ async function executeToolInner(
                 }
               : {}),
           },
-        });
+        };
+        let output;
+        if (shellInv.useDefaultShell) {
+          output = execSync(args.command, fgExecOpts);
+        } else {
+          // PowerShell route: explicit argv, no intermediate default shell.
+          // Reproduce execSync's contract so the shared catch shapes errors
+          // identically: throw on spawn error; throw an Error carrying
+          // status/stdout/stderr on non-zero exit.
+          const res = spawnSync(shellInv.file, shellInv.argv, {
+            ...fgExecOpts,
+            windowsHide: true,
+          });
+          if (res.error) throw res.error;
+          if (res.status !== 0) {
+            const e = new Error(
+              `Command failed (${shellInv.kind}, exit ${res.status}): ${args.command}`,
+            );
+            e.status = res.status;
+            e.stdout = res.stdout;
+            e.stderr = res.stderr;
+            throw e;
+          }
+          output = res.stdout ?? "";
+        }
         return attachDescriptor(
           {
             stdout: output.substring(0, 30000),
+            ...shellMeta,
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
           },
@@ -2672,6 +2729,7 @@ async function executeToolInner(
               : {}),
             stderr: (err.stderr || "").substring(0, 2000),
             exitCode: err.status,
+            ...shellMeta,
             shellCommandPolicy: shellPolicy,
             approval: approvalOutcome,
           },
@@ -3104,6 +3162,65 @@ async function executeToolInner(
       }
     }
 
+    case "publish_artifact": {
+      // P1 #10: copy a finished deliverable into the user's artifact store.
+      // Only METADATA returns to the conversation (the transcript never
+      // carries the file body); `cc artifacts` lists/inspects/cleans.
+      try {
+        const { ArtifactStore } = await import("../lib/artifact-store.js");
+        const store = new ArtifactStore();
+        const entry = store.publish({
+          filePath: path.resolve(cwd, String(args.path || "")),
+          title: args.title,
+          kind: args.kind,
+          ttlDays: args.ttl_days,
+          sessionId: sessionId ? String(sessionId) : null,
+        });
+        return attachDescriptor({
+          published: entry,
+          hint: "The user can browse this with `cc artifacts list` / `cc artifacts show <id>`.",
+        });
+      } catch (err) {
+        return attachDescriptor({
+          error: `publish_artifact failed: ${err.message}`,
+        });
+      }
+    }
+
+    case "browser_state": {
+      // P1 #8: first-class Chrome CDP observation — the agent side of the
+      // "locate error → fix → verify" web loop against the user's real,
+      // logged-in browser (`cc browse chrome launch`). DOM is capped harder
+      // than the CLI command's 150k default so a page dump cannot flood the
+      // conversation; screenshots go to a generated temp file (never an
+      // agent-chosen path) to keep the tool strictly read-only.
+      try {
+        const { captureState } = await import("../lib/chrome-connector.js");
+        const screenshotPath = args.screenshot
+          ? path.join(os.tmpdir(), `cc-browser-state-${Date.now()}.png`)
+          : null;
+        const state = await captureState({
+          port: args.port != null ? Number(args.port) : undefined,
+          tab: args.tab != null ? Number(args.tab) : undefined,
+          reload: args.reload === true,
+          watchMs: args.watch_ms != null ? Number(args.watch_ms) : undefined,
+          includeDom: args.include_dom !== false,
+          domCap: args.dom_cap != null ? Number(args.dom_cap) : 40000,
+          screenshotPath,
+        });
+        if (!state.ok) {
+          return attachDescriptor({
+            error: `browser_state failed: ${state.error}`,
+          });
+        }
+        return attachDescriptor(state);
+      } catch (err) {
+        return attachDescriptor({
+          error: `browser_state failed: ${err.message}`,
+        });
+      }
+    }
+
     case "search_files": {
       // An explicit directory scopes the search to one root; otherwise span
       // cwd plus any --add-dir roots so cross-package searches find matches.
@@ -6438,6 +6555,10 @@ export function formatToolArgs(name, args) {
       return `"${(args.query || "").substring(0, 60)}"`;
     case "notify":
       return `${args.level || "info"}: ${(args.title || "").substring(0, 50)}`;
+    case "publish_artifact":
+      return `${args.kind || "other"}: ${(args.title || args.path || "").substring(0, 60)}`;
+    case "browser_state":
+      return `tab=${args.tab ?? 0} port=${args.port ?? 9222}${args.reload ? " reload" : ""}`;
     case "schedule":
       return args.action === "cron"
         ? `cron ${args.cron || ""}`.trim()

package/src/runtime/coding-agent-contract-shared.cjs

@@ -238,6 +238,12 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
           description:
             "Foreground (synchronous) timeout in milliseconds. Default 60000, max 600000. Ignored when run_in_background is true.",
         },
+        shell: {
+          type: "string",
+          enum: ["default", "cmd", "powershell", "pwsh"],
+          description:
+            "Shell to run the command with (optional). default = the platform shell (cmd.exe on Windows, /bin/sh elsewhere) or the configured settings shell.windowsDefault. Use powershell (Windows PowerShell 5.1) or pwsh (PowerShell 7+) when the command uses PowerShell syntax: cmdlets, object pipelines, $variables.",
+        },
       },
       required: ["command"],
     },
@@ -953,6 +959,105 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
       tags: ["tool:schedule", "contract:coding-agent", "tier:extension"],
     },
   },
+  {
+    name: "publish_artifact",
+    title: "Publish Artifact",
+    kind: "artifact",
+    tier: "extension",
+    description:
+      "Publish a finished deliverable file (Markdown report, patch, screenshot, test log, findings JSON) as a durable artifact the user can find later with `cc artifacts`. The file is copied into the user's artifact store with metadata; only the metadata enters the conversation. Use at the END of a task for its key outputs — not for intermediate scratch files.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description:
+            "Path of the file to publish (relative to cwd or absolute)",
+        },
+        title: {
+          type: "string",
+          description: "Human title for the artifact (default: the file name)",
+        },
+        kind: {
+          type: "string",
+          enum: ["report", "patch", "screenshot", "log", "data", "other"],
+          description: "What kind of deliverable this is (default: other)",
+        },
+        ttl_days: {
+          type: "number",
+          description:
+            "Days to retain before `cc artifacts clean` may remove it (default 30)",
+        },
+      },
+      required: ["path"],
+    },
+    ...TOOL_POLICY_METADATA.publish_artifact,
+    permissions: {
+      level: "standard",
+      scopes: ["filesystem:read", "artifact:write"],
+    },
+    telemetry: {
+      category: "artifact",
+      tags: [
+        "tool:publish_artifact",
+        "contract:coding-agent",
+        "tier:extension",
+      ],
+    },
+  },
+  {
+    name: "browser_state",
+    title: "Browser State",
+    kind: "browser",
+    tier: "extension",
+    description:
+      "Capture live state from the user's real Chrome over CDP: current URL/title, open tabs, console messages and failed/error network requests observed during a short watch window, a capped DOM snapshot, and optionally a screenshot (saved to a temp file whose path is returned). Requires a debuggable Chrome — the user starts one with `cc browse chrome launch`. Console/network capture starts at attach time (CDP keeps no history) — set reload=true to observe load-time errors. Use to verify web changes in the user's logged-in browser.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        port: {
+          type: "number",
+          description: "CDP port of the debuggable Chrome (default 9222)",
+        },
+        tab: {
+          type: "number",
+          description: "Tab index to observe (default 0)",
+        },
+        reload: {
+          type: "boolean",
+          description:
+            "Reload the page first to capture load-time console/network (default false)",
+        },
+        watch_ms: {
+          type: "number",
+          description: "Observation window in milliseconds (default 3000)",
+        },
+        include_dom: {
+          type: "boolean",
+          description: "Include a capped HTML snapshot (default true)",
+        },
+        dom_cap: {
+          type: "number",
+          description: "Max HTML characters to return (default 40000)",
+        },
+        screenshot: {
+          type: "boolean",
+          description:
+            "Save a screenshot to a generated temp file and return its path (default false)",
+        },
+      },
+      required: [],
+    },
+    ...TOOL_POLICY_METADATA.browser_state,
+    permissions: {
+      level: "standard",
+      scopes: ["browser:read"],
+    },
+    telemetry: {
+      category: "browser",
+      tags: ["tool:browser_state", "contract:coding-agent", "tier:extension"],
+    },
+  },
 ]);
 
 const CODING_AGENT_MVP_TOOL_NAMES = Object.freeze(

package/src/runtime/coding-agent-policy.cjs

@@ -289,6 +289,37 @@ const TOOL_POLICY_METADATA = Object.freeze({
     approvalFlow: "auto",
     isReadOnly: false,
   },
+  // Copies a finished deliverable (report/patch/screenshot/log) into the
+  // user's own ~/.chainlesschain/artifacts store with metadata. Reads a
+  // workspace file, writes only under the user's config dir — no third-party
+  // egress. Blocked in plan mode (publishing is a side effect of DONE work,
+  // not analysis).
+  publish_artifact: {
+    riskLevel: RISK_LEVELS.LOW,
+    category: TOOL_CATEGORIES.WRITE,
+    availableInPlanMode: false,
+    planModeBehavior: "blocked",
+    requiresPlanApproval: false,
+    requiresConfirmation: false,
+    approvalFlow: "auto",
+    isReadOnly: false,
+  },
+  // Attaches to the user's own debuggable Chrome over loopback CDP and
+  // observes one tab (console/network/DOM/optional screenshot) for a bounded
+  // window. Observation only — it never clicks, types, or navigates; the
+  // optional reload re-runs the page the user already has open, and the
+  // screenshot goes to a generated temp path (never an agent-chosen one), so
+  // the tool stays read-only and plan-mode safe.
+  browser_state: {
+    riskLevel: RISK_LEVELS.LOW,
+    category: TOOL_CATEGORIES.READ,
+    availableInPlanMode: true,
+    planModeBehavior: "allow",
+    requiresPlanApproval: false,
+    requiresConfirmation: false,
+    approvalFlow: "auto",
+    isReadOnly: true,
+  },
 });
 
 function normalizeGitCommand(command) {

package/src/runtime/headless-stream.js

@@ -181,6 +181,47 @@ export function planSnapshot(pm) {
   }
   return { active: pm.isActive(), state: pm.state || null, items, risk };
 }
+
+const MAX_PLAN_REVIEW_SNAPSHOT_CHARS = 24000;
+
+function planReviewFromInput(obj) {
+  const review =
+    obj && obj.review && typeof obj.review === "object" ? obj.review : null;
+  const snapshot =
+    typeof obj?.snapshot === "string"
+      ? obj.snapshot
+      : typeof review?.snapshot === "string"
+        ? review.snapshot
+        : "";
+  if (!snapshot.trim()) return null;
+  const text =
+    snapshot.length > MAX_PLAN_REVIEW_SNAPSHOT_CHARS
+      ? snapshot.slice(0, MAX_PLAN_REVIEW_SNAPSHOT_CHARS) +
+        `\n\n[review snapshot truncated: ${snapshot.length - MAX_PLAN_REVIEW_SNAPSHOT_CHARS} chars omitted]`
+      : snapshot;
+  return {
+    action: String(review?.action || obj.action || "").toLowerCase(),
+    reviewedAt:
+      typeof review?.reviewedAt === "string" ? review.reviewedAt : null,
+    conversationId:
+      typeof review?.conversationId === "string" ? review.conversationId : null,
+    snapshot: text,
+  };
+}
+
+function planReviewSystemMessage(review) {
+  if (!review?.snapshot) return null;
+  const meta = [
+    review.action ? `action=${review.action}` : null,
+    review.reviewedAt ? `reviewedAt=${review.reviewedAt}` : null,
+    review.conversationId ? `conversationId=${review.conversationId}` : null,
+  ]
+    .filter(Boolean)
+    .join(" ");
+  return (
+    "[PLAN REVIEW SNAPSHOT]" + (meta ? ` ${meta}` : "") + "\n" + review.snapshot
+  );
+}
 import { withQuietStdout } from "./quiet-stdout.js";
 
 /**
@@ -199,7 +240,9 @@ export function parseInputEvent(line) {
   //   {"type":"plan","action":"enter"|"approve"|"reject"}
   if (obj && typeof obj === "object" && obj.type === "plan") {
     const action = String(obj.action || "").toLowerCase();
-    return action ? { plan: action } : null;
+    if (!action) return null;
+    const planReview = planReviewFromInput(obj);
+    return planReview ? { plan: action, planReview } : { plan: action };
   }
   // Turn interrupt (panel Stop / Claude-Code Esc parity): aborts the
   // in-flight turn without ending the conversation. {"type":"interrupt"}
@@ -1304,6 +1347,13 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
     // exits plan mode. Every control answers with a `plan_update` event.
     if (parsed.plan) {
       const pm = getPlanModeManager();
+      const reviewMessage =
+        parsed.plan === "approve" || parsed.plan === "reject"
+          ? planReviewSystemMessage(parsed.planReview)
+          : null;
+      if (reviewMessage) {
+        messages.push({ role: "system", content: reviewMessage });
+      }
       if (parsed.plan === "enter") {
         if (!pm.isActive()) {
           pm.enterPlanMode({ title: "Agent Plan" });

package/src/runtime/policies/agent-policy.js

@@ -55,6 +55,10 @@ export function resolveAgentPolicy({
     fallbackModels: overrides.fallbackModels,
     pdh: overrides.pdh,
     outputStyle: overrides.outputStyle,
+    disableSlashCommands: overrides.disableSlashCommands === true,
+    // --remote-control also applies interactively: the REPL starts the
+    // paired-device approval bridge at startup (批26).
+    remoteControl: overrides.remoteControl === true,
   };
 }