linkshell-cli 0.5.36 → 0.5.38

package/dist/cli/src/runtime/bridge-session.js

@@ -2,7 +2,7 @@ import * as pty from "node-pty";
 import * as http from "node:http";
 import WebSocket from "ws";
 import { hostname, platform, homedir } from "node:os";
-import { writeFileSync, readFileSync, readdirSync, statSync, unlinkSync, mkdirSync, existsSync, openSync, readSync, closeSync } from "node:fs";
+import { writeFileSync, readFileSync, readdirSync, statSync, mkdirSync, existsSync, openSync, readSync, closeSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, basename, resolve, relative, isAbsolute } from "node:path";
 import { agentV2MessageRoute, createEnvelope, parseEnvelope, parseTypedPayload, serializeEnvelope, PROTOCOL_VERSION, } from "@linkshell/protocol";
@@ -14,9 +14,9 @@ import { startKeepAwake } from "../utils/keep-awake.js";
 import { loadOrCreateMachineIdentity } from "../machine-id.js";
 import { getValidToken, refreshAccessToken } from "../auth.js";
 import { AgentSessionProxy } from "./acp/agent-session.js";
-import { AgentWorkspaceProxy, makeAgentV2RemoteConversationId } from "./acp/agent-workspace.js";
+import { AgentWorkspaceProxy } from "./acp/agent-workspace.js";
 import { detectAvailableProviders } from "./acp/provider-resolver.js";
-import { buildLinkShellHookCommand, shouldWriteProjectHooksJson } from "./hook-command.js";
+import { sweepLinkShellHookConfigs } from "./hook-command.js";
 const HEARTBEAT_INTERVAL = 15_000;
 // Transport-layer WS keepalive: ping the gateway periodically; if a pong
 // doesn't arrive before the next ping, the socket is half-open (network
@@ -30,7 +30,6 @@ const RECONNECT_MAX_DELAY = 30_000;
 // arbitrarily long network outages, reconnecting whenever connectivity returns.
 const RECONNECT_MAX_EXPONENT = 5;
 const DEFAULT_TERMINAL_ID = "default";
-const HOOK_BODY_LIMIT = 256 * 1024;
 const SCROLLBACK_LINES = 500;
 // Upper bound on concurrent live terminals — forceNew removed the cwd-dedup
 // ceiling, so bound growth to avoid PTY/fd exhaustion from a runaway client.
@@ -41,113 +40,6 @@ const EXITED_TERMINAL_GRACE_MS = 30_000;
 // Default ports the bridge will proxy tunnel requests to when no explicit
 // allowlist is configured. Covers the common dev servers the app tunnels to.
 const DEFAULT_TUNNEL_PORTS = [3000, 3001, 4321, 5173, 5174, 8080, 8000, 8081];
-const PERMISSION_REQUEST_TIMEOUT_MS = Number(process.env.LINKSHELL_PERMISSION_TIMEOUT_MS ?? 5 * 60_000);
-const HOOK_COMMAND_TIMEOUT_SEC = Math.ceil((PERMISSION_REQUEST_TIMEOUT_MS + 30_000) / 1000);
-const LINKSHELL_PERMISSION_GUARD_MARKER = "LINKSHELL_PERMISSION_GUARD";
-function isLinkShellHookEntry(entry, marker) {
-    let raw = "";
-    try {
-        raw = JSON.stringify(entry);
-    }
-    catch {
-        raw = String(entry);
-    }
-    return ((marker ? raw.includes(`/hook?m=${marker}`) : false) ||
-        raw.includes("/hook?m=lsh-") ||
-        (raw.includes("/hook?m=") && raw.includes("LINKSHELL_ID")));
-}
-function withLinkShellHookEntry(entries, entry, priority) {
-    const cleaned = (Array.isArray(entries) ? entries : []).filter((item) => !isLinkShellHookEntry(item));
-    return priority === "first" ? [entry, ...cleaned] : [...cleaned, entry];
-}
-function guardPermissionCommandForLinkShell(command) {
-    if (typeof command !== "string")
-        return command;
-    if (command.includes(LINKSHELL_PERMISSION_GUARD_MARKER))
-        return command;
-    return [
-        `case "\${LINKSHELL_ID:-}" in lsh-*) exit 0 ;; esac`,
-        `# ${LINKSHELL_PERMISSION_GUARD_MARKER}`,
-        command,
-    ].join("\n");
-}
-function guardPermissionHookObjectForLinkShell(hook) {
-    if (isLinkShellHookEntry(hook))
-        return hook;
-    const next = { ...hook };
-    if (typeof next.command === "string") {
-        next.command = guardPermissionCommandForLinkShell(next.command);
-    }
-    if (typeof next.bash === "string") {
-        next.bash = guardPermissionCommandForLinkShell(next.bash);
-    }
-    return next;
-}
-function guardPermissionHookEntryForLinkShell(entry) {
-    if (isLinkShellHookEntry(entry))
-        return entry;
-    if (typeof entry === "string")
-        return guardPermissionCommandForLinkShell(entry);
-    if (Array.isArray(entry))
-        return entry.map(guardPermissionHookEntryForLinkShell);
-    if (!entry || typeof entry !== "object")
-        return entry;
-    const next = { ...entry };
-    if (Array.isArray(next.hooks)) {
-        next.hooks = next.hooks.map((hook) => hook && typeof hook === "object" && !Array.isArray(hook)
-            ? guardPermissionHookObjectForLinkShell(hook)
-            : guardPermissionHookEntryForLinkShell(hook));
-    }
-    if (typeof next.command === "string" || typeof next.bash === "string") {
-        return guardPermissionHookObjectForLinkShell(next);
-    }
-    return next;
-}
-function withBlockingLinkShellPermissionEntry(entries, entry) {
-    const cleaned = (Array.isArray(entries) ? entries : [])
-        .filter((item) => !isLinkShellHookEntry(item))
-        .map(guardPermissionHookEntryForLinkShell);
-    return [entry, ...cleaned];
-}
-function stringifyHookInput(value) {
-    if (typeof value === "string")
-        return value.slice(0, 1200);
-    if (typeof value === "object" && value) {
-        try {
-            return JSON.stringify(value, null, 2).slice(0, 1200);
-        }
-        catch {
-            return String(value).slice(0, 1200);
-        }
-    }
-    return "";
-}
-function hookPermissionSuggestions(event) {
-    if (isCodexPermissionRequest(event))
-        return [];
-    const snake = event.permission_suggestions;
-    const camel = event.permissionSuggestions;
-    if (Array.isArray(snake))
-        return snake;
-    if (Array.isArray(camel))
-        return camel;
-    return [];
-}
-function isCodexPermissionRequest(event) {
-    if (typeof event.turn_id === "string" || typeof event.turnId === "string")
-        return true;
-    const transcriptPath = event.transcript_path ?? event.transcriptPath;
-    return typeof transcriptPath === "string" && transcriptPath.includes("/.codex/");
-}
-function hookPermissionOptions(suggestions) {
-    return [
-        { id: "deny", label: "拒绝", kind: "deny" },
-        { id: "allow_once", label: "允许一次", kind: "allow" },
-        ...(suggestions.length > 0
-            ? [{ id: "allow_always", label: "始终允许", kind: "allow" }]
-            : []),
-    ];
-}
 function stripGatewayBase(url) {
     url.hash = "";
     url.search = "";
@@ -261,10 +153,6 @@ export class BridgeSession {
     hostToken;
     exited = false;
     stopped = false;
-    permissionStacks = new Map();
-    // Pending permission responses: requestId → HTTP response callback
-    pendingPermissions = new Map();
-    hookMarker = `lsh-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
     screenCapture;
     screenShare;
     tunnelSockets = new Map();
@@ -324,16 +212,12 @@ export class BridgeSession {
             process.stderr.write(`[bridge:verbose] ${msg}\n`);
         }
     }
-    terminalHookMarker(terminalId) {
-        const safeTerminalId = terminalId.replace(/[^a-zA-Z0-9_-]+/g, "-");
-        return `${this.hookMarker}-${safeTerminalId}`;
-    }
     async start() {
         this.log(`starting session (gateway=${this.options.gatewayUrl}, provider=${this.options.providerConfig.provider})`);
         this.machineIdentity = loadOrCreateMachineIdentity();
-        // Sweep stale LinkShell hook entries (dead curl ports) left by a prior crash
-        // before we write fresh ones for this session.
-        this.sweepStaleHookConfigs();
+        // One-shot leftover sweep. Structured agent control is ACP/SDK subprocesses;
+        // we never rewrite hook configs.
+        sweepLinkShellHookConfigs(homedir(), [join(this.defaultCwd, "hooks.json")]);
         if (!this.sessionId) {
             await this.createPairing();
         }
@@ -344,7 +228,6 @@ export class BridgeSession {
             process.stderr.write("[bridge] keep-awake disabled\n");
         }
         if (this.options.agentUi) {
-            process.env.LINKSHELL_ID = this.terminalHookMarker(DEFAULT_TERMINAL_ID);
             const availableProviders = resolveAgentWorkspaceProviders(this.options);
             const agentOptions = {
                 sessionId: this.sessionId,
@@ -584,20 +467,6 @@ export class BridgeSession {
                 }));
                 return;
             }
-            if (envelope.type === "agent.v2.prompt" || envelope.type === "agent.v2.command.execute") {
-                this.refreshAgentPermissionHooks();
-            }
-            // A v2 permission response may be answering an EXTERNAL session's request
-            // that came in through the hook HTTP server (held on a pending connection),
-            // not a workspace-driven one. Resolve that pending hook connection first;
-            // only fall through to the workspace if it wasn't a hook request. Mirrors
-            // the v1 agent.permission.response path.
-            if (envelope.type === "agent.v2.permission.respond") {
-                const p = parseTypedPayload("agent.v2.permission.respond", envelope.payload);
-                if (this.resolvePendingPermission(p.requestId, { outcome: p.outcome === "cancelled" ? "deny" : p.outcome, optionId: p.optionId }, "agent.v2.permission.respond").resolved) {
-                    return;
-                }
-            }
             try {
                 await this.agentWorkspace.handleEnvelope(envelope);
             }
@@ -943,19 +812,11 @@ export class BridgeSession {
                     }));
                     break;
                 }
-                if (envelope.type === "agent.prompt")
-                    this.refreshAgentPermissionHooks();
                 await this.agentSession.handleEnvelope(envelope);
                 break;
             }
             case "agent.permission.response": {
                 const p = parseTypedPayload("agent.permission.response", envelope.payload);
-                if (this.resolvePendingPermission(p.requestId, {
-                    outcome: p.outcome,
-                    optionId: p.optionId,
-                }, "agent.permission.response").resolved) {
-                    break;
-                }
                 if (!this.agentSession) {
                     this.send(createEnvelope({
                         type: "agent.capabilities",
@@ -993,16 +854,7 @@ export class BridgeSession {
             }
             case "permission.decision": {
                 const p = envelope.payload;
-                const result = this.resolvePendingPermission(p.requestId, p.decision, "permission.decision");
-                if (!result.resolved) {
-                    this.sendPermissionSnapshot(tid, "thinking", "permission not pending", {
-                        requestId: p.requestId,
-                        outcome: p.decision,
-                        source: "permission.decision",
-                        delivered: false,
-                    });
-                }
-                process.stderr.write(`[bridge] permission decision request=${p.requestId} decision=${p.decision} resolved=${result.resolved} delivered=${result.delivered}\n`);
+                process.stderr.write(`[bridge] permission.decision ignored (ACP/SDK owns authorization) request=${p.requestId} decision=${p.decision}\n`);
                 this.send(createEnvelope({
                     type: "permission.decision.result",
                     sessionId: this.sessionId,
@@ -1010,14 +862,10 @@ export class BridgeSession {
                     payload: {
                         requestId: p.requestId,
                         decision: p.decision,
-                        resolved: result.resolved,
-                        delivered: result.delivered,
+                        resolved: false,
+                        delivered: false,
                         source: "permission.decision",
-                        message: result.delivered
-                            ? undefined
-                            : result.resolved
-                                ? "Permission resolved but response was not delivered"
-                                : "Permission request is no longer pending",
+                        message: "Authorization is handled by the ACP/SDK agent subprocess",
                     },
                 }));
                 break;
@@ -1231,33 +1079,8 @@ export class BridgeSession {
             if (v !== undefined)
                 cleanEnv[k] = v;
         }
-        const hookMarker = this.terminalHookMarker(terminalId);
-        // Inject marker so child CLIs' hook commands carry our identity
-        cleanEnv["LINKSHELL_ID"] = hookMarker;
         const provider = providerOverride ?? this.options.providerConfig.provider;
         const args = [...this.options.providerConfig.args];
-        // Set up hook server for structured status (all supported providers)
-        // For "custom" shell, set up hooks for all providers since user may launch any of them
-        let hookServer;
-        let hookPort;
-        const hookConfigPaths = [];
-        if (provider === "custom") {
-            const result = await this.setupHookServer(terminalId, args, "claude", hookMarker);
-            hookServer = result.server;
-            hookPort = result.port;
-            hookConfigPaths.push(result.configPath);
-            // Also set up hooks for other providers (curlCmd already has marker from setupHookServer)
-            const curlCmd = buildLinkShellHookCommand(result.port, hookMarker, HOOK_COMMAND_TIMEOUT_SEC);
-            hookConfigPaths.push(this.setupCodexHooks(terminalId, curlCmd, hookMarker));
-            hookConfigPaths.push(this.setupGeminiHooks(terminalId, curlCmd, hookMarker));
-            hookConfigPaths.push(this.setupCopilotHooks(terminalId, curlCmd, hookMarker));
-        }
-        else if (provider === "claude" || provider === "codex" || provider === "gemini" || provider === "copilot") {
-            const result = await this.setupHookServer(terminalId, args, provider, hookMarker);
-            hookServer = result.server;
-            hookPort = result.port;
-            hookConfigPaths.push(result.configPath);
-        }
         const term = {
             id: terminalId,
             pty: pty.spawn(this.options.providerConfig.command, args, {
@@ -1274,10 +1097,6 @@ export class BridgeSession {
             outputSeq: 0,
             statusSeq: 0,
             status: "running",
-            hookServer,
-            hookPort,
-            hookMarker,
-            hookConfigPaths,
         };
         term.pty.onData((data) => {
             const seq = term.outputSeq++;
@@ -1299,7 +1118,6 @@ export class BridgeSession {
         });
         term.pty.onExit(({ exitCode, signal }) => {
             term.status = "exited";
-            this.cleanupHookServer(term);
             this.send(createEnvelope({
                 type: "terminal.exit",
                 sessionId: this.sessionId,
@@ -1338,847 +1156,6 @@ export class BridgeSession {
         this.terminals.set(terminalId, term);
         this.log(`spawned terminal ${terminalId} in ${cwd}`);
     }
-    async setupHookServer(terminalId, args, provider, marker) {
-        const server = http.createServer((req, res) => {
-            this.log(`hook server received: ${req.method} ${req.url}`);
-            const reqUrl = new URL(req.url ?? "/", "http://localhost");
-            if (req.method !== "POST" || reqUrl.pathname !== "/hook") {
-                res.writeHead(404);
-                res.end();
-                return;
-            }
-            // Check marker — reject events not from our PTY
-            // m must match; lid must match OR be empty (some CLIs don't inherit env vars)
-            const reqMarker = reqUrl.searchParams.get("m");
-            const reqLid = reqUrl.searchParams.get("lid") ?? "";
-            if (reqMarker !== marker || (reqLid !== "" && reqLid !== marker)) {
-                this.log(`ignoring hook event: m=${reqMarker} lid=${reqLid} (expected ${marker})`);
-                res.writeHead(200, { "Content-Type": "application/json" });
-                res.end("{}");
-                return;
-            }
-            let body = "";
-            let bodyTooLarge = false;
-            req.on("data", (chunk) => {
-                if (bodyTooLarge)
-                    return;
-                body += chunk.toString();
-                if (Buffer.byteLength(body, "utf8") > HOOK_BODY_LIMIT) {
-                    bodyTooLarge = true;
-                    res.writeHead(413, { "Content-Type": "application/json" });
-                    res.end("{}");
-                    req.destroy();
-                }
-            });
-            req.on("end", () => {
-                if (bodyTooLarge || res.writableEnded)
-                    return;
-                this.log(`hook body (${body.length} bytes): ${body.slice(0, 200)}`);
-                try {
-                    const event = JSON.parse(body);
-                    const hookName = (event.hook_event_name ?? event.event_name);
-                    // PermissionRequest: hold connection, wait for user decision from mobile app
-                    if (hookName === "PermissionRequest") {
-                        const requestId = `pr-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-                        const permissionSuggestions = hookPermissionSuggestions(event);
-                        const timeout = setTimeout(() => {
-                            if (this.resolvePendingPermission(requestId, "deny", "permission.timeout").resolved) {
-                                this.log(`permission request ${requestId} timed out`);
-                                this.sendPermissionSnapshot(terminalId, "thinking", "permission timed out");
-                            }
-                        }, PERMISSION_REQUEST_TIMEOUT_MS);
-                        this.pendingPermissions.set(requestId, {
-                            terminalId,
-                            timeout,
-                            permissionSuggestions,
-                            resolve: (decision) => {
-                                if (res.writableEnded)
-                                    return false;
-                                const responseJson = JSON.stringify({
-                                    hookSpecificOutput: {
-                                        hookEventName: "PermissionRequest",
-                                        decision,
-                                    },
-                                });
-                                res.writeHead(200, { "Content-Type": "application/json" });
-                                res.end(responseJson);
-                                return true;
-                            },
-                        });
-                        // Send status with requestId so app can route decision back
-                        this.handleHookEvent(terminalId, event, provider, requestId);
-                        this.sendHookPermissionRequest(terminalId, event, requestId, provider);
-                    }
-                    else {
-                        // All other hooks: respond immediately with valid JSON so clients
-                        // that parse stdout (Cursor) fail-open instead of blocking the tool.
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end("{}");
-                        this.handleHookEvent(terminalId, event, provider);
-                    }
-                }
-                catch (e) {
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end("{}");
-                    this.log(`hook parse error: ${e}`);
-                }
-            });
-        });
-        // Listen on random port — await binding before reading address
-        const port = await new Promise((resolve, reject) => {
-            server.listen(0, "127.0.0.1", () => {
-                const addr = server.address();
-                resolve(addr.port);
-            });
-            server.on("error", reject);
-        });
-        this.log(`hook server for ${terminalId} (${provider}) listening on port ${port}, marker=${marker}`);
-        const curlCmd = buildLinkShellHookCommand(port, marker, HOOK_COMMAND_TIMEOUT_SEC);
-        let configPath;
-        if (provider === "codex") {
-            configPath = this.setupCodexHooks(terminalId, curlCmd, marker);
-        }
-        else if (provider === "gemini") {
-            configPath = this.setupGeminiHooks(terminalId, curlCmd, marker);
-        }
-        else if (provider === "copilot") {
-            configPath = this.setupCopilotHooks(terminalId, curlCmd, marker);
-        }
-        else {
-            // Claude (default)
-            configPath = this.setupClaudeHooks(terminalId, curlCmd, args, marker);
-        }
-        return { server, port, configPath };
-    }
-    refreshAgentPermissionHooks() {
-        const term = this.terminals.get(DEFAULT_TERMINAL_ID);
-        if (!term?.hookPort)
-            return;
-        const marker = term.hookMarker;
-        const curlCmd = buildLinkShellHookCommand(term.hookPort, marker, HOOK_COMMAND_TIMEOUT_SEC);
-        const providers = resolveAgentWorkspaceProviders(this.options);
-        try {
-            for (const provider of providers) {
-                if (provider === "codex") {
-                    this.setupCodexHooks(DEFAULT_TERMINAL_ID, curlCmd, marker);
-                }
-                else {
-                    // claude, custom
-                    this.setupClaudeHooks(DEFAULT_TERMINAL_ID, curlCmd, [], marker);
-                }
-            }
-        }
-        catch (error) {
-            this.log(`failed to refresh agent permission hooks: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    setupClaudeHooks(terminalId, curlCmd, args, marker) {
-        // Write hooks to ~/.claude/settings.json — Claude Code reads hooks from here
-        const claudeDir = join(homedir(), ".claude");
-        if (!existsSync(claudeDir))
-            mkdirSync(claudeDir, { recursive: true });
-        const settingsPath = join(claudeDir, "settings.json");
-        let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(settingsPath, "utf8"));
-        }
-        catch { /* doesn't exist yet */ }
-        const hookEntry = { matcher: "", hooks: [{ type: "command", command: curlCmd, timeout: 5 }] };
-        const permissionEntry = {
-            matcher: "",
-            hooks: [{
-                    type: "command",
-                    command: curlCmd,
-                    timeout: HOOK_COMMAND_TIMEOUT_SEC,
-                }],
-        };
-        const hookEvents = {
-            PreToolUse: hookEntry,
-            PostToolUse: hookEntry,
-            PostToolUseFailure: hookEntry,
-            Stop: hookEntry,
-            PermissionRequest: permissionEntry,
-            UserPromptSubmit: hookEntry,
-            SessionStart: hookEntry,
-        };
-        // Append our entries to existing hooks (first remove stale linkshell entries)
-        const existingHooks = (existing.hooks ?? {});
-        for (const [eventName, entry] of Object.entries(hookEvents)) {
-            existingHooks[eventName] = eventName === "PermissionRequest"
-                ? withBlockingLinkShellPermissionEntry(existingHooks[eventName], entry)
-                : withLinkShellHookEntry(existingHooks[eventName], entry, "last");
-        }
-        const merged = { ...existing, hooks: existingHooks };
-        writeFileSync(settingsPath, JSON.stringify(merged, null, 2));
-        this.log(`claude hooks appended to ${settingsPath}`);
-        return settingsPath;
-    }
-    setupCodexHooks(terminalId, curlCmd, marker) {
-        // Codex uses ~/.codex/hooks.json — same format as Claude (with matcher)
-        const codexDir = join(homedir(), ".codex");
-        if (!existsSync(codexDir))
-            mkdirSync(codexDir, { recursive: true });
-        // Ensure [features] codex_hooks = true in config.toml
-        const tomlPath = join(codexDir, "config.toml");
-        let tomlContent = "";
-        try {
-            tomlContent = readFileSync(tomlPath, "utf8");
-        }
-        catch { /* doesn't exist yet */ }
-        // Remove top-level codex_hooks (wrong location) and ensure it's under [features]
-        const hasFeatureSection = tomlContent.includes("[features]");
-        const hasCodexHooksUnderFeatures = hasFeatureSection &&
-            /\[features\][^\[]*codex_hooks\s*=\s*true/s.test(tomlContent);
-        if (!hasCodexHooksUnderFeatures) {
-            // Remove any top-level codex_hooks line
-            tomlContent = tomlContent.replace(/^codex_hooks\s*=.*\n?/m, "");
-            if (!tomlContent.includes("[features]")) {
-                tomlContent += `\n[features]\ncodex_hooks = true\n`;
-            }
-            else {
-                tomlContent = tomlContent.replace("[features]", "[features]\ncodex_hooks = true");
-            }
-            writeFileSync(tomlPath, tomlContent);
-            this.log(`enabled codex_hooks under [features] in ${tomlPath}`);
-        }
-        const hooksPath = join(codexDir, "hooks.json");
-        const hookEntry = { matcher: "", hooks: [{ type: "command", command: curlCmd, timeout: 5 }] };
-        const permissionEntry = {
-            matcher: "",
-            hooks: [{
-                    type: "command",
-                    command: curlCmd,
-                    timeout: HOOK_COMMAND_TIMEOUT_SEC,
-                }],
-        };
-        const hookEvents = {
-            SessionStart: hookEntry,
-            PreToolUse: hookEntry,
-            PostToolUse: hookEntry,
-            UserPromptSubmit: hookEntry,
-            Stop: hookEntry,
-            PermissionRequest: permissionEntry,
-        };
-        // Read existing and append
-        let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(hooksPath, "utf8"));
-        }
-        catch { /* doesn't exist yet */ }
-        const existingHooks = existing.hooks ?? {};
-        for (const [eventName, entry] of Object.entries(hookEvents)) {
-            existingHooks[eventName] = eventName === "PermissionRequest"
-                ? withBlockingLinkShellPermissionEntry(existingHooks[eventName], entry)
-                : withLinkShellHookEntry(existingHooks[eventName], entry, "last");
-        }
-        writeFileSync(hooksPath, JSON.stringify({ ...existing, hooks: existingHooks }, null, 2));
-        this.log(`codex hooks appended to ${hooksPath}`);
-        return hooksPath;
-    }
-    setupGeminiHooks(terminalId, curlCmd, marker) {
-        // Gemini uses ~/.gemini/settings.json — same format as Claude (with matcher)
-        const geminiDir = join(homedir(), ".gemini");
-        if (!existsSync(geminiDir))
-            mkdirSync(geminiDir, { recursive: true });
-        const settingsPath = join(geminiDir, "settings.json");
-        const hookEntry = { matcher: "", hooks: [{ type: "command", command: curlCmd, timeout: 5000 }] };
-        const hookEvents = {
-            SessionStart: hookEntry,
-            SessionEnd: hookEntry,
-            BeforeTool: hookEntry,
-            AfterTool: hookEntry,
-        };
-        // Merge with existing settings if present
-        let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(settingsPath, "utf8"));
-        }
-        catch { /* doesn't exist yet */ }
-        const existingHooks = (existing.hooks ?? {});
-        for (const [eventName, entry] of Object.entries(hookEvents)) {
-            existingHooks[eventName] = withLinkShellHookEntry(existingHooks[eventName], entry, "last");
-        }
-        existing.hooks = existingHooks;
-        writeFileSync(settingsPath, JSON.stringify(existing, null, 2));
-        this.log(`gemini hooks appended to ${settingsPath}`);
-        return settingsPath;
-    }
-    setupCopilotHooks(terminalId, curlCmd, marker) {
-        // Copilot loads hooks from CWD as hooks.json. Cursor's coding agent also
-        // reads that file when the folder is a Cursor project — writing it here
-        // freezes every IDE tool call the moment the hook server is down or
-        // returns non-JSON.
-        const cwd = this.terminals.get(terminalId)?.cwd ?? this.defaultCwd;
-        const hooksPath = join(cwd, "hooks.json");
-        if (!shouldWriteProjectHooksJson(cwd)) {
-            this.sweepLinkShellHookEntries(hooksPath);
-            try {
-                if (existsSync(hooksPath)) {
-                    const raw = JSON.parse(readFileSync(hooksPath, "utf8"));
-                    if (!raw.hooks || (typeof raw.hooks === "object" && Object.keys(raw.hooks).length === 0)) {
-                        unlinkSync(hooksPath);
-                    }
-                }
-            }
-            catch { /* leave whatever is on disk */ }
-            this.log(`skip writing ${hooksPath}: Cursor project would inherit it and freeze the IDE agent`);
-            return hooksPath;
-        }
-        const mkHook = () => ({
-            type: "command",
-            bash: curlCmd,
-            timeoutSec: 30,
-        });
-        const hookEvents = {
-            sessionStart: mkHook(),
-            sessionEnd: mkHook(),
-            userPromptSubmitted: mkHook(),
-            preToolUse: mkHook(),
-            postToolUse: mkHook(),
-            errorOccurred: mkHook(),
-        };
-        // Read existing and append
-        let existing = {};
-        try {
-            existing = JSON.parse(readFileSync(hooksPath, "utf8"));
-        }
-        catch { /* doesn't exist yet */ }
-        const existingHooks = existing.hooks ?? {};
-        for (const [eventName, entry] of Object.entries(hookEvents)) {
-            existingHooks[eventName] = withLinkShellHookEntry(existingHooks[eventName], entry, "last");
-        }
-        writeFileSync(hooksPath, JSON.stringify({ version: 1, hooks: existingHooks }, null, 2));
-        this.log(`copilot hooks appended to ${hooksPath}`);
-        return hooksPath;
-    }
-    handleHookEvent(terminalId, event, provider, permissionRequestId) {
-        const rawHookName = (event.hook_event_name ?? event.event_name);
-        if (!rawHookName)
-            return;
-        // Auto-detect provider from hook event fields
-        const hookTerm = this.terminals.get(terminalId);
-        let detectedProvider = provider;
-        // Always detect from transcript_path (most reliable), regardless of current provider
-        const transcriptPath = typeof event.transcript_path === "string" ? event.transcript_path : "";
-        if (transcriptPath.includes(".claude/")) {
-            detectedProvider = "claude";
-        }
-        else if (transcriptPath.includes(".gemini/")) {
-            detectedProvider = "gemini";
-        }
-        else if (transcriptPath.includes(".codex/")) {
-            detectedProvider = "codex";
-        }
-        else if (hookTerm?.provider === "custom") {
-            // Fallback heuristics only when provider is still unknown
-            if (event.model && typeof event.model === "string" && /^(gpt|o[0-9]|codex)/i.test(event.model)) {
-                detectedProvider = "codex";
-            }
-            else if (event.session_id && !transcriptPath) {
-                detectedProvider = "codex";
-            }
-            else if (/^(Before|After)(Tool)$|^Session(Start|End)$/.test(rawHookName)) {
-                detectedProvider = "gemini";
-            }
-            else if (/^(pre|post)ToolUse$|^session(Start|End)$|^userPromptSubmitted$|^errorOccurred$/.test(rawHookName)) {
-                detectedProvider = "copilot";
-            }
-        }
-        if (hookTerm && detectedProvider !== hookTerm.provider) {
-            const wasCustom = hookTerm.provider === "custom";
-            hookTerm.provider = detectedProvider;
-            this.log(`${wasCustom ? "detected" : "provider switched"} provider for ${terminalId}: ${detectedProvider}`);
-            this.permissionStacks.delete(terminalId);
-            this.sendTerminalList();
-        }
-        // Normalize hook event names from different providers to unified names
-        const hookName = this.normalizeHookName(rawHookName, detectedProvider);
-        if (!hookName)
-            return;
-        let phase;
-        let toolName;
-        let toolInput;
-        let permissionRequest;
-        let summary;
-        switch (hookName) {
-            case "PreToolUse":
-                phase = "tool_use";
-                toolName = (event.tool_name ?? event.toolName);
-                if (event.tool_input && typeof event.tool_input === "object") {
-                    const input = event.tool_input;
-                    toolInput = JSON.stringify(input).slice(0, 200);
-                }
-                else if (event.toolInput && typeof event.toolInput === "object") {
-                    toolInput = JSON.stringify(event.toolInput).slice(0, 200);
-                }
-                break;
-            case "PostToolUse":
-                phase = "thinking";
-                toolName = (event.tool_name ?? event.toolName);
-                // Pop permission stack + auto-resolve pending HTTP connection
-                {
-                    const stack = this.permissionStacks.get(terminalId);
-                    if (stack && stack.length > 0) {
-                        const popped = stack.pop();
-                        if (popped)
-                            this.autoResolvePending(popped.requestId);
-                        if (stack.length === 0)
-                            this.permissionStacks.delete(terminalId);
-                    }
-                }
-                break;
-            case "PostToolUseFailure":
-                phase = "error";
-                toolName = (event.tool_name ?? event.toolName);
-                {
-                    const stack = this.permissionStacks.get(terminalId);
-                    if (stack && stack.length > 0) {
-                        const popped = stack.pop();
-                        if (popped)
-                            this.autoResolvePending(popped.requestId);
-                        if (stack.length === 0)
-                            this.permissionStacks.delete(terminalId);
-                    }
-                }
-                break;
-            case "Stop":
-                phase = "idle";
-                if (event.stop_reason)
-                    summary = String(event.stop_reason);
-                this.drainPendingPermissions(terminalId);
-                this.permissionStacks.delete(terminalId);
-                // Reset provider to "custom" when a CLI session ends inside a custom shell
-                if (hookTerm && this.options.providerConfig.provider === "custom") {
-                    hookTerm.provider = "custom";
-                    this.log(`provider reset to custom for ${terminalId} (CLI session ended)`);
-                    this.sendTerminalList();
-                }
-                break;
-            case "PermissionRequest":
-                phase = "waiting";
-                toolName = (event.tool_name ?? event.toolName);
-                if (event.tool_input && typeof event.tool_input === "object") {
-                    const input = event.tool_input;
-                    permissionRequest = JSON.stringify(input).slice(0, 300);
-                }
-                else if (event.toolInput && typeof event.toolInput === "object") {
-                    permissionRequest = JSON.stringify(event.toolInput).slice(0, 300);
-                }
-                // Push to permission stack (use requestId from hook server if available)
-                {
-                    const reqId = permissionRequestId ?? `pr-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-                    if (!this.permissionStacks.has(terminalId)) {
-                        this.permissionStacks.set(terminalId, []);
-                    }
-                    this.permissionStacks.get(terminalId).push({
-                        requestId: reqId,
-                        toolName: toolName ?? "unknown",
-                        toolInput: toolInput ?? (permissionRequest ?? ""),
-                        permissionRequest: permissionRequest ?? "",
-                        timestamp: Date.now(),
-                    });
-                }
-                break;
-            case "SessionStart":
-                phase = "idle";
-                summary = "session started";
-                break;
-            case "UserPromptSubmit":
-                phase = "thinking";
-                this.drainPendingPermissions(terminalId);
-                this.permissionStacks.delete(terminalId);
-                break;
-            default:
-                return;
-        }
-        this.log(`hook event [${provider}]: ${rawHookName} → ${hookName} → phase=${phase} tool=${toolName ?? "none"}`);
-        // Build topPermission from stack
-        const stack = this.permissionStacks.get(terminalId);
-        const topPermission = stack && stack.length > 0 ? stack[stack.length - 1] : undefined;
-        const pendingPermissionCount = stack?.length ?? 0;
-        // Increment statusSeq for ordering
-        const term = this.terminals.get(terminalId);
-        const seq = term ? term.statusSeq++ : 0;
-        this.send(createEnvelope({
-            type: "terminal.status",
-            sessionId: this.sessionId,
-            terminalId,
-            payload: {
-                phase,
-                provider,
-                seq,
-                ...(toolName && { toolName }),
-                ...(toolInput && { toolInput }),
-                ...(permissionRequest && { permissionRequest }),
-                ...(summary && { summary }),
-                ...(topPermission && { topPermission }),
-                ...(pendingPermissionCount > 0 && { pendingPermissionCount }),
-            },
-        }));
-    }
-    /** Determine which provider a session id belongs to by which on-disk store
-     *  holds its transcript — Claude writes ~/.claude/projects/<proj>/<id>.jsonl,
-     *  Codex writes ~/.codex/sessions/**​/rollout-*-<id>.jsonl. Deterministic and
-     *  needed because an external session's provider is NOT the spawned PTY's
-     *  provider. best-effort; returns undefined if not found (caller falls back).
-     *  Only hit on a permission request (human-in-loop, rare), so the directory
-     *  scan cost is fine. */
-    providerForExternalSession(sessionId) {
-        try {
-            const claudeRoot = join(homedir(), ".claude", "projects");
-            if (existsSync(claudeRoot)) {
-                for (const proj of readdirSync(claudeRoot)) {
-                    if (existsSync(join(claudeRoot, proj, `${sessionId}.jsonl`)))
-                        return "claude";
-                }
-            }
-        }
-        catch { /* ignore */ }
-        try {
-            const codexRoot = join(homedir(), ".codex", "sessions");
-            if (existsSync(codexRoot)) {
-                const suffix = `-${sessionId}.jsonl`;
-                const walk = (dir) => {
-                    for (const name of readdirSync(dir)) {
-                        const p = join(dir, name);
-                        let st;
-                        try {
-                            st = statSync(p);
-                        }
-                        catch {
-                            continue;
-                        }
-                        if (st.isDirectory()) {
-                            if (walk(p))
-                                return true;
-                        }
-                        else if (name.startsWith("rollout-") && name.endsWith(suffix))
-                            return true;
-                    }
-                    return false;
-                };
-                if (walk(codexRoot))
-                    return "codex";
-            }
-        }
-        catch { /* ignore */ }
-        return undefined;
-    }
-    sendHookPermissionRequest(terminalId, event, requestId, provider) {
-        const toolName = (event.tool_name ?? event.toolName);
-        const toolInput = stringifyHookInput(event.tool_input ?? event.toolInput);
-        const suggestions = hookPermissionSuggestions(event);
-        const context = typeof event.permission_prompt === "string"
-            ? event.permission_prompt
-            : typeof event.message === "string"
-                ? event.message
-                : undefined;
-        const options = hookPermissionOptions(suggestions);
-        this.send(createEnvelope({
-            type: "agent.permission.request",
-            sessionId: this.sessionId,
-            terminalId,
-            payload: {
-                requestId,
-                toolName,
-                toolInput,
-                context,
-                options,
-            },
-        }));
-        // Also surface the request on the v2 channel, mapped to the on-disk session
-        // it came from, so the web agent console (which lives entirely on agent.v2)
-        // shows a permission card on the right conversation — not just the v1
-        // terminal view. The hook payload carries the provider's own session id;
-        // map it to the conversation id the session tree already uses. The v2
-        // respond is routed back to this same pending HTTP connection (see the
-        // resolvePendingPermission check in the agent.v2.permission.respond path).
-        const sessionId = (event.session_id ?? event.sessionId);
-        if (sessionId) {
-            // Derive the provider from the SESSION, not the spawned PTY's provider.
-            // The same curl hook is written to both ~/.claude and ~/.codex, and the
-            // HTTP server is created with a single provider — so an external Codex
-            // session's request could arrive on a "claude" server and get the wrong
-            // conversationId prefix, landing the card on a phantom conversation.
-            // Look up which store the id lives in (deterministic; verified).
-            const agentProvider = this.providerForExternalSession(sessionId)
-                ?? (provider === "codex" ? "codex" : provider === "claude" ? "claude" : "custom");
-            const conversationId = makeAgentV2RemoteConversationId(agentProvider, sessionId);
-            const permission = { requestId, toolName, toolInput, context, options };
-            // The web store only renders a clickable allow/deny card when the request
-            // carries a timeline `item` (it just flips the status badge otherwise), so
-            // include one shaped exactly like the workspace's own permission flow.
-            const now = Date.now();
-            const item = {
-                id: `permission:${requestId}`,
-                conversationId,
-                type: "permission",
-                permission,
-                metadata: { protocol: "v2", permissionLive: true, permissionExpired: false, permissionPending: false },
-                createdAt: now,
-                updatedAt: now,
-            };
-            this.send(createEnvelope({
-                type: "agent.v2.permission.request",
-                sessionId: this.sessionId,
-                payload: { conversationId, ...permission, item },
-            }));
-        }
-    }
-    /**
-     * Normalize hook event names from different CLI providers to unified internal names.
-     * Claude: PascalCase (PreToolUse, PostToolUse, Stop, PermissionRequest)
-     * Codex: camelCase (preToolUse, postToolUse, sessionStart)
-     * Gemini: PascalCase but different names (BeforeTool, AfterTool, BeforeSubmitPrompt)
-     */
-    normalizeHookName(rawName, provider) {
-        // Claude events — already in our canonical format
-        if (provider === "claude") {
-            return rawName;
-        }
-        // Codex events — same as Claude (PascalCase)
-        if (provider === "codex") {
-            switch (rawName) {
-                case "PreToolUse":
-                case "preToolUse": return "PreToolUse";
-                case "PostToolUse":
-                case "postToolUse": return "PostToolUse";
-                case "SessionStart":
-                case "sessionStart": return "SessionStart";
-                case "UserPromptSubmit": return "UserPromptSubmit";
-                case "PermissionRequest": return "PermissionRequest";
-                case "Stop": return "Stop";
-                default: return undefined;
-            }
-        }
-        // Gemini events
-        if (provider === "gemini") {
-            switch (rawName) {
-                case "BeforeTool": return "PreToolUse";
-                case "AfterTool": return "PostToolUse";
-                case "SessionStart": return "SessionStart";
-                case "SessionEnd": return "Stop";
-                default: return undefined;
-            }
-        }
-        // Copilot events (camelCase)
-        if (provider === "copilot") {
-            switch (rawName) {
-                case "preToolUse": return "PreToolUse";
-                case "postToolUse": return "PostToolUse";
-                case "sessionStart": return "SessionStart";
-                case "sessionEnd": return "Stop";
-                case "userPromptSubmitted": return "UserPromptSubmit";
-                case "errorOccurred": return "PostToolUseFailure";
-                default: return undefined;
-            }
-        }
-        // Unknown provider — try all known formats
-        // This handles "custom" shell where any provider might be launched
-        const allProviders = ["claude", "codex", "gemini", "copilot"];
-        for (const p of allProviders) {
-            const result = this.normalizeHookName(rawName, p);
-            if (result)
-                return result;
-        }
-        return undefined;
-    }
-    /** Auto-resolve a single pending permission (user acted in terminal) */
-    autoResolvePending(requestId) {
-        if (this.resolvePendingPermission(requestId, "allow", "terminal.auto").resolved) {
-            this.log(`auto-resolved pending permission ${requestId} (user acted in terminal)`);
-        }
-    }
-    /** Drain all pending permissions for a terminal (session ended, stop, etc.) */
-    drainPendingPermissions(terminalId) {
-        const stack = this.permissionStacks.get(terminalId);
-        if (!stack)
-            return;
-        for (const entry of [...stack]) {
-            if (this.resolvePendingPermission(entry.requestId, "deny", "terminal.drain").resolved) {
-                this.log(`drained pending permission ${entry.requestId}`);
-            }
-        }
-    }
-    resolvePendingPermission(requestId, choice, source = "unknown") {
-        const pending = this.pendingPermissions.get(requestId);
-        const outcome = typeof choice === "string" ? choice : choice.outcome;
-        const optionId = typeof choice === "string" ? undefined : choice.optionId;
-        if (!pending) {
-            this.log(`no pending permission for ${requestId} via ${source}: ${outcome}:${optionId ?? "default"}`);
-            return { resolved: false, delivered: false };
-        }
-        this.pendingPermissions.delete(requestId);
-        clearTimeout(pending.timeout);
-        const delivered = pending.resolve(this.formatHookPermissionDecision(pending, choice));
-        const stack = this.permissionStacks.get(pending.terminalId);
-        if (stack) {
-            const idx = stack.findIndex((entry) => entry.requestId === requestId);
-            if (idx >= 0)
-                stack.splice(idx, 1);
-            if (stack.length === 0)
-                this.permissionStacks.delete(pending.terminalId);
-        }
-        this.log(`resolved permission ${requestId} via ${source}: ${outcome}:${optionId ?? "default"} delivered=${delivered}`);
-        this.sendPermissionSnapshot(pending.terminalId, "thinking", outcome === "allow" ? "permission allowed" : "permission denied", { requestId, outcome, source, delivered });
-        return { resolved: true, delivered };
-    }
-    formatHookPermissionDecision(permission, choice) {
-        const outcome = typeof choice === "string" ? choice : choice.outcome;
-        const optionId = typeof choice === "string" ? undefined : choice.optionId;
-        if (outcome === "allow") {
-            return {
-                behavior: "allow",
-                ...(optionId === "allow_always" && permission.permissionSuggestions.length > 0
-                    ? { updatedPermissions: permission.permissionSuggestions }
-                    : {}),
-            };
-        }
-        return {
-            behavior: "deny",
-            message: outcome === "cancelled" ? "Permission request cancelled." : "Permission denied by user.",
-        };
-    }
-    sendPermissionSnapshot(terminalId, phase, summary, permissionResolution) {
-        const stack = this.permissionStacks.get(terminalId);
-        const topPermission = stack && stack.length > 0 ? stack[stack.length - 1] : undefined;
-        const pendingPermissionCount = stack?.length ?? 0;
-        const term = this.terminals.get(terminalId);
-        const seq = term ? term.statusSeq++ : 0;
-        this.send(createEnvelope({
-            type: "terminal.status",
-            sessionId: this.sessionId,
-            terminalId,
-            payload: {
-                phase,
-                provider: term?.provider,
-                seq,
-                ...(summary && { summary }),
-                ...(permissionResolution && { permissionResolution }),
-                ...(topPermission && { topPermission }),
-                ...(pendingPermissionCount > 0 && { pendingPermissionCount }),
-            },
-        }));
-    }
-    cleanupHookServer(term) {
-        // Drain any pending permission requests for this terminal
-        this.drainPendingPermissions(term.id);
-        if (term.hookServer) {
-            term.hookServer.close();
-            term.hookServer = undefined;
-            this.log(`hook server closed for ${term.id}`);
-        }
-        const marker = term.hookMarker;
-        for (const configPath of term.hookConfigPaths) {
-            try {
-                // Copilot: per-instance file — just delete it
-                if (configPath.includes(`linkshell-${marker}`)) {
-                    if (existsSync(configPath)) {
-                        unlinkSync(configPath);
-                        this.log(`removed copilot hook file ${configPath}`);
-                    }
-                }
-                else {
-                    // Claude/Codex/Gemini: remove our entries from the shared config
-                    this.removeHookEntries(configPath, marker);
-                }
-            }
-            catch { /* ignore */ }
-        }
-        term.hookConfigPaths = [];
-    }
-    /** Remove hook entries containing our marker from a JSON config file */
-    removeHookEntries(configPath, marker) {
-        if (!existsSync(configPath))
-            return;
-        try {
-            const raw = JSON.parse(readFileSync(configPath, "utf8"));
-            const hooks = raw.hooks;
-            if (!hooks)
-                return;
-            let changed = false;
-            for (const [eventName, entries] of Object.entries(hooks)) {
-                if (!Array.isArray(entries))
-                    continue;
-                const filtered = entries.filter((entry) => {
-                    const str = JSON.stringify(entry);
-                    return !str.includes(marker);
-                });
-                if (filtered.length !== entries.length) {
-                    changed = true;
-                    if (filtered.length === 0) {
-                        delete hooks[eventName];
-                    }
-                    else {
-                        hooks[eventName] = filtered;
-                    }
-                }
-            }
-            if (changed) {
-                // If no hooks left, remove the hooks key entirely
-                if (Object.keys(hooks).length === 0) {
-                    delete raw.hooks;
-                }
-                writeFileSync(configPath, JSON.stringify(raw, null, 2));
-                this.log(`removed our hook entries from ${configPath}`);
-            }
-        }
-        catch { /* ignore parse errors */ }
-    }
-    /**
-     * Remove ALL LinkShell hook entries (any marker) from a JSON config file.
-     * Used on startup to sweep stale entries left behind by a crashed instance,
-     * whose curl ports are now dead. Matches via isLinkShellHookEntry rather than
-     * a single marker so entries from previous runs are also cleaned.
-     */
-    sweepLinkShellHookEntries(configPath) {
-        if (!existsSync(configPath))
-            return;
-        try {
-            // Re-read immediately before write to minimize the window for a
-            // concurrent writer to clobber our changes.
-            const raw = JSON.parse(readFileSync(configPath, "utf8"));
-            const hooks = raw.hooks;
-            if (!hooks)
-                return;
-            let changed = false;
-            for (const [eventName, entries] of Object.entries(hooks)) {
-                if (!Array.isArray(entries))
-                    continue;
-                const filtered = entries.filter((entry) => !isLinkShellHookEntry(entry));
-                if (filtered.length !== entries.length) {
-                    changed = true;
-                    if (filtered.length === 0) {
-                        delete hooks[eventName];
-                    }
-                    else {
-                        hooks[eventName] = filtered;
-                    }
-                }
-            }
-            if (changed) {
-                if (Object.keys(hooks).length === 0) {
-                    delete raw.hooks;
-                }
-                writeFileSync(configPath, JSON.stringify(raw, null, 2));
-                this.log(`swept stale LinkShell hook entries from ${configPath}`);
-            }
-        }
-        catch { /* ignore parse errors */ }
-    }
-    /** Sweep stale LinkShell hook entries from known shared config files on startup. */
-    sweepStaleHookConfigs() {
-        const home = homedir();
-        const candidates = [
-            join(home, ".claude", "settings.json"),
-            join(home, ".codex", "hooks.json"),
-            join(home, ".gemini", "settings.json"),
-            join(this.defaultCwd, "hooks.json"), // copilot (per-cwd)
-        ];
-        for (const path of candidates) {
-            this.sweepLinkShellHookEntries(path);
-        }
-    }
     send(message) {
         if (!this.socket || this.socket.readyState !== WebSocket.OPEN) {
             if (message.type.startsWith("agent.v2.")) {
@@ -2377,7 +1354,6 @@ export class BridgeSession {
         }
         this.exitedTerminalTimers.clear();
         for (const term of this.terminals.values()) {
-            this.cleanupHookServer(term);
             if (term.status === "running")
                 term.pty.kill();
         }