dsh-pentester 1.0.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-pentester",
-  "version": "1.0.0",
+  "version": "2.2.0",
   "description": "Minimal Root-Orchestrator PTES pentesting plugin for DeepSeek Harness",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     }
   },
   "scripts": {
-    "build": "tsdown && node scripts/build-client.mjs",
+    "build": "node scripts/build-id.mjs && tsdown && node scripts/build-client.mjs",
     "typecheck": "tsc --noEmit",
     "check": "pnpm run typecheck && pnpm run build",
     "test": "node --import ./test/resolve-ts.mjs --test \"test/*.test.ts\"",
@@ -60,24 +60,24 @@
   "homepage": "https://github.com/fb0sh/dsh-pentester.git",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.0",
-    "@deepseek-ai/schemastery": "^3.18.0",
     "@deepseek-ai/dsh-client-runtime": "*",
-    "@deepseek-ai/dsh-client-ui-primitives": "*"
+    "@deepseek-ai/dsh-client-ui-primitives": "*",
+    "@deepseek-ai/schemastery": "^3.18.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.7",
     "@deepseek-ai/dsh-typert-protocol": "0.1.0-rc.7",
     "@deepseek-ai/schemastery": "^3.18.1",
     "@types/dockerode": "^3.3.42",
     "@types/node": "^22.20.1",
-    "@types/tar-stream": "^3.1.4",
-    "tsdown": "^0.22.14",
-    "typescript": "~5.9.2",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.0-rc.7",
     "@types/react": "18.3.12",
     "@types/react-dom": "18.3.1",
-    "esbuild": "0.25.0"
+    "@types/tar-stream": "^3.1.4",
+    "esbuild": "0.25.0",
+    "tsdown": "^0.22.14",
+    "typescript": "~5.9.2"
   },
   "exports": {
     ".": {
@@ -93,10 +93,10 @@
   },
   "dependencies": {
     "dockerode": "^5.0.1",
-    "tar-stream": "^3.2.0",
-    "zod": "^4.4.3",
     "react": "18.3.1",
-    "react-dom": "18.3.1"
+    "react-dom": "18.3.1",
+    "tar-stream": "^3.2.0",
+    "zod": "^4.4.3"
   },
   "pnpm": {
     "ignoredBuiltDependencies": [

package/presets/pentester/agent.cordis.yml

@@ -28,8 +28,10 @@
       with a stage handoff summary; (7) when a stage result needs rework, call
       pentester_rollback_stage with the stage id and a reason.
 
-      YOUR TOOL SURFACE IS ORCHESTRATION ONLY: you have the four pentester_*
-      tools, the native ask_user_question, and the subagent control tools
+      YOUR TOOL SURFACE IS ORCHESTRATION ONLY: you have the five pentester_*
+      tools (pentester_start, pentester_delegate, pentester_cancel_delegation,
+      pentester_advance_stage, pentester_rollback_stage), the native
+      ask_user_question, and the subagent control tools
       (send_message, interrupt_agent, list_agents). You have NO bash, file,
       or container-exec tools — you cannot read workspace files, run commands,
       or inspect workers directly. Information reaches you through the injected
@@ -62,72 +64,97 @@
       can see all workers with list_agents. Workers can report important
       findings to you proactively; you will be notified.
 
-      BOOTSTRAP / PRE-ENGAGEMENT: ONE BATCH, NOT A WIZARD.
+      PRE-ENGAGEMENT TOOL-CALL CONTRACT — HARD REQUIREMENT
 
-      When no PentestRun exists in the current session:
-
-      1. Parse any Target / Scope information already supplied by the user.
-      2. Build the COMPLETE fixed Pre-engagement question batch — EXACTLY six
-         questions in strict order (see below). Do NOT invent your own
-         questions, do NOT wrap ask_user_question in another tool, and do NOT
-         ask target, scope, exclusions, RoE, language, or confirmation in
-         separate calls.
-      3. Call ask_user_question EXACTLY ONCE with every required question in
-         a single `questions` array of length 6.
-      4. Host sends ALL six questions to the user in one UI panel. The user
-         answers all of them in one submission.
-      5. Read the answers bundled in the single tool result. If ALL are
-         confirmed (target accepted, scope accepted, exclusions valid, RoE
-         selected, language selected, final_confirm == "确认并开始"), call
-         pentester_advance_stage ONCE to bootstrap the run. Do NOT ask a
-         second confirmation round.
-      6. If ANY answer is not confirmed (target_confirm choice is "目标不正确",
-         scope_confirm is "范围不正确", roe_confirm is "需要自定义 RoE", or
-         final_confirm is "暂不开始"), do NOT bootstrap. Instead, tell the
-         user in natural language which items need correction and why. After
-         the user provides corrections, issue a NEW complete batch — still
-         ONE ask_user_question call, still 6 questions. Never resume from
-         question 3; always the full batch.
-
-      FIXED PRE-ENGAGEMENT BATCH (6 questions, strict order & ids):
+      For a NEW or RESTART assessment, call `ask_user_question` EXACTLY ONCE
+      for Pre-engagement. That single invocation MUST contain exactly six
+      questions in exactly this order:
 
       1. id "target_confirm" — header "🎯 测试目标", question "请确认本次授权渗透测试的 Primary Target。",
          options: [{label: "<parsed target>", description: "使用当前识别的目标"},
-                  {label: "目标不正确", description: "暂不开始测试，我会重新提供目标"}].
-         Replace "<parsed target>" with the target the user already supplied (e.g. "192.168.21.102").
+                  {label: "目标不正确", description: "暂不开始测试，我会重新提供目标"}]
 
       2. id "scope_confirm" — header "📋 授权范围", question "请确认本次允许测试的范围。",
          options: [{label: "<parsed scope>", description: "<scope description>"},
-                  {label: "范围不正确", description: "暂不开始测试，我会重新提供授权范围"}].
-         Replace "<parsed scope>" with what the user supplied (e.g. "仅 192.168.21.102:80").
+                  {label: "范围不正确", description: "暂不开始测试，我会重新提供授权范围"}]
 
       3. id "exclusions_confirm" — header "🚫 排除项", question "除授权范围本身之外，是否还有额外禁止的目标、路径或行为？",
          options: [{label: "无额外排除项", description: "仍严格受上述 Scope 和 RoE 限制"},
-                  {label: "有额外排除项", description: "暂不开始，我会补充排除项"}].
+                  {label: "有额外排除项", description: "暂不开始，我会补充排除项"}]
 
       4. id "roe_confirm" — header "⚔️ 交战规则", question "请选择本次测试的 Rules of Engagement。",
          options: [{label: "标准 RoE", description: "允许主动扫描、漏洞验证和授权范围内的利用；禁止 DoS、破坏性操作和高风险稳定性影响行为"},
                   {label: "仅非侵入式测试", description: "允许信息收集和低风险探测，不进行利用"},
-                  {label: "需要自定义 RoE", description: "暂不开始，我会提供详细规则"}].
+                  {label: "需要自定义 RoE", description: "暂不开始，我会提供详细规则"}]
 
       5. id "language_confirm" — header "🌐 输出语言", question "请选择本次测试的主要输出语言。",
          options: [{label: "中文", description: "使用中文"},
-                  {label: "English", description: "Use English"}].
+                  {label: "English", description: "Use English"}]
 
       6. id "final_confirm" — header "✅ 授权确认", question "请确认以上回答共同构成本次测试的授权边界，并开始测试。",
          options: [{label: "确认并开始", description: "按以上 Target / Scope / Exclusions / RoE / Language 开始测试"},
-                  {label: "暂不开始", description: "当前信息需要修改"}].
+                  {label: "暂不开始", description: "当前信息需要修改"}]
+
+      NEVER ask one of these questions separately.
+      NEVER wait for an earlier answer before submitting the rest.
+      NEVER split the batch across multiple ask_user_question calls.
+      NEVER ask 3+3, 5+1, or any other split.
+      NEVER change the order of these six questions.
+      NEVER omit any question.
+      NEVER duplicate a question ID.
+
+      If you cannot construct all six questions yet, DO NOT CALL
+      ask_user_question until all six are ready.
+
+      The Host validates this contract mechanically before pentester_start.
+      Split questionnaires WILL be rejected.
+
+      CORRECTION ON REJECTION: if pentester_start returns an error like
+      pre_engagement_batch_required, pre_engagement_missing, or
+      pre_engagement_incomplete, you MUST re-issue ALL SIX questions together
+      in one ask_user_question call. NEVER continue from the missing question
+      onward — always re-ask the complete batch.
+
+      BOOTSTRAP / PRE-ENGAGEMENT: ONE BATCH, NOT A WIZARD.
 
-      After all six are confirmed, call pentester_advance_stage ONCE with the
-      run initialization payload — run.targets, run.rules_of_engagement and
-      run.language — plus a summary of the confirmed pre-engagement. The host
-      bootstraps the workspace (run.json, target files, git initial commit)
+      When no PentestRun exists for the current session (see your injected
+      run state — it shows "Target Binding: (none)" when unbound):
+
+      TARGET LIFECYCLE FIRST: Before starting any pre-engagement questions,
+      check the "Existing Targets" list in your injected run state.
+
+      If the user provides a target that already exists in this workspace:
+        → Call ask_user_question EXACTLY ONCE with a single question:
+          id: "existing_target_action"
+          header: "🎯 已有测试目标"
+          question: "检测到该 Target 已有测试流程。"
+          options:
+            [{label: "Continue", description: "打开原有 Root Session 继续测试"},
+             {label: "Restart", description: "清除旧数据，从头开始"}]
+        → If Continue: tell the user to open the existing Root Session
+          (session id shown in the target list). Do NOT create a new run.
+        → If Restart: proceed to the full six-question batch below, then
+          call pentester_start(mode=restart) after final confirmation.
+
+      If the user provides a NEW target:
+        → Run the full six-question batch (see above). After all six are
+          confirmed, call pentester_start(mode=new) ONCE to bootstrap.
+
+      If the session IS already bound to a target:
+        → Continue normal PTES orchestration for that target.
+        → If the user asks to test a DIFFERENT target, tell them to create
+          a new Pentester Root Session in the same project.
+
+      After all six are confirmed, call pentester_start ONCE with the
+      initialization payload — target, scope, rules_of_engagement, language,
+      summary, and mode ("new" or "restart"). The host bootstraps the target
+      workspace (targets.json, run.json, target files, git initial commit)
       and completes pre-engagement, activating Intelligence Gathering.
       Pre-engagement never spawns a worker. pentester_delegate does NOT
       bootstrap: if you call it before a run exists the host refuses. A run
-      is created exactly once and is never re-initialized with a different
-      target. Before that confirmation you MUST NOT call any pentester tool,
-      spawn agents, ping or scan anything.
+      is created exactly once per target and is never re-initialized with a
+      different target. Before that confirmation you MUST NOT call any
+      pentester tool, spawn agents, ping or scan anything.
 
       DELEGATING: Before calling pentester_delegate, first explain to the user
       which worker you are creating, what it will do, and why the current

package/presets/pentester/run-state.mjs

@@ -3,36 +3,11 @@
  *
  * 三个职责（都只在 join 本 preset 的 agent scope 内生效）：
  *
- * 1. 工具注册位置（docs/plan.md §7 / §32）：把 5 个 pentester_* 领域工具
- *    注册进本 preset 的 standing scope（实现由宿主 `pentester` service 提供）。
- *    结果：
- *    - standard Session 完全看不到 pentester_*（宿主不再全局注册）；
- *    - Root Session 看到 4 个 pentester 编排工具（container_exec 由下方
- *      per-Root agent-local restrict 隐藏）；
- *    - Worker child 经官方 Subagent toolFilter deny-list 移除 Root 编排
- *      工具 + ask_user_question，保留 container_exec 与其它继承能力。
- *
- * 2. per-Root 工具面（docs/plan.md §6 / §32）：官方 Subagent child 会 join 本
- *    preset（composeFrom），所以 MOUNT 级 tools.restrict 会把 container_exec
- *    也挡掉（restriction 沿 scope chain 取交集，child 自己的 allow 无法
- *    重新放行）—— 必须把 deny 落在 ROOT agent 自己的 layer 上。agent/created
- *    是发布点（standing mount 的 listener 会收到它下面所有 agent 的事件），
- *    此时 composition 已就绪；child（origin=subagent / delegationDepth>=1）
- *    跳过。通用 subagent/job/bash/fs 工具由**组合排除**（本 preset 不带那些
- *    行），不需要也不允许在这里 deny。
- *
- * 3. Root 动态状态注入：每次 prompt assembly（创建/恢复/继续/compaction
- *    后/Worker wakeup 后都会触发）从 run.json 生成 compact state 注入
- *    system context —— Root 无需 status 工具即可拿到
- *    target / branch / run status / current stage / stage statuses /
- *    delegations 摘要 + 当前 stage 的 Available AgentProfiles
- *    （docs/plan.md §13 / §7）。Worker 不注入（有独立 persona + task prompt）。
- *
- * 本文件随 preset 目录发布（publishPentesterPreset 整体 cp），必须自包含：
- * 不 import 插件 src，只用 Node 标准库。项目目录取自 agent session 的
- * trusted header cwd（host 注入，模型不可伪造）。Available AgentProfiles
- * 清单（stage-profiles.json，由插件 apply 时从 STAGE_DEFINITIONS + AgentProfile
- * registry 生成）与本文件同目录读取；缺失时优雅降级为不渲染该节。
+ * 1. 工具注册位置：把 5 个 pentester_* 领域工具注册进本 preset 的 standing scope。
+ * 2. per-Root 工具面：deny container_exec 落在 Root agent 自己的 layer。
+ * 3. Root 动态状态注入：从 targets.json + run.json 生成 compact state。
+ *    Bound session → shows target's run state。
+ *    Unbound session → shows existing targets in the workspace。
  */
 import { readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
@@ -40,7 +15,6 @@ import { fileURLToPath } from 'node:url'
 
 export const name = 'dsh-pentester-run-state'
 
-/** cordis 插件契约：声明依赖服务后才能在 apply 里访问 ctx.tools / ctx.systemPrompt / ctx.pentester。 */
 export const inject = ['tools', 'systemPrompt', 'pentester']
 
 const STAGE_IDS = [
@@ -53,21 +27,8 @@ const STAGE_IDS = [
   'reporting',
 ]
 
-/**
- * Root 不该看到的工具。**只有 pentester_container_exec**：它是本 preset
- * 注册进 standing scope 的工具，Root 会经继承看到 —— 必须从 Root 的实际
- * Tool Surface 移除（per-Root agent-local restrict，Worker child 不受影响）。
- *
- * 通用 subagent / job / bash / fs 工具**不需要 deny**：本 deployment 的
- * 通用工具行是 per-preset 的（standard 等 preset 自带 tool-bash / tool-fs /
- * tool-subagent / tool-jobs；web-app bundle 把 base 宿主层的同名全局行
- * disabled），pentester preset 的组合里没有这些行 → Root 天然看不到。
- * 不要在这里堆 deny 名字：tools.restrict 对未知名字整体拒绝（先校验后
- * 生效），把其它 preset 才注册的名字加进来会让整个 restrict 抛错。
- */
 export const ROOT_DENY = ['pentester_container_exec']
 
-/** 官方 subagent child（spawn/fork）的 session header 特征。 */
 export function isWorkerAgent(agent) {
   const header = agent?.session?.header
   if (header === null || typeof header !== 'object') return false
@@ -80,28 +41,40 @@ function stageDir(stage) {
   return `${String(index + 1).padStart(2, '0')}-${stage}`
 }
 
-/**
- * 从 workspace git 仓库读当前分支。
- * 直接读 `.git/HEAD`（`ref: refs/heads/<branch>`），不 spawn git 子进程：
- * 本函数在每次 prompt assembly 的同步 text 回调里执行，spawn 会被 DSH
- * sandbox 拦截或向 stderr 泄漏 fatal 输出；纯 fs 读取无副作用且不会抛错。
- * 非 git 仓库 / 读取失败 → 回退 'main'。
- */
-function currentBranch(workspaceRoot) {
-  const head = join(workspaceRoot, '.git', 'HEAD')
-  if (!existsSync(head)) return 'main'
+// ── Target-scoped path helpers ───────────────────────────────────────────────
+
+function targetsJsonPath(projectDir) {
+  return join(projectDir, 'workspace', '.dsh-pentester', 'targets.json')
+}
+
+function targetRoot(projectDir, dirName) {
+  return join(projectDir, 'workspace', 'targets', dirName)
+}
+
+function runJsonPath(targetRootPath) {
+  return join(targetRootPath, '.dsh-pentester', 'run.json')
+}
+
+// ── Registry read ────────────────────────────────────────────────────────────
+
+function loadTargets(projectDir) {
+  const file = targetsJsonPath(projectDir)
+  if (!existsSync(file)) return null
   try {
-    const content = readFileSync(head, 'utf8').trim()
-    const match = /^ref:\s*refs\/heads\/(.+)$/.exec(content)
-    return match === null ? 'detached' : match[1]
+    return JSON.parse(readFileSync(file, 'utf8'))
   } catch {
-    return 'main'
+    return null
   }
 }
 
-/** 读 run.json；不存在（尚未 bootstrap）返回 null。 */
-function loadRun(workspaceRoot) {
-  const file = join(workspaceRoot, '.dsh-pentester', 'run.json')
+function findBoundTarget(projectDir, sessionId) {
+  const registry = loadTargets(projectDir)
+  if (registry === null || !Array.isArray(registry.targets)) return undefined
+  return registry.targets.find(t => t.rootSessionId === sessionId)
+}
+
+function loadRunFile(targetRootPath) {
+  const file = runJsonPath(targetRootPath)
   if (!existsSync(file)) return null
   try {
     return JSON.parse(readFileSync(file, 'utf8'))
@@ -110,11 +83,18 @@ function loadRun(workspaceRoot) {
   }
 }
 
-/**
- * 读取与 preset 同目录发布的 stage → AgentProfile 清单
- * （插件 apply 时由 STAGE_DEFINITIONS + AgentProfile registry 生成）。
- * 文件缺失（旧安装 / 测试）返回 null，渲染时优雅降级。
- */
+function currentBranch(targetRootPath) {
+  const head = join(targetRootPath, '.git', 'HEAD')
+  if (!existsSync(head)) return 'main'
+  try {
+    const content = readFileSync(head, 'utf8').trim()
+    const match = /^ref:\s*refs\/heads\/(.+)$/.exec(content)
+    return match === null ? 'detached' : match[1]
+  } catch {
+    return 'main'
+  }
+}
+
 export function loadStageProfiles() {
   const file = join(fileURLToPath(new URL('.', import.meta.url)), 'stage-profiles.json')
   if (!existsSync(file)) return null
@@ -125,9 +105,10 @@ export function loadStageProfiles() {
   }
 }
 
-/** 生成 compact Root state（绝不注入完整 run.json）。@returns 多行文本。 */
-export function renderCompactState(run, workspaceRoot, language = 'zh-CN', stageProfiles = loadStageProfiles()) {
-  const branch = currentBranch(workspaceRoot)
+// ── Compact state rendering ──────────────────────────────────────────────────
+
+export function renderCompactState(run, targetRootPath, language = 'zh-CN', stageProfiles = loadStageProfiles()) {
+  const branch = currentBranch(targetRootPath)
   if (run === null) {
     return [
       language === 'zh-CN' ? 'PentestRun: (尚未建立)' : 'PentestRun: (not established)',
@@ -142,15 +123,14 @@ export function renderCompactState(run, workspaceRoot, language = 'zh-CN', stage
     ? ['(none)']
     : run.delegations.map(d => `${d.id} ${d.status}${d.agentId === undefined ? '' : ` (${d.agentId})`}`)
   const profiles = stageProfiles === null ? undefined : stageProfiles?.[run.currentStage]
-  // manifest 缺失（旧安装）→ 整节省略，优雅降级；manifest 存在但该 stage 无
-  // 合法 profile（如 pre-engagement）→ 如实渲染 (none)。
   const allowedProfiles = profiles === undefined
     ? undefined
     : profiles.length === 0
       ? ['(none)']
       : profiles.map(p => `- ${p.id} (${p.name})`)
   const state = [
-    `Target: ${run.targets.join(', ') || '(not yet recorded)'}`,
+    `Target: ${run.target || '(not yet recorded)'}`,
+    run.scope ? `Scope: ${run.scope}` : '',
     `Branch: ${branch}`,
     `Run: ${run.status ?? 'active'}`,
     `Current Stage: ${run.currentStage === null ? '(completed)' : stageDir(run.currentStage)}`,
@@ -162,49 +142,78 @@ export function renderCompactState(run, workspaceRoot, language = 'zh-CN', stage
     state.push('', 'Available AgentProfiles:', ...allowedProfiles.map(line => `  ${line}`))
   }
   state.push('', 'Delegations:', ...delegations.map(line => `  ${line}`))
-  return state.join('\n')
+  return state.filter(line => line !== '').join('\n')
 }
 
+/** Render unbound session state: existing targets overview. */
+function renderUnboundState(projectDir, language = 'zh-CN') {
+  const registry = loadTargets(projectDir)
+  if (registry === null || !Array.isArray(registry.targets) || registry.targets.length === 0) {
+    return [
+      language === 'zh-CN'
+        ? 'Target Binding: (none)\n\n尚未创建任何测试目标。使用 pentester_start 创建新目标。'
+        : 'Target Binding: (none)\n\nNo targets created yet. Use pentester_start to create one.',
+    ].join('\n')
+  }
+  const lines = [
+    language === 'zh-CN' ? 'Target Binding: (none)' : 'Target Binding: (none)',
+    '',
+    language === 'zh-CN' ? '现有测试目标：' : 'Existing Targets:',
+  ]
+  for (const t of registry.targets) {
+    const run = loadRunFile(targetRoot(projectDir, t.dirName))
+    const status = run?.status ?? 'unknown'
+    const stage = run?.currentStage ?? 'unknown'
+    lines.push(`  - ${t.target}  status=${status}  stage=${stage}  rootSessionId=${t.rootSessionId ?? 'none'}`)
+  }
+  return lines.join('\n')
+}
+
+// ── Cordis apply ─────────────────────────────────────────────────────────────
+
 export function apply(ctx) {
-  // 1) 工具注册进本 preset 的 standing scope（宿主实现）。fail loud：
-  //    pentester service 缺失说明插件未加载，preset 不该半残挂载。
   if (ctx.pentester === undefined) {
     throw new Error('dsh-pentester plugin is not loaded: "pentester" service missing (cannot register root tools)')
   }
   ctx.pentester.registerRootTools(ctx.tools)
   ctx.pentester.registerContainerExecTool(ctx.tools)
 
-  // 2) per-Root 工具面（见文件头注释）：deny 只落在 Root agent 自己的 layer，
-  //    Worker child 不受影响（child 由官方 toolFilter deny-list 移除 Root 工具）。
   ctx.on('agent/created', ({ agent }) => {
     if (agent == null || isWorkerAgent(agent)) return
     try {
-      // agent.ctx.tools.restrict 在 agent 自己的 layer 上注册 restriction；
-      // agent dispose 时随 scope 一起卸载。
       agent.ctx?.tools?.restrict({ deny: ROOT_DENY })
     } catch (error) {
-      // 正常路径不应触发：container_exec 与本 listener 在同一 mount apply
-      // 里注册，Root 创建时必然已知。catch 只防 HMR 竞态并避免 veto agent
-      // publication；如真的抛错会记日志，便于诊断工具面问题。
       console.error('[dsh-pentester] root tool restriction failed:', error?.message ?? error)
     }
   })
 
-  // 3) 动态 compact state：每次 assembly 求值（含 compaction 后继续、wakeup 后继续）。
-  //    DSH SystemPrompt 内部对 text 返回值调用 text.indexOf(…)，因此 text 回调
-  //    必须 total：永远返回 string；不贡献内容时返回 ''，禁止返回 undefined。
   ctx.systemPrompt?.context({
     name: 'dsh-pentester:run-state',
     order: 900,
     text: (assemblyContext) => {
       const agent = assemblyContext?.agent
-      // Worker 不注入 run-state（有独立 persona + task prompt）。
       if (isWorkerAgent(agent)) return ''
       const cwd = agent?.session?.header?.cwd
       if (typeof cwd !== 'string' || cwd.length === 0) return ''
-      const run = loadRun(cwd)
-      const language = run?.language ?? 'zh-CN'
-      return renderCompactState(run, cwd, language, loadStageProfiles())
+      const sessionId = agent?.session?.id
+      if (typeof sessionId !== 'string' || sessionId.length === 0) return ''
+
+      // Try to find bound target
+      const binding = findBoundTarget(cwd, sessionId)
+      if (binding !== undefined) {
+        const rootPath = targetRoot(cwd, binding.dirName)
+        const run = loadRunFile(rootPath)
+        const language = run?.language ?? 'zh-CN'
+        return [
+          `Target Binding: ${binding.target}`,
+          `Target ID: ${binding.id}`,
+          '',
+          renderCompactState(run, rootPath, language, loadStageProfiles()),
+        ].join('\n')
+      }
+
+      // Unbound: show targets overview
+      return renderUnboundState(cwd, 'zh-CN')
     },
   })
-}
+}