dsh-connect-workbuddy 5.2.2 → 5.3.0

package/lib/index.js

@@ -1,12 +1,14 @@
-import { $ as regionOf, A as parseWorkBuddyAuth, At as workbuddyAppExecutableCandidates, B as forceNeutralHead, C as defaultDesktopAuthCandidates, D as isEncryptedCredentialError, Dt as macosNestedAppBundles, E as hasEncryptedCredentialFields, Et as macosBundleExecutable, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, G as knownRegionOf, H as isConversationIdGateBody, I as WorkBuddyCredentialRejectedError, J as parseCreditMultiplier, K as modelIdOfBody, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, Mt as resolveDshHome, N as CONTEXT_OVERFLOW_MARKER, Nt as withFileLock, O as isVaultAccountId, Ot as openEncryptedField, P as CREDENTIAL_REJECTED_CODE, Pt as writeFileAtomic, Q as prepareChatBody, R as classifyUpstreamError, S as authFileName, St as findWorkbuddyAppExecutable, T as defaultDesktopAuthPath, Tt as isWorkbuddyBundle, U as isCredentialRejectedError, V as isContextTooLongBody, W as isFirstMessageGateBody, X as parseUpstreamModel, Y as parseReasoning, Z as perturbChannelFingerprints, _ as ENCRYPTED_CREDENTIAL_CODE, _t as WORKBUDDY_APP_EXECUTABLE_ENV, a as readHostHeartbeat, at as offDefaultFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKeyId, c as WORKBUDDY_CONNECT_VERSION, ct as withEffectiveOff, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as pickImageModel, et as attachBusyLevels, f as WorkBuddyCatalog, ft as parseQueueAnswer, g as withoutRouters, gt as nativeModalityOf, h as fallbackModelsFor, ht as imageDefaultFor, i as processStartTimeMs, it as lastRefusalFor, j as workbuddyAccountId, k as legacyWorkbuddyOwnAuthPath, kt as readAtRestKey, l as piAiRuntimeInfo, lt as DEFAULT_IMAGE_SIZE, m as deriveCatalog, mt as NATIVE_MODALITY_BY_MODEL_ID, n as clearHostHeartbeat, nt as REFUSES_OFF_MODEL_IDS, o as workbuddyHostHeartbeatPath, ot as offRefused, p as applyContextBudgets, pt as queueNoticeText, q as openingEvidenceOfBody, r as isHeartbeatProcessAlive, rt as defaultOffModelIds, s as writeHostHeartbeat, st as recordRefusal, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as busyDisplaySuffix, u as FALLBACK_WORKBUDDY_MODELS, ut as WorkBuddyImageError, v as WORKBUDDY_AUTH_FILENAME, vt as clearAtRestKeyCache, w as defaultDesktopAuthDirs, wt as isEncryptedFieldWrapper, x as WorkBuddyEncryptedCredentialError, xt as fetchAtRestKeyPayload, y as WORKBUDDY_AUTH_FILE_ENV, yt as deriveAtRestKey, z as declaredTools } from "./host-heartbeat-r1M_OXJI.js";
+import { $ as regionOf, A as parseWorkBuddyAuth, At as workbuddyAppExecutableCandidates, B as forceNeutralHead, C as defaultDesktopAuthCandidates, D as isEncryptedCredentialError, Dt as macosNestedAppBundles, E as hasEncryptedCredentialFields, Et as macosBundleExecutable, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, G as knownRegionOf, H as isConversationIdGateBody, I as WorkBuddyCredentialRejectedError, J as parseCreditMultiplier, K as modelIdOfBody, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, Mt as resolveDshHome, N as CONTEXT_OVERFLOW_MARKER, Nt as withFileLock, O as isVaultAccountId, Ot as openEncryptedField, P as CREDENTIAL_REJECTED_CODE, Pt as writeFileAtomic, Q as prepareChatBody, R as classifyUpstreamError, S as authFileName, St as findWorkbuddyAppExecutable, T as defaultDesktopAuthPath, Tt as isWorkbuddyBundle, U as isCredentialRejectedError, V as isContextTooLongBody, W as isFirstMessageGateBody, X as parseUpstreamModel, Y as parseReasoning, Z as perturbChannelFingerprints, _ as ENCRYPTED_CREDENTIAL_CODE, _t as WORKBUDDY_APP_EXECUTABLE_ENV, a as readHostHeartbeat, at as offDefaultFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKeyId, c as WORKBUDDY_CONNECT_VERSION, ct as withEffectiveOff, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as pickImageModel, et as attachBusyLevels, f as WorkBuddyCatalog, ft as parseQueueAnswer, g as withoutRouters, gt as nativeModalityOf, h as fallbackModelsFor, ht as imageDefaultFor, i as processStartTimeMs, it as lastRefusalFor, j as workbuddyAccountId, k as legacyWorkbuddyOwnAuthPath, kt as readAtRestKey, l as piAiRuntimeInfo, lt as DEFAULT_IMAGE_SIZE, m as deriveCatalog, mt as NATIVE_MODALITY_BY_MODEL_ID, n as clearHostHeartbeat, nt as REFUSES_OFF_MODEL_IDS, o as workbuddyHostHeartbeatPath, ot as offRefused, p as applyContextBudgets, pt as queueNoticeText, q as openingEvidenceOfBody, r as isHeartbeatProcessAlive, rt as defaultOffModelIds, s as writeHostHeartbeat, st as recordRefusal, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as busyDisplaySuffix, u as FALLBACK_WORKBUDDY_MODELS, ut as WorkBuddyImageError, v as WORKBUDDY_AUTH_FILENAME, vt as clearAtRestKeyCache, w as defaultDesktopAuthDirs, wt as isEncryptedFieldWrapper, x as WorkBuddyEncryptedCredentialError, xt as fetchAtRestKeyPayload, y as WORKBUDDY_AUTH_FILE_ENV, yt as deriveAtRestKey, z as declaredTools } from "./host-heartbeat-_EvGiAek.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { isAbsolute, join, resolve, sep } from "node:path";
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { createAssistantMessageEventStream, createProvider, isContextOverflow } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
-import { ReasoningEffortId, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { ReasoningEffortId, createUserMessage, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { pathToFileURL } from "node:url";
 import { createServer } from "node:http";
@@ -206,6 +208,16 @@ const WORKBUDDY_PROVIDERS = {
 */
 const WORKBUDDY_MODEL_IDENTITY = "workbuddy";
 /**
+* The api string `dsh-llm-pi-ai` stamps on a replayed message it could not
+* rebuild natively (`foreignAssistant()`), i.e. a message that went through the
+* host's fallback path rather than this plugin's own request builder.
+*
+* It is the ONLY api value {@link alignAssistantIdentities} repairs, because it
+* is the only one that proves the field is a host marker instead of a shape this
+* plugin really produced.
+*/
+const HOST_FOREIGN_API = "dsh-foreign";
+/**
 * Registry keys an adapter serving `providerId` must publish so that every
 * stamp its models carry resolves inside its own region (issue #75).
 *
@@ -621,12 +633,33 @@ function transcript(context) {
 * or the destination changes: `baseUrl` comes from the model, not from the
 * message.
 *
-* Only `provider` is rewritten. `api` is left alone on purpose: a legacy
-* (`dsh-foreign`) message carries an api this plugin never sends, and claiming
-* `openai-completions` for it would assert a wire shape that message was never
-* built for. The `provider` mismatch is what decides the downgrade, and fixing
-* it is enough — `isSameModel` still requires the model id and api to match, so
-* a genuinely different model keeps degrading (covered by a test).
+* `provider` alone is NOT enough, because the HOST drops the message to
+* `api: 'dsh-foreign'` first. `dsh-llm-pi-ai`'s `replayedAssistant` rejects a
+* replay whose recorded provider differs from `source.provider` and falls back
+* to `foreignAssistant()`, which stamps `api: 'dsh-foreign'` and takes
+* `provider` from `source.provider` — the ROUTE id. That is why the provider
+* mismatch is not merely cosmetic: it also costs the message its native api, and
+* `isSameModel` then fails on the SECOND comparison even after `provider` is
+* repaired. Measured on a real 0.2.1-rc.2 global session, aligning `provider`
+* only still flattened a 1514-character thinking block into 1514 characters of
+* text; aligning both restored `thinking`.
+*
+* So `api` is repaired too, but ONLY from the one value that proves it is a
+* host fallback and not this plugin's own wire format: `dsh-foreign`. Any other
+* api is left exactly as it is.
+*
+* WHY THAT IS NOT FORGING A SIGNATURE. A `foreignAssistant()` message carries
+* thinking blocks with NO `thinkingSignature` (`dsh-llm-pi-ai` builds them as
+* `{type:'thinking', thinking}`), and pi-ai's request builder only emits
+* `reasoning_content` when a signature exists
+* (`api/openai-completions.js`, the `if (signature && isOpenAICompletionsReasoningField(...))`
+* branch). The block is therefore OMITTED from the request, never replayed as
+* signed reasoning — the same thing that happens today, minus the visible text.
+* The message's own `api` field is not read by the request builder at all
+* (grep: only `model.api` is), so this changes no wire shape.
+*
+* A genuinely different model still degrades: `isSameModel` continues to
+* require the model id to match (covered by a test).
 *
 * Returns the same object when nothing changed, so the common case (an
 * already-normalized transcript) allocates nothing.
@@ -639,12 +672,14 @@ function alignAssistantIdentities(context, identity = WORKBUDDY_MODEL_IDENTITY)
 		if (typeof message !== "object" || message === null) return message;
 		const record = message;
 		if (record["role"] !== "assistant") return message;
-		if (record["provider"] === identity) return message;
+		const providerAligned = record["provider"] === identity;
+		const apiAligned = record["api"] !== HOST_FOREIGN_API;
+		if (providerAligned && apiAligned) return message;
 		changed = true;
-		return {
-			...record,
-			provider: identity
-		};
+		const aligned = { ...record };
+		if (!providerAligned) aligned["provider"] = identity;
+		if (!apiAligned) aligned["api"] = "openai-completions";
+		return aligned;
 	});
 	return changed ? {
 		...context,
@@ -3936,6 +3971,1663 @@ function registerWorkBuddyImageTool(tools, deps) {
 	}
 }
 //#endregion
+//#region src/cli-bridge/redact.ts
+/**
+* Scrubbing CLI output before it can reach a conversation.
+*
+* WHY THIS IS NOT `redactUpstreamText`. That helper lives in `src/probe.ts` and
+* ends with `.slice(0, PROBE_MESSAGE_LIMIT)` — 300 characters, enough for a
+* probe failure body and far too little for a CodeBuddy reply. Reusing it here
+* would silently truncate every review to its first paragraph, so this module
+* carries its own implementation of the same two patterns plus the one thing
+* the probe route does not have: an explicit secret list.
+*
+* WHY THE SECRET LIST MATTERS MORE THAN THE PATTERNS. The bridge hands the CLI
+* its credential through `CODEBUDDY_AUTH_TOKEN`, which means the token is in
+* that child's environment and the child is capable of echoing it back (a stack
+* trace, a debug line, an error body). No regex knows what a WorkBuddy token
+* looks like from the outside; the only definition that cannot be wrong is
+* "replace the exact string I put in the environment". The patterns stay as a
+* second net for tokens this process never held (a nested service's token, an
+* `Authorization` header copied into an error).
+*
+* @module dsh-connect-workbuddy/cli-bridge/redact
+*/
+/** Longest a redacted block may stay before it is treated as one blob. */
+const MAX_SECRET_LENGTH = 4096;
+const PATTERNS = [
+	[/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/gu, "[redacted token]"],
+	[/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/giu, "Bearer [redacted]"],
+	[/\b(?:sk|ak|pk)-[A-Za-z0-9_-]{12,}\b/gu, "[redacted key]"],
+	[/(\b(?:access_token|refresh_token|api_key|apikey|auth_token|token|authorization)\b["']?\s*[=:]\s*["']?)[^"'\s,}&]{8,}/giu, "$1[redacted]"]
+];
+/**
+* Remove token-shaped content from CLI text.
+*
+* `secrets` are exact strings to scrub first (case-sensitive, literal): the
+* credential this turn handed the child. Empty strings are ignored because
+* `String.prototype.split('')` would explode the text into characters.
+*
+* Never throws, never shortens the text. Length is the caller's business — a
+* reply that is still too long is truncated by the caller with a marker, not
+* here where the reason would be lost.
+*/
+function redactCliText(text, secrets = []) {
+	let out = text;
+	for (const secret of secrets) {
+		if (typeof secret !== "string") continue;
+		if (secret.length < 8 || secret.length > MAX_SECRET_LENGTH) continue;
+		out = out.split(secret).join("[redacted credential]");
+	}
+	for (const [pattern, replacement] of PATTERNS) {
+		pattern.lastIndex = 0;
+		out = out.replace(pattern, replacement);
+	}
+	return out;
+}
+//#endregion
+//#region src/cli-bridge/inject.ts
+/**
+* Handing a finished CLI turn back to the session's model.
+*
+* WHY THIS EXISTS. `/codebuddy` runs in the Host: the model never sees the line,
+* never sees CodeBuddy's answer, and — worse — never learns that files in its own
+* workspace may have just changed. A model that believes it is looking at an
+* untouched tree will reason confidently about code that is no longer there. So
+* after a successful turn the outcome is queued for the model as ONE message
+* that names CodeBuddy and the directory it ran in (see `composeContinuation`).
+*
+* WHY `inject` AND WHY SOMETIMES `steer`. DSH's public `Agent.inject(message)`
+* queues model-facing context for the next pre-step **without waking the
+* driver** — which is exactly right when a turn is already running (the message
+* lands at the next step boundary, no interruption) and exactly wrong when the
+* session is idle (the message would sit in the inbox forever and the command
+* would look like it silently did nothing). The phase split is therefore:
+* running → `inject()`, idle → `steer()` (same call, one argument different:
+* it wakes the driver and starts the single turn that reads this message).
+*
+* "Accepted by the driver" is NOT "the model has read it": a cancellation or a
+* disposal can still discard pending context. The outcome says which of the two
+* happened and never claims more.
+*
+* @module dsh-connect-workbuddy/cli-bridge/inject
+*/
+/**
+* A second scrubbing pass on the way into the transcript.
+*
+* `runAgent` already scrubbed what it returned, so why twice? Because this is the
+* last point before the text becomes a permanent message in the session history,
+* and the path from the CLI to here goes through a result object that other code
+* (now or later) can populate. Scrubbing at the boundary that matters is cheap;
+* discovering a token in a saved transcript is not.
+*/
+function redactInjected(text) {
+	return redactCliText(text);
+}
+/** Bound on one injected message. A reply can be long; a runaway one is a bug. */
+const INJECT_TEXT_LIMIT = 2e5;
+/**
+* The `source.kind` stamped on every message this module writes.
+*
+* The Host's `MessageSource` is a CLOSED union — `model | user | tool |
+* system-prompt` — and only `user` is available for a message that must be read
+* as an incoming turn: `tool` requires a `callId` from a real tool call this
+* plugin did not make, `model` claims a provider produced it, `system-prompt`
+* would put it in the system slot. So the tag cannot say "a plugin wrote this",
+* and pretending otherwise would mean shipping a type that lies.
+*
+* WHAT COMPENSATES FOR IT: the message opens with `PROVENANCE_LINE`, a bracketed
+* line that names the plugin and the command. A human scanning the transcript
+* can tell an injected result from something they typed, and so can the model —
+* which matters because a model that mistakes it for a human instruction will
+* act on it as one.
+*/
+const INJECT_SOURCE_KIND = "user";
+/** The first line of every injected message. Not decoration: it is the only
+* provenance signal the closed `source` union leaves available. */
+const PROVENANCE_LINE = "[dsh-connect-workbuddy · 由 /codebuddy 自动回注，不是用户输入]";
+/**
+* An instruction appended so a model does not turn the result into a loop.
+*
+* The first draft ended with 「据此继续」, which is an instruction to keep going —
+* and the obvious way to "keep going" after a CodeBuddy review is to ask
+* CodeBuddy again. Each lap spends another account quota. The wording below
+* closes that door explicitly: read the result, use it, and do not re-run the
+* same bridge to chase it.
+*/
+const NO_LOOP_NOTE = "这条结论已经完成，不要为了\"再确认一次\"而重复调用 codebuddy_ask 或 /codebuddy —— 每一次调用都会真实消耗一份 CodeBuddy 额度。只有出现新的、不重复的问题时才再发起一轮。";
+/** Every refusal this module can produce, by name. */
+const REFUSALS = {
+	"agent-not-live": "拿不到这个会话的 agent，结论没有交给模型",
+	"text-required": "这一轮没有可交给模型的输出",
+	"text-too-large": `输出超过 ${String(INJECT_TEXT_LIMIT)} 字符，没有交给模型`,
+	"inject-failed": "把结论交给模型时出错"
+};
+/** A named refusal — never a silent no-op (the failure has to be sayable). */
+function refuse(code, detail) {
+	const base = REFUSALS[code];
+	return {
+		ok: false,
+		code,
+		error: detail !== void 0 && detail !== "" ? `${base}：${detail}` : base
+	};
+}
+/**
+* The message handed to the model after a CodeBuddy turn.
+*
+* Two things it must carry and one it must not claim. It carries WHERE the turn
+* ran and WHAT it was asked to do (without them the model reads a conclusion it
+* cannot place), and it says the turn may have changed files — that is the whole
+* reason a model needs to hear about it. It does NOT claim the human asked the
+* model to do anything: the command was human-to-CodeBuddy, so "continue your
+* original task" would be a fiction. The model is told to use the result if it
+* bears on the work and to stay quiet otherwise.
+*/
+function composeContinuation(reply, meta = {}) {
+	const dir = typeof meta.dir === "string" && meta.dir.trim() !== "" ? meta.dir.trim() : "";
+	const scope = typeof meta.scope === "string" && meta.scope.trim() !== "" ? meta.scope.trim() : "";
+	const tools = Array.isArray(meta.tools) ? meta.tools : [];
+	const toolList = tools.length > 0 ? tools.map((tool) => tool.count > 1 ? `${tool.name}×${String(tool.count)}` : tool.name).join("、") : "无";
+	const toolCalls = typeof meta.toolCalls === "number" ? meta.toolCalls : 0;
+	return [
+		PROVENANCE_LINE,
+		"CodeBuddy（另一个独立的 AI 编程助手，跑在本机真实的 CodeBuddy CLI 上）刚完成一次任务。",
+		dir === "" ? null : `工作目录：${dir}`,
+		scope === "" ? null : `交给它的指令：${scope}`,
+		"",
+		"--- CodeBuddy 输出开始 ---",
+		reply,
+		"--- CodeBuddy 输出结束 ---",
+		"",
+		`这一轮它用了 ${String(toolCalls)} 次工具调用（${toolList}），可能已经改动了工作区里的文件。`,
+		"如果这与当前任务有关，就用这些结论继续；如果无关，用一两句话向用户说明即可，不要重复它已经做过的事。",
+		NO_LOOP_NOTE
+	].filter((line) => line !== null).join("\n");
+}
+/**
+* Deliver the "CodeBuddy finished, here is what it said" message to the agent.
+*
+* An ABSENT status is read as running — the conservative direction. A message
+* that parks is recoverable (the next turn picks it up); an extra model turn
+* costs money and cannot be taken back. Only a positive `'idle'` earns the wake.
+*/
+function injectOutcome(agent, input) {
+	if (agent === void 0) return refuse("agent-not-live");
+	if (typeof input.reply !== "string" || input.reply.trim() === "") return refuse("text-required");
+	if (input.reply.length > 2e5) return refuse("text-too-large");
+	const scope = typeof input.scope === "string" ? input.scope : "";
+	const text = composeContinuation(redactInjected(input.reply.trim()), {
+		...typeof input.dir === "string" ? { dir: input.dir } : {},
+		...scope !== "" ? { scope: redactInjected(scope) } : {},
+		...typeof input.toolCalls === "number" ? { toolCalls: input.toolCalls } : {},
+		...Array.isArray(input.tools) ? { tools: input.tools } : {}
+	});
+	try {
+		const message = createUserMessage({
+			content: [{
+				type: "text",
+				text
+			}],
+			source: { kind: INJECT_SOURCE_KIND }
+		});
+		const idle = agent.status === "idle";
+		if (idle) agent.steer(message);
+		else agent.inject(message);
+		return {
+			ok: true,
+			delivered: idle ? "new-turn" : "next-step",
+			woke: idle,
+			messageId: String(message.id ?? "")
+		};
+	} catch (error) {
+		return refuse("inject-failed", error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Render a delivery outcome as the one line a command result carries.
+*
+* The human pressed enter and must learn whether the model was told — "the
+* command worked" and "the model knows" are different facts, and conflating
+* them is how a silent failure goes unnoticed for a week.
+*/
+function formatInjection(outcome) {
+	if (!outcome.ok) return `[未能通知模型继续：${outcome.code} — ${outcome.error}]`;
+	return outcome.woke ? "[已唤醒会话模型：CodeBuddy 的结论已交给它继续]" : "[结论已排队交给模型，随这一轮的下一个步骤或下一轮生效]";
+}
+//#endregion
+//#region src/cli-bridge/credentials.ts
+/** Environment variable that short-circuits the vault entirely. */
+const AUTH_TOKEN_ENV = "CODEBUDDY_AUTH_TOKEN";
+/**
+* Walk the vault in region order and return every usable token, best first.
+*
+* Expired tokens are kept, at the end of their region: `expiresAt` is a claim
+* the upstream does not maintain, and a token that "expired" yesterday is
+* routinely still accepted. Refusing it locally would turn a working sign-in
+* into "not signed in".
+*
+* @throws when nothing at all is available — the caller reports that as a turn
+*   that never started, not as a CLI failure.
+*/
+async function resolveCredentials(regions, regionOrder, log) {
+	const fromEnv = process.env[AUTH_TOKEN_ENV];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return [{
+		token: fromEnv.trim(),
+		source: AUTH_TOKEN_ENV,
+		region: "env",
+		expired: false
+	}];
+	const out = [];
+	const ordered = [...regions].sort((left, right) => rank(regionOrder, left.region) - rank(regionOrder, right.region));
+	for (const { region, store } of ordered) {
+		let accounts;
+		try {
+			accounts = await store.accounts();
+		} catch (error) {
+			log(`reading the ${region} vault failed: ${error instanceof Error ? error.message : String(error)}`);
+			continue;
+		}
+		const ranked = [...accounts].sort((left, right) => right.tokenExpiresAtMs - left.tokenExpiresAtMs);
+		for (const account of ranked) {
+			const credential = await store.credentialFor(account.id);
+			if (credential === void 0 || credential.accessToken === "") continue;
+			out.push({
+				token: credential.accessToken,
+				source: `${region} 账号 ${account.id.slice(0, 6)}`,
+				region,
+				expired: credential.expiresAtMs > 0 && credential.expiresAtMs <= Date.now()
+			});
+		}
+	}
+	if (out.length === 0) throw new Error(`没有可用的 WorkBuddy 登录凭据：插件配置里没读到你登录过的账号。先在 WorkBuddy / CodeBuddy 里登录，或设置环境变量 ${AUTH_TOKEN_ENV}。`);
+	return out;
+}
+/** Position of a region in the preference list; unknown regions sort last. */
+function rank(order, region) {
+	const index = order.indexOf(region);
+	return index === -1 ? order.length : index;
+}
+//#endregion
+//#region src/cli-bridge/gate.ts
+/** Hour in milliseconds. */
+const WINDOW_MS = 36e5;
+/**
+* Tracks what has been spent in the last hour.
+*
+* Deliberately in-memory and per-process: a restart forgets the history, which
+* is the right failure direction (a restart cannot lock anyone out of their own
+* tool) and the honest scope for a plugin that cannot see other processes.
+*/
+var TurnGate = class {
+	limits;
+	now;
+	/** Session key → arrival timestamps inside the window, oldest first. */
+	perSession = /* @__PURE__ */ new Map();
+	/** Every arrival in the window, oldest first. */
+	global = [];
+	/** Session keys with a turn currently running. */
+	running = /* @__PURE__ */ new Set();
+	constructor(limits, now = Date.now) {
+		this.limits = limits;
+		this.now = now;
+	}
+	/** Drop everything older than the window. Called before every decision. */
+	prune(at) {
+		const cutoff = at - WINDOW_MS;
+		while (this.global.length > 0 && (this.global[0] ?? 0) <= cutoff) this.global.shift();
+		for (const [key, arrivals] of this.perSession) {
+			while (arrivals.length > 0 && (arrivals[0] ?? 0) <= cutoff) arrivals.shift();
+			if (arrivals.length === 0) this.perSession.delete(key);
+		}
+	}
+	/** Whether a turn is running in this session right now. */
+	isBusy(sessionKey) {
+		return this.running.has(sessionKey);
+	}
+	/** How many turns this session has started inside the window. */
+	spentBySession(sessionKey) {
+		this.prune(this.now());
+		return this.perSession.get(sessionKey)?.length ?? 0;
+	}
+	/** How many turns this process has started inside the window. */
+	spentTotal() {
+		this.prune(this.now());
+		return this.global.length;
+	}
+	/**
+	* Ask to start a turn.
+	*
+	* On success the caller OWNS the slot until `release()` runs; on refusal
+	* nothing was charged and nothing needs releasing.
+	*/
+	tryEnter(sessionKey, onRefused) {
+		const at = this.now();
+		this.prune(at);
+		if (!this.limits.allowConcurrentPerSession && this.running.has(sessionKey)) return {
+			ok: false,
+			code: "busy",
+			error: "这个会话已有一个 CodeBuddy 回合在跑，等它结束再发一次。"
+		};
+		const { perSessionPerHour, globalPerHour } = this.limits;
+		if (perSessionPerHour > 0) {
+			const spent = this.perSession.get(sessionKey)?.length ?? 0;
+			if (spent >= perSessionPerHour) {
+				const message = `本会话最近一小时已经跑了 ${String(spent)} 次 CodeBuddy（上限 ${String(perSessionPerHour)} 次/小时）。等窗口过去，或调高插件配置 cliBridge.maxTurnsPerSessionHour。`;
+				onRefused(message);
+				return {
+					ok: false,
+					code: "session-quota",
+					error: message
+				};
+			}
+		}
+		if (globalPerHour > 0 && this.global.length >= globalPerHour) {
+			const message = `最近一小时全场已经跑了 ${String(this.global.length)} 次 CodeBuddy（上限 ${String(globalPerHour)} 次/小时）。等窗口过去，或调高插件配置 cliBridge.maxTurnsPerHour。`;
+			onRefused(message);
+			return {
+				ok: false,
+				code: "global-quota",
+				error: message
+			};
+		}
+		const arrivals = this.perSession.get(sessionKey) ?? [];
+		arrivals.push(at);
+		this.perSession.set(sessionKey, arrivals);
+		this.global.push(at);
+		this.running.add(sessionKey);
+		let released = false;
+		return {
+			ok: true,
+			release: () => {
+				if (released) return;
+				released = true;
+				this.running.delete(sessionKey);
+			}
+		};
+	}
+	/** Forget every counter. Used by the mount's disposer. */
+	clear() {
+		this.perSession.clear();
+		this.global.length = 0;
+		this.running.clear();
+	}
+};
+//#endregion
+//#region src/cli-bridge/runner.ts
+/**
+* One bridged CodeBuddy turn, and the credential walk around it.
+*
+* WHAT THIS ROUTE ACTUALLY ESCAPES — the honest version. The provider route has
+* to look like a CodeBuddy client to get past the gateway's channel check (code
+* 11128), which is an arms race the upstream fights with zero-width-space
+* perturbation. This route does not impersonate a client at all: the process
+* that talks to the gateway really is the CodeBuddy CLI. **That is a CLIENT
+* FINGERPRINT win, not an account win.** The credential this module hands the
+* CLI comes from the very same local vault the provider route uses, so an
+* account that the upstream restricted (code 11140, 「账号存在异常行为」) is
+* restricted on this route too. Do not describe it as a way around a ban.
+*
+* THE INPUT PROTOCOL, which is less obvious than it looks. `stream-json` is not
+* a one-way pipe. The CLI asks the driver for permission over the SAME channel
+* (`{"type":"control_request","request":{"subtype":"can_use_tool",…}}`) and
+* waits for a reply; if stdin was closed after the prompt was written, nobody
+* answers and in `plan` mode the process waits forever. So stdin stays OPEN
+* until the turn ends, every permission request is denied, and stdin is only
+* closed once a `result` frame arrives. The denial carries `interrupt: true`
+* ONLY for `ExitPlanMode`: without it `plan` hangs even after a denial, and
+* with it a denied Bash aborts the whole turn instead of letting the CLI pick a
+* different tool. Both directions were measured. See `denyPermission`.
+*
+* Two more decisions are load-bearing and easy to undo by accident:
+*
+* 1. **The prompt travels on stdin, never on argv**, and neither does anything
+*    else user-controlled: `--model` and `--append-system-prompt` come from the
+*    plugin config, and going through `cmd.exe` would let `&` / `|` / `>` in
+*    them become command separators.
+*
+* 2. **There is no shell, and no PATH fallback.** The CLI entry is always run as
+*    `node <entry>`, so no `.cmd` shim and no `shell: true` exists anywhere in
+*    this module. If the package cannot be located, the turn is refused and the
+*    user is told to set `cliBridge.binary` — because the alternative is
+*    spawning whatever `codebuddy` happens to be first on PATH, and that process
+*    would inherit a WorkBuddy token.
+*
+* @module dsh-connect-workbuddy/cli-bridge/runner
+*/
+/** Package that owns the CLI, under a global `node_modules`. */
+const CLI_PACKAGE_PATH = join("@tencent-ai", "codebuddy-code", "bin", "codebuddy");
+/** A single NDJSON line bigger than this is a broken build, not a big answer. */
+const MAX_FRAME_BYTES = 8388608;
+/** How much assistant text is accumulated before the turn is failed. */
+const MAX_ASSISTANT_CHARS = 2e6;
+/** How long the CLI gets to exit on its own after a `result` frame. */
+const EXIT_GRACE_MS = 3e3;
+/**
+* The reason sent with every denial.
+*
+* It must NOT start with one of `SYNTHETIC_DENY_PREFIXES`: the CLI treats those
+* as a cancelled prompt rather than a decision and lets the tool proceed, which
+* would turn "deny everything" into "allow everything" while looking correct.
+*/
+const DENY_REASON = "dsh-connect-workbuddy runs this turn unattended; no human is at the terminal to approve tool use";
+/**
+* Roots a global npm install of the CLI can live under, most likely first.
+*
+* WHY THE LIST IS THIS LONG. The first draft knew only about `%APPDATA%\npm`
+* and the two `/usr/*` prefixes, so every nvm, fnm, volta, pnpm, yarn, brew,
+* `~/.local` and `/opt/homebrew` user got "CLI not found" even though it was
+* installed. The version-manager roots cannot be listed statically (they carry
+* a version or a hash in the path), so `versionedCliEntries` globs one level.
+*
+* None of these are probed through PATH, and `cbc` is not a separate target: it
+* is an alias of the same `bin/codebuddy` file inside the package.
+*/
+function cliEntryRoots() {
+	const home = homedir();
+	const roots = [];
+	const appData = process.env["APPDATA"];
+	if (typeof appData === "string" && appData !== "") roots.push(join(appData, "npm"));
+	roots.push(join(home, ".npm-global"), "/usr/local", "/opt/homebrew", join(home, ".local"));
+	roots.push(join(home, "AppData", "Roaming", "npm"));
+	roots.push(join(home, ".local", "share", "pnpm", "global", "5"), join(home, ".config", "yarn", "global"));
+	roots.push(join(home, ".volta", "tools", "image"));
+	return roots.map((root) => join(root, "lib", "node_modules"));
+}
+/** Directories whose children are node version roots (`.../versions/node/<v>`). */
+function versionedCliRoots() {
+	const home = homedir();
+	return [
+		join(home, ".nvm", "versions", "node"),
+		join(home, "n", "versions", "node"),
+		join(home, ".fnm", "node-versions"),
+		join(home, ".local", "share", "fnm", "node-versions")
+	];
+}
+/** Expand one directory's children into CLI entries, ignoring unreadable ones. */
+function childrenOf(dir, separator) {
+	const out = [];
+	try {
+		for (const child of readdirSync(dir)) out.push(join(dir, child, ...separator));
+	} catch {}
+	return out;
+}
+/** Every path a global install of the CLI could live at, most likely first. */
+function cliEntryCandidates() {
+	const out = [...cliEntryRoots().map((root) => join(root, CLI_PACKAGE_PATH))];
+	for (const versions of versionedCliRoots()) {
+		out.push(...childrenOf(versions, [
+			"lib",
+			"node_modules",
+			CLI_PACKAGE_PATH
+		]));
+		out.push(...childrenOf(join(versions), [
+			"installation",
+			"lib",
+			"node_modules",
+			CLI_PACKAGE_PATH
+		]));
+	}
+	return out;
+}
+/**
+* Locate the CLI's JS entry.
+*
+* An explicit `binary` from config wins and is taken literally — never
+* second-guessed with a fallback, because a typo answered by a different
+* working executable is a bug nobody can reproduce. A `.cmd`/`.bat` path is
+* REJECTED rather than executed, because running one means going through a
+* shell, and that is the exact injection surface this module exists to avoid.
+*/
+function resolveCliEntry(binary) {
+	if (binary !== "") {
+		if (process.platform === "win32" && /\.(?:cmd|bat)$/iu.test(binary)) return {
+			ok: false,
+			entry: "",
+			configured: true,
+			reason: `cliBridge.binary 指向了 ${binary}，那是一个批处理包装，运行它要经过 cmd.exe，会把配置里的 --model / --append-system-prompt 当成命令解释。请改成同一个包里的 JS 入口，例如 ${join(binary.replace(/\.(?:cmd|bat)$/iu, ""), "..", "node_modules", CLI_PACKAGE_PATH)}。`
+		};
+		if (!existsSync(binary)) return {
+			ok: false,
+			entry: "",
+			configured: true,
+			reason: `cliBridge.binary 指定的路径不存在：${binary}`
+		};
+		return {
+			ok: true,
+			entry: binary,
+			configured: true,
+			reason: ""
+		};
+	}
+	for (const candidate of cliEntryCandidates()) if (existsSync(candidate)) return {
+		ok: true,
+		entry: candidate,
+		configured: false,
+		reason: ""
+	};
+	return {
+		ok: false,
+		entry: "",
+		configured: false,
+		reason: "没有找到本机安装的 CodeBuddy CLI（已查过 npm/pnpm/yarn/volta 全局目录与 nvm/fnm 的版本目录）。请先安装 @tencent-ai/codebuddy-code，或在插件配置里用 cliBridge.binary 指定它的绝对路径（要指向包内的 bin/codebuddy，不要指向 .cmd 包装）。不会回退到 PATH 上的 codebuddy —— 那样会把 WorkBuddy 凭据交给一个来源不明的程序。"
+	};
+}
+/**
+* Whether a finished-but-failed run failed specifically because the credential
+* was refused.
+*
+* ONLY the CLI's own error channel is read. The first draft also scanned the
+* assistant text, which meant a review that merely QUOTED `HTTP 401` looked like
+* a rejected token: the bridge then discarded a perfectly good turn and re-ran
+* the whole thing on the next account. `text` is deliberately not a parameter
+* here so that cannot come back.
+*/
+function looksLikeAuthFailure(out) {
+	if (!out.isError) return false;
+	const channel = `${out.errors.join("\n")}\n${out.subtype ?? ""}`;
+	return /\b401\b|Authentication required|\/login command|invalid[_-]?api[_-]?key/i.test(channel);
+}
+function blocksOf(frame) {
+	const fromMessage = frame.message?.content;
+	if (Array.isArray(fromMessage)) return fromMessage;
+	const topLevel = frame.content;
+	if (Array.isArray(topLevel)) return topLevel;
+	return [];
+}
+/** Whether `pid` may be used as a process-GROUP id for `process.kill(-pid, …)`. */
+function usableGroupPid(pid) {
+	return typeof pid === "number" && Number.isInteger(pid) && pid > 1;
+}
+/** Kill a child AND everything it spawned (git, npm, a test runner). */
+function killTree(child) {
+	const pid = child.pid;
+	if (!usableGroupPid(pid)) {
+		try {
+			child.kill();
+		} catch {}
+		return;
+	}
+	if (process.platform === "win32") {
+		try {
+			spawn("taskkill", [
+				"/pid",
+				String(pid),
+				"/T",
+				"/F"
+			], {
+				windowsHide: true,
+				stdio: "ignore"
+			}).on("error", () => {});
+		} catch {}
+		try {
+			child.kill();
+		} catch {}
+		return;
+	}
+	try {
+		process.kill(-pid, "SIGTERM");
+	} catch {
+		try {
+			child.kill("SIGTERM");
+		} catch {
+			return;
+		}
+	}
+	setTimeout(() => {
+		try {
+			process.kill(-pid, "SIGKILL");
+		} catch {}
+	}, 1e3).unref();
+}
+/** Run exactly one CLI turn with exactly one token. */
+function runOneTurn(options, token) {
+	const entryChoice = resolveCliEntry(options.binary);
+	if (!entryChoice.ok) return Promise.reject(new Error(entryChoice.reason));
+	const args = [
+		entryChoice.entry,
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--verbose",
+		"--max-turns",
+		String(options.maxTurns),
+		"--permission-mode",
+		options.permissionMode
+	];
+	if (options.model !== "") args.push("--model", options.model);
+	if (options.effort !== "") args.push("--effort", options.effort);
+	if (options.appendSystemPrompt !== "") args.push("--append-system-prompt", options.appendSystemPrompt);
+	if (options.sessionId !== void 0 && options.sessionId !== "") args.push("--session-id", options.sessionId);
+	if (options.continueSession === true) args.push("--continue");
+	const env = {
+		...process.env,
+		CODEBUDDY_AUTH_TOKEN: token,
+		CODEBUDDY_CODE_DISABLE_BACKGROUND_TASKS: "1"
+	};
+	return new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, args, {
+			cwd: options.cwd,
+			env,
+			shell: false,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true,
+			detached: process.platform !== "win32"
+		});
+		let settled = false;
+		const assistantText = [];
+		let assistantChars = 0;
+		const toolCounts = /* @__PURE__ */ new Map();
+		const deniedTools = [];
+		let stderr = "";
+		let buffer = "";
+		let timer;
+		let graceTimer;
+		const redact = (text) => redactCliText(text, [token]);
+		const cleanup = () => {
+			if (timer !== void 0) clearTimeout(timer);
+			if (options.signal !== void 0) options.signal.removeEventListener("abort", onAbort);
+		};
+		const closeStdin = () => {
+			try {
+				child.stdin.end();
+			} catch {}
+		};
+		/** After a settle, give the CLI a moment to exit; then take the tree down. */
+		const scheduleReaper = () => {
+			graceTimer = setTimeout(() => {
+				killTree(child);
+			}, EXIT_GRACE_MS);
+			graceTimer.unref();
+		};
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			closeStdin();
+			killTree(child);
+			reject(error);
+		};
+		const onAbort = () => {
+			fail(/* @__PURE__ */ new Error("cancelled by the host"));
+		};
+		const settle = (frame) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			closeStdin();
+			scheduleReaper();
+			const errors = Array.isArray(frame.errors) ? frame.errors.filter((value) => typeof value === "string").map(redact) : [];
+			resolve({
+				text: redact(assistantText.join("\n").trim()),
+				toolCounts,
+				deniedTools,
+				sessionId: typeof frame.session_id === "string" ? frame.session_id : void 0,
+				usage: frame.usage,
+				numTurns: typeof frame.num_turns === "number" ? frame.num_turns : void 0,
+				isError: frame.is_error === true,
+				errors,
+				subtype: typeof frame.subtype === "string" ? frame.subtype : void 0,
+				stderr: redact(stderr)
+			});
+		};
+		/**
+		* Answer one permission request. Always a denial; see `DENY_REASON`.
+		*
+		* `interrupt` IS PER-TOOL, NOT A BLANKET FLAG. Measured against the real CLI:
+		*
+		* - `plan` asks for approval of `ExitPlanMode`. A plain denial there is
+		*   answered by waiting for yet another decision and the process never ends
+		*   (>70s, until `timeoutSecs`). `interrupt: true` ends it immediately.
+		* - Every other tool (Bash, Write, …) is fine to deny WITHOUT `interrupt`:
+		*   the CLI records the denial and tries a different tool, so the turn still
+		*   produces a normal reply. Adding `interrupt: true` there aborts the whole
+		*   turn instead — measured: `acceptEdits` + Bash denial → `is_error: true`,
+		*   empty reply, `Permission denied for tool(s): Bash`, 4.2s.
+		*
+		* So `interrupt` rides along only when the request is `ExitPlanMode`. That
+		* keeps `plan` from hanging without turning every blocked Bash into a failed
+		* turn.
+		*/
+		const denyPermission = (frame) => {
+			const toolName = typeof frame.request?.tool_name === "string" ? frame.request.tool_name : "";
+			if (toolName !== "") deniedTools.push(toolName);
+			const requestId = typeof frame.request_id === "string" ? frame.request_id : "";
+			if (requestId === "") return;
+			const mustInterrupt = toolName === "ExitPlanMode";
+			try {
+				child.stdin.write(`${JSON.stringify({
+					type: "control_response",
+					response: {
+						subtype: "success",
+						request_id: requestId,
+						response: {
+							allowed: false,
+							reason: DENY_REASON,
+							...mustInterrupt ? { interrupt: true } : {}
+						}
+					}
+				})}\n`);
+			} catch {}
+		};
+		if (options.signal !== void 0) {
+			if (options.signal.aborted) {
+				fail(/* @__PURE__ */ new Error("cancelled by the host"));
+				return;
+			}
+			options.signal.addEventListener("abort", onAbort, { once: true });
+		}
+		timer = setTimeout(() => {
+			fail(/* @__PURE__ */ new Error(`codebuddy exceeded its ${Math.round(options.timeoutMs / 1e3)}s budget`));
+		}, options.timeoutMs);
+		child.stdin.on("error", () => {});
+		child.stdin.write(`${JSON.stringify({
+			type: "user",
+			message: {
+				role: "user",
+				content: [{
+					type: "text",
+					text: options.prompt
+				}]
+			}
+		})}\n`);
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			if (settled) return;
+			buffer += chunk;
+			if (buffer.length > 8388608) {
+				fail(/* @__PURE__ */ new Error(`codebuddy emitted a single line longer than ${String(MAX_FRAME_BYTES)} bytes; the CLI build is probably broken`));
+				return;
+			}
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				const trimmed = line.trim();
+				if (trimmed === "") continue;
+				let frame;
+				try {
+					frame = JSON.parse(trimmed);
+				} catch {
+					continue;
+				}
+				if (frame.type === "control_request") {
+					denyPermission(frame);
+					continue;
+				}
+				if (frame.type === "assistant") {
+					for (const block of blocksOf(frame)) if (block.type === "text" && typeof block.text === "string") {
+						assistantChars += block.text.length;
+						if (assistantChars > 2e6) {
+							fail(/* @__PURE__ */ new Error(`codebuddy produced more than ${String(MAX_ASSISTANT_CHARS)} characters of assistant text in one turn`));
+							return;
+						}
+						assistantText.push(block.text);
+					} else if (block.type === "tool_use" && typeof block.name === "string") toolCounts.set(block.name, (toolCounts.get(block.name) ?? 0) + 1);
+				}
+				if (frame.type === "result") {
+					settle(frame);
+					return;
+				}
+			}
+		});
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+			if (stderr.length > 32768) stderr = stderr.slice(-16384);
+		});
+		child.on("error", (error) => fail(error));
+		child.on("close", (code) => {
+			if (settled) return;
+			const tail = redact(stderr.trim().split("\n").slice(-6).join("\n"));
+			fail(/* @__PURE__ */ new Error(`codebuddy exited with code ${String(code)} and emitted no result frame` + (tail !== "" ? `\n${tail}` : "")));
+		});
+	});
+}
+/**
+* Run one bridged turn, walking the credential list until a turn completes or
+* the list runs out.
+*
+* WHEN IT MOVES ON, AND WHEN IT STOPS. A wrong-region token 401s, and the only
+* way to know which region this CLI build targets is to ask it — one wasted turn
+* is cheaper than making the user choose a region they cannot know. But ONLY a
+* recognised credential failure is worth another account. The first draft also
+* continued after timeouts, crashes and ENOENT, which with ten vault accounts
+* meant a single bad call could spend 10 × 900s; those errors are identical for
+* every account, so they are raised on the first attempt.
+*/
+async function runAgent(options, credentials, log) {
+	const startedAt = Date.now();
+	let lastError;
+	for (let index = 0; index < credentials.length; index += 1) {
+		const candidate = credentials[index];
+		if (candidate === void 0) continue;
+		if (candidate.expired) log(`${candidate.source} is past its expiry; trying it anyway`);
+		const out = await runOneTurn(options, candidate.token);
+		const isLast = index === credentials.length - 1;
+		if (looksLikeAuthFailure(out) && !isLast) {
+			log(`${candidate.source} was refused (401); trying the next credential`);
+			lastError = new Error(out.errors[0] ?? "401");
+			continue;
+		}
+		return {
+			ok: !out.isError,
+			text: out.text,
+			toolCounts: out.toolCounts,
+			deniedTools: out.deniedTools,
+			sessionId: out.sessionId,
+			usage: out.usage,
+			numTurns: out.numTurns,
+			credential: candidate,
+			elapsedMs: Date.now() - startedAt,
+			error: out.isError ? out.errors.join("\n") || out.subtype || "the turn reported an error" : void 0
+		};
+	}
+	throw lastError ?? /* @__PURE__ */ new Error("no credential worked");
+}
+//#endregion
+//#region src/cli-bridge/tool.ts
+/**
+* `codebuddy_ask` — the model-side entrance to the CLI route.
+*
+* WHAT THIS ROUTE DOES AND DOES NOT ESCAPE. The provider route has to look like
+* a CodeBuddy client to get past the gateway's channel check, which is a
+* fingerprint arms race. Here the process that talks to the gateway really is
+* the CodeBuddy CLI, so there is no client to impersonate. But the credential is
+* the same local vault account, so this is a CLIENT-FINGERPRINT win only: an
+* account restricted upstream (code 11140) is restricted here too. See the
+* module comment in `./runner.ts` for the long version.
+*
+* THE PRICE, stated plainly: a bridged turn is a SEPARATE agent. It does not see
+* this session's conversation, so it re-explores the workspace from scratch. That
+* is fine for "review this module" and wrong for "continue what we were doing" —
+* which is why the tool takes a self-contained `message`.
+*
+* THE DIRECTORY RULE IS THE IMPORTANT PART OF THIS FILE. A bridged turn spawns
+* an agent that can edit files, and the directory it runs in is that agent's
+* whole world. So the directory is never taken on faith: it must exist, be a
+* directory, and resolve to somewhere this plugin is allowed to point a
+* file-editing agent at. A model that asks for `C:\Users\...\.ssh` gets a
+* refusal that says why, not a turn.
+*
+* @module dsh-connect-workbuddy/cli-bridge/tool
+*/
+/** Permission modes the CLI accepts for `--permission-mode`. */
+const PERMISSION_MODES = [
+	"default",
+	"acceptEdits",
+	"bypassPermissions",
+	"plan",
+	"dontAsk",
+	"auto"
+];
+/** Reasoning levels the CLI accepts for `--effort`. */
+const EFFORT_LEVELS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/** Hard ceiling on one turn's wall clock, in seconds. */
+const TIMEOUT_SECS_CAP = 1800;
+/** Hard ceiling on the reply length, in characters. */
+const MAX_REPLY_CHARS_CAP = 4e5;
+/** Every field defaulted, so the Host's closed schema always validates. */
+function result(partial) {
+	return {
+		ok: partial.ok === true,
+		reply: partial.reply ?? "",
+		session_id: partial.session_id ?? "",
+		tools: partial.tools ?? [],
+		denied_tools: partial.denied_tools ?? [],
+		tool_calls: partial.tool_calls ?? 0,
+		num_turns: partial.num_turns ?? 0,
+		tokens_in: partial.tokens_in ?? 0,
+		tokens_out: partial.tokens_out ?? 0,
+		cache_read_tokens: partial.cache_read_tokens ?? 0,
+		credential_region: partial.credential_region ?? "",
+		working_dir: partial.working_dir ?? "",
+		unattended: partial.unattended === true,
+		elapsed_ms: partial.elapsed_ms ?? 0,
+		truncated: partial.truncated === true,
+		error: partial.error ?? ""
+	};
+}
+/** Clamp an optional numeric argument to a config default and a hard ceiling. */
+function clampInt$1(value, fallback, cap) {
+	return Math.max(1, Math.min(cap, typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback));
+}
+/** The throwaway directory used when the caller explicitly allows no workspace. */
+function scratchDir() {
+	const dir = join(tmpdir(), "dsh-codebuddy-scratch");
+	mkdirSync(dir, { recursive: true });
+	return dir;
+}
+/** Case-fold a path on the platforms whose filesystems ignore case. */
+function foldCase(path) {
+	return process.platform === "win32" || process.platform === "darwin" ? path.toLowerCase() : path;
+}
+/** Resolve symlinks when we can; fall back to the lexical path when we cannot. */
+function canonical(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/** True when `child` is `parent` itself or lives underneath it. */
+function isInside(parent, child) {
+	const outer = foldCase(canonical(parent));
+	const inner = foldCase(canonical(child));
+	if (inner === outer) return true;
+	return inner.startsWith(outer.endsWith(sep) ? outer : outer + sep);
+}
+/** The session directory this tool call came from, when the Host supplies one. */
+function sessionDirOf(execution) {
+	const cwd = execution?.agent?.session?.header?.cwd;
+	if (typeof cwd !== "string") return "";
+	const trimmed = cwd.trim();
+	return trimmed !== "" && isAbsolute(trimmed) ? trimmed : "";
+}
+/**
+* Decide the directory one turn runs in.
+*
+* THE ORDER IS A LADDER, and the last rung is a refusal rather than a guess.
+* Explicit argument → the calling agent's session cwd → the configured default →
+* an explicitly allowed scratch dir → refuse.
+*
+* THE LADDER IS NOT THE SAFETY PROPERTY; the check after it is. Whatever rung
+* wins, the directory must (a) already exist, (b) be a directory, and (c) resolve
+* inside an allowed root — the session it was called from, the configured
+* default, or one of `allowedDirs`. That third clause is what stops a model from
+* asking for `/` or `~/.ssh`: those exist and are directories, so existence
+* alone would happily accept them.
+*
+* A scratch turn is exempt by construction: it is a fresh empty temp directory
+* the bridge just created, so there is nothing in it to leak.
+*/
+function resolveWorkingDir(args, options, execution) {
+	const sessionDir = sessionDirOf(execution);
+	const explicit = typeof args["working_dir"] === "string" ? args["working_dir"].trim() : "";
+	let chosen = "";
+	let fromArgument = false;
+	if (explicit !== "") {
+		if (!isAbsolute(explicit)) return {
+			ok: false,
+			dir: "",
+			unattended: false,
+			reason: `working_dir "${explicit}" 不是绝对路径。请传一个绝对路径（宿主的工具调用不携带会话 cwd）。`
+		};
+		chosen = explicit;
+		fromArgument = true;
+	} else if (sessionDir !== "") chosen = sessionDir;
+	else if (options.workingDir !== "") chosen = options.workingDir;
+	else if (args["allow_unattended"] === true || options.allowUnattended) return {
+		ok: true,
+		dir: scratchDir(),
+		unattended: true,
+		reason: ""
+	};
+	else return {
+		ok: false,
+		dir: "",
+		unattended: false,
+		reason: "no working directory。宿主目前不把会话 cwd 传给插件工具，所以这个值必须由调用方给：① 传 working_dir 指定一个已存在的绝对路径目录；② 在插件配置里设 cliBridge.workingDir；③ 若本回合只是通用问答、不需要任何目录，传 allow_unattended: true（会在一个临时目录里跑，该目录是它的读写边界，不碰你的 home 或会话工作区）。"
+	};
+	if (!existsSync(chosen)) return {
+		ok: false,
+		dir: "",
+		unattended: false,
+		reason: `working_dir "${chosen}" 不存在。`
+	};
+	let isDir = false;
+	try {
+		isDir = statSync(chosen).isDirectory();
+	} catch (error) {
+		return {
+			ok: false,
+			dir: "",
+			unattended: false,
+			reason: `working_dir "${chosen}" 无法读取：${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (!isDir) return {
+		ok: false,
+		dir: "",
+		unattended: false,
+		reason: `working_dir "${chosen}" 不是一个目录。`
+	};
+	const roots = [];
+	if (sessionDir !== "") roots.push(sessionDir);
+	if (options.workingDir !== "") roots.push(options.workingDir);
+	roots.push(...options.allowedDirs);
+	if (!roots.some((root) => root !== "" && isInside(root, chosen))) {
+		const listed = roots.filter((root) => root !== "");
+		return {
+			ok: false,
+			dir: "",
+			unattended: false,
+			reason: `working_dir "${chosen}" 不在本回合允许的范围内。` + (fromArgument ? "工具不能把可写文件的 agent 指向任意目录——请从下面这些根里选一个（或子目录），要放开别的目录得在插件配置 cliBridge.allowedDirs 里显式列出。" : "") + (listed.length > 0 ? `允许的根：${listed.join(" / ")}。` : "当前没有任何允许的根：本会话没有 cwd，配置里也没有 cliBridge.workingDir 或 cliBridge.allowedDirs。")
+		};
+	}
+	return {
+		ok: true,
+		dir: canonical(chosen),
+		unattended: false,
+		reason: ""
+	};
+}
+/** The closed output schema the Host validates every result against. */
+const OUTPUT_SCHEMA = {
+	type: "object",
+	properties: {
+		ok: {
+			type: "boolean",
+			description: "本回合是否正常完成"
+		},
+		reply: {
+			type: "string",
+			description: "CodeBuddy 的最终回复文本"
+		},
+		session_id: {
+			type: "string",
+			description: "本回合的 CLI 会话 id；空字符串表示未报"
+		},
+		tools: {
+			type: "array",
+			description: `本回合用过的工具及次数，最多 ${String(12)} 条（超出见 tool_calls，它是真实总数）`,
+			items: {
+				type: "object",
+				properties: {
+					name: { type: "string" },
+					count: { type: "number" }
+				},
+				required: ["name", "count"],
+				additionalProperties: false
+			}
+		},
+		denied_tools: {
+			type: "array",
+			description: "本回合 CLI 请求过、但被本插件拒绝的工具。非空说明它想动手但没被允许",
+			items: { type: "string" }
+		},
+		tool_calls: {
+			type: "number",
+			description: "本回合工具调用总次数（tools 数组可能被截断，这个数是真实的）"
+		},
+		num_turns: {
+			type: "number",
+			description: "CLI 自报的 agent 轮数"
+		},
+		tokens_in: {
+			type: "number",
+			description: "本回合输入 token 数（含缓存命中部分）"
+		},
+		tokens_out: {
+			type: "number",
+			description: "本回合输出 token 数"
+		},
+		cache_read_tokens: {
+			type: "number",
+			description: "输入里命中提示缓存的部分。它通常占 tokens_in 的绝大部分——名义输入看着很大，新增计费其实很小"
+		},
+		credential_region: {
+			type: "string",
+			description: "本次实际用的凭据区域（cn / global / env）"
+		},
+		working_dir: {
+			type: "string",
+			description: "本回合实际使用的工作目录（它的读写边界）；空字符串表示本回合在拒绝前就结束了"
+		},
+		unattended: {
+			type: "boolean",
+			description: "本回合是否因为调用方传了 allow_unattended 而在临时目录里跑（工具可能在那里写文件）"
+		},
+		elapsed_ms: {
+			type: "number",
+			description: "本回合墙钟毫秒数"
+		},
+		truncated: {
+			type: "boolean",
+			description: "reply 超过上限被截断（截断处有标记）；长内容应让它落盘再读"
+		},
+		error: {
+			type: "string",
+			description: "失败原因；空字符串表示没有错误"
+		}
+	},
+	required: [
+		"ok",
+		"reply",
+		"session_id",
+		"tools",
+		"denied_tools",
+		"tool_calls",
+		"num_turns",
+		"tokens_in",
+		"tokens_out",
+		"cache_read_tokens",
+		"credential_region",
+		"working_dir",
+		"unattended",
+		"elapsed_ms",
+		"truncated",
+		"error"
+	],
+	additionalProperties: false
+};
+/** The gate this call must pass, built once per normalized option set. */
+function gateFor(options) {
+	return new TurnGate({
+		perSessionPerHour: options.maxTurnsPerSessionHour,
+		globalPerHour: options.maxTurnsPerHour,
+		allowConcurrentPerSession: false
+	});
+}
+/** The session key a call is charged to, from whichever handle it arrived on. */
+function sessionKeyOf(execution, fallback) {
+	const id = execution?.agent?.id;
+	return typeof id === "string" && id !== "" ? id : fallback;
+}
+/**
+* Run one bridged turn and return the complete result object.
+*
+* Exported because the `/codebuddy` slash command needs the same turn with the
+* same validation — a command that re-implemented this would drift from the tool
+* the first time either side gained a knob.
+*/
+async function runAsk(args, execution, deps) {
+	const startedAt = Date.now();
+	const { options, regions, log } = deps;
+	const mode = typeof args["permission_mode"] === "string" ? args["permission_mode"].trim() : "";
+	if (mode !== "" && !PERMISSION_MODES.includes(mode)) return result({
+		ok: false,
+		error: `permission_mode "${mode}" 不是合法值；合法值：${PERMISSION_MODES.join(", ")}`
+	});
+	const effort = typeof args["effort"] === "string" ? args["effort"].trim() : "";
+	if (effort !== "" && !EFFORT_LEVELS.includes(effort)) return result({
+		ok: false,
+		error: `effort "${effort}" 不是合法值；合法值：${EFFORT_LEVELS.join(", ")}`
+	});
+	const message = typeof args["message"] === "string" ? args["message"] : "";
+	if (message.trim() === "") return result({
+		ok: false,
+		error: "message 不能为空：要说清楚这一轮让 CodeBuddy 做什么。"
+	});
+	const dir = resolveWorkingDir(args, options, execution);
+	if (!dir.ok) return result({
+		ok: false,
+		error: dir.reason
+	});
+	const entry = (deps.gate ?? gateFor(options)).tryEnter(sessionKeyOf(execution, "codebuddy_ask"), (message) => log(message));
+	if (!entry.ok) return result({
+		ok: false,
+		error: entry.error
+	});
+	try {
+		let credentials;
+		try {
+			credentials = await resolveCredentials(regions, options.regionOrder, log);
+		} catch (error) {
+			return result({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+		const modelArg = typeof args["model"] === "string" ? args["model"].trim() : "";
+		const sessionIdArg = typeof args["session_id"] === "string" ? args["session_id"].trim() : "";
+		const signal = execution?.signal;
+		const outcome = await runAgent({
+			prompt: message,
+			cwd: dir.dir,
+			binary: options.binary,
+			model: modelArg !== "" ? modelArg : options.model,
+			permissionMode: mode !== "" ? mode : options.permissionMode,
+			effort: effort !== "" ? effort : options.effort,
+			appendSystemPrompt: options.appendSystemPrompt,
+			maxTurns: clampInt$1(args["max_turns"], options.maxTurns, 100),
+			timeoutMs: clampInt$1(args["timeout_secs"], options.timeoutSecs, TIMEOUT_SECS_CAP) * 1e3,
+			...sessionIdArg !== "" ? { sessionId: sessionIdArg } : {},
+			...signal !== void 0 ? { signal } : {}
+		}, credentials, log);
+		let reply = outcome.text;
+		let truncated = false;
+		if (reply.length > options.maxReplyChars) {
+			const omitted = reply.length - options.maxReplyChars;
+			reply = `${reply.slice(0, options.maxReplyChars)}\n\n[truncated by dsh-connect-workbuddy: ${String(omitted)} more characters. Have CodeBuddy write the full text to a file and read it back.]`;
+			truncated = true;
+		}
+		const tools = [...outcome.toolCounts.entries()].slice(0, 12).map(([name, count]) => ({
+			name,
+			count
+		}));
+		return result({
+			ok: outcome.ok,
+			reply,
+			session_id: outcome.sessionId ?? "",
+			tools,
+			denied_tools: [...outcome.deniedTools],
+			tool_calls: [...outcome.toolCounts.values()].reduce((sum, count) => sum + count, 0),
+			num_turns: outcome.numTurns ?? 0,
+			tokens_in: outcome.usage?.input_tokens ?? 0,
+			tokens_out: outcome.usage?.output_tokens ?? 0,
+			cache_read_tokens: outcome.usage?.cache_read_input_tokens ?? 0,
+			credential_region: outcome.credential.region,
+			working_dir: dir.dir,
+			unattended: dir.unattended,
+			elapsed_ms: Date.now() - startedAt,
+			truncated,
+			error: outcome.error ?? ""
+		});
+	} catch (error) {
+		return result({
+			ok: false,
+			error: error instanceof Error ? error.message : String(error),
+			elapsed_ms: Date.now() - startedAt
+		});
+	} finally {
+		entry.release();
+	}
+}
+/**
+* Register `codebuddy_ask`, returning the disposer.
+*
+* `tools` is passed in rather than looked up so a Host without the service
+* degrades to "no tool" instead of failing the mount.
+*/
+function mountAskTool(tools, deps) {
+	if (tools === void 0 || typeof tools.register !== "function") return () => {};
+	try {
+		return tools.register({
+			name: "codebuddy_ask",
+			description: `把一个独立的任务交给本机的 CodeBuddy CLI 跑一轮完整 agent（它自己读文件、改文件、跑命令），返回它的结论。适合"独立审一块代码 / 跑一轮调查 / 让另一个 agent 复核"，不适合"接着我们刚才的思路改"——它看不到本会话的对话，会重新探索工作区。每次调用都会真实消耗一份 CodeBuddy 账号额度（一轮通常几万输入 token，多数命中缓存）；本会话每小时上限 ${String(deps.options.maxTurnsPerSessionHour === 0 ? "不限" : deps.options.maxTurnsPerSessionHour)} 次、全场每小时上限 ${String(deps.options.maxTurnsPerHour === 0 ? "不限" : deps.options.maxTurnsPerHour)} 次，超了会被具名拒绝。默认只能在本会话的工作区（或在配置里显式列出的目录）里跑；要指定别处的目录得先把它加进 cliBridge.allowedDirs。`,
+			timeoutMs: (deps.options.timeoutSecs + 30) * 1e3,
+			parameters: {
+				type: "object",
+				properties: {
+					message: {
+						type: "string",
+						description: "交给 CodeBuddy 的完整任务描述。它看不到本会话，所以要自包含：目标、范围、验收标准。"
+					},
+					working_dir: {
+						type: "string",
+						description: "本回合的工作目录（它的读写边界），必须是已存在的绝对路径，且落在本会话工作区或配置的 allowedDirs 之内。不传则用本会话的工作区。"
+					},
+					model: {
+						type: "string",
+						description: `可选：本回合模型 id，默认取插件配置（当前 ${deps.options.model === "" ? "CLI 自己的设置" : deps.options.model}）。`
+					},
+					permission_mode: {
+						type: "string",
+						description: "可选：本回合权限模式。默认取插件配置（dontAsk = 只读工具放行、写工具被拒，且不会卡住等审批）；plan = 只读，纯审查可用（注意 plan 在 -p 下会请求 ExitPlanMode 审批，被拒才结束）；acceptEdits = 允许改文件；bypassPermissions = 全部放行。default / auto 也接受。传其它值会被拒绝并列出合法值。"
+					},
+					effort: {
+						type: "string",
+						description: `可选：本回合推理力度。合法值：${EFFORT_LEVELS.join(", ")}。不传取插件配置。`
+					},
+					max_turns: {
+						type: "number",
+						description: `可选：本回合 agent 轮数上限，默认取插件配置（当前 ${String(deps.options.maxTurns)}），上限 ${String(100)}。用尽会标记为截断，不当作成功。`
+					},
+					timeout_secs: {
+						type: "number",
+						description: `可选：本回合墙钟超时秒数，默认取插件配置（当前 ${String(deps.options.timeoutSecs)}），上限 ${String(TIMEOUT_SECS_CAP)}；超时会被杀掉并报错。`
+					},
+					session_id: {
+						type: "string",
+						description: "可选：指定 CLI 会话 id，让后续调用接着同一个会话。不传则每次开新会话。"
+					},
+					allow_unattended: {
+						type: "boolean",
+						description: "可选：本回合不需要任何目录时设为 true，会在一个临时目录里跑（该目录是它的读写边界）。默认 false：一个能改文件的 agent 不该被指向没人选过的目录。"
+					}
+				},
+				required: ["message"]
+			},
+			output: {
+				schema: OUTPUT_SCHEMA,
+				render(_args, value) {
+					const typed = value;
+					if (!typed.ok) return [{
+						type: "text",
+						text: `CodeBuddy 调用失败: ${typed.error === "" ? "(未给出原因)" : typed.error}`
+					}];
+					const lines = [
+						"CodeBuddy 回复:",
+						typed.reply === "" ? "(空回复)" : typed.reply,
+						""
+					];
+					if (typed.truncated) lines.push("[注意：reply 已截断。让 CodeBuddy 把完整内容写到文件里再读，别只靠这一份摘要]", "");
+					if (typed.denied_tools.length > 0) lines.push(`[注意：本回合 CodeBuddy 请求过这些工具但被拒绝：${typed.denied_tools.join(", ")}。如果任务本来就要求它们动手，说明默认权限模式（dontAsk）挡住了——明确传 permission_mode 再试]`, "");
+					if (typed.unattended) lines.push(`[注意：本回合未指定 working_dir，按调用方的 allow_unattended 在临时目录里执行（${typed.working_dir}）。它读不到你的仓库；要针对某个仓库请显式传 working_dir]`, "");
+					const toolList = typed.tools.length > 0 ? typed.tools.map((tool) => tool.count > 1 ? `${tool.name}×${String(tool.count)}` : tool.name).join(", ") : "无";
+					lines.push(`[session_id=${typed.session_id === "" ? "?" : typed.session_id} turns=${String(typed.num_turns)} tool_calls=${String(typed.tool_calls)} tools=${toolList} tokens=${String(typed.tokens_in)}in/${String(typed.tokens_out)}out (cache_read=${String(typed.cache_read_tokens)}) elapsed_ms=${String(typed.elapsed_ms)} cred=${typed.credential_region}` + (typed.working_dir !== "" ? ` dir=${typed.working_dir}` : "") + "]");
+					return [{
+						type: "text",
+						text: lines.join("\n")
+					}];
+				}
+			},
+			async execute(args, execution) {
+				return runAsk(typeof args === "object" && args !== null ? args : {}, execution, deps);
+			}
+		});
+	} catch (error) {
+		deps.log(`tool registration failed: ${error instanceof Error ? error.message : String(error)}`);
+		return () => {};
+	}
+}
+//#endregion
+//#region src/cli-bridge/command.ts
+/**
+* `/codebuddy` — one CodeBuddy turn started from the composer.
+*
+* WHY A COMMAND AND NOT JUST THE TOOL. `codebuddy_ask` only runs when the model
+* decides to call it, which costs a DSH turn and a decision. A slash command is
+* the one host channel that executes against the receiving agent WITHOUT sending
+* the line to the model, so the WORK costs no DSH turns.
+*
+* THE ONE THING IT DOES SPEND BY DEFAULT. On success the result is handed back to
+* the session's model so the conversation knows what happened, and that wake-up
+* is a real DSH turn with real tokens. The first draft's description claimed the
+* command "does not consume DSH quota", which is false under the default
+* `injectResult: true`; the description now says so. With `injectResult: false`
+* the promise holds: nothing but the human sees the result.
+*
+* WHAT AN EMPTY LINE MEANS. `/codebuddy` alone is a review: the built-in brief
+* asks CodeBuddy to read the uncommitted changes and report problems. Anything
+* the human types is sent verbatim instead.
+*
+* @module dsh-connect-workbuddy/cli-bridge/command
+*/
+/** The command name as registered (no leading slash). */
+const COMMAND_NAME = "codebuddy";
+/**
+* The mode a review runs in.
+*
+* NOT `plan`. `plan` under `-p` answers a write attempt by asking the driver to
+* approve an `ExitPlanMode` hand-off, and the only answer an unattended bridge
+* can give is a denial — so a "review" in plan mode tends to end as a failed
+* turn with no findings, which is the least useful possible outcome. `dontAsk`
+* gets the read half (Read/Glob/Grep/Bash) auto-approved and refuses the write
+* half, which is exactly what a review needs. Measured both ways; see the module
+* comment in `./runner.ts`.
+*/
+const REVIEW_PERMISSION_MODE = "dontAsk";
+/**
+* The brief an empty `/codebuddy` line expands to.
+*
+* It names the scope AND the failure mode it wants avoided ("只报你确实看见的
+* 问题"): a review that guesses is worse than one that says less, because the
+* human cannot tell the two apart in the output.
+*/
+const REVIEW_BRIEF = "评审当前工作区里未提交的改动（git 未提交改动；没有未提交改动时看最近一次提交）。自己运行 git 命令确认范围，必要时读相关文件理解上下文，然后给出评审结论：哪些地方有问题、为什么、怎么改。只报你确实看见的问题，不要猜。";
+/**
+* What the composer line becomes.
+*
+* Empty → the review brief. Non-empty → the text verbatim, because a human who
+* typed something meant it, and silently prepending a review brief to "改一下
+* 这个 bug" is how a command does something other than what it was asked.
+*/
+function composeCommandPrompt(raw) {
+	const note = raw.trim();
+	return note === "" ? REVIEW_BRIEF : note;
+}
+/** A one-line label saying how the human's words were used. */
+function commandScopeLabel(raw) {
+	const note = raw.trim();
+	return note === "" ? "（未提交改动）" : `（指令：${note}）`;
+}
+/** Whether this invocation is the built-in review (empty line). */
+function isReviewInvocation(raw) {
+	return raw.trim() === "";
+}
+/** The permission mode this invocation runs in. */
+function permissionModeForInvocation(raw) {
+	return isReviewInvocation(raw) ? REVIEW_PERMISSION_MODE : "";
+}
+/**
+* Render one turn outcome as the plain text a command result carries.
+*
+* The footer is the same shape the tool renders, because a human reading a
+* command result wants the same facts: which session, how many turns, what it
+* cost, and where it ran. The one thing added here is the working directory —
+* a command result is the only place the human learns WHICH tree was reviewed.
+*
+* `injection` is the delivery outcome of handing the result to the session's
+* model. It is rendered on its own line because "the command ran" and "the model
+* was told" are different facts and the human is entitled to both; omitting it
+* means no delivery was attempted (failed turn, or disabled).
+*/
+function formatCommandOutcome(value, extra = {}) {
+	const scope = commandScopeLabel(extra.raw ?? "");
+	if (!value.ok) return `CodeBuddy 失败${scope}：${value.error === "" ? "未知错误" : value.error}`;
+	const body = value.reply.trim();
+	const head = body === "" ? `CodeBuddy 完成${scope}：没有输出任何结论。` : `CodeBuddy 完成${scope}：\n\n${body}`;
+	const toolList = value.tools.length > 0 ? value.tools.map((tool) => tool.count > 1 ? `${tool.name}×${String(tool.count)}` : tool.name).join(", ") : "无";
+	const denied = value.denied_tools.length > 0 ? `\n\n[注意：CodeBuddy 请求过这些工具但被拒绝：${value.denied_tools.join(", ")}。评审类任务读到这些就该够了；要它真动手请写明要求并显式指定权限模式]` : "";
+	const footer = `\n\n[session_id=${value.session_id === "" ? "?" : value.session_id} turns=${String(value.num_turns)} tool_calls=${String(value.tool_calls)} tools=${toolList} tokens=${String(value.tokens_in)}in/${String(value.tokens_out)}out (cache_read=${String(value.cache_read_tokens)}) elapsed_ms=${String(value.elapsed_ms)} cred=${value.credential_region}` + (value.working_dir !== "" ? ` dir=${value.working_dir}` : "") + "]";
+	const truncated = value.truncated ? "\n\n[注意：输出已截断。让 CodeBuddy 把完整内容写到文件里再读，别只靠这一份摘要]" : "";
+	const delivery = extra.injection === void 0 ? "" : `\n\n${formatInjection(extra.injection)}`;
+	return head + denied + footer + truncated + delivery;
+}
+/**
+* Register `/codebuddy`, returning the disposer.
+*
+* `commands` is passed in rather than looked up so a Host without the service
+* degrades to "no command" instead of failing the mount — the command is an
+* addition, not a load-bearing part of the plugin.
+*
+* CONCURRENCY IS NOT TRACKED HERE ANY MORE. The first draft kept its own
+* `inFlight` set, which covered `/codebuddy` calls against each other and nothing
+* else: a tool call and a command could run two agents in the same workspace at
+* once, and neither counted against any budget. Both entrances now go through
+* `runAsk`, so the shared `TurnGate` in `./gate.ts` is the single place that
+* decides "one at a time per session" and "N per hour".
+*/
+function mountCodebuddyCommand(commands, deps) {
+	if (commands === void 0 || typeof commands.register !== "function") return () => {};
+	const { options, log } = deps;
+	try {
+		return commands.register({
+			name: COMMAND_NAME,
+			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
+			input: { hint: "可留空：直接评审当前工作区未提交的改动；或写你的要求（如\"修一下这个空指针\"）" },
+			handler: async (invocation) => {
+				const cwd = invocation.agent?.session?.header?.cwd;
+				if (typeof cwd !== "string" || cwd.trim() === "") return {
+					kind: "error",
+					text: "这个会话没有工作区路径（session.header.cwd 为空），无法确定 CodeBuddy 该在哪里跑。请在一个打开过目录的会话里再试。"
+				};
+				const raw = typeof invocation.rawInput === "string" ? invocation.rawInput : "";
+				const message = composeCommandPrompt(raw);
+				const review = isReviewInvocation(raw);
+				const startedAt = Date.now();
+				try {
+					const value = await runAsk({
+						message,
+						working_dir: cwd,
+						...review ? { permission_mode: permissionModeForInvocation(raw) } : {}
+					}, {
+						...invocation.agent !== void 0 ? { agent: invocation.agent } : {},
+						...invocation.signal !== void 0 ? { signal: invocation.signal } : {}
+					}, deps);
+					log(`command /${COMMAND_NAME} finished in ${String(Date.now() - startedAt)}ms (ok=${String(value.ok)})`);
+					const injection = value.ok && options.injectResult ? injectOutcome(invocation.agent, {
+						reply: value.reply,
+						dir: cwd,
+						scope: commandScopeLabel(raw),
+						toolCalls: value.tool_calls,
+						tools: value.tools
+					}) : void 0;
+					return {
+						kind: value.ok ? "success" : "error",
+						text: formatCommandOutcome(value, {
+							raw,
+							...injection !== void 0 ? { injection } : {}
+						})
+					};
+				} catch (error) {
+					const text = error instanceof Error ? error.message : String(error);
+					log(`command /${COMMAND_NAME} threw: ${text}`);
+					return {
+						kind: "error",
+						text: `CodeBuddy 异常终止：${text}`
+					};
+				}
+			}
+		});
+	} catch (error) {
+		log(`command registration failed: ${error instanceof Error ? error.message : String(error)}`);
+		return () => {};
+	}
+}
+//#endregion
+//#region src/cli-bridge/mount.ts
+/**
+* Wiring the CLI route into the plugin, and normalizing its settings.
+*
+* THE ROUTE IS OPT-IN AND NON-BREAKING. It is `enabled: false` by default, and
+* its two host surfaces are mounted reactively by the caller (`ctx.inject`), not
+* sampled once at apply time. That combination is deliberate: this plugin is
+* installed by people whose only interest is the provider, and a new hard
+* dependency would either fail their mount or silently remove their models.
+*
+* THE MOUNT IS TWO INDEPENDENT SURFACES ON PURPOSE. `codebuddy_ask` and
+* `/codebuddy` come from two different host services that become available at
+* different moments (and can come and go). So the settings are normalized ONCE
+* into a `CliBridgeRuntime` — options plus the shared turn gate — and each
+* surface mounts and disposes on its own. That is why the mid-sized fact "the
+* tool and the command share one budget" survives a re-mount: the gate lives on
+* the runtime, not on either surface.
+*
+* WHY THE ROUTE EXISTS AT ALL, stated honestly. The provider route has to look
+* like a CodeBuddy client to get past the gateway's channel check, and that is an
+* arms race the upstream fights with zero-width-space perturbation (see
+* `perturbChannelFingerprints`). This route does not impersonate anything — but
+* it uses the SAME vault account, so it is a client-fingerprint win, NOT a way
+* around an account restriction (code 11140). The first draft's README claimed
+* otherwise; do not let that claim come back.
+*
+* @module dsh-connect-workbuddy/cli-bridge/mount
+*/
+/**
+* Defaults, mirroring the schema so a missing key behaves the same either way.
+*
+* `permissionMode` is `dontAsk`, NOT `acceptEdits` and not `plan`. Measured
+* against the real CLI under `-p`: `acceptEdits` lets the agent edit files in a
+* directory a model chose; `plan` asks the driver to approve an `ExitPlanMode`
+* hand-off and a bridge can only deny it, so the turn dies without findings;
+* `dontAsk` auto-approves the read half and refuses the write half without ever
+* waiting for a human. That is the only one of the three that is both safe and
+* useful when nobody is watching.
+*/
+const CLI_BRIDGE_DEFAULTS = {
+	enabled: false,
+	binary: "",
+	model: "",
+	permissionMode: "dontAsk",
+	effort: "",
+	maxTurns: 10,
+	timeoutSecs: 900,
+	regionOrder: "cn,global",
+	workingDir: "",
+	allowedDirs: "",
+	appendSystemPrompt: "",
+	allowUnattended: false,
+	maxReplyChars: 6e4,
+	injectResult: true,
+	maxTurnsPerSessionHour: 6,
+	maxTurnsPerHour: 20
+};
+/** Clamp an optional number to a default and a hard ceiling. */
+function clampInt(value, fallback, cap) {
+	return Math.max(1, Math.min(cap, typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback));
+}
+/** Read a non-negative integer setting where 0 legitimately means "unbounded". */
+function clampQuota(value, fallback) {
+	if (value === 0) return 0;
+	return Math.max(0, typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback);
+}
+/** Read a string setting, trimmed, falling back when it is not a string. */
+function text(value, fallback) {
+	return typeof value === "string" ? value.trim() : fallback;
+}
+/** Split a comma-separated list, dropping empties. */
+function list(value) {
+	return value.split(",").map((part) => part.trim()).filter((part) => part !== "");
+}
+/**
+* Turn raw settings into the normalized options one turn runs on.
+*
+* An out-of-range enum is REPORTED and then replaced by the default rather than
+* rejected: a typo in `permissionMode` should not take the whole plugin down, but
+* it must not silently run under a permission level the user did not pick
+* either. `onRejected` is how the caller turns that into a log line.
+*/
+function normalizeCliBridgeOptions(settings, onRejected) {
+	const raw = settings ?? {};
+	const reject = onRejected ?? (() => {});
+	const permissionMode = text(raw.permissionMode, CLI_BRIDGE_DEFAULTS.permissionMode);
+	const safePermissionMode = PERMISSION_MODES.includes(permissionMode) ? permissionMode : CLI_BRIDGE_DEFAULTS.permissionMode;
+	if (safePermissionMode !== permissionMode) reject(`permissionMode "${permissionMode}" 不是合法值，已回退到 ${safePermissionMode}；合法值：${PERMISSION_MODES.join(", ")}`);
+	const effort = text(raw.effort, CLI_BRIDGE_DEFAULTS.effort);
+	const safeEffort = effort === "" || EFFORT_LEVELS.includes(effort) ? effort : "";
+	if (safeEffort !== effort) reject(`effort "${effort}" 不是合法值，已回退到 CLI 默认；合法值：${EFFORT_LEVELS.join(", ")}`);
+	const regionOrder = text(raw.regionOrder, CLI_BRIDGE_DEFAULTS.regionOrder);
+	return {
+		enabled: raw.enabled === true,
+		binary: text(raw.binary, CLI_BRIDGE_DEFAULTS.binary),
+		model: text(raw.model, CLI_BRIDGE_DEFAULTS.model),
+		permissionMode: safePermissionMode,
+		effort: safeEffort,
+		maxTurns: clampInt(raw.maxTurns, CLI_BRIDGE_DEFAULTS.maxTurns, 100),
+		timeoutSecs: clampInt(raw.timeoutSecs, CLI_BRIDGE_DEFAULTS.timeoutSecs, TIMEOUT_SECS_CAP),
+		regionOrder: list(regionOrder),
+		workingDir: text(raw.workingDir, CLI_BRIDGE_DEFAULTS.workingDir),
+		allowedDirs: list(text(raw.allowedDirs, CLI_BRIDGE_DEFAULTS.allowedDirs)),
+		appendSystemPrompt: text(raw.appendSystemPrompt, CLI_BRIDGE_DEFAULTS.appendSystemPrompt),
+		allowUnattended: raw.allowUnattended === true,
+		maxReplyChars: clampInt(raw.maxReplyChars, CLI_BRIDGE_DEFAULTS.maxReplyChars, MAX_REPLY_CHARS_CAP),
+		injectResult: raw.injectResult !== false,
+		maxTurnsPerSessionHour: clampQuota(raw.maxTurnsPerSessionHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerSessionHour),
+		maxTurnsPerHour: clampQuota(raw.maxTurnsPerHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerHour)
+	};
+}
+/**
+* Build the runtime, or `undefined` when the route is disabled.
+*
+* Returning `undefined` rather than an enabled flag keeps every caller honest:
+* there is no "mounted but disabled" state to accidentally treat as live.
+*/
+function createCliBridgeRuntime(settings, regions, log) {
+	const options = normalizeCliBridgeOptions(settings, (message) => log(message));
+	if (!options.enabled) return void 0;
+	return {
+		options,
+		deps: {
+			options,
+			regions,
+			log,
+			gate: gateFor(options)
+		}
+	};
+}
+/** Mount `codebuddy_ask` on a tools service, returning its disposer. */
+function mountToolSurface(runtime, tools) {
+	return mountAskTool(tools, runtime.deps);
+}
+/** Mount `/codebuddy` on a commands service, returning its disposer. */
+function mountCommandSurface(runtime, commands) {
+	return mountCodebuddyCommand(commands, runtime.deps);
+}
+//#endregion
 //#region src/probe.ts
 /**
 * How long to bench a MODEL that answered 14003 with no stated time.
@@ -5958,6 +7650,19 @@ function safeMessage(error) {
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+* Merge a `cliBridge` patch into the committed settings object.
+*
+* ONE level on purpose: every field in that block is a scalar (a boolean, a cap,
+* a path), so the only thing a deeper merge could produce is a half-written entry.
+* Sibling keys survive — flipping the switch must not drop the user's tuned caps.
+*/
+function nextCliBridgeSettings(current, patch) {
+	const base = isPlainRecord(current) ? { ...current } : {};
+	if (!isPlainRecord(patch)) return base;
+	for (const [key, value] of Object.entries(patch)) base[key] = value;
+	return base;
+}
 function json(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
@@ -6193,6 +7898,7 @@ async function workBuddyWebStatus(deps, region, options = {}) {
 	const showCreditsInMainUi = deps.showCreditsInMainUi?.(region) ?? true;
 	const creditPosition = deps.creditPosition?.(region) ?? "composer";
 	const imageToolEnabled = deps.imageToolEnabled?.(region) ?? false;
+	const cliBridgeEnabled = deps.cliBridgeEnabled?.() === true;
 	const authStatus = await store.status();
 	const selectionExplicit = store.hasExplicitSelection();
 	if (authStatus.state !== "signed-out" && accounts.length === 0) return {
@@ -6201,7 +7907,8 @@ async function workBuddyWebStatus(deps, region, options = {}) {
 		selectionExplicit,
 		enabled,
 		showCreditsInMainUi,
-		imageToolEnabled
+		imageToolEnabled,
+		cliBridgeEnabled
 	};
 	let credential;
 	try {
@@ -6218,6 +7925,7 @@ async function workBuddyWebStatus(deps, region, options = {}) {
 			showCreditsInMainUi,
 			creditPosition,
 			imageToolEnabled,
+			cliBridgeEnabled,
 			...await store.selectionLost() ? { selectionLost: true } : {},
 			...webAccounts.length === 0 ? await searchedPaths(store) : {}
 		};
@@ -6235,6 +7943,7 @@ async function workBuddyWebStatus(deps, region, options = {}) {
 		showCreditsInMainUi,
 		creditPosition,
 		imageToolEnabled,
+		cliBridgeEnabled,
 		accounts: accounts.map(toWebAccount),
 		models: deps.displayModels(region).map((model) => toWebModel(model, deps.contextBudgets(region))).map((model) => model.reasoning === void 0 || lastRefusalFor(model.id) === void 0 ? model : {
 			...model,
@@ -6756,11 +8465,24 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						req.on("error", reject);
 					});
 					const field = body.field;
-					if (field !== "regions" && field !== "accounts") return json(res, 400, { error: "field must be regions or accounts" });
+					if (field !== "regions" && field !== "accounts" && field !== "cliBridge") return json(res, 400, { error: "field must be regions, accounts or cliBridge" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
 					const current = unwrapVolatileDeep(row.value?.[field] ?? {});
 					const incoming = body.value ?? {};
+					if (field === "cliBridge") {
+						if (!isPlainRecord(incoming)) return json(res, 400, { error: "cliBridge value must be an object" });
+						const mergedBridge = nextCliBridgeSettings(current, incoming);
+						await settings.mutate(row.ns, [{
+							op: "set",
+							path: [field],
+							value: mergedBridge
+						}], void 0);
+						return json(res, 200, {
+							ok: true,
+							value: mergedBridge
+						});
+					}
 					const merged = { ...current };
 					for (const [key, slot] of Object.entries(incoming)) {
 						const prior = current[key];
@@ -7044,6 +8766,24 @@ function unwrapVolatile(value) {
 * region. It is imported and re-exported from here so the Host entry keeps
 * exposing it as part of its public API.
 */
+const cliBridgeConfig = z.object({
+	enabled: z.boolean().default(false).description("Mount the optional CodeBuddy CLI route (tool codebuddy_ask + /codebuddy). Off by default; the provider stacks are unaffected either way."),
+	binary: z.string().default("").description("Absolute path to the CodeBuddy CLI JS entry (the package's bin/codebuddy, not its .cmd shim). Empty means auto-detect in the usual global npm/pnpm/yarn/volta/nvm/fnm locations. There is deliberately no fallback to whatever \"codebuddy\" is on PATH."),
+	model: z.string().default("").description("Model id passed as --model. Empty means the CLI's own configured default."),
+	permissionMode: z.string().default("dontAsk").description("Permission mode passed as --permission-mode: dontAsk (default: read tools allowed, writes refused, never blocks), plan / default / auto, acceptEdits (may edit files), or bypassPermissions (allows everything)."),
+	effort: z.string().default("").description("Reasoning effort passed as --effort: minimal, low, medium, high, xhigh or max. Empty means unset."),
+	maxTurns: z.number().step(1).min(1).default(10).description("Agent turn budget for one bridged call. Clamped to 100."),
+	timeoutSecs: z.number().step(1).min(1).default(900).description("Wall-clock budget for one bridged call, in seconds. Clamped to 1800."),
+	regionOrder: z.string().default("cn,global").description("Credential region preference for the CLI, comma separated. Domestic tokens are accepted by copilot.tencent.com; global tokens are refused there with 401."),
+	workingDir: z.string().default("").description("Default working directory for a bridged call when the caller names none. Must exist and be a directory. Empty means a call has to name one (or come from a session that has one)."),
+	allowedDirs: z.string().default("").description("Extra roots a bridged call may be pointed at, comma separated absolute paths. A call can always run inside its own session workspace; anything else has to be listed here. Empty means only the session workspace."),
+	appendSystemPrompt: z.string().default("").description("Extra system prompt appended to every bridged call. Passed as --append-system-prompt, never through a shell."),
+	allowUnattended: z.boolean().default(false).description("Allow a bridged call with no directory at all to run in a throwaway temp directory. Off by default: an agent that can edit files should not be aimed at a directory nobody chose."),
+	maxReplyChars: z.number().step(1).min(1).default(6e4).description("Reply length cap handed back to the model, in characters. Clamped to 400000."),
+	injectResult: z.boolean().default(true).description("Hand a successful /codebuddy result to the session model so the conversation knows about it. That wake-up costs a real DSH turn; set false to keep results purely local."),
+	maxTurnsPerSessionHour: z.number().step(1).min(0).default(6).description("Bridged calls allowed per hour in one session. 0 disables the limit."),
+	maxTurnsPerHour: z.number().step(1).min(0).default(20).description("Bridged calls allowed per hour across the whole process. 0 disables the limit.")
+});
 const Config = z.object({
 	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)")),
 	accountId: z.string().description("Deprecated: pre-split account selector, attributed to its own region"),
@@ -7052,7 +8792,8 @@ const Config = z.object({
 	lastCatalog: z.array(modelConfig).description("Deprecated: pre-region-split CN model directory"),
 	enabledModelIds: z.array(z.string()).default([]).description("Deprecated: pre-region-split CN selection"),
 	imageModelIds: z.array(z.string()).default([]).description("Deprecated: pre-region-split CN image opt-in"),
-	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Deprecated: pre-region-split CN context budgets")
+	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Deprecated: pre-region-split CN context budgets"),
+	cliBridge: asVolatile(cliBridgeConfig.default({}).description("Optional CodeBuddy CLI route; off by default and independent of the providers"))
 });
 /**
 * One region's saved model state. A config written before the region split has
@@ -7335,6 +9076,7 @@ function apply(ctx, config) {
 		invalidateCatalog();
 		syncRegionRegistration(value);
 		syncImageTool(value);
+		syncCliBridge(value);
 		refreshRegionUsability();
 	};
 	/**
@@ -7431,6 +9173,57 @@ function apply(ctx, config) {
 			imageTools = void 0;
 		});
 	});
+	let cliTools;
+	let cliCommands;
+	let cliRuntime;
+	let cliRuntimeKey = "";
+	let disposeCliTool;
+	let disposeCliCommand;
+	const disposeCliSurfaces = () => {
+		disposeCliTool?.();
+		disposeCliTool = void 0;
+		disposeCliCommand?.();
+		disposeCliCommand = void 0;
+	};
+	const syncCliBridge = (value) => {
+		const settings = unwrapVolatile(value.cliBridge);
+		const key = JSON.stringify(settings ?? {});
+		if (key !== cliRuntimeKey) {
+			cliRuntimeKey = key;
+			disposeCliSurfaces();
+			cliRuntime?.deps.gate?.clear();
+			cliRuntime = createCliBridgeRuntime(settings, REGION_KEYS.map((region) => ({
+				region,
+				store: stacks[region].store
+			})), (message) => ctx.logger.warn(`dsh-connect-workbuddy: ${message}`));
+		}
+		if (cliRuntime === void 0) {
+			disposeCliSurfaces();
+			return;
+		}
+		if (cliTools !== void 0 && disposeCliTool === void 0) disposeCliTool = mountToolSurface(cliRuntime, cliTools);
+		if (cliCommands !== void 0 && disposeCliCommand === void 0) disposeCliCommand = mountCommandSurface(cliRuntime, cliCommands);
+	};
+	ctx.inject(["tools"], (toolsCtx) => {
+		cliTools = toolsCtx.tools;
+		if (cliTools === void 0) return;
+		syncCliBridge(current());
+		toolsCtx.effect(() => () => {
+			disposeCliTool?.();
+			disposeCliTool = void 0;
+			cliTools = void 0;
+		});
+	});
+	ctx.inject(["commands"], (commandsCtx) => {
+		cliCommands = commandsCtx.commands;
+		if (cliCommands === void 0) return;
+		syncCliBridge(current());
+		commandsCtx.effect(() => () => {
+			disposeCliCommand?.();
+			disposeCliCommand = void 0;
+			cliCommands = void 0;
+		});
+	});
 	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
 		store: (region) => stacks[region].store,
 		client,
@@ -7475,6 +9268,16 @@ function apply(ctx, config) {
 		*/
 		imageToolEnabled: (region) => regionStateOf(current(), region).imageToolEnabled === true,
 		/**
+		* Whether the optional CodeBuddy CLI route is mounted (`codebuddy_ask` tool
+		* + `/codebuddy` command).
+		*
+		* GLOBAL, so it takes no region. `=== true` like `imageToolEnabled`, not
+		* `!== false`: switching this on lets a child process edit files and spend
+		* CodeBuddy quota, so an absent value must read as OFF rather than as
+		* consent. `cliBridge` is a volatile field, hence the unwrap.
+		*/
+		cliBridgeEnabled: () => unwrapVolatile(current().cliBridge)?.enabled === true,
+		/**
 		* WHERE the readout sits, resolved here rather than read from the browser
 		* settings mirror, for the same measured reason as the flag above: on the
 		* affected 0.1.7 deployments that mirror never picks up this plugin's