qlogicagent 2.17.9 → 2.18.1

package/dist/types/runtime/session/session-types.d.ts

@@ -2,6 +2,22 @@ import type { ChatMessage } from "../../protocol/wire/index.js";
 import type { TokenUsage } from "../../agent/types.js";
 import type { SessionUsageSnapshot } from "./session-state.js";
 export declare const SESSION_SCHEMA_VERSION = 1;
+/** 熔断阈值：连续崩溃中断达此次数后放弃自动恢复（对齐 hermes stuck-loop 的 3）。 */
+export declare const MAX_INTERRUPTED_RECOVERY = 3;
+/**
+ * 在飞轮次标记。turn 开始写入 SessionMetadata.inflightTurn，正常完成/用户主动中断时清除。
+ * 崩溃/非优雅退出时它残留在磁盘上 —— 这就是"上次这轮没跑完"的显式信号
+ * （对照 codex CLI 靠时间戳隐式推断、坏了要手动裁 JSONL，见 docs/session-lifecycle-recovery-spec.md §7）。
+ */
+export interface InflightTurnMarker {
+    turnId: string;
+    /** turn 开始时间（ISO）。启动扫描用它与 transcript 最后一条 assistant 消息的 ts 做双校验。 */
+    startedAt: string;
+    /** 最后一条 user 消息前若干字（UI 提示用，不含敏感全文）。 */
+    lastUserPreview?: string;
+    /** 该轮是否已执行过有副作用的工具（写文件/发消息/外部 API）。安全档不据此自动续，仅用于 UI"可能重复"提示 + 为智能档铺路。 */
+    hadSideEffectTool?: boolean;
+}
 export interface SessionMetadata {
     schemaVersion?: number;
     sessionId: string;
@@ -30,6 +46,12 @@ export interface SessionMetadata {
     groupPlatform?: string;
     totalInputTokens?: number;
     totalOutputTokens?: number;
+    /** 在飞轮次标记：存在即"上次这轮没跑完"（崩溃残留）。turn 开始写、正常完成/中断清。 */
+    inflightTurn?: InflightTurnMarker;
+    /** 连续崩溃中断计数；turn 正常完成清零；达 MAX_INTERRUPTED_RECOVERY 熔断放弃恢复。 */
+    interruptedTurnCount?: number;
+    /** 达熔断阈值放弃恢复的时间戳（UI 显示"多次中断已停止自动恢复"）。 */
+    recoveryAbandonedAt?: string;
 }
 export interface PersistedSession {
     metadata: SessionMetadata;
@@ -43,6 +65,14 @@ export interface MessageDisplayMetadata {
     chatId?: string;
     userId?: string;
     userName?: string;
+    /**
+     * Presentation kind for a persisted message whose ROLE alone doesn't capture how
+     * the UI should render it. Currently: "mid_turn_guidance" — a user-authored message
+     * injected into a running turn (运行中引导). It stays role:"user" (the model must see
+     * it as the user's words), but the desktop renders it as an agent-side "收到引导"
+     * receipt line rather than a standalone user bubble.
+     */
+    kind?: string;
 }
 export interface PersistedChatMessage extends ChatMessage {
     timestamp?: string;

package/dist/types/skills/permissions/hook-runner.d.ts

@@ -43,6 +43,14 @@ export interface PermissionCheckerDeps {
     sessionId?: string;
     /** Getter for current turn ID (changes per turn). */
     getTurnId?: () => string;
+    /**
+     * Persist a directory allow-rule across restarts (user picked "始终允许此文件夹").
+     * Wired by the CLI layer to append into the user-level settings.json; optional so
+     * headless/test checkers degrade to session-only memory.
+     */
+    persistPermissionRule?: (rule: {
+        pathPrefix: string;
+    }) => void | Promise<void>;
 }
 export declare class PermissionChecker {
     private readonly ruleEngine;
@@ -57,6 +65,7 @@ export declare class PermissionChecker {
     private readonly auditLogger;
     private readonly sessionId;
     private readonly getTurnId;
+    private readonly persistPermissionRule;
     private unregisterHook;
     /** Tool meta cache — populated from ToolDefinition[] at agent creation */
     private toolMetaCache;

package/dist/types/skills/permissions/settings-watcher.d.ts

@@ -1,6 +1,13 @@
 /**
  * Settings watcher for canonical qlogicagent permission settings.
  *
+ * Two layers (CC settings semantics):
+ *   - user level    ~/.qlogicagent/profiles/<owner>/settings.json  — where config.update persists
+ *   - project level <projectRoot>/.qlogicagent/settings.json       — repo-local overrides
+ * The project file's `permissions` object, when present, overrides the user file's.
+ * Both layers are watched; either changing re-resolves the effective permissions.
+ * (写读同源:此前 config.update 写用户级、watcher 只读项目级,重启后持久模式永远丢失。)
+ *
  * Only the `permissions` object is accepted. Removed top-level aliases such as
  * `permissionMode`, `permissionRules`, and `defaultBehavior` must fail loudly.
  */

package/dist/types/skills/tools/exec-tool.d.ts

@@ -16,7 +16,7 @@ export declare const EXEC_TOOL_SCHEMA: {
     readonly properties: {
         readonly command: {
             readonly type: "string";
-            readonly description: "Shell command to execute in PowerShell." | "Shell command to execute in bash. Use Unix-style commands (ls, cat, mkdir -p, etc.).";
+            readonly description: "Shell command to execute in PowerShell. See the # Environment section for the active edition and path/syntax rules." | "Shell command to execute in bash. Use Unix-style commands (ls, cat, mkdir -p, etc.).";
         };
         readonly description: {
             readonly type: "string";

package/dist/types/skills/tools/shell/command-classification.d.ts

@@ -50,3 +50,4 @@ export declare function requiresDedicatedReadSearchTool(classification: CommandC
  * called for reads/searches now (directory listing is allowed via exec — see above).
  */
 export declare function dedicatedToolRedirectMessage(classification: CommandClassification): string;
+export declare function commandTargetsBinaryFile(command: string | null): boolean;

package/dist/types/skills/tools/shell/index.d.ts

@@ -1,5 +1,5 @@
-export type { ShellType, BuildCommandOpts, BuiltCommand, ShellProvider, } from "./shell-provider.js";
-export { isPowerShellToolEnabled, getDefaultShellType, generateCommandId, } from "./shell-provider.js";
+export type { ShellType, PowerShellEdition, ShellSelection, WindowsPowerShellResolution, WindowsPowerShellProbe, BuildCommandOpts, BuiltCommand, ShellProvider, } from "./shell-provider.js";
+export { isPowerShellToolEnabled, resolveShellSelection, resolveWindowsPowerShell, getDefaultShellType, generateCommandId, } from "./shell-provider.js";
 export { createBashProvider } from "./bash-provider.js";
 export type { BashProviderOptions } from "./bash-provider.js";
 export { createPowerShellProvider, encodePowerShellCommand, } from "./powershell-provider.js";
@@ -14,5 +14,5 @@ export type { ProgressCallback } from "./task-output.js";
 export type { ExecResult, ShellCommand } from "./shell-command.js";
 export { wrapSpawn, createAbortedCommand, createFailedCommand, } from "./shell-command.js";
 export { subprocessEnv } from "./subprocess-env.js";
-export { exec, getCwd, setCwd, initCwd, getOriginalCwd, setShellProvider, getShellProvider, } from "./shell-exec.js";
+export { exec, getCwd, setCwd, initCwd, getOriginalCwd, setShellProvider, getShellProvider, getActiveShellInfo, } from "./shell-exec.js";
 export type { ExecOptions } from "./shell-exec.js";

package/dist/types/skills/tools/shell/powershell-provider.d.ts

@@ -1,4 +1,4 @@
-import type { ShellProvider } from "./shell-provider.js";
+import type { ShellProvider, PowerShellEdition } from "./shell-provider.js";
 /**
  * Encode a PowerShell command as UTF-16LE Base64 for -EncodedCommand.
  * This avoids all quoting/escaping issues when passing complex commands
@@ -7,9 +7,14 @@ import type { ShellProvider } from "./shell-provider.js";
  * Ported directly from cc's `encodePowerShellCommand()`.
  */
 export declare function encodePowerShellCommand(psCommand: string): string;
+export interface PowerShellProviderOptions {
+    /** Which PowerShell edition `shellPath` is (5.1 vs 7+); surfaced as `psEdition`. */
+    edition?: PowerShellEdition;
+}
 /**
  * Create a PowerShell ShellProvider.
  *
- * @param shellPath Absolute path to pwsh.exe or powershell.exe
+ * @param shellPath Absolute path (or PATH-resolvable name) to pwsh.exe / powershell.exe
+ * @param options   Optional edition metadata (from `resolveWindowsPowerShell`)
  */
-export declare function createPowerShellProvider(shellPath: string): ShellProvider;
+export declare function createPowerShellProvider(shellPath: string, options?: PowerShellProviderOptions): ShellProvider;

package/dist/types/skills/tools/shell/shell-exec.d.ts

@@ -31,6 +31,24 @@ export declare function setShellProvider(provider: ShellProvider): void;
  * Get the current shell provider, or throw if not configured.
  */
 export declare function getShellProvider(): ShellProvider;
+/**
+ * Read-only snapshot of the active shell provider's identity, as plain data.
+ *
+ * Consumed by the prompt layer (via the CLI, which passes it in — the prompt
+ * layer must not import shell modules) to tailor environment guidance to the
+ * shell that `exec()` actually drives, instead of re-guessing from env vars.
+ *
+ * Returns `undefined` when no provider has been configured yet. This MUST NOT
+ * throw: prompt assembly can run before/without `setShellProvider()` (tests,
+ * lightweight turns), and a missing provider is a normal "fall back to
+ * detectShellType()" signal, not an error.
+ */
+export declare function getActiveShellInfo(): {
+    type: ShellType;
+    shellPath: string;
+    psEdition?: "5.1" | "7+";
+    isGitBashOnWindows?: boolean;
+} | undefined;
 /**
  * Execute a shell command using the configured provider.
  * Creates a new child process for each invocation.

package/dist/types/skills/tools/shell/shell-provider.d.ts

@@ -2,6 +2,13 @@
  * Discriminated shell type identifier.
  */
 export type ShellType = "bash" | "powershell";
+/**
+ * Which PowerShell edition the active provider drives.
+ *   "5.1" = Windows PowerShell (powershell.exe) — no `&&`/`||`, use `;`.
+ *   "7+"  = PowerShell 7 (pwsh)                 — `&&`/`||` supported.
+ * Consumed by prompt/guidance layers to tailor syntax advice.
+ */
+export type PowerShellEdition = "5.1" | "7+";
 /**
  * Options passed to `buildExecCommand`.
  */
@@ -45,19 +52,31 @@ export interface ShellProvider {
      * PowerShell: false (no POSIX process groups on Windows).
      */
     readonly detached: boolean;
+    /**
+     * For PowerShell providers: which edition the binary is (5.1 vs 7+).
+     * Undefined for bash. Read by prompt guidance to decide `&&` vs `;`.
+     */
+    readonly psEdition?: PowerShellEdition;
+    /**
+     * True when this is a bash provider running on Windows (Git Bash / MSYS).
+     * Undefined/false otherwise. Read by prompt guidance for path conventions.
+     */
+    readonly isGitBashOnWindows?: boolean;
     /**
      * Wrap a raw user command into a full shell command string.
      * Handles:
      *   - Environment snapshots / session env sourcing (bash)
-     *   - UTF-16LE EncodedCommand wrapping (PowerShell)
      *   - CWD tracking (`pwd -P > file` / `Get-Location | Out-File`)
      *   - stdin redirect for interactive commands (bash)
+     * Returns the UNENCODED script; PowerShell's UTF-16LE EncodedCommand wrapping
+     * happens in getSpawnArgs so the encode is applied exactly once.
      */
     buildExecCommand(command: string, opts: BuildCommandOpts): Promise<BuiltCommand>;
     /**
      * Return the argv array for `child_process.spawn()`.
      * E.g. bash → `['-c', commandString]`
-     *      PS   → `['-NoProfile', '-NonInteractive', '-Command', cmd]`
+     *      PS   → `['-NoProfile', '-NonInteractive', '-EncodedCommand', <utf16le-base64(commandString)>]`
+     * (`commandString` is the UNENCODED script; PS encodes it here, exactly once.)
      */
     getSpawnArgs(commandString: string): string[];
     /**
@@ -66,18 +85,61 @@ export interface ShellProvider {
      */
     getEnvironmentOverrides(command: string): Promise<Record<string, string>>;
 }
+/** High-level shell family selected for the current platform + env. */
+export type ShellSelection = "powershell" | "bash";
+/**
+ * Pure decision: given a platform + env, pick the shell family.
+ *
+ * Contract (the "flip default"):
+ *   - non-win32                       → bash (unchanged)
+ *   - win32, QLOGICAGENT_SHELL=bash   → bash (explicit opt-in Git Bash)
+ *   - win32, QLOGICAGENT_SHELL=powershell|pwsh → powershell
+ *   - win32, QLOGICAGENT_USE_POWERSHELL truthy (compat alias) → powershell
+ *   - win32, nothing set              → powershell  ← flipped default
+ *
+ * `QLOGICAGENT_SHELL` is the single three-state switch; the legacy
+ * `QLOGICAGENT_USE_POWERSHELL` truthy flag is kept as a compat alias but is
+ * overridden by an explicit `QLOGICAGENT_SHELL=bash`.
+ */
+export declare function resolveShellSelection(platform: NodeJS.Platform, env: NodeJS.ProcessEnv): ShellSelection;
 /**
- * Check if PowerShell tool mode should be enabled.
+ * Check if PowerShell tool mode should be enabled for the live process.
  * Mirrors cc's `isPowerShellToolEnabled()`.
  *
- * On Windows: enabled when `QLOGICAGENT_USE_POWERSHELL` is truthy.
- * On non-Windows: always false.
+ * On Windows the default is now PowerShell (see `resolveShellSelection`);
+ * `QLOGICAGENT_SHELL=bash` opts back into Git Bash. On non-Windows: false.
  */
 export declare function isPowerShellToolEnabled(): boolean;
 /**
  * Default shell type for the current platform.
  */
 export declare function getDefaultShellType(): ShellType;
+/**
+ * Result of Windows PowerShell resolution: the binary to spawn plus which
+ * edition it is (so guidance can decide `&&` vs `;`).
+ */
+export interface WindowsPowerShellResolution {
+    shellPath: string;
+    psEdition: PowerShellEdition;
+}
+/**
+ * Injectable probes for `resolveWindowsPowerShell` (so it is unit-testable off
+ * a real Windows host). Defaults hit the real filesystem / PATH.
+ */
+export interface WindowsPowerShellProbe {
+    /** Whether a path exists on disk. */
+    exists(path: string): boolean;
+    /** Absolute path to `pwsh` on PATH, or null if not found. */
+    pwshOnPath(): string | null;
+}
+/**
+ * Resolve which PowerShell binary to drive on Windows.
+ *
+ * Order: explicit `QLOGICAGENT_POWERSHELL_PATH` → `pwsh` on PATH (PS7) →
+ * well-known pwsh install path (PS7) → `powershell.exe` (5.1, always present).
+ * The returned `psEdition` records which one was chosen.
+ */
+export declare function resolveWindowsPowerShell(env: NodeJS.ProcessEnv, probe: WindowsPowerShellProbe): WindowsPowerShellResolution;
 /**
  * Generate a short random hex ID for CWD temp file naming.
  * Matches cc's `Math.floor(Math.random() * 0x10000).toString(16)`.

package/dist/types/transport/acp-server.d.ts

@@ -154,6 +154,12 @@ export declare class AcpServer {
      * Returns a promise that resolves with the host's chosen option.
      */
     requestPermission(params: AcpPermissionRequestParams): Promise<AcpPermissionRequestResult>;
+    /**
+     * Cancel every in-flight permission request (turn abort / session cancel). Each
+     * awaiter resolves to "deny" and its maps are cleared, so a cancelled turn's
+     * pending approval can't survive to poison the next turn.
+     */
+    cancelAllPendingPermissions(): void;
     /** Whether the host supports extended events */
     get supportsExtendedEvents(): boolean;
     /** Whether the host supports extended methods */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qlogicagent",
-  "version": "2.17.9",
+  "version": "2.18.1",
   "description": "XiaozhiClaw Agent CLI — subprocess architecture (JSON-RPC over stdio)",
   "type": "module",
   "main": "dist/index.js",
@@ -69,6 +69,7 @@
     "build:search-svc": "node scripts/build-search-svc.mjs",
     "start": "node dist/cli.js",
     "test": "vitest run",
+    "test:replay": "vitest run benchmarks/transcript-replay",
     "check": "pnpm run check:encoding-corruption && tsc --noEmit && pnpm test && pnpm run check:architecture-boundaries && pnpm run check:provider-core-boundary && pnpm run check:provider-core-release-sync && pnpm run check:pet-core-boundary && pnpm run check:workspace-hygiene && pnpm run check:package-artifact",
     "test:watch": "vitest",
     "benchmark:hermes-superiority": "tsx benchmarks/hermes-superiority/runner.ts",
@@ -81,6 +82,7 @@
     "check:workspace-hygiene": "node scripts/check-workspace-hygiene.mjs",
     "check:workspace-hygiene:strict": "node scripts/check-workspace-hygiene.mjs --strict",
     "check:package-artifact": "npm run build && node scripts/check-package-artifact.mjs",
+    "corpus:export-feedback": "tsx scripts/export-feedback-corpus.ts",
     "redteam:community-desensitization": "tsx src/runtime/community/community-desensitization-red-team-cli.ts",
     "clean:workspace-hygiene": "node scripts/clean-workspace-hygiene.mjs",
     "release": "node scripts/release.mjs"
@@ -106,6 +108,7 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^22.15.0",
     "esbuild": "^0.28.0",
+    "javascript-obfuscator": "^5.4.3",
     "oxlint": "1.67.0",
     "tsx": "^4.19.0",
     "typescript": "^5.9.0",