cli-wechat-bridge 1.0.5 → 1.0.6

package/README.md

@@ -6,9 +6,12 @@
 
 <p align="center">
   <a href="https://github.com/UNLINEARITY/CLI-WeChat-Bridge"><img alt="GitHub stars" src="https://img.shields.io/github/stars/UNLINEARITY/CLI-WeChat-Bridge?label=Stars&amp;style=for-the-badge&amp;logo=github&amp;color=0891b2&amp;labelColor=1c1917"></a>
-  <a href="https://www.npmjs.com/package/cli-wechat-bridge"><img alt="npm version" src="https://img.shields.io/npm/v/cli-wechat-bridge?label=npm&amp;style=for-the-badge&amp;logo=npm&amp;color=cb3837&amp;labelColor=1c1917"></a>
-  <a href="https://www.npmjs.com/package/cli-wechat-bridge"><img alt="npm downloads" src="https://img.shields.io/npm/dm/cli-wechat-bridge?label=Downloads&amp;style=for-the-badge&amp;logo=npm&amp;color=16a34a&amp;labelColor=1c1917"></a>
-  <a href="https://github.com/UNLINEARITY/CLI-WeChat-Bridge/blob/main/LICENSE.txt"><img alt="License" src="https://img.shields.io/github/license/UNLINEARITY/CLI-WeChat-Bridge?label=License&amp;style=for-the-badge&amp;color=7c3aed&amp;labelColor=1c1917"></a>
+  <a href="https://www.npmjs.com/package/cli-wechat-bridge"><img alt="npm version" src="https://img.shields.io/npm/v/cli-wechat-bridge?label=npm&amp;style=for-the-badge&amp;logo=npm&amp;color=cb3837&amp;labelColor=1c1917"></a>
+  <a href="https://www.npmjs.com/package/cli-wechat-bridge"><img alt="npm downloads" src="https://img.shields.io/npm/dm/cli-wechat-bridge?label=Downloads&amp;style=for-the-badge&amp;logo=npm&amp;color=16a34a&amp;labelColor=1c1917"></a>
+  <a href="https://www.npmjs.com/package/@unlinearity/cli-wechat-bridge"><img alt="scoped npm downloads" src="https://img.shields.io/npm/dm/@unlinearity/cli-wechat-bridge?label=Scoped%20downloads&amp;style=for-the-badge&amp;logo=npm&amp;color=15803d&amp;labelColor=1c1917"></a>
+  <a href="https://www.npmjs.com/package/cli-wechat-bridge">
+  <img alt="License" src="https://img.shields.io/npm/l/cli-wechat-bridge?label=License&style=for-the-badge&color=7c3aed&labelColor=1c1917">
+</a>
 </p>
 
 **命令行工具的微信桥接**：本项目用于桥接微信消息与本地运行的 [`Codex`](https://github.com/openai/codex)、[`Claude Code`](https://code.claude.com/docs/en/overview)、`OpenCode` 或持久化 `powershell.exe` 会话，并将本地输出、审批请求与运行状态同步回微信。
@@ -47,13 +50,13 @@
 
 正式版本可以直接从 npm 安装：
 
-```bash
-npm install -g cli-wechat-bridge@latest
-```
-
-安装后可在任意项目目录中直接使用 `wechat-daemon`、`wechat-codex-start`、`wechat-claude-start`、`wechat-opencode-start` 等命令。
-
-兼容说明：旧包名 `@unlinearity/cli-wechat-bridge` 会继续同步发布，已经安装旧包名的用户可以正常升级；新用户优先使用更短的 `cli-wechat-bridge`。
+```bash
+npm install -g cli-wechat-bridge@latest
+```
+
+安装后可在任意项目目录中直接使用 `wechat-daemon`、`wechat-codex-start`、`wechat-claude-start`、`wechat-opencode-start` 等命令。
+
+兼容说明：旧包名 `@unlinearity/cli-wechat-bridge` 会继续同步发布，已经安装旧包名的用户可以正常升级；新用户优先使用更短的 `cli-wechat-bridge`。
 
 如果你希望从源码运行或参与开发，也可以克隆仓库并安装依赖：
 
@@ -152,12 +155,12 @@ wechat-daemon
 | 指令 | 行为 |
 | --- | --- |
 | `/codex` | 切换到 Codex |
-| `/claude` | 切换到 Claude Code |
-| `/opencode` | 切换到 OpenCode |
-
-daemon 启动后，后续切换都可以直接从微信发起；如果对应 CLI 还没有可见窗口，daemon 会自动打开或复用它，不需要再手动运行 `wechat-codex`、`wechat-claude` 或 `wechat-opencode`。
-
-daemon 的 v1 行为是：
+| `/claude` | 切换到 Claude Code |
+| `/opencode` | 切换到 OpenCode |
+
+daemon 启动后，后续切换都可以直接从微信发起；如果对应 CLI 还没有可见窗口，daemon 会自动打开或复用它，不需要再手动运行 `wechat-codex`、`wechat-claude` 或 `wechat-opencode`。
+
+daemon 的 v1 行为是：
 
 - daemon 绑定启动时的工作目录；暂不支持在微信里切换工作目录；
 - 启动时会自动接管并清理旧的单 bridge 进程、失效 lock 和旧 endpoint；
@@ -485,9 +488,9 @@ wechat-check-update
 
 如果你使用 npm 全局安装，当前推荐直接执行：
 
-```bash
-npm install -g cli-wechat-bridge@latest
-```
+```bash
+npm install -g cli-wechat-bridge@latest
+```
 
 升级后请重启正在运行的 bridge 和 companion 终端，确保它们加载同一版本。
 
@@ -516,11 +519,11 @@ npm install -g .
 
 请确认已经执行以下之一：
 
-```bash
-npm install -g cli-wechat-bridge@latest
-npm install -g .
-npm link
-```
+```bash
+npm install -g cli-wechat-bridge@latest
+npm install -g .
+npm link
+```
 
 如果命令仍不存在，请检查 npm 全局 bin 目录是否已加入 `PATH`。
 

package/dist/bridge/bridge-adapters.claude.js

@@ -3,14 +3,17 @@ import net from "node:net";
 import path from "node:path";
 import { buildLocalCompanionToken } from "../companion/local-companion-link.js";
 import { ensureWorkspaceChannelDir } from "../wechat/channel-config.js";
-import { buildClaudeFailureMessage, buildClaudeHookScript, buildClaudeHookSettings, buildClaudePermissionDecisionHookOutput, buildClaudePermissionApprovalRequest, extractClaudeAssistantMessageText, extractClaudeResumeConversationId, extractClaudeTranscriptFinalReply, findInjectedClaudePromptIndex, normalizeClaudeAssistantMessage, parseClaudeHookPayload, } from "./claude-hooks.js";
+import { buildClaudeFailureMessage, buildClaudeHookScript, buildClaudeHookSettings, buildClaudePermissionDecisionHookOutput, buildClaudePermissionApprovalRequest, extractClaudeAssistantMessageText, extractClaudeResumeConversationId, extractClaudeTranscriptFinalReply, findInjectedClaudePromptIndex, getClaudePermissionAutoResponse, getClaudeWechatOutboundAttachmentDenyMessage, normalizeClaudeAssistantMessage, parseClaudeHookPayload, } from "./claude-hooks.js";
 import { detectCliApproval, normalizeOutput, nowIso, truncatePreview, } from "./bridge-utils.js";
 import { AbstractPtyAdapter } from "./bridge-adapters.core.js";
 import * as shared from "./bridge-adapters.shared.js";
-const { CLAUDE_HOOK_LISTEN_HOST, CLAUDE_WECHAT_WORKING_NOTICE_DELAY_MS, DEFAULT_COLS, DEFAULT_ROWS, MODULE_DIR, buildClaudeCliArgs, isClaudeInvalidResumeError, quotePosixCommandArg, quoteWindowsCommandArg, shouldIncludeClaudeNoAltScreen, } = shared;
+const { CLAUDE_HOOK_LISTEN_HOST, CLAUDE_WECHAT_WORKING_NOTICE_DELAY_MS, DEFAULT_COLS, DEFAULT_ROWS, MODULE_DIR, buildClaudeCliArgs, delay, isClaudeInvalidResumeError, quotePosixCommandArg, quoteWindowsCommandArg, shouldIncludeClaudeNoAltScreen, } = shared;
 const CLAUDE_COMPACT_OUTPUT_LINE_RE = /^Compacted(?:\s*\(.*full summary.*\))?$/i;
 const CLAUDE_COMPACT_FAILURE_RE = /Error:\s*Error during compaction:|(?:^|\b)API Error:|\b(?:compact|compaction)\s+failed\b|^Error:/i;
 const CLAUDE_COMPACT_DEDUP_MS = 2_000;
+const CLAUDE_BRACKETED_PASTE_START = "\u001b[200~";
+const CLAUDE_BRACKETED_PASTE_END = "\u001b[201~";
+const CLAUDE_REMOTE_ENTER_DELAY_MS = 40;
 export class ClaudeCompanionAdapter extends AbstractPtyAdapter {
     hookServer = null;
     hookPort = null;
@@ -99,7 +102,8 @@ export class ClaudeCompanionAdapter extends AbstractPtyAdapter {
         this.pendingCliApprovalHints = null;
         this.clearWechatWorkingNotice(true);
         this.setStatus("busy");
-        this.writeToPty(text.replace(/\r?\n/g, "\r"));
+        this.writeToPty(this.buildRemoteInputPayload(text));
+        await delay(CLAUDE_REMOTE_ENTER_DELAY_MS);
         this.writeToPty("\r");
         this.armWechatWorkingNotice();
     }
@@ -464,6 +468,13 @@ export class ClaudeCompanionAdapter extends AbstractPtyAdapter {
             timestamp: nowIso(),
         });
     }
+    buildRemoteInputPayload(text) {
+        const normalizedText = text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+        if (!normalizedText.includes("\n")) {
+            return normalizedText;
+        }
+        return `${CLAUDE_BRACKETED_PASTE_START}${normalizedText}${CLAUDE_BRACKETED_PASTE_END}`;
+    }
     shouldTreatClaudeOutputAsCompactCompletion(text) {
         if (this.state.status !== "busy" &&
             this.state.status !== "awaiting_approval" &&
@@ -707,6 +718,25 @@ export class ClaudeCompanionAdapter extends AbstractPtyAdapter {
     }
     handleClaudePermissionRequest(requestId, payload, socket) {
         this.clearWechatWorkingNotice();
+        const denyMessage = getClaudeWechatOutboundAttachmentDenyMessage(payload);
+        if (denyMessage) {
+            this.pendingApproval = null;
+            this.state.pendingApproval = null;
+            this.state.pendingApprovalOrigin = undefined;
+            if (this.state.status === "awaiting_approval") {
+                this.setStatus("busy");
+            }
+            this.respondToClaudeHook(socket, requestId, buildClaudePermissionDecisionHookOutput("deny", denyMessage));
+            return;
+        }
+        const autoResponse = getClaudePermissionAutoResponse(payload);
+        if (autoResponse) {
+            if (!this.pendingApproval && !this.state.pendingApproval) {
+                this.setStatus("busy", `Claude approval auto-approved: ${truncatePreview(autoResponse.reason, 180)}`);
+            }
+            this.respondToClaudeHook(socket, requestId, buildClaudePermissionDecisionHookOutput(autoResponse.action));
+            return;
+        }
         this.flushPendingClaudeHookApprovals();
         this.pendingHookApprovals.set(requestId, {
             requestId,

package/dist/bridge/bridge-adapters.codex.js

@@ -7,7 +7,7 @@ import { AbstractPtyAdapter } from "./bridge-adapters.core.js";
 import * as shared from "./bridge-adapters.shared.js";
 import { ensureWorkspaceChannelDir } from "../wechat/channel-config.js";
 import { CODEX_REMOTE_AUTH_TOKEN_ENV, LOCAL_CLIENT_PROTOCOL_VERSION, } from "../runtime/runtime-types.js";
-const { CODEX_APP_SERVER_HOST, CODEX_APP_SERVER_LOG_LIMIT, CODEX_APP_SERVER_READY_TIMEOUT_MS, CODEX_FINAL_REPLY_SETTLE_DELAY_MS, CODEX_RECENT_SESSION_KEY_LIMIT, CODEX_RPC_CONNECT_RETRY_MS, CODEX_RPC_RECONNECT_TIMEOUT_MS, CODEX_SESSION_FALLBACK_SCAN_INTERVAL_MS, CODEX_SESSION_LOCAL_MIRROR_FALLBACK_WINDOW_MS, CODEX_SESSION_POLL_INTERVAL_MS, CODEX_STARTUP_WARMUP_MS, CODEX_THREAD_SIGNAL_TTL_MS, INTERRUPT_SETTLE_DELAY_MS, appendBoundedLog, buildCliEnvironment, buildCodexApprovalRequest, buildCodexCliArgs, buildCodexUserInputRequest, coerceWebSocketMessageData, delay, describeUnknownError, extractCodexFinalTextFromItem, extractCodexThreadFollowIdFromStatusChanged, extractCodexThreadStartedThreadId, extractCodexUserMessageText, findCodexSessionFile, findRecentCodexSessionFileForCwd, getCodexRpcRequestId, getNotificationThreadId, getNotificationTurnId, isRecord, isRecentIsoTimestamp, listCodexResumeSessions, normalizeComparablePath, normalizeCodexRpcError, reserveLocalPort, resolveSpawnTarget, shouldAutoCompleteCodexWechatTurnAfterFinalReply, shouldIgnoreCodexSessionReplayEntry, shouldRecoverCodexStaleBusyState, waitForTcpPort, } = shared;
+const { CODEX_APP_SERVER_HOST, CODEX_APP_SERVER_LOG_LIMIT, CODEX_APP_SERVER_READY_TIMEOUT_MS, CODEX_FINAL_REPLY_SETTLE_DELAY_MS, CODEX_RECENT_SESSION_KEY_LIMIT, CODEX_RPC_CONNECT_RETRY_MS, CODEX_RPC_RECONNECT_TIMEOUT_MS, CODEX_SESSION_FALLBACK_SCAN_INTERVAL_MS, CODEX_SESSION_LOCAL_MIRROR_FALLBACK_WINDOW_MS, CODEX_SESSION_POLL_INTERVAL_MS, CODEX_STARTUP_WARMUP_MS, CODEX_THREAD_SIGNAL_TTL_MS, INTERRUPT_SETTLE_DELAY_MS, appendBoundedLog, buildCliEnvironment, buildCodexApprovalRequest, buildCodexCliArgs, buildCodexDynamicToolCallFailureResponse, buildCodexMcpServerElicitationDeclineResponse, buildCodexPermissionsRequestApprovalResponse, buildCodexUserInputRequest, coerceWebSocketMessageData, delay, describeUnknownError, extractCodexFinalTextFromItem, extractCodexThreadFollowIdFromStatusChanged, extractCodexThreadStartedThreadId, extractCodexUserMessageText, findCodexSessionFile, findRecentCodexSessionFileForCwd, getCodexRpcRequestId, getCodexApprovalAutoResponse, getCodexWechatOutboundAttachmentDenyMessage, getNotificationThreadId, getNotificationTurnId, isRecord, isRecentIsoTimestamp, listCodexResumeSessions, normalizeComparablePath, normalizeCodexRpcError, reserveLocalPort, resolveSpawnTarget, shouldAutoCompleteCodexWechatTurnAfterFinalReply, shouldIgnoreCodexSessionReplayEntry, shouldRecoverCodexStaleBusyState, waitForTcpPort, } = shared;
 const CODEX_LOCAL_THREAD_ANNOUNCE_SETTLE_MS = 150;
 export class CodexPtyAdapter extends AbstractPtyAdapter {
     runtimeKind = "codex_runtime_host";
@@ -24,6 +24,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
     cleanPanelExitInProgress = false;
     rpcRequestCounter = 0;
     pendingRpcRequests = new Map();
+    subscribedThreadIds = new Set();
     sharedThreadId = null;
     announcedThreadId = null;
     pendingThreadAnnouncement = null;
@@ -194,6 +195,27 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         }
         return await super.resolveApproval(action);
     }
+    async submitUserInput(answers) {
+        if (!this.pendingUserInputRequest) {
+            return false;
+        }
+        const request = this.pendingUserInputRequest;
+        const responseAnswers = {};
+        for (const [questionId, values] of Object.entries(answers)) {
+            responseAnswers[questionId] = {
+                answers: values,
+            };
+        }
+        this.sendRpcMessage({
+            id: request.requestId,
+            result: {
+                answers: responseAnswers,
+            },
+        });
+        this.clearPendingUserInputState();
+        this.setStatus("busy", "Codex user input submitted.");
+        return true;
+    }
     async dispose() {
         this.resetTurnTracking({ preserveThread: false });
         if (this.isEmbeddedCliMode()) {
@@ -752,6 +774,9 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         if (this.pendingApproval) {
             throw new Error("A Codex approval request is pending. Reply with /confirm <code> or /deny.");
         }
+        if (this.pendingUserInputRequest || this.state.pendingUserInput) {
+            throw new Error("Codex is waiting for user input. Reply with /answer and your response, or use /stop.");
+        }
         if (this.pendingTurnStart || this.activeTurn || this.state.status === "busy") {
             const origin = this.state.activeTurnOrigin;
             if (origin === "local") {
@@ -766,6 +791,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         this.rememberInjectedInput(text);
         this.clearPendingApprovalState();
         const threadId = await this.ensureThreadStarted();
+        const subscribedBeforeTurnStart = await this.tryEnsureSharedThreadSubscribed(threadId);
         this.pendingTurnStart = true;
         this.pendingTurnThreadId = threadId;
         this.interruptPendingTurnStart = false;
@@ -793,6 +819,9 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
                 turnId,
                 origin: "wechat",
             });
+            if (!subscribedBeforeTurnStart) {
+                await this.tryEnsureSharedThreadSubscribed(threadId);
+            }
             if (this.interruptPendingTurnStart) {
                 await this.requestActiveTurnInterrupt();
                 this.armInterruptFallback();
@@ -813,11 +842,15 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         if (this.isNativePanelMode() && !this.nativeProcess) {
             return false;
         }
-        const turnPending = this.pendingTurnStart || this.state.status === "busy" || this.state.status === "awaiting_approval";
+        const turnPending = this.pendingTurnStart ||
+            this.state.status === "busy" ||
+            this.state.status === "awaiting_approval" ||
+            this.state.status === "awaiting_input";
         if (!turnPending) {
             return false;
         }
         this.clearPendingApprovalState();
+        this.clearPendingUserInputState();
         if (this.pendingTurnStart && !this.activeTurn) {
             this.interruptPendingTurnStart = true;
             this.armInterruptFallback();
@@ -980,6 +1013,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
     attachRpcSocket(socket) {
         this.rpcSocket = socket;
         this.rpcShuttingDown = false;
+        this.subscribedThreadIds.clear();
         socket.addEventListener("message", (event) => {
             this.handleRpcMessageData(event.data);
         });
@@ -991,6 +1025,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         const socket = this.rpcSocket;
         this.rpcSocket = null;
         this.rpcShuttingDown = true;
+        this.subscribedThreadIds.clear();
         this.rejectPendingRpcRequests("Codex websocket connection closed.");
         if (!socket) {
             this.rpcShuttingDown = false;
@@ -1028,6 +1063,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             cleanPanelExitInProgress: this.cleanPanelExitInProgress,
         });
         this.rpcSocket = null;
+        this.subscribedThreadIds.clear();
         this.rejectPendingRpcRequests("Codex websocket connection closed.");
         this.rpcShuttingDown = false;
         if (expectedShutdown) {
@@ -1156,9 +1192,44 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             throw new Error("Codex did not return a thread id for the bridge session.");
         }
         this.rememberBridgeOwnedThreadSignal(threadId);
+        this.subscribedThreadIds.add(threadId);
         this.updateSharedThread(threadId);
         return threadId;
     }
+    async tryEnsureSharedThreadSubscribed(threadId) {
+        if (this.subscribedThreadIds.has(threadId)) {
+            return true;
+        }
+        try {
+            await this.ensureSharedThreadSubscribed(threadId);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async ensureSharedThreadSubscribed(threadId) {
+        if (this.subscribedThreadIds.has(threadId)) {
+            return;
+        }
+        const response = await this.sendRpcRequest("thread/resume", {
+            threadId,
+            cwd: this.options.cwd,
+            approvalPolicy: "on-request",
+            approvalsReviewer: "user",
+            sandbox: "workspace-write",
+            excludeTurns: true,
+        });
+        const resumedThreadId = this.extractThreadIdFromResponse(response);
+        if (!resumedThreadId) {
+            throw new Error("Codex did not return a thread id while subscribing the bridge client.");
+        }
+        this.rememberBridgeOwnedThreadSignal(resumedThreadId);
+        this.subscribedThreadIds.add(resumedThreadId);
+        if (resumedThreadId !== this.sharedThreadId) {
+            this.updateSharedThread(resumedThreadId);
+        }
+    }
     async resumeSharedThread(threadId, options = {}) {
         const trimmedThreadId = threadId.trim();
         if (!trimmedThreadId) {
@@ -1180,12 +1251,14 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             approvalPolicy: "on-request",
             approvalsReviewer: "user",
             sandbox: "workspace-write",
+            excludeTurns: true,
         });
         const resumedThreadId = this.extractThreadIdFromResponse(response);
         if (!resumedThreadId) {
             throw new Error("Codex did not return a thread id while resuming the saved thread.");
         }
         this.rememberBridgeOwnedThreadSignal(resumedThreadId);
+        this.subscribedThreadIds.add(resumedThreadId);
         this.sessionFilePath = null;
         this.sessionReadOffset = 0;
         this.sessionPartialLine = "";
@@ -1238,7 +1311,9 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         this.clearInterruptTimer();
         this.interruptTimer = setTimeout(() => {
             this.interruptTimer = null;
-            if (this.state.status !== "busy" && this.state.status !== "awaiting_approval") {
+            if (this.state.status !== "busy" &&
+                this.state.status !== "awaiting_approval" &&
+                this.state.status !== "awaiting_input") {
                 return;
             }
             this.resetTurnTracking({ preserveThread: true });
@@ -1263,6 +1338,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             pendingTurnStart: this.pendingTurnStart,
             hasActiveTurn: Boolean(this.activeTurn),
             hasPendingApproval: Boolean(this.pendingApproval || this.pendingApprovalRequest),
+            hasPendingUserInput: Boolean(this.pendingUserInputRequest || this.state.pendingUserInput),
             activeTurnId: this.state.activeTurnId,
         })) {
             return;
@@ -1301,6 +1377,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         this.interruptPendingTurnStart = false;
         this.pendingThreadFollowId = null;
         this.clearPendingApprovalState();
+        this.clearPendingUserInputState();
         this.queuedTurnNotifications = [];
         this.queuedTurnServerRequests = [];
         this.turnFinalMessages.clear();
@@ -1503,6 +1580,11 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         this.state.pendingApproval = null;
         this.state.pendingApprovalOrigin = undefined;
     }
+    clearPendingUserInputState() {
+        this.pendingUserInputRequest = null;
+        this.state.pendingUserInput = null;
+        this.state.pendingUserInputOrigin = undefined;
+    }
     cleanupTurnArtifacts(turnId) {
         this.clearFinalReplyCompletionTimerForTurn(turnId);
         this.turnFinalMessages.delete(turnId);
@@ -1570,6 +1652,13 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         socket.send(JSON.stringify(payload));
     }
     async respondToApprovalRequest(request, action) {
+        if (request.method === "item/permissions/requestApproval") {
+            this.sendRpcMessage({
+                id: request.requestId,
+                result: buildCodexPermissionsRequestApprovalResponse(request.params, action),
+            });
+            return;
+        }
         const decision = action === "confirm" ? "accept" : "decline";
         this.sendRpcMessage({
             id: request.requestId,
@@ -1754,6 +1843,15 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
                         this.setStatus("busy", "Codex approval resolved.");
                     }
                 }
+                if (requestId !== null &&
+                    this.pendingUserInputRequest &&
+                    requestId === this.pendingUserInputRequest.requestId &&
+                    trackedTurn.turnId === this.pendingUserInputRequest.turnId) {
+                    this.clearPendingUserInputState();
+                    if (this.state.status === "awaiting_input") {
+                        this.setStatus("busy", "Codex user input resolved.");
+                    }
+                }
                 return;
             }
             case "turn/completed": {
@@ -1764,8 +1862,24 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         }
     }
     handleRpcServerRequest(requestId, method, params) {
+        if (method === "mcpServer/elicitation/request") {
+            this.sendRpcMessage({
+                id: requestId,
+                result: buildCodexMcpServerElicitationDeclineResponse(),
+            });
+            return;
+        }
+        if (method === "item/tool/call") {
+            this.sendRpcMessage({
+                id: requestId,
+                result: buildCodexDynamicToolCallFailureResponse(),
+            });
+            return;
+        }
         if (method !== "item/commandExecution/requestApproval" &&
-            method !== "item/fileChange/requestApproval") {
+            method !== "item/fileChange/requestApproval" &&
+            method !== "item/permissions/requestApproval" &&
+            method !== "item/tool/requestUserInput") {
             this.sendRpcMessage({
                 id: requestId,
                 error: {
@@ -1793,16 +1907,57 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             });
             return;
         }
-        const trackedTurn = this.identifyTrackedTurn("server/request", params);
+        const trackedTurn = this.identifyTrackedTurn("server/request", params) ??
+            this.fallbackTrackedTurnForServerRequest(params);
         if (!trackedTurn) {
+            this.sendRpcMessage({
+                id: requestId,
+                error: {
+                    code: -32602,
+                    message: "Invalid Codex server request payload: missing threadId or turnId.",
+                },
+            });
             return;
         }
         this.handleTrackedTurnStarted(trackedTurn);
         this.handleTrackedTurnServerRequest(requestId, method, params, trackedTurn);
     }
     handleTrackedTurnServerRequest(requestId, method, params, trackedTurn) {
+        if (method === "item/tool/requestUserInput") {
+            this.handleTrackedTurnUserInputRequest(requestId, params, trackedTurn);
+            return;
+        }
+        const denyMessage = getCodexWechatOutboundAttachmentDenyMessage(method, params);
+        if (denyMessage) {
+            this.sendRpcMessage({
+                id: requestId,
+                result: method === "item/permissions/requestApproval"
+                    ? buildCodexPermissionsRequestApprovalResponse(params, "deny")
+                    : { decision: "decline" },
+            });
+            this.state.lastOutputAt = nowIso();
+            this.setStatus("busy", `Codex approval auto-denied: ${truncatePreview(denyMessage, 180)}`);
+            return;
+        }
+        const autoResponse = getCodexApprovalAutoResponse(method, params);
+        if (autoResponse) {
+            this.sendRpcMessage({
+                id: requestId,
+                result: autoResponse.result,
+            });
+            this.state.lastOutputAt = nowIso();
+            this.setStatus("busy", `Codex approval auto-approved: ${truncatePreview(autoResponse.reason, 180)}`);
+            return;
+        }
         const request = buildCodexApprovalRequest(method, params);
         if (!request) {
+            this.sendRpcMessage({
+                id: requestId,
+                error: {
+                    code: -32602,
+                    message: "Invalid Codex approval request payload.",
+                },
+            });
             return;
         }
         this.pendingApprovalRequest = {
@@ -1811,18 +1966,63 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             threadId: trackedTurn.threadId,
             turnId: trackedTurn.turnId,
             origin: trackedTurn.origin,
+            params,
         };
         this.pendingApproval = request;
         this.state.pendingApproval = request;
         this.state.pendingApprovalOrigin = trackedTurn.origin;
         this.state.lastOutputAt = nowIso();
-        this.setStatus("awaiting_approval", "Codex approval is required.");
+        this.setStatus("awaiting_approval", `Codex approval is required: ${truncatePreview(request.commandPreview, 180)}`);
         this.emit({
             type: "approval_required",
             request,
             timestamp: nowIso(),
         });
     }
+    fallbackTrackedTurnForServerRequest(params) {
+        if (this.activeTurn) {
+            return null;
+        }
+        const threadId = getNotificationThreadId(params);
+        const turnId = getNotificationTurnId(params);
+        if (!threadId || !turnId) {
+            return null;
+        }
+        return {
+            threadId,
+            turnId,
+            origin: this.bridgeOwnedTurnIds.has(turnId) ? "wechat" : "local",
+        };
+    }
+    handleTrackedTurnUserInputRequest(requestId, params, trackedTurn) {
+        const request = buildCodexUserInputRequest(params);
+        if (!request) {
+            this.sendRpcMessage({
+                id: requestId,
+                error: {
+                    code: -32602,
+                    message: "Invalid Codex user input request payload.",
+                },
+            });
+            return;
+        }
+        this.pendingUserInputRequest = {
+            requestId,
+            method: "item/tool/requestUserInput",
+            threadId: trackedTurn.threadId,
+            turnId: trackedTurn.turnId,
+            origin: trackedTurn.origin,
+        };
+        this.state.pendingUserInput = request;
+        this.state.pendingUserInputOrigin = trackedTurn.origin;
+        this.state.lastOutputAt = nowIso();
+        this.setStatus("awaiting_input", "Codex is waiting for user input.");
+        this.emit({
+            type: "user_input_required",
+            request,
+            timestamp: nowIso(),
+        });
+    }
     handleThreadStatusChanged(params) {
         const threadId = extractCodexThreadFollowIdFromStatusChanged(params);
         if (!threadId) {
@@ -1935,6 +2135,10 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             this.pendingApprovalRequest.turnId === trackedTurn.turnId) {
             this.clearPendingApprovalState();
         }
+        if (this.pendingUserInputRequest &&
+            this.pendingUserInputRequest.turnId === trackedTurn.turnId) {
+            this.clearPendingUserInputState();
+        }
         if (this.activeTurn?.turnId === trackedTurn.turnId) {
             this.setActiveTurn(null);
         }
@@ -2023,6 +2227,8 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             this.pendingTurnStart ||
             this.pendingApproval ||
             this.pendingApprovalRequest ||
+            this.pendingUserInputRequest ||
+            this.state.pendingUserInput ||
             !this.collectTurnOutput(turnId)) {
             return;
         }
@@ -2039,6 +2245,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
         const finalText = this.collectTurnOutput(turnId);
         const lastActivityAtMs = this.turnLastActivityAtMs.get(turnId) ?? null;
         const pendingApproval = Boolean(this.pendingApproval || this.pendingApprovalRequest);
+        const pendingUserInput = Boolean(this.pendingUserInputRequest || this.state.pendingUserInput);
         const nowMs = Date.now();
         if (!shouldAutoCompleteCodexWechatTurnAfterFinalReply({
             candidateTurnId: turnId,
@@ -2046,6 +2253,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             activeTurnOrigin: activeTurn?.origin,
             pendingTurnStart: this.pendingTurnStart,
             hasPendingApproval: pendingApproval,
+            hasPendingUserInput: pendingUserInput,
             hasFinalOutput: Boolean(finalText),
             hasCompletedTurn: this.hasCompletedTurn(turnId),
             lastActivityAtMs,
@@ -2056,6 +2264,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
                 activeTurn.origin === "wechat" &&
                 !this.pendingTurnStart &&
                 !pendingApproval &&
+                !pendingUserInput &&
                 finalText &&
                 typeof lastActivityAtMs === "number") {
                 const remainingMs = CODEX_FINAL_REPLY_SETTLE_DELAY_MS - (nowMs - lastActivityAtMs);
@@ -2073,6 +2282,7 @@ export class CodexPtyAdapter extends AbstractPtyAdapter {
             return;
         }
         this.clearPendingApprovalState();
+        this.clearPendingUserInputState();
         this.setActiveTurn(null);
         this.cleanupTurnArtifacts(turnId);
         this.state.lastOutputAt = nowIso();

package/dist/bridge/bridge-adapters.opencode.js

@@ -1,7 +1,7 @@
 import { spawn as spawnChildProcess } from "node:child_process";
 import { OPENCODE_SERVER_HOST, OPENCODE_SERVER_READY_TIMEOUT_MS, OPENCODE_SSE_RECONNECT_DELAY_MS, OPENCODE_SESSION_IDLE_SETTLE_MS, OPENCODE_WECHAT_WORKING_NOTICE_DELAY_MS, buildCliEnvironment, isRecord, describeUnknownError, resolveSpawnTarget, reserveLocalPort, waitForTcpPort, delay, } from "./bridge-adapters.shared.js";
 import { killProcessTreeSync } from "./bridge-process-reaper.js";
-import { buildOneTimeCode, normalizeOutput, nowIso, truncatePreview, OutputBatcher, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, buildOneTimeCode, isWechatOutboundAttachmentMutationTool, isWechatOutboundAttachmentWriteCommand, normalizeOutput, nowIso, truncatePreview, OutputBatcher, } from "./bridge-utils.js";
 const OPENCODE_DEBUG_ENABLED = /^(1|true|yes|on)$/i.test(process.env.WECHAT_OPENCODE_DEBUG ?? "");
 const OPENCODE_DUPLICATE_EVENT_TTL_MS = 150;
 const OPENCODE_WECHAT_MIRROR_SUPPRESSION_TTL_MS = 30_000;
@@ -801,6 +801,11 @@ export class OpenCodeServerAdapter {
             return;
         }
         this.clearWechatWorkingNotice();
+        const denyMessage = this.getWechatOutboundAttachmentPermissionDenyMessage(properties, pendingPermission);
+        if (denyMessage) {
+            this.rejectPermission(pendingPermission, denyMessage);
+            return;
+        }
         const approval = this.toPendingApproval(pendingPermission);
         this.pendingPermission = pendingPermission;
         this.state.pendingApproval = approval;
@@ -817,6 +822,57 @@ export class OpenCodeServerAdapter {
         this.state.pendingApproval = null;
         this.state.pendingApprovalOrigin = undefined;
     }
+    getWechatOutboundAttachmentPermissionDenyMessage(properties, pendingPermission) {
+        const metadata = isRecord(properties.metadata) ? properties.metadata : {};
+        const command = this.extractPermissionCommand(properties, metadata);
+        if (isWechatOutboundAttachmentWriteCommand(command)) {
+            return WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+        }
+        const targetPath = [
+            command,
+            typeof metadata.path === "string" ? metadata.path : "",
+            typeof metadata.file === "string" ? metadata.file : "",
+            typeof metadata.filePath === "string" ? metadata.filePath : "",
+            typeof metadata.filepath === "string" ? metadata.filepath : "",
+            typeof metadata.parentDir === "string" ? metadata.parentDir : "",
+            typeof metadata.target === "string" ? metadata.target : "",
+            typeof metadata.detail === "string" ? metadata.detail : "",
+            Array.isArray(properties.patterns)
+                ? properties.patterns.filter((value) => typeof value === "string").join(" ")
+                : "",
+            typeof properties.pattern === "string" ? properties.pattern : "",
+        ].join(" ");
+        return isWechatOutboundAttachmentMutationTool(pendingPermission.request.toolName, targetPath)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    rejectPermission(pendingPermission, denyMessage) {
+        const client = this.client;
+        if (!client) {
+            return;
+        }
+        void (async () => {
+            try {
+                const result = await client.permission.respond({
+                    sessionID: pendingPermission.sessionId,
+                    permissionID: pendingPermission.permissionId,
+                    directory: this.options.cwd,
+                    workspace: this.activeWorkspaceId ?? undefined,
+                    response: "reject",
+                });
+                if (result.error !== undefined) {
+                    throw new Error(`SDK error: ${describeUnknownError(result.error)}`);
+                }
+            }
+            catch (err) {
+                this.emit({
+                    type: "stderr",
+                    text: `${denyMessage}\nFailed to reject permission: ${describeUnknownError(err)}`,
+                    timestamp: nowIso(),
+                });
+            }
+        })();
+    }
     toPendingApproval(pendingPermission) {
         return {
             ...pendingPermission.request,
@@ -834,24 +890,14 @@ export class OpenCodeServerAdapter {
         if (!sessionId || !permissionId) {
             return null;
         }
-        const toolName = typeof properties.type === "string"
-            ? properties.type
-            : typeof properties.permission === "string"
-                ? properties.permission
-                : undefined;
+        const toolName = this.extractPermissionToolName(properties);
         const title = typeof properties.title === "string"
             ? properties.title
             : typeof properties.permission === "string"
                 ? `Permission request: ${properties.permission}`
                 : undefined;
         const metadata = isRecord(properties.metadata) ? properties.metadata : {};
-        const command = typeof metadata.command === "string"
-            ? metadata.command
-            : typeof metadata.detail === "string"
-                ? metadata.detail
-                : Array.isArray(properties.patterns)
-                    ? properties.patterns.filter((value) => typeof value === "string").join(", ")
-                    : undefined;
+        const command = this.extractPermissionCommand(properties, metadata);
         return {
             sessionId,
             permissionId,
@@ -869,6 +915,26 @@ export class OpenCodeServerAdapter {
             },
         };
     }
+    extractPermissionToolName(properties) {
+        return typeof properties.type === "string"
+            ? properties.type
+            : typeof properties.permission === "string"
+                ? properties.permission
+                : undefined;
+    }
+    extractPermissionCommand(properties, metadata) {
+        if (typeof metadata.command === "string") {
+            return metadata.command;
+        }
+        if (typeof metadata.detail === "string") {
+            return metadata.detail;
+        }
+        if (Array.isArray(properties.patterns)) {
+            const patterns = properties.patterns.filter((value) => typeof value === "string");
+            return patterns.length > 0 ? patterns.join(", ") : undefined;
+        }
+        return undefined;
+    }
     handleSessionCreated(properties) {
         if (!isRecord(properties)) {
             return;

package/dist/bridge/bridge-adapters.shared.js

@@ -7,7 +7,7 @@ import { spawn as spawnPty } from "node-pty";
 import { attachLocalCompanionMessageListener, buildLocalCompanionToken, clearLocalCompanionEndpoint, sendLocalCompanionMessage, writeLocalCompanionEndpoint, } from "../companion/local-companion-link.js";
 import { ensureWorkspaceChannelDir } from "../wechat/channel-config.js";
 import { buildClaudeFailureMessage, buildClaudeHookSettings, buildClaudePermissionDecisionHookOutput, buildClaudePermissionApprovalRequest, extractClaudeResumeConversationId, findInjectedClaudePromptIndex, normalizeClaudeAssistantMessage, parseClaudeHookPayload, } from "./claude-hooks.js";
-import { detectCliApproval, isHighRiskShellCommand, normalizeOutput, nowIso, truncatePreview, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, containsWechatOutboundAttachmentPathDeep, detectCliApproval, isWechatOutboundAttachmentWriteCommand, isHighRiskShellCommand, normalizeOutput, nowIso, truncatePreview, } from "./bridge-utils.js";
 import { coerceWebSocketMessageData, describeUnknownError, getCodexRpcRequestId, getLocalCompanionCommandName, getNotificationThreadId, getNotificationTurnId, getSharedSessionIdFromAdapterState, isRecentIsoTimestamp, isRecord, normalizeCodexRpcError, quotePosixCommandArg, quoteWindowsCommandArg, } from "./bridge-adapter-common.js";
 export { coerceWebSocketMessageData, describeUnknownError, getCodexRpcRequestId, getLocalCompanionCommandName, getNotificationThreadId, getNotificationTurnId, getSharedSessionIdFromAdapterState, isRecentIsoTimestamp, isRecord, normalizeCodexRpcError, quotePosixCommandArg, quoteWindowsCommandArg, } from "./bridge-adapter-common.js";
 export const DEFAULT_COLS = 120;
@@ -152,8 +152,220 @@ export function buildCodexApprovalRequest(method, params) {
             commandPreview: truncatePreview(preview, 180),
         };
     }
+    if (method === "item/permissions/requestApproval") {
+        const reason = typeof params.reason === "string" ? params.reason : "";
+        const preview = summarizeCodexPermissionsRequest(params.permissions);
+        return {
+            source: "cli",
+            summary: reason
+                ? `Codex needs approval before granting extra permissions: ${truncatePreview(reason, 160)}`
+                : "Codex needs approval before granting extra permissions.",
+            commandPreview: truncatePreview(preview, 180),
+        };
+    }
+    return null;
+}
+export function getCodexWechatOutboundAttachmentDenyMessage(method, params) {
+    if (!isRecord(params)) {
+        return null;
+    }
+    if (method === "item/commandExecution/requestApproval") {
+        return isWechatOutboundAttachmentWriteCommand(params.command) ||
+            containsWechatOutboundAttachmentPathDeep(params.additionalPermissions)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (method === "item/fileChange/requestApproval") {
+        return containsWechatOutboundAttachmentPath(params.grantRoot)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (method === "item/permissions/requestApproval") {
+        return containsWechatOutboundAttachmentPathDeep(params.permissions)
+            ? WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
     return null;
 }
+function commandApprovalAllowsAccept(availableDecisions) {
+    if (!Array.isArray(availableDecisions)) {
+        return true;
+    }
+    return availableDecisions.some((decision) => decision === "accept");
+}
+function normalizePermissionPath(pathValue) {
+    const normalized = pathValue.trim().replace(/\\/g, "/").toLowerCase();
+    return normalized === "/" ? normalized : normalized.replace(/\/+$/g, "");
+}
+function isHighRiskPermissionPath(pathValue) {
+    const normalized = normalizePermissionPath(pathValue);
+    if (!normalized) {
+        return false;
+    }
+    if (normalized === "/" || /^[a-z]:$/i.test(normalized)) {
+        return true;
+    }
+    return /^[a-z]:(?:\/windows|\/program files(?: \(x86\))?|\/programdata)(?:\/|$)/i.test(normalized);
+}
+function collectPermissionPaths(value, output) {
+    if (typeof value === "string") {
+        output.push(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectPermissionPaths(item, output);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    if (typeof value.path === "string") {
+        output.push(value.path);
+    }
+    if (typeof value.pattern === "string") {
+        output.push(value.pattern);
+    }
+    for (const item of Object.values(value)) {
+        collectPermissionPaths(item, output);
+    }
+}
+function hasRootSpecialPermissionPath(value) {
+    if (Array.isArray(value)) {
+        return value.some(hasRootSpecialPermissionPath);
+    }
+    if (!isRecord(value)) {
+        return false;
+    }
+    if ((value.kind === "root" || value.kind === "Root") ||
+        (value.value === "root" || value.value === "Root")) {
+        return true;
+    }
+    return Object.values(value).some(hasRootSpecialPermissionPath);
+}
+function containsHighRiskPermissionTarget(value) {
+    if (hasRootSpecialPermissionPath(value)) {
+        return true;
+    }
+    const paths = [];
+    collectPermissionPaths(value, paths);
+    return paths.some(isHighRiskPermissionPath);
+}
+export function getCodexApprovalAutoResponse(method, params) {
+    if (method === "item/commandExecution/requestApproval") {
+        const command = typeof params.command === "string" ? params.command : "";
+        if (!commandApprovalAllowsAccept(params.availableDecisions)) {
+            return null;
+        }
+        if (command && isHighRiskShellCommand(command)) {
+            return null;
+        }
+        if (containsHighRiskPermissionTarget(params.additionalPermissions)) {
+            return null;
+        }
+        return {
+            result: { decision: "accept" },
+            reason: command
+                ? `low-risk command ${truncatePreview(command, 120)}`
+                : "low-risk command approval",
+        };
+    }
+    if (method === "item/fileChange/requestApproval") {
+        if (containsHighRiskPermissionTarget(params.grantRoot)) {
+            return null;
+        }
+        return {
+            result: { decision: "accept" },
+            reason: "low-risk file change approval",
+        };
+    }
+    if (method === "item/permissions/requestApproval") {
+        if (containsHighRiskPermissionTarget(params.permissions)) {
+            return null;
+        }
+        return {
+            result: buildCodexPermissionsRequestApprovalResponse(params, "confirm", {
+                strictAutoReview: true,
+            }),
+            reason: "low-risk permission grant",
+        };
+    }
+    return null;
+}
+function collectStringValues(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string" && item.trim().length > 0)
+        : [];
+}
+function summarizeCodexPermissionsRequest(permissions) {
+    if (!isRecord(permissions)) {
+        return "Additional permissions requested.";
+    }
+    const parts = [];
+    if (isRecord(permissions.network) && permissions.network.enabled === true) {
+        parts.push("network access");
+    }
+    if (isRecord(permissions.fileSystem)) {
+        const readPaths = collectStringValues(permissions.fileSystem.read);
+        const writePaths = collectStringValues(permissions.fileSystem.write);
+        if (readPaths.length > 0) {
+            parts.push(`read: ${readPaths.join(", ")}`);
+        }
+        if (writePaths.length > 0) {
+            parts.push(`write: ${writePaths.join(", ")}`);
+        }
+        if (Array.isArray(permissions.fileSystem.entries) && permissions.fileSystem.entries.length > 0) {
+            parts.push(`filesystem entries: ${permissions.fileSystem.entries.length}`);
+        }
+    }
+    return parts.length > 0 ? parts.join("; ") : "Additional permissions requested.";
+}
+function clonePermissionObject(value) {
+    if (!isRecord(value)) {
+        return null;
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+export function buildCodexPermissionsRequestApprovalResponse(params, action = "deny", options = {}) {
+    const permissions = {};
+    if (action === "confirm" && isRecord(params) && isRecord(params.permissions)) {
+        const network = clonePermissionObject(params.permissions.network);
+        const fileSystem = clonePermissionObject(params.permissions.fileSystem);
+        if (network) {
+            permissions.network = network;
+        }
+        if (fileSystem) {
+            permissions.fileSystem = fileSystem;
+        }
+    }
+    const response = {
+        permissions,
+        scope: "turn",
+    };
+    if (options.strictAutoReview) {
+        response.strictAutoReview = true;
+    }
+    return response;
+}
+export function buildCodexMcpServerElicitationDeclineResponse() {
+    return {
+        action: "decline",
+        content: null,
+        _meta: null,
+    };
+}
+export function buildCodexDynamicToolCallFailureResponse() {
+    return {
+        contentItems: [
+            {
+                type: "inputText",
+                text: "Dynamic tool calls are not supported by the WeChat bridge.",
+            },
+        ],
+        success: false,
+    };
+}
 export function buildCodexUserInputRequest(params) {
     if (!isRecord(params) || !Array.isArray(params.questions)) {
         return null;
@@ -287,6 +499,7 @@ export function shouldRecoverCodexStaleBusyState(params) {
         !params.pendingTurnStart &&
         !params.hasActiveTurn &&
         !params.hasPendingApproval &&
+        !params.hasPendingUserInput &&
         !params.activeTurnId);
 }
 export function shouldAutoCompleteCodexWechatTurnAfterFinalReply(params) {
@@ -295,6 +508,7 @@ export function shouldAutoCompleteCodexWechatTurnAfterFinalReply(params) {
         params.activeTurnOrigin === "wechat" &&
         !params.pendingTurnStart &&
         !params.hasPendingApproval &&
+        !params.hasPendingUserInput &&
         params.hasFinalOutput &&
         !params.hasCompletedTurn &&
         typeof params.lastActivityAtMs === "number" &&

package/dist/bridge/bridge-utils.js

@@ -16,10 +16,12 @@ const WECHAT_ATTACHMENT_PROMPT_PREFIX = [
     "[WeChat bridge note]",
     "Your final reply will be forwarded back to a WeChat chat.",
     "If the user asks you to send a local file or media to WeChat and you know the local path, do not say that you lack a WeChat sending tool.",
-    "For a real send request, prefer locating and sending the file directly instead of opening or reading it unless the user explicitly asked for that.",
+    "For a real send request, locate the original local file path and reference that path directly in the attachment block.",
+    "Do not create, copy, move, or write files into ~/.claude/channels/wechat, ~/.cli-bridge, or any outbound-attachments directory.",
+    "Do not call Write, cp, copy, xcopy, robocopy, mv, move, or shell redirection to stage outbound files for WeChat.",
     "Put any brief visible reply text first, then end the message with exactly one trailing block like:",
     "```wechat-attachments",
-    "file C:\\Users\\name\\Desktop\\document.pdf",
+    "file C:\\Users\\name\\Desktop\\document.docx",
     "```",
     "Valid kinds: image, file, video, voice.",
     "Use `file` for PDFs and ordinary documents. Only include files you truly intend to upload.",
@@ -27,6 +29,10 @@ const WECHAT_ATTACHMENT_PROMPT_PREFIX = [
     "[User request]",
 ].join("\n");
 const WECHAT_ATTACHMENT_BLOCK_RE = /\n```wechat-attachments[ \t]*\n([\s\S]*?)\n```[ \t]*$/;
+export const WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE = "The WeChat bridge does not use outbound attachment directories. Do not create or copy files under .claude/channels/wechat/outbound-attachments or .cli-bridge/outbound-attachments. To send a file, put the original absolute local file path in the final ```wechat-attachments``` block.";
+const WECHAT_OUTBOUND_ATTACHMENT_PATH_RE = /(?:^|\/)(?:(?:\.claude\/channels\/wechat\/|\.cli-bridge\/)?outbound-attachments)(?:\/|$)/i;
+const WECHAT_OUTBOUND_ATTACHMENT_WRITE_COMMAND_RE = /\b(cp|copy|copy-item|xcopy|robocopy|mv|move|move-item|mkdir|md|new-item|ni|set-content|add-content|out-file|write-output|touch)\b|>\s*["']?[^&|]*outbound-attachments/i;
+const WECHAT_OUTBOUND_ATTACHMENT_MUTATION_TOOL_RE = /^(?:write|edit|multiedit|notebookedit|patch|create|mkdir|move|copy|file[_-]?change|external_directory)$/i;
 const WECHAT_ATTACHMENT_KINDS = ["image", "file", "video", "voice"];
 const INLINE_IMAGE_EXTENSIONS = new Set([
     ".png",
@@ -211,6 +217,43 @@ export function shouldInjectWechatAttachmentPrompt(text) {
         mentionsLocalPath ||
         looksLikeShortSendCommand);
 }
+export function containsWechatOutboundAttachmentPath(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    const normalized = value.trim().replace(/\\/g, "/");
+    return WECHAT_OUTBOUND_ATTACHMENT_PATH_RE.test(normalized);
+}
+export function containsWechatOutboundAttachmentPathDeep(value) {
+    const seen = new WeakSet();
+    const visit = (candidate) => {
+        if (containsWechatOutboundAttachmentPath(candidate)) {
+            return true;
+        }
+        if (!candidate || typeof candidate !== "object") {
+            return false;
+        }
+        if (seen.has(candidate)) {
+            return false;
+        }
+        seen.add(candidate);
+        if (Array.isArray(candidate)) {
+            return candidate.some((item) => visit(item));
+        }
+        return Object.values(candidate).some((item) => visit(item));
+    };
+    return visit(value);
+}
+export function isWechatOutboundAttachmentWriteCommand(command) {
+    return (typeof command === "string" &&
+        containsWechatOutboundAttachmentPath(command) &&
+        WECHAT_OUTBOUND_ATTACHMENT_WRITE_COMMAND_RE.test(command));
+}
+export function isWechatOutboundAttachmentMutationTool(toolName, targetPath) {
+    return (typeof toolName === "string" &&
+        WECHAT_OUTBOUND_ATTACHMENT_MUTATION_TOOL_RE.test(toolName.trim()) &&
+        containsWechatOutboundAttachmentPath(targetPath));
+}
 function formatPromptByteSize(bytes) {
     if (bytes === undefined || !Number.isFinite(bytes) || bytes < 0) {
         return null;
@@ -356,7 +399,11 @@ const HIGH_RISK_PATTERNS = [
     /\b(?:invoke-expression|iex)\b/i,
     /\bcurl\b.*\|\s*(?:iex|powershell)\b/i,
     /\binvoke-webrequest\b.*\|\s*(?:iex|powershell)\b/i,
+    /\brm\b\s+/i,
     /\brm\b\s+-[A-Za-z-]*r[A-Za-z-]*/i,
+    /\bfind\b[^\r\n]*\s-delete\b/i,
+    /\bfind\b[^\r\n]*\s-exec\s+(?:rm|rmdir|del|erase|remove-item)\b/i,
+    /\bxargs\b[^\r\n]*\b(?:rm|rmdir|del|erase|remove-item)\b/i,
     /\bsudo\b/i,
     /\bmkfs(?:\.\w+)?\b/i,
     /\bdd\b/i,

package/dist/bridge/claude-hooks.js

@@ -1,4 +1,19 @@
-import { normalizeOutput, truncatePreview } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, isHighRiskShellCommand, isWechatOutboundAttachmentWriteCommand, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
+export const CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE = WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+const FILE_MUTATION_TOOL_NAMES = new Set([
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+]);
+const LOW_RISK_READ_TOOL_NAMES = new Set([
+    "Glob",
+    "Grep",
+    "LS",
+    "NotebookRead",
+    "Read",
+    "TodoRead",
+]);
 function quoteWindowsCommandArg(value) {
     return `"${value.replace(/"/g, '""')}"`;
 }
@@ -166,14 +181,60 @@ export function buildClaudePermissionApprovalRequest(payload) {
         detailPreview,
     };
 }
-export function buildClaudePermissionDecisionHookOutput(action) {
+function getClaudeToolInputString(payload, key) {
+    const value = payload.tool_input?.[key];
+    return typeof value === "string" ? value : "";
+}
+export function getClaudeWechatOutboundAttachmentDenyMessage(payload) {
+    const toolName = typeof payload.tool_name === "string" ? payload.tool_name.trim() : "";
+    if (!toolName) {
+        return null;
+    }
+    if (FILE_MUTATION_TOOL_NAMES.has(toolName)) {
+        const filePath = getClaudeToolInputString(payload, "file_path");
+        return containsWechatOutboundAttachmentPath(filePath)
+            ? CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE
+            : null;
+    }
+    if (toolName === "Bash") {
+        const command = getClaudeToolInputString(payload, "command");
+        if (isWechatOutboundAttachmentWriteCommand(command)) {
+            return CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
+        }
+    }
+    return null;
+}
+export function getClaudePermissionAutoResponse(payload) {
+    const toolName = typeof payload.tool_name === "string" ? payload.tool_name.trim() : "";
+    if (!toolName) {
+        return null;
+    }
+    if (LOW_RISK_READ_TOOL_NAMES.has(toolName)) {
+        return {
+            action: "confirm",
+            reason: `low-risk ${toolName} permission`,
+        };
+    }
+    if (toolName !== "Bash") {
+        return null;
+    }
+    const command = getClaudeToolInputString(payload, "command").trim();
+    if (!command || isHighRiskShellCommand(command)) {
+        return null;
+    }
+    return {
+        action: "confirm",
+        reason: `low-risk command ${truncatePreview(command, 120)}`,
+    };
+}
+export function buildClaudePermissionDecisionHookOutput(action, denyMessage = "Permission denied from WeChat bridge.") {
     const decision = action === "confirm"
         ? {
             behavior: "allow",
         }
         : {
             behavior: "deny",
-            message: "Permission denied from WeChat bridge.",
+            message: denyMessage,
             interrupt: false,
         };
     return JSON.stringify({

package/dist/bridge/wechat-bridge.js

@@ -8,7 +8,7 @@ import { ensureWechatCredentials } from "../wechat/setup.js";
 import { BridgeStateStore } from "./bridge-state.js";
 import { reapOrphanedOpencodeProcesses, reapPeerBridgeProcesses } from "./bridge-process-reaper.js";
 import { createRuntimeHost } from "../runtime/create-runtime-host.js";
-import { buildWechatInboundPrompt, buildOneTimeCode, formatApprovalMessage, formatPendingApprovalReminder, formatDuration, formatMirroredUserInputMessage, formatSessionSwitchMessage, formatStatusReport, formatTaskFailedMessage, MESSAGE_START_GRACE_MS, nowIso, OutputBatcher, parseWechatControlCommand, truncatePreview, } from "./bridge-utils.js";
+import { buildWechatInboundPrompt, buildOneTimeCode, formatApprovalMessage, formatPendingApprovalReminder, formatPendingUserInputReminder, formatDuration, formatMirroredUserInputMessage, formatSessionSwitchMessage, formatStatusReport, formatTaskFailedMessage, formatUserInputRequestMessage, MESSAGE_START_GRACE_MS, nowIso, OutputBatcher, parsePendingUserInputAnswerCommand, parseWechatControlCommand, truncatePreview, } from "./bridge-utils.js";
 import { classifyWechatTransportError, DEFAULT_LONG_POLL_TIMEOUT_MS, WeChatTransport, describeWechatTransportError, isWechatContextTokenStaleError, } from "../wechat/wechat-transport.js";
 import { checkForUpdate, formatUpdateMessage, } from "../utils/version-checker.js";
 import { clearDaemonEndpoint, isDaemonEndpointAlive, readDaemonEndpoint, } from "../daemon/daemon-link.js";
@@ -111,6 +111,15 @@ function toPendingApproval(request) {
         createdAt: nowIso(),
     };
 }
+function toPendingUserInput(request) {
+    if (typeof request.createdAt === "string") {
+        return request;
+    }
+    return {
+        ...request,
+        createdAt: nowIso(),
+    };
+}
 export function shouldDeferCodexInboundMessage(params) {
     return (params.adapter === "codex" &&
         !params.hasPendingConfirmation &&
@@ -122,11 +131,13 @@ export function canDrainDeferredCodexInboundQueue(params) {
     return (params.adapter === "codex" &&
         params.deferredCount > 0 &&
         !params.hasPendingConfirmation &&
+        !params.hasPendingUserInput &&
         !params.hasPendingApproval &&
         !params.hasActiveTask &&
         !params.activeTurnId &&
         params.status !== "busy" &&
-        params.status !== "awaiting_approval");
+        params.status !== "awaiting_approval" &&
+        params.status !== "awaiting_input");
 }
 export function formatDeferredCodexInboundQueueMessage(queuePosition) {
     return `Queued for delivery after the current local Codex turn finishes. Queue position: ${queuePosition}.`;
@@ -394,6 +405,7 @@ async function main() {
             status: adapterState.status,
             activeTurnId: adapterState.activeTurnId,
             hasPendingConfirmation: Boolean(stateStore.getState().pendingConfirmation),
+            hasPendingUserInput: Boolean(stateStore.getState().pendingUserInput),
             hasPendingApproval: Boolean(adapterState.pendingApproval),
             hasActiveTask: Boolean(activeTask),
         })) {
@@ -717,6 +729,9 @@ function wireAdapterEvents(params) {
         if (bridgeState.pendingConfirmation && !adapterState.pendingApproval) {
             stateStore.clearPendingConfirmation();
         }
+        if (bridgeState.pendingUserInput && !adapterState.pendingUserInput) {
+            stateStore.clearPendingUserInput();
+        }
         const authorizedUserId = stateStore.getState().authorizedUserId;
         switch (event.type) {
             case "stdout":
@@ -775,6 +790,14 @@ function wireAdapterEvents(params) {
                     await queueWechatMessage(authorizedUserId, formatApprovalMessage(pending, adapterState), "approval_required");
                 }));
                 break;
+            case "user_input_required":
+                trackWechatForwardTask(outputBatcher.flushNow().then(async () => {
+                    const pending = toPendingUserInput(event.request);
+                    stateStore.setPendingUserInput(pending);
+                    stateStore.appendLog(`User input requested: questions=${pending.questions.length}`);
+                    await queueWechatMessage(authorizedUserId, formatUserInputRequestMessage(pending, adapterState), "user_input_required");
+                }));
+                break;
             case "mirrored_user_input":
                 stateStore.appendLog(`mirrored_local_input: ${truncatePreview(event.text)}`);
                 if (shouldForwardBridgeEventToWechat(options.adapter, event.type, { text: event.text })) {
@@ -813,6 +836,7 @@ function wireAdapterEvents(params) {
             case "task_complete":
                 trackWechatForwardTask(outputBatcher.flushNow().then(async () => {
                     stateStore.clearPendingConfirmation();
+                    stateStore.clearPendingUserInput();
                     if (options.adapter === "shell") {
                         const summary = buildCompletionSummary({
                             adapter: options.adapter,
@@ -829,6 +853,7 @@ function wireAdapterEvents(params) {
             case "task_failed":
                 trackWechatForwardTask(outputBatcher.flushNow().then(async () => {
                     stateStore.clearPendingConfirmation();
+                    stateStore.clearPendingUserInput();
                     clearActiveTask();
                     await queueWechatMessage(authorizedUserId, formatTaskFailedMessage(options.adapter, event.message), "task_failed");
                     await maybeDrainDeferredInboundMessages();
@@ -838,6 +863,7 @@ function wireAdapterEvents(params) {
                 logError(event.message);
                 stateStore.appendLog(`fatal_error: ${event.message}`);
                 stateStore.clearPendingConfirmation();
+                stateStore.clearPendingUserInput();
                 clearActiveTask();
                 trackWechatForwardTask(outputBatcher.flushNow().then(async () => {
                     await queueWechatMessage(authorizedUserId, formatUserFacingBridgeFatalError(event.message), "fatal_error");
@@ -914,6 +940,7 @@ async function handleInboundMessage(params) {
             await outputBatcher.flushNow();
             outputBatcher.clear();
             stateStore.clearPendingConfirmation();
+            stateStore.clearPendingUserInput();
             stateStore.clearSharedSessionId();
             await adapter.createSession();
             stateStore.appendLog(`New ${options.adapter} session requested by owner.`);
@@ -930,6 +957,7 @@ async function handleInboundMessage(params) {
             await outputBatcher.flushNow();
             outputBatcher.clear();
             stateStore.clearPendingConfirmation();
+            stateStore.clearPendingUserInput();
             stateStore.clearSharedSessionId();
             await adapter.reset();
             stateStore.appendLog("Worker reset by owner.");
@@ -974,11 +1002,39 @@ async function handleInboundMessage(params) {
             await queueWechatMessage(message.senderId, "Approval denied.");
             return null;
         }
+        case "answer": {
+            const pending = state.pendingUserInput;
+            if (!pending) {
+                await queueWechatMessage(message.senderId, "No pending user input request.");
+                return null;
+            }
+            const parsed = parsePendingUserInputAnswerCommand(systemCommand.raw, pending);
+            if ("error" in parsed) {
+                await queueWechatMessage(message.senderId, parsed.error);
+                return null;
+            }
+            const submitted = await adapter.submitUserInput(parsed.answers);
+            if (!submitted) {
+                await queueWechatMessage(message.senderId, "The worker could not apply this answer.");
+                return null;
+            }
+            stateStore.clearPendingUserInput();
+            stateStore.appendLog(`User input answered: ${parsed.preview}`);
+            await queueWechatMessage(message.senderId, "Answer submitted. Continuing...");
+            return {
+                startedAt: Date.now(),
+                inputPreview: parsed.preview,
+            };
+        }
     }
     if (state.pendingConfirmation) {
         await queueWechatMessage(message.senderId, formatPendingApprovalReminder(state.pendingConfirmation, adapter.getState()));
         return null;
     }
+    if (state.pendingUserInput) {
+        await queueWechatMessage(message.senderId, formatPendingUserInputReminder(state.pendingUserInput));
+        return null;
+    }
     const adapterState = adapter.getState();
     if (shouldDeferCodexInboundMessage({
         adapter: options.adapter,

package/dist/daemon/wechat-daemon.js

@@ -703,7 +703,7 @@ class WechatDaemon {
                     const pending = toPendingUserInput(event.request);
                     slot.pendingUserInput = pending;
                     appendDaemonLog(`user_input_required: adapter=${slot.adapter} questions=${pending.questions.length}`);
-                    await this.queueWechatMessage(this.authorizedUserId, prefixDaemonAdapterMessage(slot.adapter, formatUserInputRequestMessage(pending, adapterState)), "approval_required");
+                    await this.queueWechatMessage(this.authorizedUserId, prefixDaemonAdapterMessage(slot.adapter, formatUserInputRequestMessage(pending, adapterState)), "user_input_required");
                 }));
                 break;
             case "mirrored_user_input":

package/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "cli-wechat-bridge",
-  "version": "1.0.5",
+  "name": "cli-wechat-bridge",
+  "version": "1.0.6",
   "description": "CLI WeChat Bridge for Codex, Claude Code, OpenCode, and PowerShell over WeChat",
   "type": "module",
   "files": [
@@ -55,8 +55,8 @@
     "lint:fix": "eslint bin src test --fix",
     "typecheck:src": "tsc -p tsconfig.typecheck.src.json --noEmit --pretty false",
     "quality": "npm run lint && npm run typecheck:src && bun test test && npm run build",
-    "smoke:global": "node scripts/smoke-global-install.mjs",
-    "publish:dual": "node scripts/publish-dual.mjs",
+    "smoke:global": "node scripts/smoke-global-install.mjs",
+    "publish:dual": "node scripts/publish-dual.mjs",
     "setup": "node --no-warnings --experimental-strip-types src/wechat/setup.ts",
     "start": "node --no-warnings --experimental-strip-types src/wechat/wechat-channel.ts",
     "check": "node --no-warnings --experimental-strip-types src/wechat/wechat-channel.ts --check",