flavor-code 1.4.3-beta.2 → 1.4.4-beta.2

package/README.md

@@ -33,7 +33,7 @@ Flavor Code connects to OpenAI, Anthropic, or compatible services and works with
 | --- | --- | --- |
 | 🖥️ | **One runtime, three entry points** | CLI, Electron, and VS Code share model configuration, sessions, and tooling |
 | 🧭 | **Controlled progress on complex tasks** | Task plans, sub-agents, steering, follow-ups, `/loop`, `/goal`, and conflict-safe parallel execution (tasks owning overlapping files run serially) |
-| 🏝️ | **Flavor Island local control** | Host apps steer a running session over a token-authenticated local IPC channel (Windows named pipes / Unix sockets): abort, steering, follow-ups, and window focus; model duration, token usage, task summaries, and deliverables are reported via hook events |
+| 🏝️ | **Flavor Island local control** | Host apps steer a running session over a token-authenticated local IPC channel (Windows named pipes / Unix sockets): abort, steering, follow-ups, and window focus; model duration, token usage, session titles, task summaries, and deliverables are reported via hook events |
 | ⏪ | **Traceable, resumable results** | Full timeline, checkpoints, rewind, traces, diffs, and failure audits |
 | 🧱 | **Crash-consistent execution** | Fsync-backed event journal, durable steering queue, savepoints, and no automatic replay of non-idempotent tools |
 | 🧠 | **Local long-term context** | Memory, Skills, plugins, and project guides stored on your machine |
@@ -147,6 +147,28 @@ OpenAI-protocol providers default `thinkingEffort` to `high`. Supported values a
 
 Runtime behavior and configuration conventions for OAuth PKCE are described in the [PKCE spec](./docs/specs/pkce-runtime-config.md). The [config schema](./src/config/schema.ts) is the source of truth for all fields.
 
+### Global coding instructions
+
+Coding rules shared across projects are stored in `~/.flavor-code/GLOBAL.md`. You can edit the file manually or use explicit commands to manage single-line Markdown list items. Flavor Code never extracts or writes global rules automatically from conversation. The limit is 64 KiB. Main agents, subagents, and loop workers receive the rules. Edits or deletion are read before the next model call and appended to the current conversation without rewriting its existing prompt-cache prefix.
+
+```text
+/global                         show the path and all rules
+/global remember Keep tests focused  add one rule
+/global forget Keep tests focused    remove one matching list item
+```
+
+`forget` tries an exact text match first, then a unique partial match. It refuses ambiguous matches and preserves other hand-written Markdown.
+
+This feature is enabled by default. Disable it in global or project `flavor.json`:
+
+```json
+{
+  "globalInstructions": { "enabled": false }
+}
+```
+
+When disabled, `GLOBAL.md` is neither read nor injected, and `/global` cannot write it. The default local Shell and terminal still run with the current user's filesystem permissions; use an isolated execution environment if agent-run commands must be unable to modify this file.
+
 ## Entry Points
 
 | Entry point | Best for | How to start |
@@ -184,6 +206,9 @@ Common commands:
 | `/audit` | View tool failure audits |
 
 You can submit steering or queue follow-ups while a run is in progress; once the current model response finishes, the task picks up new instructions at safe boundaries.
+While a run is active, Enter queues the text for the next turn; `/steer <message>` changes the current turn. Type `/queue` to inspect all queued messages, use Up/Down to select one, Enter to move it back to the draft, or `d` to cancel it. Escape closes the queue; outside that view it restores the latest queued message for editing.
+
+When reading older output, a status line indicates if new output has arrived. Press End to return to the latest output, Home to jump to the top, or Ctrl+Up/Down to move between visible turns. Approval and question views keep their action keys visible while their details scroll with PageUp/PageDown or the mouse wheel.
 
 During planned work, a wide CLI shows the main task plan and sub-agent exploration side by side; if only one track exists it uses the full row, and narrow terminals stack both tracks. Long streamed responses keep a live `Writing response` activity below the latest output. LSP tools locate the nearest nested project configuration for each target file, so monorepos and sandbox/worktree projects do not need a `tsconfig.json` or `jsconfig.json` at the Flavor workspace root; JavaScript and CommonJS files are supported by the bundled TypeScript server as well.
 
@@ -300,7 +325,7 @@ A Skill is a `SKILL.md` with YAML frontmatter, placed in `.flavor/skills/<name>/
 
 Plugins live in `.flavor/plugins/` and can register commands, tools, hooks, Skill roots, and model adapters. Official plugins can be installed with the plugin manager: `npx --yes @flavor-code/plugin-manager`. `additionalContext` returned by `SessionStart` and `UserPromptSubmit` hooks is added to the current task context, enabling reliable project-level engineering policy injection. Plugin loads record a content fingerprint plus declared capabilities. Worker/vm isolation is available through the embedding API's `pluginSandbox: true` option; the compatibility default remains in-process because bundled and existing plugins use Node.js APIs that the isolated runtime does not yet mediate.
 
-When the `flavor-island` plugin is loaded, Flavor also starts a Flavor Island local control channel: a loopback-only IPC service (Windows named pipe, or Unix socket on macOS/Linux) secured by a random token. A host app (such as the Flavor Island desktop) can use it to abort, steer, or send follow-ups to a running session, and desktop hosts can also bring their window into focus. The channel's endpoint, token, and capability list are exposed to the host plugin via hook event context (`islandControlEndpoint`/`islandControlToken`/`islandControlCapabilities`); model-call duration and token usage, plus the final task summary and deliverables, are reported through hook events so the host can show live status and a result overview.
+When the `flavor-island` plugin is loaded, Flavor also starts a Flavor Island local control channel: a loopback-only IPC service (Windows named pipe, or Unix socket on macOS/Linux) secured by a random token. A host app (such as the Flavor Island desktop) can use it to abort, steer, or send follow-ups to a running session, and desktop hosts can also bring their window into focus. The channel's endpoint, token, and capability list are exposed to the host plugin via hook event context (`islandControlEndpoint`/`islandControlToken`/`islandControlCapabilities`); model-call duration and token usage, the current session title (desktop custom task name, falling back to the session preview), plus the final task summary and deliverables, are reported through hook events so the host can show live status and a result overview.
 
 > [!WARNING]
 > The default in-process plugin runtime grants full Node.js access. Only install and enable plugins you trust. Sandboxing reduces ambient access but does not make untrusted instructions safe, and plugins that import Node.js built-ins will not load with `pluginSandbox: true` yet.

package/README.zh-CN.md

@@ -33,7 +33,7 @@ Flavor Code 接入 OpenAI、Anthropic 或兼容服务，在受控工作区内使
 | --- | --- | --- |
 | 🖥️ | **一个运行时，三个入口** | CLI、Electron 与 VS Code 共享模型配置、会话和工具能力 |
 | 🧭 | **复杂任务可控推进** | 任务计划、子 Agent、steering、follow-up、`/loop`、`/goal`，并行任务自动避免写冲突（拥有重叠文件的任务串行执行） |
-| 🏝️ | **Flavor Island 本地控制** | 宿主应用通过 token 认证的本机 IPC（Windows named pipe / Unix socket）控制运行中的会话：中止、steering、follow-up 与窗口聚焦；模型耗时、token 用量、任务摘要和交付物随 Hook 事件上报 |
+| 🏝️ | **Flavor Island 本地控制** | 宿主应用通过 token 认证的本机 IPC（Windows named pipe / Unix socket）控制运行中的会话：中止、steering、follow-up 与窗口聚焦；模型耗时、token 用量、会话标题、任务摘要和交付物随 Hook 事件上报 |
 | ⏪ | **结果可追溯、可恢复** | 完整时间线、checkpoint、rewind、trace、Diff 和失败审计 |
 | 🧱 | **崩溃一致执行** | fsync 事件日志、持久 steering 队列、savepoint，非幂等工具不自动重放 |
 | 🧠 | **本地长期上下文** | 记忆、Skill、插件和项目指南均保存在本机 |
@@ -147,6 +147,28 @@ OpenAI 协议 Provider 的 `thinkingEffort` 默认值为 `high`，支持 `minima
 
 OAuth PKCE 的运行时行为与配置约定见 [PKCE 规范](./docs/specs/pkce-runtime-config.md)。完整配置字段以 [配置 Schema](./src/config/schema.ts) 为准。
 
+### 全局编程规范
+
+跨项目编程规范存放在 `~/.flavor-code/GLOBAL.md`。可以手动编辑文件，也可以使用明确的命令管理单行 Markdown 列表项；Flavor Code 不会从对话自动提取或写入全局规范。文件大小上限为 64 KiB。主 Agent、子 Agent 和 loop worker 都会收到这些规范。编辑或删除文件后，下一次模型调用会读取新内容，并把变更追加到当前会话，不改写已有的 prompt cache 前缀。
+
+```text
+/global                         显示文件路径和全部规范
+/global remember 保持测试聚焦    添加一条规范
+/global forget 保持测试聚焦      删除唯一匹配的列表项
+```
+
+`forget` 优先按完整文本匹配，其次按唯一的部分文本匹配；匹配到多条时不会删除。文件中的其他手写 Markdown 会保留。
+
+默认启用。可在全局或项目 `flavor.json` 中关闭：
+
+```json
+{
+  "globalInstructions": { "enabled": false }
+}
+```
+
+关闭时不会读取或注入 `GLOBAL.md`，`/global` 修改命令也不会写入。默认本地 Shell 和终端仍以当前用户权限运行；若需要阻止 Agent 执行的命令修改该文件，需另行使用隔离执行环境。
+
 ## 使用入口
 
 | 入口 | 适合场景 | 启动方式 |
@@ -184,6 +206,9 @@ OAuth PKCE 的运行时行为与配置约定见 [PKCE 规范](./docs/specs/pkce-
 | `/audit` | 查看工具失败审计 |
 
 运行中可以提交 steering 或排队 follow-up；当前模型响应结束后，任务会在安全边界处接收新指令。
+运行中按 Enter 会把输入排到下一轮；输入 `/steer <内容>` 会影响当前回合。输入 `/queue` 可查看全部待发送消息，用上下键选中，按 Enter 移回输入框编辑，或按 `d` 取消。Esc 关闭队列视图；在普通输入界面则会取回最后一条待发送消息供编辑。
+
+查看较早输出时，状态栏会提示是否有新内容。按 End 回到最新输出，Home 跳到顶部，Ctrl+上下键在当前可见的回合间跳转。审批和提问界面的操作键固定显示，详情可用 PageUp/PageDown 或鼠标滚轮翻阅。
 
 有任务规划时，宽终端会把主任务计划与子 Agent 探索左右并排展示；只有一类工作时占满整行，窄终端则自动纵向排列。长内容流式输出期间，最新内容下方会持续显示 `Writing response` 动作。LSP 工具会从目标文件向上寻找最近的嵌套项目配置，因此 monorepo、sandbox 或 worktree 项目无需在 Flavor 工作区根部额外放置 `tsconfig.json` / `jsconfig.json`；内置 TypeScript 服务也支持 JavaScript 与 CommonJS 文件。
 
@@ -300,7 +325,7 @@ Skill 是带有 YAML 头信息的 `SKILL.md`，放在 `.flavor/skills/<name>/`
 
 插件放在 `.flavor/plugins/`，可以注册命令、工具、Hook、Skill 根目录和模型适配器。官方插件可通过插件管理器安装：`npx --yes @flavor-code/plugin-manager`。`SessionStart` 与 `UserPromptSubmit` Hook 返回的 `additionalContext` 会进入当前任务上下文，可用于注入项目级工程规则。插件加载会记录内容指纹与声明的能力。可通过嵌入 API 的 `pluginSandbox: true` 启用 Worker/vm 隔离；由于内置插件和已有插件依赖沙箱尚未代理的 Node.js API，当前兼容默认值仍为进程内运行。
 
-加载 `flavor-island` 插件时，Flavor 会额外启动一个 Flavor Island 本地控制通道：这是一个只监听本机回环的 IPC 服务（Windows 使用 named pipe，macOS/Linux 使用 Unix socket），通过随机 token 认证。宿主应用（如 Flavor Island 桌面端）可以借此对运行中的会话执行中止、steering、follow-up 等操作，桌面端还支持把窗口带到前台（focus）。通道的地址、token 与能力列表会通过 Hook 事件上下文（`islandControlEndpoint`/`islandControlToken`/`islandControlCapabilities`）提供给宿主插件，模型调用的耗时与 token 用量、任务结束时的摘要和交付文件也会随 Hook 事件上报，方便宿主展示运行状态与结果概览。
+加载 `flavor-island` 插件时，Flavor 会额外启动一个 Flavor Island 本地控制通道：这是一个只监听本机回环的 IPC 服务（Windows 使用 named pipe，macOS/Linux 使用 Unix socket），通过随机 token 认证。宿主应用（如 Flavor Island 桌面端）可以借此对运行中的会话执行中止、steering、follow-up 等操作，桌面端还支持把窗口带到前台（focus）。通道的地址、token 与能力列表会通过 Hook 事件上下文（`islandControlEndpoint`/`islandControlToken`/`islandControlCapabilities`）提供给宿主插件，模型调用的耗时与 token 用量、当前会话标题（桌面端自定义任务名，缺省时回退到会话 preview 摘要）、任务结束时的摘要和交付文件也会随 Hook 事件上报，方便宿主展示运行状态与结果概览。
 
 > [!WARNING]
 > 默认的进程内插件运行时拥有完整 Node.js 权限，只安装和启用你信任的插件。沙箱会降低环境权限，但不能让不可信指令自动变安全；目前导入 Node.js 内置模块的插件在 `pluginSandbox: true` 下仍无法加载。

package/dist/agent/loop.d.ts

@@ -29,6 +29,7 @@ export interface AgentLoopOptions {
     extendIterations?: number;
     maxExtensions?: number;
     hasActiveProgress?(): boolean;
+    beforeModelCall?(signal?: AbortSignal): Promise<void>;
     agent?: "main" | "subagent";
     ownerId?: string;
     hallucinationGuard?: HallucinationGuard;