dsh-connect-workbuddy 5.4.0 → 5.5.1

package/lib/index.js

@@ -1,11 +1,11 @@
-import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-D5FWM_8k.js";
+import { $ as prepareChatBody, A as parseWorkBuddyAuth, At as readAtRestKey, B as declaredTools, C as defaultDesktopAuthCandidates, Ct as findWorkbuddyAppExecutable, D as isEncryptedCredentialError, Dt as macosBundleExecutable, E as hasEncryptedCredentialFields, Et as isWorkbuddyBundle, F as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, Ft as writeFileAtomic, G as isFirstMessageGateBody, H as isContextTooLongBody, I as WorkBuddyCredentialRejectedError, J as openingEvidenceOfBody, K as knownRegionOf, L as WorkBuddyUpstreamClient, M as workbuddyOwnAuthPath, N as CONTEXT_OVERFLOW_MARKER, Nt as resolveDshHome, O as isVaultAccountId, Ot as macosNestedAppBundles, P as CREDENTIAL_REJECTED_CODE, Pt as withFileLock, Q as perturbChannelFingerprints, R as channelGateMemberOf, S as authFileName, St as fetchAtRestKeyPayload, T as defaultDesktopAuthPath, Tt as isEncryptedFieldWrapper, U as isConversationIdGateBody, V as forceNeutralHead, W as isCredentialRejectedError, X as parseReasoning, Y as parseCreditMultiplier, Z as parseUpstreamModel, _ as ENCRYPTED_CREDENTIAL_CODE, _t as nativeModalityOf, a as readHostHeartbeat, at as lastRefusalFor, b as WorkBuddyCredentialStore, bt as deriveAtRestKey, c as WORKBUDDY_CONNECT_VERSION, ct as recordRefusal, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as WorkBuddyImageError, et as regionOf, f as WorkBuddyCatalog, ft as pickImageModel, g as withoutRouters, gt as imageDefaultFor, h as fallbackModelsFor, ht as NATIVE_MODALITY_BY_MODEL_ID, i as processStartTimeMs, it as defaultOffModelIds, j as workbuddyAccountId, jt as workbuddyAppExecutableCandidates, k as legacyWorkbuddyOwnAuthPath, kt as openEncryptedField, l as piAiRuntimeInfo, lt as withEffectiveOff, m as deriveCatalog, mt as queueNoticeText, n as clearHostHeartbeat, nt as attachBusyLevels, o as workbuddyHostHeartbeatPath, ot as offDefaultFor, p as applyContextBudgets, pt as parseQueueAnswer, q as modelIdOfBody, r as isHeartbeatProcessAlive, rt as REFUSES_OFF_MODEL_IDS, s as writeHostHeartbeat, st as offRefused, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as requestEvidenceOf, u as FALLBACK_WORKBUDDY_MODELS, ut as DEFAULT_IMAGE_SIZE, v as WORKBUDDY_AUTH_FILENAME, vt as WORKBUDDY_APP_EXECUTABLE_ENV, w as defaultDesktopAuthDirs, x as WorkBuddyEncryptedCredentialError, xt as deriveAtRestKeyId, y as WORKBUDDY_AUTH_FILE_ENV, yt as clearAtRestKeyCache, z as classifyUpstreamError } from "./host-heartbeat-BhgyeZWV.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, resolve, sep } from "node:path";
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, mkdtempSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { createAssistantMessageEventStream, createProvider, isContextOverflow } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { ReasoningEffortId, createUserMessage, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -347,6 +347,19 @@ const WORKBUDDY_POOL_ACCOUNT_PARAM = "accountId";
 * arbitrary user data and export carries token material.
 */
 const WORKBUDDY_TRANSFER_PATH = "/plugins/dsh-connect-workbuddy/transfer";
+/**
+* The CLI route's live turns, for the composer readout.
+*
+* A GET with no parameters and no region: a live turn is not scoped to a
+* credential region (it is one spawned process), and the chip polls this on an
+* interval, so it must stay cheap — the handler reads an in-memory board and
+* serializes it, touching no upstream and no disk.
+*
+* The document is `{ turns: LiveTurnView[], serverTime: number }`. `serverTime`
+* is the host's clock at serialization so the browser can derive an age from
+* `startedAt` without trusting the two clocks to agree.
+*/
+const WORKBUDDY_CLI_LIVE_PATH = "/plugins/dsh-connect-workbuddy/cli-live";
 /** Read the transfer action off a request URL; unknown/absent means undefined. */
 function transferActionOf(url) {
 	const at = url.indexOf("?");
@@ -426,14 +439,196 @@ function regionOfStatusUrl(url) {
 * it is then `undefined`: the enabled flag reads back as "on" forever (the very
 * symptom described above), and a merge that spreads this map silently drops
 * the region it was not editing. Unwrap before narrowing.
+*
+* THE HOP IS CONDITIONAL, and that is the whole point (a saved manual pool
+* order "disappearing"). "Has a `regions` key" is NOT sufficient evidence that
+* the caller passed the whole section: the `regions` MAP can legitimately carry
+* a `regions` key of its own, because an earlier build could write a sibling
+* field name into it — a live profile was found with `accounts`, `regions` and
+* `cliBridge` sitting beside `cn` / `global`. Hopping there means reading a
+* DIFFERENT, older copy of the same region: measured, the same document returned
+* `['c','a','b']` when read as a section and `[]` when read as a map. So a value
+* counts as the whole section only when it shows a key that is neither a region
+* id nor a known sibling — i.e. it looks like a settings document. A plain (or
+* dirty) `cn` / `global` map is returned as-is.
+*
+* THE RESULT IS HEALED, not merely narrowed — see {@link healedRegionsMap}.
+* Returning the map "as-is" is what let a corrupted document keep reading as
+* half-empty: the field held `cn` at level 0 and `global` only one level down,
+* so every `global` question answered "never configured" even though the file
+* still had the answer. Reads and writes both come through here, so healing
+* here fixes both halves at once (the Host's `regionStateOf`, the card's
+* `nextRegion*` write bases, and the catalog repair's write).
 */
 function regionsMapOf(value) {
+	const peeled = peelLiveReference(value);
+	if (typeof peeled === "object" && peeled !== null && !Array.isArray(peeled)) {
+		const candidate = peeled;
+		if (!isRecord$1(candidate["regions"]) && !carriesForeignKey(candidate)) return candidate;
+	}
 	const unwrapped = unwrapVolatileDeep(value);
 	if (typeof unwrapped !== "object" || unwrapped === null || Array.isArray(unwrapped)) return {};
 	const record = unwrapped;
 	const nested = record["regions"];
-	if (typeof nested === "object" && nested !== null && !Array.isArray(nested)) return nested;
-	return record;
+	if (typeof nested !== "object" || nested === null || Array.isArray(nested)) return healedRegionsMap(record);
+	return healedRegionsMap(hasRegionKey(record) ? record : nested);
+}
+/** `value` with ONE `{get(): T}` live reference peeled, exactly like a read. */
+function peelLiveReference(value) {
+	if (value === null || typeof value !== "object") return value;
+	const get = value.get;
+	return typeof get === "function" ? get() : value;
+}
+/** Whether the object carries a sibling-field name where a region id belongs. */
+function carriesForeignKey(record) {
+	return Object.keys(record).some((key) => REGION_MAP_FOREIGN_KEYS.has(key));
+}
+/**
+* Names that belong to the settings SECTION (`Config` in `src/index.ts`) or to
+* one region SLOT (`regionStateConfig`) — never to the `regions` map.
+*
+* They are the signature of a data-loss bug and the list that undoes it. From
+* 5.4.0 to 5.5.0 `mergeRegionCatalog` was handed the WHOLE settings section but
+* read it as the `regions` field, so every boot's directory repair wrote
+* `{ accounts, regions, cliBridge }` INTO the field — replacing the region map
+* and burying the real one under a `regions` key. A live profile ended up five
+* levels deep (one per startup) and 258 KB of duplicated slots.
+*
+* Neither a region id (`cn` / `global`) nor any future one can collide with
+* these names, so removing them from the map is safe, idempotent, and does not
+* discard a region that a newer build might add.
+*/
+const REGION_MAP_FOREIGN_KEYS = /* @__PURE__ */ new Set([
+	"authFile",
+	"accountId",
+	"accounts",
+	"regions",
+	"cliBridge",
+	"enabled",
+	"showCreditsInMainUi",
+	"creditPosition",
+	"lastCatalog",
+	"enabledModelIds",
+	"imageModelIds",
+	"imageToolEnabled",
+	"offModelIds",
+	"contextBudgets",
+	"pool"
+]);
+/** A non-null, non-array object: the only shape a slot or a level can have. */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Whether a map carries at least one real region id. */
+function hasRegionKey(map) {
+	return Object.keys(map).some((key) => WORKBUDDY_REGIONS.includes(key));
+}
+/**
+* How much USER CONFIG one candidate slot actually carries.
+*
+* Used only when the map lost a region and the copies left at different depths
+* disagree — and they do: the bug's own directory repair wrote a slot that held
+* nothing but `lastCatalog` (it started from a map where the region was already
+* missing), while the copy further down still holds the pool the user had
+* checked in. "Shallowest wins" would therefore resurrect the EMPTY one and
+* throw away the real configuration. Depth is not age in this wreckage; CONTENT
+* is the only usable signal.
+*
+* Deliberately counts only non-default, user-authored values: resolved slots
+* carry every schema default, so a slot's key count says nothing.
+*/
+function slotConfigWeight(slot) {
+	let weight = 0;
+	const pool = slot["pool"];
+	if (isRecord$1(pool)) {
+		if (pool["enabled"] === true) weight += 4;
+		if (Array.isArray(pool["memberAccountIds"]) && pool["memberAccountIds"].length > 0) weight += 4;
+		if (Array.isArray(pool["orderAccountIds"]) && pool["orderAccountIds"].length > 0) weight += 2;
+		if (typeof pool["targetModelId"] === "string" && pool["targetModelId"] !== "") weight += 2;
+		if (typeof pool["probeInputTokens"] === "number" && pool["probeInputTokens"] > 0) weight += 1;
+	}
+	for (const key of [
+		"enabledModelIds",
+		"imageModelIds",
+		"offModelIds"
+	]) {
+		const list = slot[key];
+		if (Array.isArray(list) && list.length > 0) weight += 1;
+	}
+	const budgets = slot["contextBudgets"];
+	if (isRecord$1(budgets) && Object.keys(budgets).length > 0) weight += 1;
+	if (slot["enabled"] === false) weight += 1;
+	if (slot["showCreditsInMainUi"] === false) weight += 1;
+	if (slot["imageToolEnabled"] === true) weight += 1;
+	return weight;
+}
+/**
+* The `regions` map with a corrupted document's wreckage removed.
+*
+* Two repairs, both keyed on the bug's signature (a foreign key or a nested
+* `regions` copy) so a HEALTHY map passes through untouched:
+*
+*  1. DROP every key that names a section field or a slot field. Those are the
+*     copies the bug wrote; keeping them means the next save carries them
+*     forward forever.
+*  2. RECOVER a region this level does not have from the copies buried beneath
+*     it. A region that IS here is never replaced — the outer copy is the one
+*     the surviving writers have been updating, and re-reading a stale inner
+*     copy over it is exactly the defect the shape rule above was fixed for.
+*
+* Recovery exists because `global` in the measured profile lived ONLY one level
+* down: without it, the host reads that region as "never configured" and the
+* first write after the fix would delete the user's international pool outright.
+*
+* Among the buried copies of a MISSING region, the one carrying the most user
+* configuration wins rather than the shallowest — see {@link slotConfigWeight}:
+* the bug's own directory repair left `{ lastCatalog }` slots that look newer
+* but hold nothing, one level above the copy with the pool still in it.
+*/
+function healedRegionsMap(map) {
+	const healed = {};
+	for (const [key, slot] of Object.entries(map)) {
+		if (REGION_MAP_FOREIGN_KEYS.has(key)) continue;
+		healed[key] = slot;
+	}
+	const recovered = {};
+	let deeper = map;
+	for (let depth = 0; depth < 8; depth += 1) {
+		const nested = deeper["regions"];
+		if (!isRecord$1(nested)) break;
+		for (const region of WORKBUDDY_REGIONS) {
+			if (region in map) continue;
+			const candidate = nested[region];
+			if (!isRecord$1(candidate)) continue;
+			const weight = slotConfigWeight(candidate);
+			const best = recovered[region];
+			if (best === void 0 || weight > best.weight) recovered[region] = {
+				slot: candidate,
+				weight
+			};
+		}
+		deeper = nested;
+	}
+	for (const [region, entry] of Object.entries(recovered)) healed[region] = entry.slot;
+	return healed;
+}
+/**
+* Whether the stored `regions` FIELD still carries the debris described at
+* {@link REGION_MAP_FOREIGN_KEYS}.
+*
+* Pass the field itself (`Config['regions']`), not the whole section: the
+* section legitimately has `accounts` / `cliBridge` beside `regions`, so asking
+* that question of a section would always answer "corrupt".
+*
+* The catalog repair uses it to write even when the model directory already
+* matches: without that, a profile whose directory is in agreement would never
+* be cleaned — the very shape that made the pool look unsaved would outlive the
+* fix that stops producing it.
+*/
+function regionsFieldIsCorrupt(value) {
+	const unwrapped = unwrapVolatileDeep(value);
+	if (!isRecord$1(unwrapped)) return false;
+	return Object.keys(unwrapped).some((key) => REGION_MAP_FOREIGN_KEYS.has(key));
 }
 /** One region's stored slot as a plain object; any other shape reads as empty. */
 function regionSlotOf(value, region) {
@@ -534,8 +729,8 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 /**
 * Writing the model's saved directory back to the Host's settings document.
 *
-* THE HOST-SIDE HALF OF ISSUES #114/#115. The card's own save path lives in
-* the browser half (`src/client/`), but the repair that heals a STALE saved
+* THE HOST-SIDE HALF OF ISSUES #114/#115. The card's own save path lives in the
+* browser half (`src/client/`), but the repair that heals a STALE saved
 * directory has to happen where the LIVE roster lands — inside the Host
 * process, right after the upstream answered. So this module writes through
 * the Host's own settings service, using the same merge discipline the
@@ -548,6 +743,19 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 * replaced, every other key of the slot is preserved, and the sibling region
 * is untouched.
 *
+* THE VALUE THIS MODULE WRITES IS THE `regions` FIELD, NOT THE SETTINGS
+* SECTION. That distinction is the whole of this bug — reported as
+* "账号池状态重启就失效". `describe()` hands back the resolved SECTION
+* (`{authFile, accounts, regions, cliBridge, …}`), and
+* `mutate(ns, [{ op: 'set', path: ['regions'], … }])` stores whatever it is
+* given AT that path. Handing it the section therefore wrote the section INTO
+* the field: the real region map was pushed down under a nested `regions` key,
+* its own siblings (`accounts`, `cliBridge`) became fake region slots, and the
+* Host's `regionStateOf(config, 'cn')` — which reads exactly one level — then
+* answered "no slot". Every account-pool preference, model selection and
+* directory looked unsaved after the next restart, and each startup added
+* another level (measured on a live profile: five levels, 258 KB).
+*
 * WHY THE HOST SERVICE RATHER THAN THE SCOPE. The plugin's browser half
 * writes through the Host's settings endpoint because the browser-side
 * `scope.set()` replaces the whole field with the browser's own (possibly
@@ -558,25 +766,27 @@ const WORKBUDDY_SETTINGS_NS = "workbuddy";
 * @module dsh-connect-workbuddy/catalog-write
 */
 /**
-* Merge one region's repaired directory into the `regions` field, preserving
-* every other key of that region's slot and the whole sibling region.
+* Merge one region's repaired directory into the `regions` FIELD.
+*
+* `current` may be EITHER the resolved settings section (what `describe()`
+* answers, and what {@link writeRegionCatalog} passes) OR the bare `regions`
+* field; `regionsMapOf` narrows both and heals a document the bug above already
+* corrupted. The RETURN value is always the field itself — the exact shape
+* `path: ['regions']` expects — never the section around it.
 *
 * The merge is done on the AUTHORITATIVE value the settings service holds —
 * not on a snapshot the caller brought — because a snapshot can be stale and
 * a stale merge is how the other region disappears.
 */
 function mergeRegionCatalog(current, region, catalog) {
-	const field = unwrapVolatileDeep(current) ?? {};
-	const regions = field["regions"] ?? {};
-	const slot = regions[region] ?? {};
+	const regions = regionsMapOf(current);
+	const stored = regions[region];
+	const slot = typeof stored === "object" && stored !== null && !Array.isArray(stored) ? stored : {};
 	return {
-		...field,
-		regions: {
-			...regions,
-			[region]: {
-				...slot,
-				lastCatalog: catalog
-			}
+		...regions,
+		[region]: {
+			...slot,
+			lastCatalog: catalog
 		}
 	};
 }
@@ -601,6 +811,39 @@ async function writeRegionCatalog(service, ns, region, catalog) {
 	}], void 0);
 	return true;
 }
+/**
+* Clean a `regions` field an older build corrupted, WITHOUT touching any
+* region's content.
+*
+* WHY THIS IS SEPARATE FROM {@link writeRegionCatalog}. The catalog repair is
+* the writer that produced the wreckage, so it is also a natural place to clean
+* it — but it only runs when the live roster arrived (an enabled region, a
+* reachable upstream, a non-empty answer). A profile would therefore stay dirty
+* for as long as the network is down, and a region the user has switched OFF
+* would never be cleaned at all. This write needs neither: it is one settings
+* round-trip at boot, and it is a no-op for every healthy profile (a single key
+* scan, no mutation).
+*
+* It is a pure shape fix, not a merge: `regionsMapOf` already answers the
+* healed map, and the field is replaced with exactly that. Reads are correct
+* without this write (they narrow through the same helper), so failing to write
+* costs tidiness only — the caller logs and carries on.
+*
+* @returns whether the write happened.
+*/
+async function healRegionsField(service, ns) {
+	if (service === void 0) return false;
+	const row = service.describe().find((entry) => entry.ns === ns);
+	if (row === void 0) return false;
+	const section = row.value ?? {};
+	if (!regionsFieldIsCorrupt(section["regions"])) return false;
+	await service.mutate(ns, [{
+		op: "set",
+		path: ["regions"],
+		value: regionsMapOf(section)
+	}], void 0);
+	return true;
+}
 //#endregion
 //#region src/credential-recovery.ts
 /** How long a verdict stays fresh by default. */
@@ -4663,22 +4906,26 @@ const INJECT_TEXT_LIMIT = 2e5;
 /**
 * The `source.kind` stamped on every message this module writes.
 *
-* The Host's `MessageSource` is a CLOSED union — `model | user | tool |
-* system-prompt` — and only `user` is available for a message that must be read
-* as an incoming turn: `tool` requires a `callId` from a real tool call this
-* plugin did not make, `model` claims a provider produced it, `system-prompt`
-* would put it in the system slot. So the tag cannot say "a plugin wrote this",
-* and pretending otherwise would mean shipping a type that lies.
-*
-* WHAT COMPENSATES FOR IT: the message opens with `PROVENANCE_LINE`, a bracketed
-* line that names the plugin and the command. A human scanning the transcript
-* can tell an injected result from something they typed, and so can the model —
-* which matters because a model that mistakes it for a human instruction will
-* act on it as one.
-*/
-const INJECT_SOURCE_KIND = "user";
-/** The first line of every injected message. Not decoration: it is the only
-* provenance signal the closed `source` union leaves available. */
+* This used to be `'user'`, on the reading that `MessageSource` is a closed
+* union and `'user'` is the only slot a plugin-written turn message can occupy.
+* That reading was wrong. `MessageSourceMap` is MERGE-EXTENSIBLE — its own doc
+* comment says "each producer declares its own `kind` in its own module; there
+* is no shared catch-all `plugin` kind", and consumers fall through unknown
+* kinds — so `'user'` was never the only option, it was the dishonest one: the
+* transcript rendered the injected CodeBuddy result as a user bubble, and the
+* UI had no way to label the row as a notification. `dsh-connect-atomcode`
+* stamps `'atomcode-bridge'` for exactly this reason.
+*
+* The declaration that makes the union accept it lives in
+* `src/dsh-llm-augment.d.ts`.
+*
+* `PROVENANCE_LINE` still opens the text: the kind is what the UI and later
+* readers key on, but the text is what the MODEL reads, and a model cannot see
+* `source`.
+*/
+const INJECT_SOURCE_KIND = "codebuddy-bridge";
+/** The first line of every injected message. Not decoration: the model never
+* sees `source.kind`, so this line is its only provenance signal. */
 const PROVENANCE_LINE = "[dsh-connect-workbuddy · 由 /codebuddy 自动回注，不是用户输入]";
 /**
 * An instruction appended so a model does not turn the result into a loop.
@@ -5005,37 +5252,62 @@ const EXIT_GRACE_MS = 3e3;
 */
 const DENY_REASON = "dsh-connect-workbuddy runs this turn unattended; no human is at the terminal to approve tool use";
 /**
-* Roots a global npm install of the CLI can live under, most likely first.
+* Directories that ARE a `node_modules` root a global install can live in,
+* most likely first.
 *
 * WHY THE LIST IS THIS LONG. The first draft knew only about `%APPDATA%\npm`
 * and the two `/usr/*` prefixes, so every nvm, fnm, volta, pnpm, yarn, brew,
 * `~/.local` and `/opt/homebrew` user got "CLI not found" even though it was
 * installed. The version-manager roots cannot be listed statically (they carry
-* a version or a hash in the path), so `versionedCliEntries` globs one level.
+* a version or a hash in the path), so `versionedCliRoots` globs one level.
+*
+* WHY EVERY ENTRY SPELLS OUT ITS OWN LAYOUT. A global npm prefix is not shaped
+* the same way on every platform. On POSIX a prefix holds
+* `<prefix>/lib/node_modules`; on Windows the prefix `%APPDATA%\npm` holds
+* `<prefix>\node_modules` directly and has no `lib` level at all. Appending
+* `lib/node_modules` to every root — which an earlier revision of this list
+* did — produced paths that exist on no Windows machine, so auto-detection
+* failed for every Windows user while the POSIX roots kept working. The
+* pnpm and yarn stores are their own `node_modules` root for the same reason.
 *
 * None of these are probed through PATH, and `cbc` is not a separate target: it
 * is an alias of the same `bin/codebuddy` file inside the package.
 */
-function cliEntryRoots() {
+function cliModuleDirs() {
 	const home = homedir();
-	const roots = [];
+	const dirs = [];
 	const appData = process.env["APPDATA"];
-	if (typeof appData === "string" && appData !== "") roots.push(join(appData, "npm"));
-	roots.push(join(home, ".npm-global"), "/usr/local", "/opt/homebrew", join(home, ".local"));
-	roots.push(join(home, "AppData", "Roaming", "npm"));
-	roots.push(join(home, ".local", "share", "pnpm", "global", "5"), join(home, ".config", "yarn", "global"));
-	roots.push(join(home, ".volta", "tools", "image"));
-	return roots.map((root) => join(root, "lib", "node_modules"));
+	if (typeof appData === "string" && appData !== "") dirs.push(join(appData, "npm", "node_modules"));
+	dirs.push(join(home, "AppData", "Roaming", "npm", "node_modules"));
+	for (const prefix of [
+		join(home, ".npm-global"),
+		"/usr/local",
+		"/opt/homebrew",
+		join(home, ".local")
+	]) dirs.push(join(prefix, "lib", "node_modules"));
+	dirs.push(join(home, ".local", "share", "pnpm", "global", "5", "node_modules"));
+	dirs.push(join(home, "Library", "pnpm", "global", "5", "node_modules"));
+	const localAppData = process.env["LOCALAPPDATA"];
+	if (typeof localAppData === "string" && localAppData !== "") {
+		dirs.push(join(localAppData, "pnpm", "global", "5", "node_modules"));
+		dirs.push(join(localAppData, "Yarn", "Data", "global", "node_modules"));
+	}
+	dirs.push(join(home, ".config", "yarn", "global", "node_modules"));
+	return dirs;
 }
 /** Directories whose children are node version roots (`.../versions/node/<v>`). */
 function versionedCliRoots() {
 	const home = homedir();
-	return [
+	const roots = [
 		join(home, ".nvm", "versions", "node"),
 		join(home, "n", "versions", "node"),
 		join(home, ".fnm", "node-versions"),
-		join(home, ".local", "share", "fnm", "node-versions")
+		join(home, ".local", "share", "fnm", "node-versions"),
+		join(home, ".volta", "tools", "image", "node")
 	];
+	const appData = process.env["APPDATA"];
+	if (typeof appData === "string" && appData !== "") roots.push(join(appData, "fnm", "node-versions"));
+	return roots;
 }
 /** Expand one directory's children into CLI entries, ignoring unreadable ones. */
 function childrenOf(dir, separator) {
@@ -5047,21 +5319,21 @@ function childrenOf(dir, separator) {
 }
 /** Every path a global install of the CLI could live at, most likely first. */
 function cliEntryCandidates() {
-	const out = [...cliEntryRoots().map((root) => join(root, CLI_PACKAGE_PATH))];
+	const out = [...cliModuleDirs().map((dir) => join(dir, CLI_PACKAGE_PATH))];
 	for (const versions of versionedCliRoots()) {
 		out.push(...childrenOf(versions, [
 			"lib",
 			"node_modules",
 			CLI_PACKAGE_PATH
 		]));
-		out.push(...childrenOf(join(versions), [
+		out.push(...childrenOf(versions, [
 			"installation",
 			"lib",
 			"node_modules",
 			CLI_PACKAGE_PATH
 		]));
 	}
-	return out;
+	return [...new Set(out)];
 }
 /**
 * Locate the CLI's JS entry.
@@ -5217,6 +5489,8 @@ function runOneTurn(options, token) {
 		const assistantText = [];
 		let assistantChars = 0;
 		const toolCounts = /* @__PURE__ */ new Map();
+		let liveToolCalls = 0;
+		let lastToolName = "";
 		const deniedTools = [];
 		let stderr = "";
 		let buffer = "";
@@ -5361,7 +5635,21 @@ function runOneTurn(options, token) {
 							return;
 						}
 						assistantText.push(block.text);
-					} else if (block.type === "tool_use" && typeof block.name === "string") toolCounts.set(block.name, (toolCounts.get(block.name) ?? 0) + 1);
+						options.onProgress?.({
+							toolCalls: liveToolCalls,
+							lastTool: lastToolName,
+							chars: assistantChars
+						});
+					} else if (block.type === "tool_use" && typeof block.name === "string") {
+						toolCounts.set(block.name, (toolCounts.get(block.name) ?? 0) + 1);
+						liveToolCalls += 1;
+						lastToolName = block.name;
+						options.onProgress?.({
+							toolCalls: liveToolCalls,
+							lastTool: lastToolName,
+							chars: assistantChars
+						});
+					}
 				}
 				if (frame.type === "result") {
 					settle(frame);
@@ -5472,6 +5760,16 @@ const EFFORT_LEVELS = [
 const TIMEOUT_SECS_CAP = 1800;
 /** Hard ceiling on the reply length, in characters. */
 const MAX_REPLY_CHARS_CAP = 4e5;
+/**
+* What `cliBridge.sessionContinuity` accepts.
+*
+* `auto` threads the previous CLI session into the next call; `off` leaves every
+* call independent unless the caller passes `session_id` itself. There is no
+* `on`-with-a-different-mechanism value: the one that was measured to work is
+* `--session-id <existing>`, and offering `--continue` (whatever ran last in the
+* cwd) next to it would make two concurrent sessions race for one conversation.
+*/
+const SESSION_CONTINUITY_MODES = ["auto", "off"];
 /** Every field defaulted, so the Host's closed schema always validates. */
 function result(partial) {
 	return {
@@ -5497,11 +5795,62 @@ function result(partial) {
 function clampInt$1(value, fallback, cap) {
 	return Math.max(1, Math.min(cap, typeof value === "number" && Number.isFinite(value) ? Math.floor(value) : fallback));
 }
-/** The throwaway directory used when the caller explicitly allows no workspace. */
+/**
+* Last CLI session id per DSH session, for automatic continuation.
+*
+* WHY A MAP AND NOT JUST A TOOL ARGUMENT. `--session-id <existing>` really does
+* resume the conversation — measured against the installed CLI: a number sent in
+* turn 1 came back from turn 2, and the CLI echoed the same id both times. But
+* that id only reaches the CLI when the CALLER passes it back as `session_id`,
+* which asks the model to copy a uuid out of the previous result. Best effort,
+* not a guarantee. Remembering the id here makes continuation the default rather
+* than a habit.
+*
+* IN MEMORY ON PURPOSE. The value is a uuid owned by the CLI, and an unknown id
+* is not an error there — the CLI silently starts a fresh session under it. So
+* the failure mode of a lost or stale entry is one new conversation, never a
+* mixed-up one, which is the right trade for a file the plugin would otherwise
+* have to garbage-collect. Bounded (FIFO) so a long-lived process cannot grow it
+* without limit.
+*/
+const CLI_SESSION_MEMORY = /* @__PURE__ */ new Map();
+const CLI_SESSION_MEMORY_CAP = 256;
+/** Remember the CLI session a DSH session should continue next time. */
+function rememberCliSession(sessionKey, cliSessionId) {
+	if (sessionKey === "" || cliSessionId === "") return;
+	CLI_SESSION_MEMORY.delete(sessionKey);
+	CLI_SESSION_MEMORY.set(sessionKey, cliSessionId);
+	while (CLI_SESSION_MEMORY.size > CLI_SESSION_MEMORY_CAP) {
+		const oldest = CLI_SESSION_MEMORY.keys().next();
+		if (oldest.done === true) break;
+		CLI_SESSION_MEMORY.delete(oldest.value);
+	}
+}
+/** The CLI session to continue for this DSH session, or `''` for a fresh one. */
+function recallCliSession(sessionKey) {
+	return CLI_SESSION_MEMORY.get(sessionKey) ?? "";
+}
+/**
+* A throwaway directory for ONE unattended turn.
+*
+* ONE DIRECTORY PER CALL, not a fixed `dsh-codebuddy-scratch`. A single shared
+* path meant two concurrent unattended turns ran in the same writable space —
+* each could read and overwrite the other's files, and anything a previous turn
+* left behind was still there. `mkdtemp` guarantees a fresh, empty, uniquely
+* named directory, which is what makes the "exempt by construction" argument in
+* `resolveWorkingDir` actually true.
+*/
 function scratchDir() {
-	const dir = join(tmpdir(), "dsh-codebuddy-scratch");
-	mkdirSync(dir, { recursive: true });
-	return dir;
+	return mkdtempSync(join(tmpdir(), "dsh-codebuddy-scratch-"));
+}
+/** Best-effort removal: a locked file must not turn a finished turn into an error. */
+function removeScratch(dir) {
+	try {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
 }
 /** Case-fold a path on the platforms whose filesystems ignore case. */
 function foldCase(path) {
@@ -5729,16 +6078,77 @@ function sessionKeyOf(execution, fallback) {
 	const id = execution?.agent?.id;
 	return typeof id === "string" && id !== "" ? id : fallback;
 }
-/**
-* Run one bridged turn and return the complete result object.
-*
-* Exported because the `/codebuddy` slash command needs the same turn with the
-* same validation — a command that re-implemented this would drift from the tool
-* the first time either side gained a knob.
-*/
-async function runAsk(args, execution, deps) {
-	const startedAt = Date.now();
+/** The part of a turn that runs once the budget and the directory are settled. */
+async function runAskTurn(args, execution, deps, context) {
+	const { startedAt, dir, message, effort, modelArg, effectiveMode, liveTurn } = context;
 	const { options, regions, log } = deps;
+	let credentials;
+	try {
+		credentials = await resolveCredentials(regions, options.regionOrder, log);
+	} catch (error) {
+		return result({
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+	const sessionIdArg = typeof args["session_id"] === "string" ? args["session_id"].trim() : "";
+	const signal = execution?.signal;
+	const sessionKey = sessionKeyOf(execution, "codebuddy_ask");
+	const continuedSessionId = sessionIdArg !== "" ? sessionIdArg : options.sessionContinuity === "auto" ? recallCliSession(sessionKey) : "";
+	if (liveTurn !== void 0) liveTurn.phase = "running";
+	const outcome = await runAgent({
+		prompt: message,
+		cwd: dir.dir,
+		binary: options.binary,
+		model: modelArg !== "" ? modelArg : options.model,
+		permissionMode: effectiveMode,
+		effort: effort !== "" ? effort : options.effort,
+		appendSystemPrompt: options.appendSystemPrompt,
+		maxTurns: clampInt$1(args["max_turns"], options.maxTurns, 100),
+		timeoutMs: clampInt$1(args["timeout_secs"], options.timeoutSecs, TIMEOUT_SECS_CAP) * 1e3,
+		...continuedSessionId !== "" ? { sessionId: continuedSessionId } : {},
+		...signal !== void 0 ? { signal } : {},
+		...liveTurn === void 0 ? {} : { onProgress: (progress) => {
+			liveTurn.toolCalls = progress.toolCalls;
+			liveTurn.lastTool = progress.lastTool;
+			liveTurn.chars = progress.chars;
+		} }
+	}, credentials, log);
+	if (liveTurn !== void 0) liveTurn.phase = "finishing";
+	let reply = outcome.text;
+	let truncated = false;
+	if (reply.length > options.maxReplyChars) {
+		const omitted = reply.length - options.maxReplyChars;
+		reply = `${reply.slice(0, options.maxReplyChars)}\n\n[truncated by dsh-connect-workbuddy: ${String(omitted)} more characters. Have CodeBuddy write the full text to a file and read it back.]`;
+		truncated = true;
+	}
+	const tools = [...outcome.toolCounts.entries()].slice(0, 12).map(([name, count]) => ({
+		name,
+		count
+	}));
+	rememberCliSession(sessionKey, outcome.sessionId ?? "");
+	return result({
+		ok: outcome.ok,
+		reply,
+		session_id: outcome.sessionId ?? "",
+		tools,
+		denied_tools: [...outcome.deniedTools],
+		tool_calls: [...outcome.toolCounts.values()].reduce((sum, count) => sum + count, 0),
+		num_turns: outcome.numTurns ?? 0,
+		tokens_in: outcome.usage?.input_tokens ?? 0,
+		tokens_out: outcome.usage?.output_tokens ?? 0,
+		cache_read_tokens: outcome.usage?.cache_read_input_tokens ?? 0,
+		credential_region: outcome.credential.region,
+		working_dir: dir.dir,
+		unattended: dir.unattended,
+		elapsed_ms: Date.now() - startedAt,
+		truncated,
+		error: outcome.error ?? ""
+	});
+}
+async function runAsk(args, execution, deps, entrance = "tool") {
+	const startedAt = Date.now();
+	const { options, log } = deps;
 	const mode = typeof args["permission_mode"] === "string" ? args["permission_mode"].trim() : "";
 	if (mode !== "" && !PERMISSION_MODES.includes(mode)) return result({
 		ok: false,
@@ -5760,73 +6170,48 @@ async function runAsk(args, execution, deps) {
 		error: dir.reason
 	});
 	const entry = (deps.gate ?? gateFor(options)).tryEnter(sessionKeyOf(execution, "codebuddy_ask"), (message) => log(message));
-	if (!entry.ok) return result({
-		ok: false,
-		error: entry.error
-	});
+	if (!entry.ok) {
+		if (dir.unattended) removeScratch(dir.dir);
+		return result({
+			ok: false,
+			error: entry.error
+		});
+	}
 	try {
-		let credentials;
+		const modelArg = typeof args["model"] === "string" ? args["model"].trim() : "";
+		const effectiveMode = mode !== "" ? mode : options.permissionMode;
+		const liveTurn = deps.live?.begin({
+			entrance,
+			workingDir: dir.dir,
+			unattended: dir.unattended,
+			permissionMode: effectiveMode,
+			model: modelArg !== "" ? modelArg : options.model,
+			...execution?.agent?.id !== void 0 ? { sessionId: execution.agent.id } : {}
+		});
 		try {
-			credentials = await resolveCredentials(regions, options.regionOrder, log);
+			return await runAskTurn(args, execution, deps, {
+				startedAt,
+				dir,
+				message,
+				effort,
+				mode,
+				modelArg,
+				effectiveMode,
+				entry,
+				...liveTurn === void 0 ? {} : { liveTurn }
+			});
 		} catch (error) {
 			return result({
 				ok: false,
-				error: error instanceof Error ? error.message : String(error)
+				error: error instanceof Error ? error.message : String(error),
+				elapsed_ms: Date.now() - startedAt
 			});
+		} finally {
+			if (liveTurn !== void 0) deps.live?.end(liveTurn);
 		}
-		const modelArg = typeof args["model"] === "string" ? args["model"].trim() : "";
-		const sessionIdArg = typeof args["session_id"] === "string" ? args["session_id"].trim() : "";
-		const signal = execution?.signal;
-		const outcome = await runAgent({
-			prompt: message,
-			cwd: dir.dir,
-			binary: options.binary,
-			model: modelArg !== "" ? modelArg : options.model,
-			permissionMode: mode !== "" ? mode : options.permissionMode,
-			effort: effort !== "" ? effort : options.effort,
-			appendSystemPrompt: options.appendSystemPrompt,
-			maxTurns: clampInt$1(args["max_turns"], options.maxTurns, 100),
-			timeoutMs: clampInt$1(args["timeout_secs"], options.timeoutSecs, TIMEOUT_SECS_CAP) * 1e3,
-			...sessionIdArg !== "" ? { sessionId: sessionIdArg } : {},
-			...signal !== void 0 ? { signal } : {}
-		}, credentials, log);
-		let reply = outcome.text;
-		let truncated = false;
-		if (reply.length > options.maxReplyChars) {
-			const omitted = reply.length - options.maxReplyChars;
-			reply = `${reply.slice(0, options.maxReplyChars)}\n\n[truncated by dsh-connect-workbuddy: ${String(omitted)} more characters. Have CodeBuddy write the full text to a file and read it back.]`;
-			truncated = true;
-		}
-		const tools = [...outcome.toolCounts.entries()].slice(0, 12).map(([name, count]) => ({
-			name,
-			count
-		}));
-		return result({
-			ok: outcome.ok,
-			reply,
-			session_id: outcome.sessionId ?? "",
-			tools,
-			denied_tools: [...outcome.deniedTools],
-			tool_calls: [...outcome.toolCounts.values()].reduce((sum, count) => sum + count, 0),
-			num_turns: outcome.numTurns ?? 0,
-			tokens_in: outcome.usage?.input_tokens ?? 0,
-			tokens_out: outcome.usage?.output_tokens ?? 0,
-			cache_read_tokens: outcome.usage?.cache_read_input_tokens ?? 0,
-			credential_region: outcome.credential.region,
-			working_dir: dir.dir,
-			unattended: dir.unattended,
-			elapsed_ms: Date.now() - startedAt,
-			truncated,
-			error: outcome.error ?? ""
-		});
-	} catch (error) {
-		return result({
-			ok: false,
-			error: error instanceof Error ? error.message : String(error),
-			elapsed_ms: Date.now() - startedAt
-		});
 	} finally {
 		entry.release();
+		if (dir.unattended) removeScratch(dir.dir);
 	}
 }
 /**
@@ -5875,7 +6260,7 @@ function mountAskTool(tools, deps) {
 					},
 					session_id: {
 						type: "string",
-						description: "可选：指定 CLI 会话 id，让后续调用接着同一个会话。不传则每次开新会话。"
+						description: "可选：要续接的 CLI 会话 id。留空 = 由插件自动续接本会话上一轮的 CodeBuddy 对话（cliBridge.sessionContinuity=auto 时；=off 时留空就是每次开新会话）。只有想故意开一条新对话、或切到另一条对话时才显式传。"
 					},
 					allow_unattended: {
 						type: "boolean",
@@ -5962,29 +6347,44 @@ const REVIEW_PERMISSION_MODE = "dontAsk";
 * human cannot tell the two apart in the output.
 */
 const REVIEW_BRIEF = "评审当前工作区里未提交的改动（git 未提交改动；没有未提交改动时看最近一次提交）。自己运行 git 命令确认范围，必要时读相关文件理解上下文，然后给出评审结论：哪些地方有问题、为什么、怎么改。只报你确实看见的问题，不要猜。";
+/** The mode `--edit` selects for the one turn it appears on. */
+const EDIT_PERMISSION_MODE = "acceptEdits";
 /**
-* What the composer line becomes.
+* Read the composer line.
 *
 * Empty → the review brief. Non-empty → the text verbatim, because a human who
 * typed something meant it, and silently prepending a review brief to "改一下
 * 这个 bug" is how a command does something other than what it was asked.
+*
+* `--edit` is stripped and remembered rather than forwarded: CodeBuddy must not
+* see a flag that only means something to this bridge.
 */
-function composeCommandPrompt(raw) {
+function parseCommandInput(raw) {
 	const note = raw.trim();
-	return note === "" ? REVIEW_BRIEF : note;
+	if (note === "") return {
+		prompt: REVIEW_BRIEF,
+		label: "（未提交改动）",
+		review: true,
+		permissionMode: REVIEW_PERMISSION_MODE
+	};
+	const edit = /^--edit(?:\s|$)/u.test(note);
+	const body = edit ? note.replace(/^--edit\s*/u, "").trim() : note;
+	if (body === "") return {
+		prompt: REVIEW_BRIEF,
+		label: "（未提交改动，可写）",
+		review: true,
+		permissionMode: EDIT_PERMISSION_MODE
+	};
+	return {
+		prompt: body,
+		label: edit ? `（可写：${body}）` : `（指令：${body}）`,
+		review: false,
+		permissionMode: edit ? EDIT_PERMISSION_MODE : ""
+	};
 }
 /** A one-line label saying how the human's words were used. */
 function commandScopeLabel(raw) {
-	const note = raw.trim();
-	return note === "" ? "（未提交改动）" : `（指令：${note}）`;
-}
-/** Whether this invocation is the built-in review (empty line). */
-function isReviewInvocation(raw) {
-	return raw.trim() === "";
-}
-/** The permission mode this invocation runs in. */
-function permissionModeForInvocation(raw) {
-	return isReviewInvocation(raw) ? REVIEW_PERMISSION_MODE : "";
+	return parseCommandInput(raw).label;
 }
 /**
 * Render one turn outcome as the plain text a command result carries.
@@ -6005,7 +6405,7 @@ function formatCommandOutcome(value, extra = {}) {
 	const body = value.reply.trim();
 	const head = body === "" ? `CodeBuddy 完成${scope}：没有输出任何结论。` : `CodeBuddy 完成${scope}：\n\n${body}`;
 	const toolList = value.tools.length > 0 ? value.tools.map((tool) => tool.count > 1 ? `${tool.name}×${String(tool.count)}` : tool.name).join(", ") : "无";
-	const denied = value.denied_tools.length > 0 ? `\n\n[注意：CodeBuddy 请求过这些工具但被拒绝：${value.denied_tools.join(", ")}。评审类任务读到这些就该够了；要它真动手请写明要求并显式指定权限模式]` : "";
+	const denied = value.denied_tools.length > 0 ? `\n\n[注意：CodeBuddy 请求过这些工具但被拒绝：${value.denied_tools.join(", ")}。评审类任务读到这些就该够了；要它真动手，在指令前加 --edit（只影响这一轮），或在配置里设 cliBridge.permissionMode=acceptEdits（影响之后每一轮）]` : "";
 	const footer = `\n\n[session_id=${value.session_id === "" ? "?" : value.session_id} turns=${String(value.num_turns)} tool_calls=${String(value.tool_calls)} tools=${toolList} tokens=${String(value.tokens_in)}in/${String(value.tokens_out)}out (cache_read=${String(value.cache_read_tokens)}) elapsed_ms=${String(value.elapsed_ms)} cred=${value.credential_region}` + (value.working_dir !== "" ? ` dir=${value.working_dir}` : "") + "]";
 	const truncated = value.truncated ? "\n\n[注意：输出已截断。让 CodeBuddy 把完整内容写到文件里再读，别只靠这一份摘要]" : "";
 	const delivery = extra.injection === void 0 ? "" : `\n\n${formatInjection(extra.injection)}`;
@@ -6031,8 +6431,8 @@ function mountCodebuddyCommand(commands, deps) {
 	try {
 		return commands.register({
 			name: COMMAND_NAME,
-			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
-			input: { hint: "可留空：直接评审当前工作区未提交的改动；或写你的要求（如\"修一下这个空指针\"）" },
+			description: "用 CodeBuddy 在当前工作区跑一轮；留空 = 评审未提交改动；以 --edit 开头 = 这一轮允许改文件。注意：默认（cliBridge.injectResult=true）跑完会把结论回注给本会话的模型，那一次唤醒会真的消耗 DSH token；设 injectResult=false 才完全不碰模型。CodeBuddy 那一侧的账号额度每次都会消耗。",
+			input: { hint: "留空 = 评审未提交改动；写要求 = 只读执行（如\"看一下这个函数为什么崩\"）；要以 --edit 开头 = 允许改文件（如\"--edit 修一下这个空指针\"）" },
 			handler: async (invocation) => {
 				const cwd = invocation.agent?.session?.header?.cwd;
 				if (typeof cwd !== "string" || cwd.trim() === "") return {
@@ -6040,18 +6440,17 @@ function mountCodebuddyCommand(commands, deps) {
 					text: "这个会话没有工作区路径（session.header.cwd 为空），无法确定 CodeBuddy 该在哪里跑。请在一个打开过目录的会话里再试。"
 				};
 				const raw = typeof invocation.rawInput === "string" ? invocation.rawInput : "";
-				const message = composeCommandPrompt(raw);
-				const review = isReviewInvocation(raw);
+				const parsed = parseCommandInput(raw);
 				const startedAt = Date.now();
 				try {
 					const value = await runAsk({
-						message,
+						message: parsed.prompt,
 						working_dir: cwd,
-						...review ? { permission_mode: permissionModeForInvocation(raw) } : {}
+						...parsed.permissionMode !== "" ? { permission_mode: parsed.permissionMode } : {}
 					}, {
 						...invocation.agent !== void 0 ? { agent: invocation.agent } : {},
 						...invocation.signal !== void 0 ? { signal: invocation.signal } : {}
-					}, deps);
+					}, deps, "command");
 					log(`command /${COMMAND_NAME} finished in ${String(Date.now() - startedAt)}ms (ok=${String(value.ok)})`);
 					const injection = value.ok && options.injectResult ? injectOutcome(invocation.agent, {
 						reply: value.reply,
@@ -6083,6 +6482,67 @@ function mountCodebuddyCommand(commands, deps) {
 	}
 }
 //#endregion
+//#region src/cli-bridge/live.ts
+/**
+* Build a board.
+*
+* Ordering is "oldest first", which is the order a human reads a queue in; the
+* chip draws the newest as the headline because that is the one the last click
+* started.
+*/
+function createLiveBoard() {
+	const turns = [];
+	let counter = 0;
+	const begin = (input) => {
+		counter += 1;
+		const startedAt = Date.now();
+		const turn = {
+			id: `${startedAt.toString(36)}-${String(counter)}`,
+			startedAt,
+			entrance: input.entrance,
+			workingDir: input.workingDir,
+			unattended: input.unattended,
+			permissionMode: input.permissionMode,
+			model: input.model,
+			sessionId: input.sessionId ?? "",
+			phase: "starting",
+			toolCalls: 0,
+			lastTool: "",
+			chars: 0
+		};
+		turns.push(turn);
+		return turn;
+	};
+	const end = (turn) => {
+		const at = turns.indexOf(turn);
+		if (at >= 0) turns.splice(at, 1);
+	};
+	const snapshot = (now = Date.now()) => ({
+		turns: turns.map((turn) => ({
+			id: turn.id,
+			startedAt: turn.startedAt,
+			elapsedMs: Math.max(0, now - turn.startedAt),
+			entrance: turn.entrance,
+			workingDir: turn.workingDir,
+			unattended: turn.unattended,
+			permissionMode: turn.permissionMode,
+			model: turn.model,
+			sessionId: turn.sessionId,
+			phase: turn.phase,
+			toolCalls: turn.toolCalls,
+			lastTool: turn.lastTool,
+			chars: turn.chars
+		})),
+		serverTime: now
+	});
+	return {
+		begin,
+		end,
+		snapshot,
+		size: () => turns.length
+	};
+}
+//#endregion
 //#region src/cli-bridge/mount.ts
 /**
 * Wiring the CLI route into the plugin, and normalizing its settings.
@@ -6137,6 +6597,7 @@ const CLI_BRIDGE_DEFAULTS = {
 	allowUnattended: false,
 	maxReplyChars: 6e4,
 	injectResult: true,
+	sessionContinuity: "auto",
 	maxTurnsPerSessionHour: 6,
 	maxTurnsPerHour: 20
 };
@@ -6175,6 +6636,9 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 	const safeEffort = effort === "" || EFFORT_LEVELS.includes(effort) ? effort : "";
 	if (safeEffort !== effort) reject(`effort "${effort}" 不是合法值，已回退到 CLI 默认；合法值：${EFFORT_LEVELS.join(", ")}`);
 	const regionOrder = text(raw.regionOrder, CLI_BRIDGE_DEFAULTS.regionOrder);
+	const sessionContinuity = text(raw.sessionContinuity, CLI_BRIDGE_DEFAULTS.sessionContinuity);
+	const safeSessionContinuity = SESSION_CONTINUITY_MODES.includes(sessionContinuity) ? sessionContinuity : CLI_BRIDGE_DEFAULTS.sessionContinuity;
+	if (safeSessionContinuity !== sessionContinuity) reject(`sessionContinuity "${sessionContinuity}" 不是合法值，已回退到 ${CLI_BRIDGE_DEFAULTS.sessionContinuity}；合法值：${SESSION_CONTINUITY_MODES.join(", ")}`);
 	return {
 		enabled: raw.enabled === true,
 		binary: text(raw.binary, CLI_BRIDGE_DEFAULTS.binary),
@@ -6190,6 +6654,7 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 		allowUnattended: raw.allowUnattended === true,
 		maxReplyChars: clampInt(raw.maxReplyChars, CLI_BRIDGE_DEFAULTS.maxReplyChars, MAX_REPLY_CHARS_CAP),
 		injectResult: raw.injectResult !== false,
+		sessionContinuity: safeSessionContinuity,
 		maxTurnsPerSessionHour: clampQuota(raw.maxTurnsPerSessionHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerSessionHour),
 		maxTurnsPerHour: clampQuota(raw.maxTurnsPerHour, CLI_BRIDGE_DEFAULTS.maxTurnsPerHour)
 	};
@@ -6203,14 +6668,17 @@ function normalizeCliBridgeOptions(settings, onRejected) {
 function createCliBridgeRuntime(settings, regions, log) {
 	const options = normalizeCliBridgeOptions(settings, (message) => log(message));
 	if (!options.enabled) return void 0;
+	const live = createLiveBoard();
 	return {
 		options,
 		deps: {
 			options,
 			regions,
 			log,
-			gate: gateFor(options)
-		}
+			gate: gateFor(options),
+			live
+		},
+		live
 	};
 }
 /** Mount `codebuddy_ask` on a tools service, returning its disposer. */
@@ -8782,8 +9250,8 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					if (field !== "regions" && field !== "accounts" && field !== "cliBridge") return json(res, 400, { error: "field must be regions, accounts or cliBridge" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
-					const current = unwrapVolatileDeep(row.value?.[field] ?? {});
-					const incoming = body.value ?? {};
+					const current = field === "regions" ? regionsMapOf(row.value?.[field]) : unwrapVolatileDeep(row.value?.[field] ?? {});
+					const incoming = field === "regions" ? regionsMapOf(body.value) : body.value ?? {};
 					if (field === "cliBridge") {
 						if (!isPlainRecord(incoming)) return json(res, 400, { error: "cliBridge value must be an object" });
 						const mergedBridge = nextCliBridgeSettings(current, incoming);
@@ -8896,6 +9364,41 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* The CLI route's live turns.
+		*
+		* Registered even when the bridge is switched off, and answers an empty
+		* document in that case: the composer chip polls this path unconditionally
+		* (it cannot know the setting — the settings mirror is not readable from a
+		* session component), so "off" has to be a 200 with nothing in it rather
+		* than a 404 the chip would have to special-case.
+		*
+		* No region parameter: a live turn is not scoped to a credential region, and
+		* `requestRegion` would 400 a perfectly valid read.
+		*
+		* A 404 is not an option here, and that is a second reason for the
+		* unconditional registration: the chip keeps showing the last document it
+		* read while a poll fails (it cannot tell "the route is gone" from "the
+		* request dropped"), so a route that vanished on a settings change would
+		* leave a ghost pill describing a turn that already ended. Answering an
+		* empty document keeps "off" inside the same code path as "no turns".
+		*/
+		const disposeCliLive = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_CLI_LIVE_PATH,
+			handler: (req, res) => {
+				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				try {
+					json(res, 200, deps.cliLive?.() ?? {
+						turns: [],
+						serverTime: Date.now()
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		return () => {
 			disposeRefresh();
 			disposeCheckin();
@@ -8908,6 +9411,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			disposeOAuth();
 			disposeTransfer();
 			disposeDiagWrite();
+			disposeCliLive();
 		};
 	}, "dsh-connect-workbuddy: Web status route");
 }
@@ -9096,6 +9600,7 @@ const cliBridgeConfig = z.object({
 	allowUnattended: z.boolean().default(false).description("Allow a bridged call with no directory at all to run in a throwaway temp directory. Off by default: an agent that can edit files should not be aimed at a directory nobody chose."),
 	maxReplyChars: z.number().step(1).min(1).default(6e4).description("Reply length cap handed back to the model, in characters. Clamped to 400000."),
 	injectResult: z.boolean().default(true).description("Hand a successful /codebuddy result to the session model so the conversation knows about it. That wake-up costs a real DSH turn; set false to keep results purely local."),
+	sessionContinuity: z.string().default("auto").description("Whether a second /codebuddy (or codebuddy_ask) in the same session continues the previous CodeBuddy conversation: auto (default) resumes it via --session-id, off starts a fresh one every time. An explicit session_id argument always wins over this setting."),
 	maxTurnsPerSessionHour: z.number().step(1).min(0).default(6).description("Bridged calls allowed per hour in one session. 0 disables the limit."),
 	maxTurnsPerHour: z.number().step(1).min(0).default(20).description("Bridged calls allowed per hour across the whole process. 0 disables the limit.")
 });
@@ -9120,7 +9625,7 @@ const Config = z.object({
 * picks.
 */
 function regionStateOf(config, region) {
-	const stored = unwrapVolatile(config.regions)?.[region];
+	const stored = regionsMapOf(config.regions)[region];
 	if (stored !== void 0 && stored !== null) return stored;
 	if (region !== "cn") return {};
 	const lastCatalog = unwrapVolatile(config.lastCatalog);
@@ -9397,7 +9902,7 @@ function apply(ctx, config) {
 			return rest;
 		});
 		if (repaired.length === 0) return;
-		if (catalogFingerprint(repaired) === catalogFingerprint(saved)) return;
+		if (!(catalogFingerprint(repaired) !== catalogFingerprint(saved)) && !regionsFieldIsCorrupt(current().regions)) return;
 		try {
 			await writeRegionCatalog(hostSettings(), settingsNs, region, repaired);
 		} catch (error) {
@@ -9413,6 +9918,27 @@ function apply(ctx, config) {
 	*/
 	const hostSettings = () => ctx.get?.("settings");
 	/**
+	* Clean a `regions` field a previous version corrupted, once, at boot.
+	*
+	* The corruption itself is fixed at the source (`src/catalog-write.ts`) and the
+	* read paths heal in memory, so a dirty profile is CORRECT long before this
+	* runs — but it stays dirty in the file, and the next save would carry the
+	* debris forward. The catalog repair writes the same clean shape, yet it only
+	* runs when a live roster arrives: a disabled region, an unreachable upstream
+	* or an empty answer would leave the wreckage in place for as long as those
+	* conditions hold. This needs no upstream at all.
+	*
+	* FAIL-SOFT, exactly like the repair: the read side is already right, so a
+	* write that cannot land costs tidiness and nothing else.
+	*/
+	const healRegionsFieldIfCorrupt = async () => {
+		try {
+			await healRegionsField(hostSettings(), settingsNs);
+		} catch (error) {
+			ctx.logger.warn("dsh-connect-workbuddy: could not clean the shape of the regions setting", error);
+		}
+	};
+	/**
 	* Legacy migration for the pre-split single `accountId`: its region is
 	* resolved once from the local account scan and the selection is then
 	* attributed to that region ONLY — the other region keeps its documented
@@ -9650,6 +10176,19 @@ function apply(ctx, config) {
 		client,
 		accountUsable: accountUsabilityProbe,
 		/**
+		* The CLI route's live turns, for the composer readout.
+		*
+		* Read through `cliRuntime` rather than captured once: the runtime is rebuilt
+		* whenever `cliBridge` settings change, and the board belongs to the runtime.
+		* A captured board would keep answering for a runtime nothing drives any
+		* more. Switched off means `undefined`, which the route reports as an empty
+		* document.
+		*/
+		cliLive: () => cliRuntime?.live.snapshot() ?? {
+			turns: [],
+			serverTime: Date.now()
+		},
+		/**
 		* Why each of the region's accounts cannot serve right now, for the composer
 		* panel's table.
 		*
@@ -10638,6 +11177,7 @@ function apply(ctx, config) {
 			return;
 		}
 		if (stopped) return;
+		const regionsFieldHealed = healRegionsFieldIfCorrupt();
 		for (const region of REGION_KEYS) {
 			if (!regionEnabled(current(), region)) continue;
 			(async () => {
@@ -10649,6 +11189,7 @@ function apply(ctx, config) {
 					const state = regionStateOf(current(), region);
 					stacks[region].catalog.set(withEffectiveOff(withImageSelection(deriveCatalog(models, new Set(state.enabledModelIds ?? []), state.contextBudgets ?? {}), new Set(state.imageModelIds ?? [])), new Set(savedOffModelIds(state, models))));
 					adapters[region].invalidate();
+					await regionsFieldHealed;
 					await repairRegionCatalog(region, models);
 				} catch (error) {
 					ctx.logger.warn(`dsh-connect-workbuddy: dynamic ${region} model catalog unavailable; serving the static fallback list`, error);
@@ -10660,4 +11201,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, DEFAULT_PROBE_INPUT_TOKENS, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKEN_CHOICES, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, REFUSES_OFF_MODEL_IDS, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_TPS_PATH, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, defaultOffModelIds, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, knownRegionOf, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, modelIdOfBody, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, offDefaultFor, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, regionsFieldIsCorrupt, regionsMapOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withEffectiveOff, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };