dsh-connect-workbuddy 5.4.0 → 5.5.0

package/lib/index.js

@@ -1,11 +1,11 @@
-import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-D5FWM_8k.js";
+import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-CVnH8S3J.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, resolve, sep } from "node:path";
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, mkdtempSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { createAssistantMessageEventStream, createProvider, isContextOverflow } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { ReasoningEffortId, createUserMessage, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -347,6 +347,19 @@ const WORKBUDDY_POOL_ACCOUNT_PARAM = "accountId";
 * arbitrary user data and export carries token material.
 */
 const WORKBUDDY_TRANSFER_PATH = "/plugins/dsh-connect-workbuddy/transfer";
+/**
+* The CLI route's live turns, for the composer readout.
+*
+* A GET with no parameters and no region: a live turn is not scoped to a
+* credential region (it is one spawned process), and the chip polls this on an
+* interval, so it must stay cheap — the handler reads an in-memory board and
+* serializes it, touching no upstream and no disk.
+*
+* The document is `{ turns: LiveTurnView[], serverTime: number }`. `serverTime`
+* is the host's clock at serialization so the browser can derive an age from
+* `startedAt` without trusting the two clocks to agree.
+*/
+const WORKBUDDY_CLI_LIVE_PATH = "/plugins/dsh-connect-workbuddy/cli-live";
 /** Read the transfer action off a request URL; unknown/absent means undefined. */
 function transferActionOf(url) {
 	const at = url.indexOf("?");
@@ -426,14 +439,27 @@ function regionOfStatusUrl(url) {
 * it is then `undefined`: the enabled flag reads back as "on" forever (the very
 * symptom described above), and a merge that spreads this map silently drops
 * the region it was not editing. Unwrap before narrowing.
+*
+* THE HOP IS CONDITIONAL, and that is the whole point (a saved manual pool
+* order "disappearing"). "Has a `regions` key" is NOT sufficient evidence that
+* the caller passed the whole section: the `regions` MAP can legitimately carry
+* a `regions` key of its own, because an earlier build could write a sibling
+* field name into it — a live profile was found with `accounts`, `regions` and
+* `cliBridge` sitting beside `cn` / `global`. Hopping there means reading a
+* DIFFERENT, older copy of the same region: measured, the same document returned
+* `['c','a','b']` when read as a section and `[]` when read as a map. So a value
+* counts as the whole section only when it shows a key that is neither a region
+* id nor a known sibling — i.e. it looks like a settings document. A plain (or
+* dirty) `cn` / `global` map is returned as-is.
 */
 function regionsMapOf(value) {
 	const unwrapped = unwrapVolatileDeep(value);
 	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
 	const record = unwrapped;
 	const nested = record["regions"];
-	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
-	return record;
+	if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return record;
+	const regionIds = WORKBUDDY_REGIONS;
+	return Object.keys(record).some((key) => regionIds.includes(key)) ? record : nested;
 }
 /** One region's stored slot as a plain object; any other shape reads as empty. */
 function regionSlotOf(value, region) {
@@ -4663,22 +4689,26 @@ const INJECT_TEXT_LIMIT = 2e5;
 /**
 * The `source.kind` stamped on every message this module writes.
 *
-* The Host's `MessageSource` is a CLOSED union — `model | user | tool |
-* system-prompt` — and only `user` is available for a message that must be read
-* as an incoming turn: `tool` requires a `callId` from a real tool call this
-* plugin did not make, `model` claims a provider produced it, `system-prompt`
-* would put it in the system slot. So the tag cannot say "a plugin wrote this",
-* and pretending otherwise would mean shipping a type that lies.
-*
-* WHAT COMPENSATES FOR IT: the message opens with `PROVENANCE_LINE`, a bracketed
-* line that names the plugin and the command. A human scanning the transcript
-* can tell an injected result from something they typed, and so can the model —
-* which matters because a model that mistakes it for a human instruction will
-* act on it as one.
-*/
-const INJECT_SOURCE_KIND = "user";
-/** The first line of every injected message. Not decoration: it is the only
-* provenance signal the closed `source` union leaves available. */
+* This used to be `'user'`, on the reading that `MessageSource` is a closed
+* union and `'user'` is the only slot a plugin-written turn message can occupy.
+* That reading was wrong. `MessageSourceMap` is MERGE-EXTENSIBLE — its own doc
+* comment says "each producer declares its own `kind` in its own module; there
+* is no shared catch-all `plugin` kind", and consumers fall through unknown
+* kinds — so `'user'` was never the only option, it was the dishonest one: the
+* transcript rendered the injected CodeBuddy result as a user bubble, and the
+* UI had no way to label the row as a notification. `dsh-connect-atomcode`
+* stamps `'atomcode-bridge'` for exactly this reason.
+*
+* The declaration that makes the union accept it lives in
+* `src/dsh-llm-augment.d.ts`.
+*
+* `PROVENANCE_LINE` still opens the text: the kind is what the UI and later
+* readers key on, but the text is what the MODEL reads, and a model cannot see
+* `source`.
+*/
+const INJECT_SOURCE_KIND = "codebuddy-bridge";
+/** The first line of every injected message. Not decoration: the model never
+* sees `source.kind`, so this line is its only provenance signal. */
 const PROVENANCE_LINE = "[dsh-connect-workbuddy · 由 /codebuddy 自动回注，不是用户输入]";
 /**
 * An instruction appended so a model does not turn the result into a loop.
@@ -5005,37 +5035,62 @@ const EXIT_GRACE_MS = 3e3;
 */
 const DENY_REASON = "dsh-connect-workbuddy runs this turn unattended; no human is at the terminal to approve tool use";
 /**
-* Roots a global npm install of the CLI can live under, most likely first.
+* Directories that ARE a `node_modules` root a global install can live in,
+* most likely first.
 *
 * WHY THE LIST IS THIS LONG. The first draft knew only about `%APPDATA%\npm`
 * and the two `/usr/*` prefixes, so every nvm, fnm, volta, pnpm, yarn, brew,
 * `~/.local` and `/opt/homebrew` user got "CLI not found" even though it was
 * installed. The version-manager roots cannot be listed statically (they carry
-* a version or a hash in the path), so `versionedCliEntries` globs one level.
+* a version or a hash in the path), so `versionedCliRoots` globs one level.
+*
+* WHY EVERY ENTRY SPELLS OUT ITS OWN LAYOUT. A global npm prefix is not shaped
+* the same way on every platform. On POSIX a prefix holds
+* `<prefix>/lib/node_modules`; on Windows the prefix `%APPDATA%\npm` holds
+* `<prefix>\node_modules` directly and has no `lib` level at all. Appending
+* `lib/node_modules` to every root — which an earlier revision of this list
+* did — produced paths that exist on no Windows machine, so auto-detection
+* failed for every Windows user while the POSIX roots kept working. The
+* pnpm and yarn stores are their own `node_modules` root for the same reason.
 *
 * None of these are probed through PATH, and `cbc` is not a separate target: it
 * is an alias of the same `bin/codebuddy` file inside the package.
 */
-function cliEntryRoots() {
+function cliModuleDirs() {
 	const home = homedir();
-	const roots = [];
+	const dirs = [];
 	const appData = process.env["APPDATA"];
-	if (typeof appData === "string" && appData !== "") roots.push(join(appData, "npm"));
-	roots.push(join(home, ".npm-global"), "/usr/local", "/opt/homebrew", join(home, ".local"));
-	roots.push(join(home, "AppData", "Roaming", "npm"));
-	roots.push(join(home, ".local", "share", "pnpm", "global", "5"), join(home, ".config", "yarn", "global"));
-	roots.push(join(home, ".volta", "tools", "image"));
-	return roots.map((root) => join(root, "lib", "node_modules"));
+	if (typeof appData === "string" && appData !== "") dirs.push(join(appData, "npm", "node_modules"));
+	dirs.push(join(home, "AppData", "Roaming", "npm", "node_modules"));
+	for (const prefix of [
+		join(home, ".npm-global"),
+		"/usr/local",
+		"/opt/homebrew",
+		join(home, ".local")
+	]) dirs.push(join(prefix, "lib", "node_modules"));
+	dirs.push(join(home, ".local", "share", "pnpm", "global", "5", "node_modules"));
+	dirs.push(join(home, "Library", "pnpm", "global", "5", "node_modules"));
+	const localAppData = process.env["LOCALAPPDATA"];
+	if (typeof localAppData === "string" && localAppData !== "") {
+		dirs.push(join(localAppData, "pnpm", "global", "5", "node_modules"));
+		dirs.push(join(localAppData, "Yarn", "Data", "global", "node_modules"));
+	}
+	dirs.push(join(home, ".config", "yarn", "global", "node_modules"));
+	return dirs;
 }
 /** Directories whose children are node version roots (`.../versions/node/<v>`). */
 function versionedCliRoots() {
 	const home = homedir();
-	return [
+	const roots = [
 		join(home, ".nvm", "versions", "node"),
 		join(home, "n", "versions", "node"),
 		join(home, ".fnm", "node-versions"),
-		join(home, ".local", "share", "fnm", "node-versions")
+		join(home, ".local", "share", "fnm", "node-versions"),
+		join(home, ".volta", "tools", "image", "node")
 	];
+	const appData = process.env["APPDATA"];
+	if (typeof appData === "string" && appData !== "") roots.push(join(appData, "fnm", "node-versions"));
+	return roots;
 }
 /** Expand one directory's children into CLI entries, ignoring unreadable ones. */
 function childrenOf(dir, separator) {
@@ -5047,21 +5102,21 @@ function childrenOf(dir, separator) {
 }
 /** Every path a global install of the CLI could live at, most likely first. */
 function cliEntryCandidates() {
-	const out = [...cliEntryRoots().map((root) => join(root, CLI_PACKAGE_PATH))];
+	const out = [...cliModuleDirs().map((dir) => join(dir, CLI_PACKAGE_PATH))];
 	for (const versions of versionedCliRoots()) {
 		out.push(...childrenOf(versions, [
 			"lib",
 			"node_modules",
 			CLI_PACKAGE_PATH
 		]));
-		out.push(...childrenOf(join(versions), [
+		out.push(...childrenOf(versions, [
 			"installation",
 			"lib",
 			"node_modules",
 			CLI_PACKAGE_PATH
 		]));
 	}
-	return out;
+	return [...new Set(out)];
 }
 /**
 * Locate the CLI's JS entry.
@@ -5217,6 +5272,8 @@ function runOneTurn(options, token) {
 		const assistantText = [];
 		let assistantChars = 0;
 		const toolCounts = /* @__PURE__ */ new Map();
+		let liveToolCalls = 0;
+		let lastToolName = "";
 		const deniedTools = [];
 		let stderr = "";
 		let buffer = "";
@@ -5361,7 +5418,21 @@ function runOneTurn(options, token) {
 							return;
 						}
 						assistantText.push(block.text);
-					} else if (block.type === "tool_use" && typeof block.name === "string") toolCounts.set(block.name, (toolCounts.get(block.name) ?? 0) + 1);
+						options.onProgress?.({
+							toolCalls: liveToolCalls,
+							lastTool: lastToolName,
+							chars: assistantChars
+						});
+					} else if (block.type === "tool_use" && typeof block.name === "string") {
+						toolCounts.set(block.name, (toolCounts.get(block.name) ?? 0) + 1);
+						liveToolCalls += 1;
+						lastToolName = block.name;
+						options.onProgress?.({
+							toolCalls: liveToolCalls,
+							lastTool: lastToolName,
+							chars: assistantChars
+						});
+					}
 				}
 				if (frame.type === "result") {
 					settle(frame);
@@ -5472,6 +5543,16 @@ const EFFORT_LEVELS = [
 const TIMEOUT_SECS_CAP = 1800;
 /** Hard ceiling on the reply length, in characters. */
 const MAX_REPLY_CHARS_CAP = 4e5;
+/**
+* What `cliBridge.sessionContinuity` accepts.
+*
+* `auto` threads the previous CLI session into the next call; `off` leaves every
+* call independent unless the caller passes `session_id` itself. There is no
+* `on`-with-a-different-mechanism value: the one that was measured to work is
+* `--session-id <existing>`, and offering `--continue` (whatever ran last in the
+* cwd) next to it would make two concurrent sessions race for one conversation.
+*/
+const SESSION_CONTINUITY_MODES = ["auto", "off"];
 /** Every field defaulted, so the Host's closed schema always validates. */
 function result(partial) {
 	return {
@@ -5497,11 +5578,62 @@ function result(partial) {
 function clampInt$1(value, fallback, cap) {
 	return Math.max(1, Math.min(cap, typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback));
 }
-/** The throwaway directory used when the caller explicitly allows no workspace. */
+/**
+* Last CLI session id per DSH session, for automatic continuation.
+*
+* WHY A MAP AND NOT JUST A TOOL ARGUMENT. `--session-id <existing>` really does
+* resume the conversation — measured against the installed CLI: a number sent in
+* turn 1 came back from turn 2, and the CLI echoed the same id both times. But
+* that id only reaches the CLI when the CALLER passes it back as `session_id`,
+* which asks the model to copy a uuid out of the previous result. Best effort,
+* not a guarantee. Remembering the id here makes continuation the default rather
+* than a habit.
+*
+* IN MEMORY ON PURPOSE. The value is a uuid owned by the CLI, and an unknown id
+* is not an error there — the CLI silently starts a fresh session under it. So
+* the failure mode of a lost or stale entry is one new conversation, never a
+* mixed-up one, which is the right trade for a file the plugin would otherwise
+* have to garbage-collect. Bounded (FIFO) so a long-lived process cannot grow it
+* without limit.
+*/
+const CLI_SESSION_MEMORY = /* @__PURE__ */ new Map();
+const CLI_SESSION_MEMORY_CAP = 256;
+/** Remember the CLI session a DSH session should continue next time. */
+function rememberCliSession(sessionKey, cliSessionId) {
+	if (sessionKey === "" || cliSessionId === "") return;
+	CLI_SESSION_MEMORY.delete(sessionKey);
+	CLI_SESSION_MEMORY.set(sessionKey, cliSessionId);
+	while (CLI_SESSION_MEMORY.size > CLI_SESSION_MEMORY_CAP) {
+		const oldest = CLI_SESSION_MEMORY.keys().next();
+		if (oldest.done === true) break;
+		CLI_SESSION_MEMORY.delete(oldest.value);
+	}
+}
+/** The CLI session to continue for this DSH session, or `''` for a fresh one. */
+function recallCliSession(sessionKey) {
+	return CLI_SESSION_MEMORY.get(sessionKey) ?? "";
+}
+/**
+* A throwaway directory for ONE unattended turn.
+*
+* ONE DIRECTORY PER CALL, not a fixed `dsh-codebuddy-scratch`. A single shared
+* path meant two concurrent unattended turns ran in the same writable space —
+* each could read and overwrite the other's files, and anything a previous turn
+* left behind was still there. `mkdtemp` guarantees a fresh, empty, uniquely
+* named directory, which is what makes the "exempt by construction" argument in
+* `resolveWorkingDir` actually true.
+*/
 function scratchDir() {
-	const dir = join(tmpdir(), "dsh-codebuddy-scratch");
-	mkdirSync(dir, { recursive: true });
-	return dir;
+	return mkdtempSync(join(tmpdir(), "dsh-codebuddy-scratch-"));
+}
+/** Best-effort removal: a locked file must not turn a finished turn into an error. */
+function removeScratch(dir) {
+	try {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
 }
 /** Case-fold a path on the platforms whose filesystems ignore case. */
 function foldCase(path) {
@@ -5729,16 +5861,77 @@ function sessionKeyOf(execution, fallback) {
 	const id = execution?.agent?.id;
 	return typeof id === "string" && id !== "" ? id : fallback;
 }
-/**
-* Run one bridged turn and return the complete result object.
-*
-* Exported because the `/codebuddy` slash command needs the same turn with the
-* same validation — a command that re-implemented this would drift from the tool
-* the first time either side gained a knob.
-*/
-async function runAsk(args, execution, deps) {
-	const startedAt = Date.now();
+/** The part of a turn that runs once the budget and the directory are settled. */
+async function runAskTurn(args, execution, deps, context) {
+	const { startedAt, dir, message, effort, modelArg, effectiveMode, liveTurn } = context;
 	const { options, regions, log } = deps;
+	let credentials;
+	try {
+		credentials = await resolveCredentials(regions, options.regionOrder, log);
+	} catch (error) {
+		return result({
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+	const sessionIdArg = typeof args["session_id"] === "string" ? args["session_id"].trim() : "";
+	const signal = execution?.signal;
+	const sessionKey = sessionKeyOf(execution, "codebuddy_ask");
+	const continuedSessionId = sessionIdArg !== "" ? sessionIdArg : options.sessionContinuity === "auto" ? recallCliSession(sessionKey) : "";
+	if (liveTurn !== void 0) liveTurn.phase = "running";
+	const outcome = await runAgent({
+		prompt: message,
+		cwd: dir.dir,
+		binary: options.binary,
+		model: modelArg !== "" ? modelArg : options.model,
+		permissionMode: effectiveMode,
+		effort: effort !== "" ? effort : options.effort,
+		appendSystemPrompt: options.appendSystemPrompt,
+		maxTurns: clampInt$1(args["max_turns"], options.maxTurns, 100),
+		timeoutMs: clampInt$1(args["timeout_secs"], options.timeoutSecs, TIMEOUT_SECS_CAP) * 1e3,
+		...continuedSessionId !== "" ? { sessionId: continuedSessionId } : {},
+		...signal !== void 0 ? { signal } : {},
+		...liveTurn === void 0 ? {} : { onProgress: (progress) => {
+			liveTurn.toolCalls = progress.toolCalls;
+			liveTurn.lastTool = progress.lastTool;
+			liveTurn.chars = progress.chars;
+		} }
+	}, credentials, log);
+	if (liveTurn !== void 0) liveTurn.phase = "finishing";
+	let reply = outcome.text;
+	let truncated = false;
+	if (reply.length > options.maxReplyChars) {
+		const omitted = reply.length - options.maxReplyChars;
+		reply = `${reply.slice(0, options.maxReplyChars)}\n\n[truncated by dsh-connect-workbuddy: ${String(omitted)} more characters. Have CodeBuddy write the full text to a file and read it back.]`;
+		truncated = true;
+	}
+	const tools = [...outcome.toolCounts.entries()].slice(0, 12).map(([name, count]) => ({
+		name,
+		count
+	}));
+	rememberCliSession(sessionKey, outcome.sessionId ?? "");
+	return result({
+		ok: outcome.ok,
+		reply,
+		session_id: outcome.sessionId ?? "",
+		tools,
+		denied_tools: [...outcome.deniedTools],
+		tool_calls: [...outcome.toolCounts.values()].reduce((sum, count) => sum + count, 0),
+		num_turns: outcome.numTurns ?? 0,
+		tokens_in: outcome.usage?.input_tokens ?? 0,
+		tokens_out: outcome.usage?.output_tokens ?? 0,
+		cache_read_tokens: outcome.usage?.cache_read_input_tokens ?? 0,
+		credential_region: outcome.credential.region,
+		working_dir: dir.dir,
+		unattended: dir.unattended,
+		elapsed_ms: Date.now() - startedAt,
+		truncated,
+		error: outcome.error ?? ""
+	});
+}
+async function runAsk(args, execution, deps, entrance = "tool") {
+	const startedAt = Date.now();
+	const { options, log } = deps;
 	const mode = typeof args["permission_mode"] === "string" ? args["permission_mode"].trim() : "";
 	if (mode !== "" && !PERMISSION_MODES.includes(mode)) return result({
 		ok: false,
@@ -5760,73 +5953,48 @@ async function runAsk(args, execution, deps) {
 		error: dir.reason
 	});
 	const entry = (deps.gate ?? gateFor(options)).tryEnter(sessionKeyOf(execution, "codebuddy_ask"), (message) => log(message));
-	if (!entry.ok) return result({
-		ok: false,
-		error: entry.error
-	});
+	if (!entry.ok) {
+		if (dir.unattended) removeScratch(dir.dir);
+		return result({
+			ok: false,
+			error: entry.error
+		});
+	}
 	try {
-		let credentials;
+		const modelArg = typeof args["model"] === "string" ? args["model"].trim() : "";
+		const effectiveMode = mode !== "" ? mode : options.permissionMode;
+		const liveTurn = deps.live?.begin({
+			entrance,
+			workingDir: dir.dir,
+			unattended: dir.unattended,
+			permissionMode: effectiveMode,
+			model: modelArg !== "" ? modelArg : options.model,
+			...execution?.agent?.id !== void 0 ? { sessionId: execution.agent.id } : {}
+		});
 		try {
-			credentials = await resolveCredentials(regions, options.regionOrder, log);
+			return await runAskTurn(args, execution, deps, {
+				startedAt,
+				dir,
+				message,
+				effort,
+				mode,
+				modelArg,
+				effectiveMode,
+				entry,
+				...liveTurn === void 0 ? {} : { liveTurn }
+			});
 		} catch (error) {
 			return result({
 				ok: false,
-				error: error instanceof Error ? error.message : String(error)
+				error: error instanceof Error ? error.message : String(error),
+				elapsed_ms: Date.now() - startedAt
 			});
+		} finally {
+			if (liveTurn !== void 0) deps.live?.end(liveTurn);
 		}
-		const modelArg = typeof args["model"] === "string" ? args["model"].trim() : "";
-		const sessionIdArg = typeof args["session_id"] === "string" ? args["session_id"].trim() : "";
-		const signal = execution?.signal;
-		const outcome = await runAgent({
-			prompt: message,
-			cwd: dir.dir,
-			binary: options.binary,
-			model: modelArg !== "" ? modelArg : options.model,
-			permissionMode: mode !== "" ? mode : options.permissionMode,
-			effort: effort !== "" ? effort : options.effort,
-			appendSystemPrompt: options.appendSystemPrompt,
-			maxTurns: clampInt$1(args["max_turns"], options.maxTurns, 100),
-			timeoutMs: clampInt$1(args["timeout_secs"], options.timeoutSecs, TIMEOUT_SECS_CAP) * 1e3,
-			...sessionIdArg !== "" ? { sessionId: sessionIdArg } : {},
-			...signal !== void 0 ? { signal } : {}
-		}, credentials, log);
-		let reply = outcome.text;
-		let truncated = false;
-		if (reply.length > options.maxReplyChars) {
-			const omitted = reply.length - options.maxReplyChars;
-			reply = `${reply.slice(0, options.maxReplyChars)}\n\n[truncated by dsh-connect-workbuddy: ${String(omitted)} more characters. Have CodeBuddy write the full text to a file and read it back.]`;
-			truncated = true;
-		}
-		const tools = [...outcome.toolCounts.entries()].slice(0, 12).map(([name, count]) => ({
-			name,
-			count
-		}));
-		return result({
-			ok: outcome.ok,
-			reply,
-			session_id: outcome.sessionId ?? "",
-			tools,
-			denied_tools: [...outcome.deniedTools],
-			tool_calls: [...outcome.toolCounts.values()].reduce((sum, count) => sum + count, 0),
-			num_turns: outcome.numTurns ?? 0,
-			tokens_in: outcome.usage?.input_tokens ?? 0,
-			tokens_out: outcome.usage?.output_tokens ?? 0,
-			cache_read_tokens: outcome.usage?.cache_read_input_tokens ?? 0,
-			credential_region: outcome.credential.region,
-			working_dir: dir.dir,
-			unattended: dir.unattended,
-			elapsed_ms: Date.now() - startedAt,
-			truncated,
-			error: outcome.error ?? ""
-		});
-	} catch (error) {
-		return result({
-			ok: false,
-			error: error instanceof Error ? error.message : String(error),
-			elapsed_ms: Date.now() - startedAt
-		});
 	} finally {
 		entry.release();
+		if (dir.unattended) removeScratch(dir.dir);
 	}
 }
 /**
@@ -5875,7 +6043,7 @@ function mountAskTool(tools, deps) {
 					},
 					session_id: {
 						type: "string",
-						description: "可选：指定 CLI 会话 id，让后续调用接着同一个会话。不传则每次开新会话。"
+						description: "可选：要续接的 CLI 会话 id。留空 = 由插件自动续接本会话上一轮的 CodeBuddy 对话（cliBridge.sessionContinuity=auto 时；=off 时留空就是每次开新会话）。只有想故意开一条新对话、或切到另一条对话时才显式传。"
 					},
 					allow_unattended: {
 						type: "boolean",
@@ -5962,29 +6130,44 @@ const REVIEW_PERMISSION_MODE = "dontAsk";
 * human cannot tell the two apart in the output.
 */
 const REVIEW_BRIEF = "评审当前工作区里未提交的改动（git 未提交改动；没有未提交改动时看最近一次提交）。自己运行 git 命令确认范围，必要时读相关文件理解上下文，然后给出评审结论：哪些地方有问题、为什么、怎么改。只报你确实看见的问题，不要猜。";
+/** The mode `--edit` selects for the one turn it appears on. */
+const EDIT_PERMISSION_MODE = "acceptEdits";
 /**
-* What the composer line becomes.
+* Read the composer line.
 *
 * Empty → the review brief. Non-empty → the text verbatim, because a human who
 * typed something meant it, and silently prepending a review brief to "改一下
 * 这个 bug" is how a command does something other than what it was asked.
+*
+* `--edit` is stripped and remembered rather than forwarded: CodeBuddy must not
+* see a flag that only means something to this bridge.
 */
-function composeCommandPrompt(raw) {
+function parseCommandInput(raw) {
 	const note = raw.trim();
-	return note === "" ? REVIEW_BRIEF : note;
+	if (note === "") return {
+		prompt: REVIEW_BRIEF,
+		label: "（未提交改动）",
+		review: true,
+		permissionMode: REVIEW_PERMISSION_MODE
+	};
+	const edit = /^--edit(?:\s|$)/u.test(note);
+	const body = edit ? note.replace(/^--edit\s*/u, "").trim() : note;
+	if (body === "") return {
+		prompt: REVIEW_BRIEF,
+		label: "（未提交改动，可写）",
+		review: true,
+		permissionMode: EDIT_PERMISSION_MODE
+	};
+	return {
+		prompt: body,
+		label: edit ? `（可写：${body}）` : `（指令：${body}）`,
+		review: false,
+		permissionMode: edit ? EDIT_PERMISSION_MODE : ""
+	};
 }
 /** A one-line label saying how the human's words were used. */
 function commandScopeLabel(raw) {
-	const note = raw.trim();
-	return note === "" ? "（未提交改动）" : `（指令：${note}）`;
-}
-/** Whether this invocation is the built-in review (empty line). */
-function isReviewInvocation(raw) {
-	return raw.trim() === "";
-}
-/** The permission mode this invocation runs in. */
-function permissionModeForInvocation(raw) {
-	return isReviewInvocation(raw) ? REVIEW_PERMISSION_MODE : "";
+	return parseCommandInput(raw).label;
 }
 /**
 * Render one turn outcome as the plain text a command result carries.
@@ -6005,7 +6188,7 @@ function formatCommandOutcome(value, extra = {}) {
 	const body = value.reply.trim();
 	const head = body === "" ? `CodeBuddy 完成${scope}：没有输出任何结论。` : `CodeBuddy 完成${scope}：\n\n${body}`;
 	const toolList = value.tools.length > 0 ? value.tools.map((tool) => tool.count > 1 ? `${tool.name}×${String(tool.count)}` : tool.name).join(", ") : "无";
-	const denied = value.denied_tools.length > 0 ? `\n\n[注意：CodeBuddy 请求过这些工具但被拒绝：${value.denied_tools.join(", ")}。评审类任务读到这些就该够了；要它真动手请写明要求并显式指定权限模式]` : "";
+	const denied = value.denied_tools.length > 0 ? `\n\n[注意：CodeBuddy 请求过这些工具但被拒绝：${value.denied_tools.join(", ")}。评审类任务读到这些就该够了；要它真动手，在指令前加 --edit（只影响这一轮），或在配置里设 cliBridge.permissionMode=acceptEdits（影响之后每一轮）]` : "";
 	const footer = `\n\n[session_id=${value.session_id === "" ? "?" : value.session_id} turns=${String(value.num_turns)} tool_calls=${String(value.tool_calls)} tools=${toolList} tokens=${String(value.tokens_in)}in/${String(value.tokens_out)}out (cache_read=${String(value.cache_read_tokens)}) elapsed_ms=${String(value.elapsed_ms)} cred=${value.credential_region}` + (value.working_dir !== "" ? ` dir=${value.working_dir}` : "") + "]";
 	const truncated = value.truncated ? "\n\n[注意：输出已截断。让 CodeBuddy 把完整内容写到文件里再读，别只靠这一份摘要]" : "";
 	const delivery = extra.injection === void 0 ? "" : `\n\n${formatInjection(extra.injection)}`;
@@ -6031,8 +6214,8 @@ function mountCodebuddyCommand(commands, deps) {
 	try {
 		return commands.register({
 			name: COMMAND_NAME,
-			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
-			input: { hint: "可留空：直接评审当前工作区未提交的改动；或写你的要求（如\"修一下这个空指针\"）" },
+			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动；以 --edit 开头 = 这一轮允许改文件。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
+			input: { hint: "留空 = 评审未提交改动；写要求 = 只读执行（如\"看一下这个函数为什么崩\"）；要以 --edit 开头 = 允许改文件（如\"--edit 修一下这个空指针\"）" },
 			handler: async (invocation) => {
 				const cwd = invocation.agent?.session?.header?.cwd;
 				if (typeof cwd !== "string" || cwd.trim() === "") return {
@@ -6040,18 +6223,17 @@ function mountCodebuddyCommand(commands, deps) {
 					text: "这个会话没有工作区路径（session.header.cwd 为空），无法确定 CodeBuddy 该在哪里跑。请在一个打开过目录的会话里再试。"
 				};
 				const raw = typeof invocation.rawInput === "string" ? invocation.rawInput : "";
-				const message = composeCommandPrompt(raw);
-				const review = isReviewInvocation(raw);
+				const parsed = parseCommandInput(raw);
 				const startedAt = Date.now();
 				try {
 					const value = await runAsk({
-						message,
+						message: parsed.prompt,
 						working_dir: cwd,
-						...review ? { permission_mode: permissionModeForInvocation(raw) } : {}
+						...parsed.permissionMode !== "" ? { permission_mode: parsed.permissionMode } : {}
 					}, {
 						...invocation.agent !== void 0 ? { agent: invocation.agent } : {},
 						...invocation.signal !== void 0 ? { signal: invocation.signal } : {}
-					}, deps);
+					}, deps, "command");
 					log(`command /${COMMAND_NAME} finished in ${String(Date.now() - startedAt)}ms (ok=${String(value.ok)})`);
 					const injection = value.ok && options.injectResult ? injectOutcome(invocation.agent, {
 						reply: value.reply,
@@ -6083,6 +6265,67 @@ function mountCodebuddyCommand(commands, deps) {
 	}
 }
 //#endregion
+//#region src/cli-bridge/live.ts
+/**
+* Build a board.
+*
+* Ordering is "oldest first", which is the order a human reads a queue in; the
+* chip draws the newest as the headline because that is the one the last click
+* started.
+*/
+function createLiveBoard() {
+	const turns = [];
+	let counter = 0;
+	const begin = (input) => {
+		counter += 1;
+		const startedAt = Date.now();
+		const turn = {
+			id: `${startedAt.toString(36)}-${String(counter)}`,
+			startedAt,
+			entrance: input.entrance,
+			workingDir: input.workingDir,
+			unattended: input.unattended,
+			permissionMode: input.permissionMode,
+			model: input.model,
+			sessionId: input.sessionId ?? "",
+			phase: "starting",
+			toolCalls: 0,
+			lastTool: "",
+			chars: 0
+		};
+		turns.push(turn);
+		return turn;
+	};
+	const end = (turn) => {
+		const at = turns.indexOf(turn);
+		if (at >= 0) turns.splice(at, 1);
+	};
+	const snapshot = (now = Date.now()) => ({
+		turns: turns.map((turn) => ({
+			id: turn.id,
+			startedAt: turn.startedAt,
+			elapsedMs: Math.max(0, now - turn.startedAt),
+			entrance: turn.entrance,
+			workingDir: turn.workingDir,
+			unattended: turn.unattended,
+			permissionMode: turn.permissionMode,
+			model: turn.model,
+			sessionId: turn.sessionId,
+			phase: turn.phase,
+			toolCalls: turn.toolCalls,
+			lastTool: turn.lastTool,
+			chars: turn.chars
+		})),
+		serverTime: now
+	});
+	return {
+		begin,
+		end,
+		snapshot,
+		size: () => turns.length
+	};
+}
+//#endregion
 //#region src/cli-bridge/mount.ts
 /**
 * Wiring the CLI route into the plugin, and normalizing its settings.
@@ -6137,6 +6380,7 @@ const CLI_BRIDGE_DEFAULTS = {
 	allowUnattended: false,
 	maxReplyChars: 6e4,
 	injectResult: true,
+	sessionContinuity: "auto",
 	maxTurnsPerSessionHour: 6,
 	maxTurnsPerHour: 20
 };
@@ -6175,6 +6419,9 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 	const safeEffort = effort === "" || EFFORT_LEVELS.includes(effort) ? effort : "";
 	if (safeEffort !== effort) reject(`effort "${effort}" 不是合法值，已回退到 CLI 默认；合法值：${EFFORT_LEVELS.join(", ")}`);
 	const regionOrder = text(raw.regionOrder, CLI_BRIDGE_DEFAULTS.regionOrder);
+	const sessionContinuity = text(raw.sessionContinuity, CLI_BRIDGE_DEFAULTS.sessionContinuity);
+	const safeSessionContinuity = SESSION_CONTINUITY_MODES.includes(sessionContinuity) ? sessionContinuity : CLI_BRIDGE_DEFAULTS.sessionContinuity;
+	if (safeSessionContinuity !== sessionContinuity) reject(`sessionContinuity "${sessionContinuity}" 不是合法值，已回退到 ${CLI_BRIDGE_DEFAULTS.sessionContinuity}；合法值：${SESSION_CONTINUITY_MODES.join(", ")}`);
 	return {
 		enabled: raw.enabled === true,
 		binary: text(raw.binary, CLI_BRIDGE_DEFAULTS.binary),
@@ -6190,6 +6437,7 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 		allowUnattended: raw.allowUnattended === true,
 		maxReplyChars: clampInt(raw.maxReplyChars, CLI_BRIDGE_DEFAULTS.maxReplyChars, MAX_REPLY_CHARS_CAP),
 		injectResult: raw.injectResult !== false,
+		sessionContinuity: safeSessionContinuity,
 		maxTurnsPerSessionHour: clampQuota(raw.maxTurnsPerSessionHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerSessionHour),
 		maxTurnsPerHour: clampQuota(raw.maxTurnsPerHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerHour)
 	};
@@ -6203,14 +6451,17 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 function createCliBridgeRuntime(settings, regions, log) {
 	const options = normalizeCliBridgeOptions(settings, (message) => log(message));
 	if (!options.enabled) return void 0;
+	const live = createLiveBoard();
 	return {
 		options,
 		deps: {
 			options,
 			regions,
 			log,
-			gate: gateFor(options)
-		}
+			gate: gateFor(options),
+			live
+		},
+		live
 	};
 }
 /** Mount `codebuddy_ask` on a tools service, returning its disposer. */
@@ -8896,6 +9147,41 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* The CLI route's live turns.
+		*
+		* Registered even when the bridge is switched off, and answers an empty
+		* document in that case: the composer chip polls this path unconditionally
+		* (it cannot know the setting — the settings mirror is not readable from a
+		* session component), so "off" has to be a 200 with nothing in it rather
+		* than a 404 the chip would have to special-case.
+		*
+		* No region parameter: a live turn is not scoped to a credential region, and
+		* `requestRegion` would 400 a perfectly valid read.
+		*
+		* A 404 is not an option here, and that is a second reason for the
+		* unconditional registration: the chip keeps showing the last document it
+		* read while a poll fails (it cannot tell "the route is gone" from "the
+		* request dropped"), so a route that vanished on a settings change would
+		* leave a ghost pill describing a turn that already ended. Answering an
+		* empty document keeps "off" inside the same code path as "no turns".
+		*/
+		const disposeCliLive = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_CLI_LIVE_PATH,
+			handler: (req, res) => {
+				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				try {
+					json(res, 200, deps.cliLive?.() ?? {
+						turns: [],
+						serverTime: Date.now()
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		return () => {
 			disposeRefresh();
 			disposeCheckin();
@@ -8908,6 +9194,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			disposeOAuth();
 			disposeTransfer();
 			disposeDiagWrite();
+			disposeCliLive();
 		};
 	}, "dsh-connect-workbuddy: Web status route");
 }
@@ -9096,6 +9383,7 @@ const cliBridgeConfig = z.object({
 	allowUnattended: z.boolean().default(false).description("Allow a bridged call with no directory at all to run in a throwaway temp directory. Off by default: an agent that can edit files should not be aimed at a directory nobody chose."),
 	maxReplyChars: z.number().step(1).min(1).default(6e4).description("Reply length cap handed back to the model, in characters. Clamped to 400000."),
 	injectResult: z.boolean().default(true).description("Hand a successful /codebuddy result to the session model so the conversation knows about it. That wake-up costs a real DSH turn; set false to keep results purely local."),
+	sessionContinuity: z.string().default("auto").description("Whether a second /codebuddy (or codebuddy_ask) in the same session continues the previous CodeBuddy conversation: auto (default) resumes it via --session-id, off starts a fresh one every time. An explicit session_id argument always wins over this setting."),
 	maxTurnsPerSessionHour: z.number().step(1).min(0).default(6).description("Bridged calls allowed per hour in one session. 0 disables the limit."),
 	maxTurnsPerHour: z.number().step(1).min(0).default(20).description("Bridged calls allowed per hour across the whole process. 0 disables the limit.")
 });
@@ -9650,6 +9938,19 @@ function apply(ctx, config) {
 		client,
 		accountUsable: accountUsabilityProbe,
 		/**
+		* The CLI route's live turns, for the composer readout.
+		*
+		* Read through `cliRuntime` rather than captured once: the runtime is rebuilt
+		* whenever `cliBridge` settings change, and the board belongs to the runtime.
+		* A captured board would keep answering for a runtime nothing drives any
+		* more. Switched off means `undefined`, which the route reports as an empty
+		* document.
+		*/
+		cliLive: () => cliRuntime?.live.snapshot() ?? {
+			turns: [],
+			serverTime: Date.now()
+		},
+		/**
 		* Why each of the region's accounts cannot serve right now, for the composer
 		* panel's table.
 		*