cli-wechat-bridge 1.1.1 → 1.1.3

package/dist/bridge/bridge-adapters.shared.js

@@ -1,11 +1,12 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import net from "node:net";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { t } from "../i18n/index.js";
 import { spawn as spawnPty } from "node-pty";
-import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, containsWechatOutboundAttachmentPathDeep, isWechatOutboundAttachmentWriteCommand, isHighRiskShellCommand, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, containsWechatOutboundAttachmentPathDeep, isWechatOutboundAttachmentWriteCommand, isHighRiskShellCommand, isStrictApprovalModeEnabled, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
 import { getNotificationThreadId, isRecord, } from "./bridge-adapter-common.js";
 export { coerceWebSocketMessageData, describeUnknownError, getCodexRpcRequestId, getLocalCompanionCommandName, getNotificationThreadId, getNotificationTurnId, getSharedSessionIdFromAdapterState, isRecentIsoTimestamp, isRecord, normalizeCodexRpcError, quotePosixCommandArg, quoteWindowsCommandArg, } from "./bridge-adapter-common.js";
 export const DEFAULT_COLS = 120;
@@ -39,13 +40,19 @@ export const OPENCODE_SERVER_READY_TIMEOUT_MS = 10_000;
 export const OPENCODE_SSE_RECONNECT_DELAY_MS = 2_000;
 export const OPENCODE_SESSION_IDLE_SETTLE_MS = 1_500;
 export const OPENCODE_WECHAT_WORKING_NOTICE_DELAY_MS = 12_000;
+// `opencode serve` binds its TCP port before the HTTP layer is ready. The
+// health probe therefore retries within this total budget so the startup
+// race self-heals instead of hanging until undici's ~300s headersTimeout.
+export const OPENCODE_HTTP_READY_TIMEOUT_MS = 15_000;
+export const OPENCODE_HTTP_READY_PROBE_TIMEOUT_MS = 3_000;
+export const OPENCODE_HTTP_READY_PROBE_INTERVAL_MS = 500;
 export function buildCodexCliArgs(remoteUrl, options = {}) {
     assertNoReservedExtraCliArgs(options.extraCliArgs ?? [], ["--remote", "--remote-auth-token-env"], "Codex remote connection");
     const args = [];
     if (options.resumeThreadId) {
         args.push("resume", options.resumeThreadId);
     }
-    args.push("--enable", "tui_app_server", "--remote", remoteUrl);
+    args.push("--remote", remoteUrl);
     if (options.inlineMode) {
         args.push("--no-alt-screen");
     }
@@ -250,7 +257,10 @@ function containsHighRiskPermissionTarget(value) {
     collectPermissionPaths(value, paths);
     return paths.some(isHighRiskPermissionPath);
 }
-export function getCodexApprovalAutoResponse(method, params) {
+export function getCodexApprovalAutoResponse(method, params, env = process.env) {
+    if (isStrictApprovalModeEnabled(env)) {
+        return null;
+    }
     if (method === "item/commandExecution/requestApproval") {
         const command = typeof params.command === "string" ? params.command : "";
         if (!commandApprovalAllowsAccept(params.availableDecisions)) {
@@ -687,50 +697,17 @@ export function resolveDefaultAdapterCommand(kind, options = {}) {
 export function buildCliEnvironment(kind, options = {}) {
     const sourceEnv = options.env ?? process.env;
     const platform = options.platform ?? process.platform;
-    if (kind === "codex" || kind === "claude" || kind === "opencode") {
-        if (platform !== "win32") {
-            return applyLoopbackNoProxy({
-                ...copyDefinedEnv(sourceEnv),
-                TERM: sourceEnv.TERM || "xterm-256color",
-            });
-        }
+    if (kind === "codex" || kind === "claude" || kind === "opencode" || kind === "pi") {
+        // Pass the full environment through on every platform. A previous
+        // Windows-only allowlist silently dropped user-configured variables such
+        // as ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN / OPENAI_API_KEY, which
+        // broke CLIs that authenticate via environment variables even though the
+        // same CLI worked when launched manually from the user's shell.
         const env = {
+            ...copyDefinedEnv(sourceEnv),
             TERM: sourceEnv.TERM || "xterm-256color",
         };
-        const keys = [
-            "PATH",
-            "PATHEXT",
-            "ComSpec",
-            "COMSPEC",
-            "SystemRoot",
-            "SYSTEMROOT",
-            "USERPROFILE",
-            "HOME",
-            "APPDATA",
-            "LOCALAPPDATA",
-            "TEMP",
-            "TMP",
-            "OS",
-            "ProgramFiles",
-            "ProgramFiles(x86)",
-            "CommonProgramFiles",
-            "CommonProgramFiles(x86)",
-            "HTTP_PROXY",
-            "HTTPS_PROXY",
-            "ALL_PROXY",
-            "http_proxy",
-            "https_proxy",
-            "all_proxy",
-            "NO_PROXY",
-            "no_proxy",
-        ];
-        for (const key of keys) {
-            const value = sourceEnv[key];
-            if (value) {
-                env[key] = value;
-            }
-        }
-        if (!env.HOME && env.USERPROFILE) {
+        if (platform === "win32" && !env.HOME && env.USERPROFILE) {
             env.HOME = env.USERPROFILE;
         }
         return applyLoopbackNoProxy(env);
@@ -740,6 +717,13 @@ export function buildCliEnvironment(kind, options = {}) {
         TERM: sourceEnv.TERM || "xterm-256color",
     };
 }
+// ConPTY shipped in Windows 10 build 18309; on older builds node-pty must be
+// left to auto-select its winpty fallback instead of being forced onto ConPTY.
+export const WINDOWS_CONPTY_MIN_BUILD = 18309;
+export function windowsBuildSupportsConpty(osRelease) {
+    const build = Number(osRelease.split(".")[2]);
+    return Number.isFinite(build) && build >= WINDOWS_CONPTY_MIN_BUILD;
+}
 export function buildPtySpawnOptions(params) {
     const options = {
         name: "xterm-color",
@@ -748,7 +732,8 @@ export function buildPtySpawnOptions(params) {
         cwd: params.cwd,
         env: params.env,
     };
-    if ((params.platform ?? process.platform) === "win32") {
+    if ((params.platform ?? process.platform) === "win32" &&
+        windowsBuildSupportsConpty(params.osRelease ?? os.release())) {
         options.useConpty = true;
     }
     return options;
@@ -1191,7 +1176,8 @@ export function resolveSpawnTarget(command, kind, options = {}) {
         return { file: trimmed, args: [...forwardArgs] };
     }
     const resolved = resolveCommandPath(trimmed, platform, env) ?? trimmed;
-    if (platform !== "win32" || (kind !== "codex" && kind !== "claude" && kind !== "opencode")) {
+    if (platform !== "win32" ||
+        (kind !== "codex" && kind !== "claude" && kind !== "opencode" && kind !== "pi")) {
         return { file: resolved, args: [...forwardArgs] };
     }
     const bundledExe = kind === "codex" || kind === "claude"
@@ -1246,6 +1232,18 @@ export function spawnFallbackProcess(file, args, options) {
             listener({ exitCode });
         }
     });
+    // spawn itself failed (e.g. ENOENT/EACCES) — surface as an exit so callers
+    // stop waiting, instead of throwing an unhandled "error" event that would
+    // crash the bridge on the PTY fallback path.
+    child.on("error", () => {
+        for (const listener of exitListeners) {
+            listener({ exitCode: 1 });
+        }
+    });
+    // Swallow broken-pipe errors on stdin writes after the child has exited.
+    child.stdin?.on("error", () => {
+        /* best effort */
+    });
     return {
         pid: child.pid,
         write(data) {

package/dist/bridge/bridge-final-reply.js

@@ -1,4 +1,4 @@
-import { formatFinalReplyMessage, parseWechatFinalReply, sanitizeWechatFinalReplyText, } from "./bridge-utils.js";
+import { formatFinalReplyMessage, parseWechatFinalReply, sanitizeWechatFinalReplyText, splitWechatTextIntoChunks, } from "./bridge-utils.js";
 export const OPENCODE_EMPTY_VISIBLE_REPLY_MESSAGE = "OpenCode 没有产生可发送到微信的可见回复。请查看本地终端输出，或重试这条消息。";
 export async function forwardWechatFinalReply(params) {
     const { adapter, rawText, sender, onEmptyVisibleReply } = params;
@@ -6,9 +6,13 @@ export async function forwardWechatFinalReply(params) {
     const sanitizedText = sanitizeWechatFinalReplyText(adapter, parsed.visibleText);
     const visibleText = formatFinalReplyMessage(adapter, sanitizedText).trim();
     if (visibleText) {
-        const sent = await sender.sendText(visibleText);
-        if (sent === false) {
-            return;
+        // Send long replies in bounded chunks: a single oversized sendmessage call
+        // can be rejected by the WeChat API, silently losing the whole reply.
+        for (const chunk of splitWechatTextIntoChunks(visibleText)) {
+            const sent = await sender.sendText(chunk);
+            if (sent === false) {
+                return;
+            }
         }
     }
     else if (adapter === "opencode" && parsed.visibleText.trim()) {

package/dist/bridge/bridge-process-reaper.js

@@ -303,10 +303,52 @@ async function waitForProcessExit(pid, timeoutMs) {
     }
     return !isPidAlive(pid);
 }
+/**
+ * Collect all descendant PIDs of `rootPid` on POSIX by walking `pgrep -P`.
+ * Used so killProcessTreeSync can reach grandchildren even when the child was
+ * spawned without `detached` (and therefore shares our process group).
+ */
+function collectPosixDescendantsSync(rootPid) {
+    const descendants = [];
+    const stack = [rootPid];
+    while (stack.length > 0) {
+        const parent = stack.pop();
+        if (parent === undefined) {
+            break;
+        }
+        try {
+            const result = spawnSync("pgrep", ["-P", String(parent)], {
+                encoding: "utf8",
+                windowsHide: true,
+            });
+            if (result.error || result.status !== 0) {
+                continue;
+            }
+            const stdout = result.stdout ?? "";
+            for (const line of stdout.split(/\r?\n/)) {
+                const childPid = Number.parseInt(line.trim(), 10);
+                if (Number.isInteger(childPid) &&
+                    childPid > 0 &&
+                    childPid !== rootPid &&
+                    !descendants.includes(childPid)) {
+                    descendants.push(childPid);
+                    stack.push(childPid);
+                }
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return descendants;
+}
 /**
  * Synchronously kill a process and its entire descendant tree.
  * On Windows uses `taskkill /T /F /PID` to recursively kill all descendants.
- * On other platforms uses `process.kill(pid)` directly.
+ * On POSIX, first tries the process group (kill -pgid) for group leaders, then
+ * walks the descendant tree via pgrep — required because codex/opencode children
+ * are spawned without `detached`, so they share our process group and a bare
+ * kill(pid) would orphan them on Linux/macOS.
  */
 export function killProcessTreeSync(pid) {
     if (!Number.isInteger(pid) || pid <= 0) {
@@ -327,15 +369,28 @@ export function killProcessTreeSync(pid) {
         }
     }
     else {
+        // Best effort: signal the whole group if the child happens to be a leader.
         try {
             process.kill(-pid);
         }
-        catch {
+        catch { /* not a group leader or already gone */ }
+        // Walk and kill descendants (leaves first), then the root, so grandchildren
+        // are not re-parented to init and left running.
+        const descendants = collectPosixDescendantsSync(pid);
+        for (let i = descendants.length - 1; i >= 0; i--) {
+            const descendantPid = descendants[i];
+            if (descendantPid === undefined) {
+                continue;
+            }
             try {
-                process.kill(pid);
+                process.kill(descendantPid);
             }
             catch { /* best effort */ }
         }
+        try {
+            process.kill(pid);
+        }
+        catch { /* best effort */ }
     }
 }
 export async function reapPeerBridgeProcesses(params = {}) {

package/dist/bridge/bridge-state.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import { BRIDGE_LOCK_FILE, BRIDGE_LOG_FILE, ensureWorkspaceChannelDir, ensureChannelDataDir, } from "../wechat/channel-config.js";
+import { BRIDGE_LOCK_FILE, BRIDGE_LOG_FILE, appendBoundedLog, ensureWorkspaceChannelDir, ensureChannelDataDir, } from "../wechat/channel-config.js";
 import { buildInstanceId } from "./bridge-utils.js";
 const ORPHAN_LOCK_RECLAIM_TIMEOUT_MS = 2_000;
 const ORPHAN_LOCK_RECLAIM_POLL_MS = 100;
@@ -59,6 +59,7 @@ export function normalizeBridgeLockPayload(value) {
     const adapter = record.adapter === "codex" ||
         record.adapter === "claude" ||
         record.adapter === "opencode" ||
+        record.adapter === "pi" ||
         record.adapter === "shell"
         ? record.adapter
         : null;
@@ -280,7 +281,7 @@ export class BridgeStateStore {
     }
     appendLog(message) {
         ensureChannelDataDir();
-        fs.appendFileSync(BRIDGE_LOG_FILE, `[${new Date().toISOString()}] ${message}\n`, "utf-8");
+        appendBoundedLog(BRIDGE_LOG_FILE, `[${new Date().toISOString()}] ${message}\n`);
     }
     releaseLock() {
         try {
@@ -293,9 +294,17 @@ export class BridgeStateStore {
             // Best effort cleanup.
         }
     }
-    save() {
+    writeAtomicJsonFile(filePath, value) {
         ensureChannelDataDir();
-        fs.writeFileSync(this.stateFilePath, JSON.stringify(this.state, null, 2), "utf-8");
+        const data = JSON.stringify(value, null, 2);
+        // temp + rename so a crash mid-write cannot leave a truncated/half-written
+        // state or lock file that would break the next launch or look like a stale lock.
+        const tempPath = `${filePath}.${process.pid}.tmp`;
+        fs.writeFileSync(tempPath, data, "utf-8");
+        fs.renameSync(tempPath, filePath);
+    }
+    save() {
+        this.writeAtomicJsonFile(this.stateFilePath, this.state);
     }
     acquireLock() {
         const existing = readBridgeLockFile();
@@ -317,7 +326,7 @@ export class BridgeStateStore {
                 throw buildLockConflictError(existing);
             }
         }
-        fs.writeFileSync(BRIDGE_LOCK_FILE, JSON.stringify(this.lockPayload, null, 2), "utf-8");
+        this.writeAtomicJsonFile(BRIDGE_LOCK_FILE, this.lockPayload);
     }
     verifyRuntimeOwnership() {
         const workspaceState = this.readWorkspaceStateFile();
@@ -336,7 +345,7 @@ export class BridgeStateStore {
             this.save();
         }
         if (ownership.rehydratedLock) {
-            fs.writeFileSync(BRIDGE_LOCK_FILE, JSON.stringify(this.lockPayload, null, 2), "utf-8");
+            this.writeAtomicJsonFile(BRIDGE_LOCK_FILE, this.lockPayload);
         }
         return ownership;
     }

package/dist/bridge/bridge-utils.js

@@ -4,7 +4,11 @@ import path from "node:path";
 const ANSI_ESCAPE_RE = 
 // eslint-disable-next-line no-control-regex
 /\x1b(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
-export const MESSAGE_START_GRACE_MS = 5_000;
+// Messages older than bridge start minus this grace window are treated as
+// pre-start backlog and skipped. The window must absorb realistic clock skew
+// between the local machine and WeChat server timestamps: with a small value,
+// a PC clock running slightly ahead silently dropped fresh messages.
+export const MESSAGE_START_GRACE_MS = 30_000;
 const WECHAT_ATTACHMENT_SEND_INTENT_RE = /\b(send|upload|attach|forward|share)\b/i;
 const WECHAT_ATTACHMENT_SEND_INTENT_ZH_RE = /发送|发给我|发我|给我发|发过来|发一下|发来|发到|发微信|上传|转发|分享|传给我|传我|传到/;
 const WECHAT_ATTACHMENT_SHORT_SEND_ZH_RE = /^(?:发|发呀|发呢|发吧|直接发|发给我|发我|发微信|发送微信)$/;
@@ -798,15 +802,25 @@ export function formatMirroredUserInputMessage(adapter, text) {
             ? "Local Claude input"
             : adapter === "opencode"
                 ? "Local OpenCode input"
-                : "Local input";
+                : adapter === "pi"
+                    ? "Local Pi input"
+                    : "Local input";
     return `${label}:\n${truncatePreview(text, 500)}`;
 }
 export function formatFinalReplyMessage(adapter, text) {
-    if (adapter === "claude" || adapter === "codex" || adapter === "opencode") {
+    if (adapter === "claude" || adapter === "codex" || adapter === "opencode" || adapter === "pi") {
         return text;
     }
     // After the early return above, only "shell" remains.
-    const label = adapter === "codex" ? "Codex" : adapter === "claude" ? "Claude" : adapter === "opencode" ? "OpenCode" : adapter;
+    const label = adapter === "codex"
+        ? "Codex"
+        : adapter === "claude"
+            ? "Claude"
+            : adapter === "opencode"
+                ? "OpenCode"
+                : adapter === "pi"
+                    ? "Pi"
+                    : adapter;
     return `${label} final reply:\n${text}`;
 }
 const OPENCODE_WORKING_NOTICE_RE = /^OpenCode is still working on:\s*$/i;
@@ -948,13 +962,21 @@ function extractInlineWechatAttachments(text) {
         attachments,
     };
 }
+// Platform-independent absolute-path check for WeChat attachment candidates.
+// Recognizes Windows drive paths (C:\, C:/) and POSIX root paths (/, \), so an
+// agent-emitted path resolves on any host OS. Node's path.isAbsolute is
+// platform-specific: it rejects "C:\Users\..." on Linux/macOS, which dropped
+// the attachment and failed CI on non-Windows runners.
+function isWechatAttachmentAbsolutePath(candidate) {
+    return /^(?:[A-Za-z]:[\\/]|[\\/])/.test(candidate);
+}
 function resolveWechatAttachmentPath(candidatePath) {
     const normalizedCandidate = normalizeWechatAttachmentCandidate(candidatePath);
     if (!normalizedCandidate) {
         return null;
     }
-    if (path.isAbsolute(normalizedCandidate)) {
-        return path.normalize(normalizedCandidate);
+    if (isWechatAttachmentAbsolutePath(normalizedCandidate)) {
+        return normalizedCandidate;
     }
     const homeRelativeMatch = /^(?:~[\\/])?(Desktop|Documents|Downloads|Pictures|Videos|Music)([\\/].+)?$/i.exec(normalizedCandidate);
     if (!homeRelativeMatch) {
@@ -967,12 +989,15 @@ function resolveWechatAttachmentPath(candidatePath) {
     }
     return path.normalize(path.join(os.homedir(), ...relativeSegments));
 }
+// Trim and clean a WeChat attachment candidate path. Intentionally does NOT
+// rewrite separators to path.sep: the path must keep its original separator
+// style (Windows "\" or POSIX "/") so the bridge can resolve agent-emitted
+// paths regardless of host OS (see isWechatAttachmentAbsolutePath).
 function normalizeWechatAttachmentCandidate(candidatePath) {
     return candidatePath
         .trim()
         .replace(/^`|`$/g, "")
-        .replace(/\.\s+([A-Za-z0-9]{2,8})(?=$|[?/\s])/g, ".$1")
-        .replace(/[\\/]+/g, path.sep);
+        .replace(/\.\s+([A-Za-z0-9]{2,8})(?=$|[?/\s])/g, ".$1");
 }
 function inferInlineWechatAttachmentKind(filePath) {
     const extension = path.extname(filePath).toLowerCase();
@@ -1001,7 +1026,15 @@ function cleanupVisibleWechatReplyText(text) {
         .trim();
 }
 export function formatTaskFailedMessage(adapter, text) {
-    const label = adapter === "codex" ? "Codex" : adapter === "claude" ? "Claude" : adapter === "opencode" ? "OpenCode" : adapter;
+    const label = adapter === "codex"
+        ? "Codex"
+        : adapter === "claude"
+            ? "Claude"
+            : adapter === "opencode"
+                ? "OpenCode"
+                : adapter === "pi"
+                    ? "Pi"
+                    : adapter;
     return `${label} task failed:\n${text}`;
 }
 export function formatApprovalMessage(pending, adapterState) {
@@ -1075,22 +1108,35 @@ function parseSingleUserInputAnswer(question, rawValue) {
             answers: [trimmed],
         };
     }
-    const separatorIndex = trimmed.indexOf("|");
+    const customAnswerMode = question.customAnswerMode ?? "note";
+    const separatorIndex = customAnswerMode === "note" ? trimmed.indexOf("|") : -1;
     const selection = separatorIndex >= 0 ? trimmed.slice(0, separatorIndex).trim() : trimmed;
     let note = separatorIndex >= 0 ? trimmed.slice(separatorIndex + 1).trim() : "";
     const answers = [];
     if (selection) {
-        const selectedLabel = resolveUserInputOptionLabel(question, selection);
-        if (selectedLabel) {
-            answers.push(selectedLabel);
-        }
-        else if (question.isOther) {
-            note = note ? `${selection}; ${note}` : selection;
-        }
-        else {
-            return {
-                error: `Question "${question.header}" expects an option number or label.`,
-            };
+        const selections = question.multiple
+            ? selection.split(",").map((value) => value.trim()).filter(Boolean)
+            : [selection];
+        for (const value of selections) {
+            const selectedLabel = resolveUserInputOptionLabel(question, value);
+            if (selectedLabel) {
+                if (!answers.includes(selectedLabel)) {
+                    answers.push(selectedLabel);
+                }
+            }
+            else if (question.isOther && customAnswerMode === "value") {
+                if (!answers.includes(value)) {
+                    answers.push(value);
+                }
+            }
+            else if (question.isOther) {
+                note = note ? `${value}; ${note}` : value;
+            }
+            else {
+                return {
+                    error: `Question "${question.header}" expects an option number or label.`,
+                };
+            }
         }
     }
     if (note) {
@@ -1195,8 +1241,13 @@ export function formatUserInputRequestMessage(pending, adapterState) {
                 lines.push(`  ${optionIndex + 1}. ${option.label} - ${truncatePreview(option.description, 160)}`);
             });
         }
+        if (question.multiple) {
+            lines.push("multiple selections: allowed (separate values with commas)");
+        }
         if (question.isOther) {
-            lines.push("custom note: allowed");
+            lines.push(question.customAnswerMode === "value"
+                ? "custom answer: allowed"
+                : "custom note: allowed");
         }
     });
     lines.push("");
@@ -1206,8 +1257,13 @@ export function formatUserInputRequestMessage(pending, adapterState) {
             return lines.join("\n");
         }
         if (question.options?.length) {
-            lines.push("Reply with /answer <option number or exact label>.");
-            if (question.isOther) {
+            lines.push(question.multiple
+                ? "Reply with /answer <option numbers or exact labels separated by commas>."
+                : "Reply with /answer <option number or exact label>.");
+            if (question.isOther && question.customAnswerMode === "value") {
+                lines.push("You may enter a custom answer instead of an option.");
+            }
+            else if (question.isOther) {
                 lines.push('Add "| your note" to include extra context.');
             }
         }
@@ -1219,7 +1275,10 @@ export function formatUserInputRequestMessage(pending, adapterState) {
         lines.push("Reply with /answer questionId=value; questionId2=value.");
         lines.push("You can use question numbers instead of ids.");
         lines.push("For option questions, value can be the option number or exact label.");
-        lines.push('Add "| your note" after an option answer to include extra context.');
+        lines.push("For multi-select questions, separate option values with commas.");
+        if (pending.questions.some((question) => question.customAnswerMode !== "value")) {
+            lines.push('Add "| your note" after an option answer to include extra context.');
+        }
     }
     lines.push("Use /stop to interrupt the active turn instead.");
     return lines.join("\n");
@@ -1228,11 +1287,11 @@ export function formatPendingUserInputReminder(pending) {
     if (pending.questions.length === 1) {
         const question = pending.questions[0];
         if (!question) {
-            return "Codex is waiting for user input. Reply with /answer and your response, or use /stop to interrupt.";
+            return "The active CLI is waiting for user input. Reply with /answer and your response, or use /stop to interrupt.";
         }
-        return `Codex is waiting for user input for ${question.header}. Reply with /answer and your response, or use /stop to interrupt.`;
+        return `The active CLI is waiting for user input for ${question.header}. Reply with /answer and your response, or use /stop to interrupt.`;
     }
-    return `Codex is waiting for answers to ${pending.questions.length} questions. Reply with /answer questionId=value; questionId2=value, or use /stop to interrupt.`;
+    return `The active CLI is waiting for answers to ${pending.questions.length} questions. Reply with /answer questionId=value; questionId2=value, or use /stop to interrupt.`;
 }
 export class OutputBatcher {
     onFlush;
@@ -1305,9 +1364,49 @@ export class OutputBatcher {
             .catch(() => undefined);
     }
 }
+// When CLI_BRIDGE_STRICT_APPROVAL is enabled, no permission request is
+// auto-approved: everything is forwarded to WeChat for an explicit
+// /confirm or /deny decision.
+export function isStrictApprovalModeEnabled(env = process.env) {
+    const value = env.CLI_BRIDGE_STRICT_APPROVAL?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes" || value === "on";
+}
+// Outbound WeChat text size cap shared by the streaming OutputBatcher and the
+// final-reply forwarder. Long replies sent as a single sendmessage call can be
+// rejected by the server, which previously made long final replies vanish.
+export const WECHAT_TEXT_CHUNK_MAX_CHARS = 1_200;
+export function splitWechatTextIntoChunks(text, maxChars = WECHAT_TEXT_CHUNK_MAX_CHARS) {
+    const normalized = text.trim();
+    if (!normalized) {
+        return [];
+    }
+    if (normalized.length <= maxChars) {
+        return [normalized];
+    }
+    const chunks = [];
+    let remaining = normalized;
+    while (remaining.length > maxChars) {
+        // Prefer breaking at a newline reasonably close to the cap so paragraphs
+        // stay intact; fall back to a hard split.
+        const window = remaining.slice(0, maxChars + 1);
+        const newlineIndex = window.lastIndexOf("\n");
+        const splitIndex = newlineIndex > maxChars / 2 ? newlineIndex : maxChars;
+        const chunk = remaining.slice(0, splitIndex).trim();
+        if (chunk) {
+            chunks.push(chunk);
+        }
+        remaining = remaining.slice(splitIndex).trim();
+    }
+    if (remaining) {
+        chunks.push(remaining);
+    }
+    return chunks;
+}
 export function shouldDropStartupBacklogMessage(createdAtMs, bridgeStartedAtMs, graceMs = MESSAGE_START_GRACE_MS) {
-    if (!Number.isFinite(createdAtMs)) {
-        return true;
+    // A missing or unparsable timestamp must not drop the message: treat it as
+    // fresh and let normal processing continue.
+    if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) {
+        return false;
     }
     return createdAtMs < bridgeStartedAtMs - graceMs;
 }

package/dist/bridge/claude-hook.js

@@ -30,6 +30,7 @@ async function main() {
         const socket = net.connect({ host: "127.0.0.1", port });
         let buffer = "";
         const finish = () => {
+            clearTimeout(connectTimer);
             try {
                 socket.destroy();
             }
@@ -38,7 +39,13 @@ async function main() {
             }
             resolve();
         };
+        // Bail out if the bridge hook server never accepts the connection, so a
+        // wedged bridge cannot leave Claude CLI blocked on this hook forever.
+        // Once connected, we wait indefinitely: approval responses legitimately
+        // take as long as the user needs to reply on WeChat.
+        const connectTimer = setTimeout(finish, 10_000);
         socket.once("connect", () => {
+            clearTimeout(connectTimer);
             try {
                 socket.write(`${JSON.stringify({ token, requestId, payload })}\n`);
             }

package/dist/bridge/claude-hooks.js

@@ -1,4 +1,4 @@
-import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, isHighRiskShellCommand, isWechatOutboundAttachmentWriteCommand, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
+import { WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE, containsWechatOutboundAttachmentPath, isHighRiskShellCommand, isStrictApprovalModeEnabled, isWechatOutboundAttachmentWriteCommand, normalizeOutput, truncatePreview, } from "./bridge-utils.js";
 export const CLAUDE_WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE = WECHAT_OUTBOUND_ATTACHMENT_DENY_MESSAGE;
 const FILE_MUTATION_TOOL_NAMES = new Set([
     "Write",
@@ -88,6 +88,11 @@ export function buildClaudeHookScript(params) {
         return [
             "@echo off",
             "setlocal",
+            // The script is written as UTF-8, but cmd.exe decodes batch lines with
+            // the active OEM code page (GBK on zh-CN systems). Paths below may
+            // contain non-ASCII characters (e.g. a Chinese Windows user name), so
+            // switch to UTF-8 before any line that embeds a path.
+            "chcp 65001>nul",
             `set "CLAUDE_WECHAT_HOOK_PORT=${params.hookPort}"`,
             `set "CLAUDE_WECHAT_HOOK_TOKEN=${params.hookToken}"`,
             `${command} ${stderrRedirect}`,
@@ -205,7 +210,10 @@ export function getClaudeWechatOutboundAttachmentDenyMessage(payload) {
     }
     return null;
 }
-export function getClaudePermissionAutoResponse(payload) {
+export function getClaudePermissionAutoResponse(payload, env = process.env) {
+    if (isStrictApprovalModeEnabled(env)) {
+        return null;
+    }
     const toolName = typeof payload.tool_name === "string" ? payload.tool_name.trim() : "";
     if (!toolName) {
         return null;