termdock 1.4.299 → 1.4.300

package/dist/server/agent/collaborationTaskCli.js

@@ -3,8 +3,12 @@ import { randomUUID } from 'node:crypto';
 export async function executeTaskCommand(command, request, io) {
     const o = command.options, operation = command.operation;
     const bodyOptions = ['content', 'file', 'stdin', 'idempotency-key'];
+    const originOptions = ['source', 'external-actor', 'external-message-id', 'metadata'];
+    if (originOptions.some(key => o[key]) && !o.principal)
+        throw new Error('External source metadata requires --principal');
     const allowed = {
         list: ['group'], get: [], create: [...bodyOptions, 'group', 'title', 'constraints', 'acceptance', 'assignee', 'coordinator', 'parent', 'depends-on', 'managed', 'reviewers', 'shared-directory', 'integration', 'work-type'],
+        answer: [...bodyOptions, 'decision'], respond: [...bodyOptions, 'attempt', 'to-event', 'evidence'],
         assign: [...bodyOptions, 'assignee', 'revision'], report: [...bodyOptions, 'attempt', 'status', 'evidence', 'summary'], ask: [...bodyOptions, 'attempt', 'options'],
         plan: [...bodyOptions, 'attempt', 'evidence'], review: [...bodyOptions, 'artifact', 'evidence', 'verdict'], comment: bodyOptions,
         'request-review': [...bodyOptions, 'artifact', 'assignee', 'revision'],
@@ -12,7 +16,7 @@ export async function executeTaskCommand(command, request, io) {
         coordinate: [...bodyOptions, 'revision'], pause: [...bodyOptions, 'revision'], resume: [...bodyOptions, 'revision'], retry: [...bodyOptions, 'revision'],
     };
     for (const flag of Object.keys(o))
-        if (![...allowed[operation], 'session', 'json', 'jsonl', 'text', 'help'].includes(flag))
+        if (![...allowed[operation], ...(o.principal ? originOptions : []), 'principal', 'session', 'json', 'jsonl', 'text', 'help'].includes(flag))
             throw new Error(`--${flag} is not supported by task ${operation}`);
     if (operation === 'list')
         return request('GET', `/tasks${o.group ? `?group=${encodeURIComponent(String(o.group))}` : ''}`);
@@ -32,8 +36,12 @@ export async function executeTaskCommand(command, request, io) {
         throw new Error('Read task get first, then supply --revision to avoid overwriting another decision');
     if (['assign', 'request-review'].includes(operation) && !o.assignee)
         throw new Error('This task operation requires --assignee');
-    if (['report', 'ask', 'plan'].includes(operation) && !o.attempt)
+    if (['report', 'respond', 'ask', 'plan'].includes(operation) && !o.attempt)
         throw new Error('Use --attempt from the dispatch message; never guess the current attempt');
+    if (operation === 'respond' && !o['to-event'])
+        throw new Error('respond requires --to-event <comment-event-id>');
+    if (operation === 'answer' && !o.decision)
+        throw new Error('answer requires --decision <question-id>');
     if (operation === 'create') {
         if (!o.title || !o.group)
             throw new Error('task create requires --title and --group');
@@ -47,7 +55,7 @@ export async function executeTaskCommand(command, request, io) {
     if (options !== undefined && (!Array.isArray(options) || options.some(v => typeof v !== 'string')))
         throw new Error('--options must be a JSON array of strings');
     return request('POST', `/tasks/${encodeURIComponent(command.target)}`, { input: {
-            kind: operation === 'plan' ? 'submit-plan' : operation, idempotencyKey, expectedRevision, content,
+            replyToEventId: o['to-event'], decisionId: o.decision, kind: operation === 'plan' ? 'submit-plan' : operation, idempotencyKey, expectedRevision, content,
             assigneeSessionId: o.assignee, attemptId: o.attempt, status: o.status, artifactId: o.artifact, options, verdict: o.verdict,
             evidence: o.evidence ? JSON.parse(String(o.evidence)) : undefined, summary: o.summary,
         } });

package/dist/server/agent/collaborationTaskService.js

@@ -70,7 +70,7 @@ export class CollaborationTaskService {
         this.group(task.groupId, actor);
         return this.view(task);
     }
-    async create(input, actor) {
+    async create(input, actor, origin) {
         this.group(input.groupId, actor);
         this.validateMembers(input.groupId, input);
         const dependencies = [...(input.dependsOn ?? []), ...(input.parentTaskId ? [input.parentTaskId] : [])];
@@ -81,22 +81,26 @@ export class CollaborationTaskService {
             if (this.tasks.get(dependency)?.ownerServiceId !== authority)
                 throw new CollaborationError('DEPENDENCY_AUTHORITY_REQUIRED', '依赖与父任务需在同一来源服务创建', 409);
         }
+        if (origin && authority !== this.self)
+            throw new CollaborationError('INTEGRATION_LOCAL_ONLY', '首版集成任务须由本机服务保存', 409);
         if (authority !== this.self) {
             const result = await this.peers.requestTasks(authority, { op: 'create', input, actorSessionId: actor?.sessionId ?? null });
             const task = result.task;
             this.tasks.merge(task, authority);
             return this.view(task);
         }
-        const task = this.tasks.create(this.self, input, actor);
+        const task = this.tasks.create(this.self, input, actor, origin);
         void this.flush();
         return this.view(task);
     }
-    async apply(taskId, input, actor) {
+    async apply(taskId, input, actor, origin) {
         const task = this.tasks.get(taskId);
         if (!task)
             throw new CollaborationError('TASK_NOT_FOUND', '任务不存在', 404);
         this.group(task.groupId, actor);
         this.validateMembers(task.groupId, input);
+        if (origin && task.ownerServiceId !== this.self)
+            throw new CollaborationError('INTEGRATION_LOCAL_ONLY', '首版集成任务须由本机服务保存', 409);
         if (task.ownerServiceId !== this.self) {
             const result = await this.peers.requestTasks(task.ownerServiceId, { op: 'apply', taskId, input, actorSessionId: actor?.sessionId ?? null });
             this.tasks.merge(result.task, task.ownerServiceId);
@@ -126,7 +130,7 @@ export class CollaborationTaskService {
                         artifactId: child.acceptedArtifactId, integration: child.workflow?.integration === true,
                         commit: child.artifacts.find(a => a.id === child.acceptedArtifactId)?.evidence?.commit })) } };
         }
-        const updated = this.tasks.apply(taskId, input, actor);
+        const updated = this.tasks.apply(taskId, input, actor, origin);
         void this.flush();
         return this.view(updated);
     }
@@ -196,7 +200,7 @@ export class CollaborationTaskService {
             const queued = this.messages.send({ groupId: group.id, fromSessionId: null, toSessionIds: [recipient.sessionId],
                 kind: packet.kind === 'task' ? 'task' : 'message', content: String(packet.content ?? ''), threadId: attempt?.threadId ?? task.id,
                 idempotencyKey: `task:${peer.serviceId}:${String(packet.outboxId)}`,
-                metadata: { taskOutboxId: packet.outboxId, termdockTask: { taskId: task.id, attemptId: attempt?.id ?? null, ownerServiceId: peer.serviceId } } });
+                metadata: { taskOutboxId: packet.outboxId, termdockTask: { taskId: task.id, attemptId: attempt?.id ?? null, ownerServiceId: peer.serviceId, replyToEventId: task.events.find(e => e.deliveryId === packet.outboxId && e.attemptId === attempt?.id && e.kind === 'comment')?.id } } });
             this.deliver(recipient.sessionId);
             return { receipt: this.receipt(queued[0].id) };
         }
@@ -313,14 +317,16 @@ export class CollaborationTaskService {
                 if (!task?.workflow)
                     return true;
                 const root = task.workflow.rootTaskId ? this.tasks.get(task.workflow.rootTaskId) : task;
-                return !task.workflow.paused && !root?.workflow?.paused && root?.status === 'open';
+                const consultation = outbox.replyToEventId && task.events.some(e => e.id === outbox.replyToEventId && e.kind === 'comment');
+                return consultation || !task.workflow.paused && !root?.workflow?.paused && root?.status === 'open';
             }).slice(0, 16);
             for (const outbox of ready) {
                 try {
                     const task = this.tasks.get(outbox.taskId);
                     this.group(task.groupId, outbox.target);
                     const root = task.workflow?.rootTaskId ? this.tasks.get(task.workflow.rootTaskId) : task;
-                    if (task.workflow && (task.workflow.paused || root?.workflow?.paused || root?.status !== 'open'))
+                    const consultation = outbox.replyToEventId && task.events.some(e => e.id === outbox.replyToEventId && e.kind === 'comment');
+                    if (task.workflow && !consultation && (task.workflow.paused || root?.workflow?.paused || root?.status !== 'open'))
                         continue;
                     if (outbox.target.serviceId === this.self) {
                         if (outbox.messageId && this.messages.getMessage(outbox.messageId)) {
@@ -330,7 +336,7 @@ export class CollaborationTaskService {
                         }
                         const queued = this.messages.send({ groupId: task.groupId, fromSessionId: null, toSessionIds: [outbox.target.sessionId],
                             kind: outbox.kind, content: outbox.content, threadId: outbox.threadId, idempotencyKey: `task:${this.self}:${outbox.id}`,
-                            metadata: { termdockTask: { taskId: task.id, attemptId: outbox.attemptId, ownerServiceId: this.self } } });
+                            metadata: { termdockTask: { taskId: task.id, attemptId: outbox.attemptId, ownerServiceId: this.self, replyToEventId: outbox.replyToEventId } } });
                         this.deliver(outbox.target.sessionId);
                         this.tasks.delivered(outbox.id, this.receipt(queued[0].id));
                     }

package/dist/server/agent/collaborationTaskStore.js

@@ -83,7 +83,7 @@ function validateSnapshot(task) {
             invalid();
         if (event.deliveryId !== undefined && !validId(event.deliveryId))
             invalid();
-        if (event.source !== undefined && !['system', 'user'].includes(event.source))
+        if (event.source !== undefined && !['system', 'user', 'integration'].includes(event.source))
             invalid();
         if (event.actor !== null)
             member(event.actor);
@@ -115,6 +115,9 @@ function validateSnapshot(task) {
 /** Atomic document writes keep decisions and their outgoing messages in one transaction. */
 export class CollaborationTaskStore {
     file;
+    listeners = new Set();
+    subscribe(listener) { this.listeners.add(listener); return () => { this.listeners.delete(listener); }; }
+    snapshot() { return structuredClone(this.document.tasks); }
     document = { version: 1, tasks: [], outbox: [], requests: {} };
     constructor(file) {
         this.file = file;
@@ -129,9 +132,18 @@ export class CollaborationTaskStore {
                 throw error;
         }
     }
-    transaction(mutate) {
+    transaction(mutate, origin) {
         const next = structuredClone(this.document);
         const result = mutate(next);
+        if (origin) {
+            const previous = new Set(this.document.tasks.flatMap(t => t.events.map(e => e.id)));
+            for (const task of next.tasks)
+                for (const event of task.events)
+                    if (!previous.has(event.id) && event.actor === null && event.source !== 'system') {
+                        event.source = 'integration';
+                        event.origin = structuredClone(origin);
+                    }
+        }
         if (next.tasks.some(task => Buffer.byteLength(JSON.stringify(task)) > 512_000))
             throw new CollaborationError('TASK_HISTORY_LIMIT', '此任务记录达到 500 KiB，请建立后续任务并保留本任务为历史', 409);
         const serialized = JSON.stringify(next);
@@ -142,8 +154,18 @@ export class CollaborationTaskStore {
         writeFileSync(temporary, serialized, { mode: 0o600 });
         renameSync(temporary, this.file);
         this.document = next;
+        for (const listener of this.listeners) {
+            try {
+                listener();
+            }
+            catch { /* Durable sources allow the integration journal to retry. */ }
+        }
         return structuredClone(result);
     }
+    integrationRequestEvent(principalId, key, taskId) {
+        const request = this.document.requests[`integration:${principalId}:${key}`];
+        return request?.taskId === taskId ? structuredClone(this.document.tasks.find(t => t.id === taskId)?.events.find(e => e.id === request.eventId)) : undefined;
+    }
     get(taskId) { return structuredClone(this.document.tasks.find(t => t.id === taskId) ?? null); }
     owned(owner) { return structuredClone(this.document.tasks.filter(t => t.ownerServiceId === owner)); }
     children(taskId) {
@@ -166,7 +188,7 @@ export class CollaborationTaskStore {
                 attempts: current ? [{ ...current, report: current.report ? { ...current.report, summary: reportSummary, content: '', evidence: undefined } : undefined }] : [],
                 artifacts: [plan, result, ...task.artifacts.filter(a => a.kind === 'review' && a.reviewsArtifactId === result?.id)].filter((a) => !!a).map(a => ({ ...a, content: '', summary: (a.summary || (a.kind === 'result' && collaborationResultPresentation(a.content).condensed ? collaborationResultPresentation(a.content).summary : undefined))?.slice(0, 800), evidence: undefined })),
                 decisions: task.decisions.filter(d => d.status === 'pending').map(d => ({ ...d, question: d.question.slice(0, 512), options: [] })),
-                events: task.events.filter(e => ['revise', 'request-review'].includes(e.kind) && e.attemptId === task.activeAttemptId).slice(-4).map(e => ({ ...e, content: e.source === 'user' && e.kind === 'revise' ? e.content.slice(0, 512) : '' })) };
+                events: task.events.filter(e => ['revise', 'request-review'].includes(e.kind) && e.attemptId === task.activeAttemptId).slice(-4).map(e => ({ ...e, content: ['user', 'integration'].includes(e.source ?? '') && e.kind === 'revise' ? e.content.slice(0, 512) : '' })) };
         }));
     }
     heads(groupIds, owner) { return this.document.tasks.filter(t => groupIds.includes(t.groupId) && t.ownerServiceId === owner).map(t => ({ id: t.id, revision: t.revision })); }
@@ -179,11 +201,11 @@ export class CollaborationTaskStore {
         task.events.push(event);
         return event;
     }
-    request(doc, actor, key, payload) {
+    request(doc, actor, key, payload, origin) {
         if (typeof key !== 'string' || !key.trim() || key.length > 256)
             throw new CollaborationError('INVALID_IDEMPOTENCY_KEY', '需要有效的请求幂等键');
-        const scoped = `${actor ? taskMemberKey(actor) : 'user'}:${key}`;
-        const hash = createHash('sha256').update(stable(payload)).digest('hex');
+        const scoped = `${origin ? `integration:${origin.integrationId}` : actor ? taskMemberKey(actor) : 'user'}:${key}`;
+        const hash = createHash('sha256').update(stable(origin ? [payload, origin] : payload)).digest('hex');
         const previous = doc.requests[scoped];
         if (previous && previous.hash !== hash)
             throw new CollaborationError('IDEMPOTENCY_CONFLICT', '该请求已用于不同内容；请保留原请求或重新开始', 409);
@@ -222,7 +244,7 @@ export class CollaborationTaskStore {
         doc.outbox.push({ id: id(), taskId: task.id, attemptId: attempt?.id ?? null, target: task.coordinator, kind: 'message', threadId: attempt?.threadId ?? task.id,
             content: `你被指定为任务「${task.title}」的协调者。\n目标：${task.spec}\n约束：${task.constraints || '未补充'}\n验收标准：${task.acceptance || '由用户决定'}\n任务 ID：${task.id}\n用 td collab task get ${task.id} --text 查看原始记录；用 task list --group ${task.groupId} 查看工作组。需要拆分时用 task create --group ${task.groupId} --parent ${task.id} --title '子任务标题' --content '任务内容'。分派前查询 revision，再用 task assign --revision；把必要的人类决策交给 task ask，不推断成员忙闲，不停止其他成员终端。` });
     }
-    create(owner, input, actor) {
+    create(owner, input, actor, origin) {
         const title = text(input.title, '标题', 640, true), spec = text(input.spec, '任务内容', 32_000, true);
         const constraints = text(input.constraints, '约束'), acceptance = text(input.acceptance, '完成标准');
         if (input.dependsOn !== undefined && (!Array.isArray(input.dependsOn) || input.dependsOn.length > 32 || input.dependsOn.some(v => typeof v !== 'string')))
@@ -242,7 +264,7 @@ export class CollaborationTaskStore {
             throw new CollaborationError('INVALID_REVIEWERS', '评审成员列表无效');
         input.reviewers?.forEach(member);
         return this.transaction(doc => {
-            const request = this.request(doc, actor, input.idempotencyKey, input);
+            const request = this.request(doc, actor, input.idempotencyKey, input, origin);
             if (request.previous)
                 return request.previous;
             if (doc.tasks.length >= 2000)
@@ -285,7 +307,7 @@ export class CollaborationTaskStore {
             const task = { id: id(), ownerServiceId: owner, groupId: input.groupId, title, spec, constraints, acceptance,
                 coordinator: parent?.workflow ? parent.coordinator : input.coordinator !== undefined ? input.coordinator : input.parentTaskId ? doc.tasks.find(t => t.id === input.parentTaskId)?.coordinator ?? actor : null,
                 parentTaskId: input.parentTaskId ?? null, dependsOn, createdAt: now, updatedAt: now, revision: 1,
-                status: 'open', activeAttemptId: null, attempts: [], decisions: [], artifacts: [], events: [], deliveries: [], ...(workflow ? { workflow } : {}) };
+                ...(origin ? { origin: structuredClone(origin) } : {}), status: 'open', activeAttemptId: null, attempts: [], decisions: [], artifacts: [], events: [], deliveries: [], ...(workflow ? { workflow } : {}) };
             this.event(task, 'created', actor, spec);
             if (parent?.constraints)
                 task.constraints = text([parent.constraints, constraints].filter(Boolean).join('\n'), '继承约束');
@@ -307,9 +329,9 @@ export class CollaborationTaskStore {
             this.touchParent(doc, task, '新子任务已创建');
             doc.requests[request.key] = { hash: request.hash, taskId: task.id };
             return task;
-        });
+        }, origin);
     }
-    apply(taskId, input, actor) {
+    apply(taskId, input, actor, origin) {
         const content = text(input.content, '内容');
         const summary = text(input.summary, '结果摘要', 2400);
         if (summary && (input.kind !== 'report' || input.status !== 'complete'))
@@ -322,23 +344,25 @@ export class CollaborationTaskStore {
             const task = doc.tasks.find(t => t.id === taskId);
             if (!task)
                 throw new CollaborationError('TASK_NOT_FOUND', '任务不存在或无权查看', 404);
-            const request = this.request(doc, actor, input.idempotencyKey, [taskId, input]);
+            const request = this.request(doc, actor, input.idempotencyKey, [taskId, input], origin);
             if (request.previous)
                 return request.previous;
+            if (origin && ['accept', 'approve-plan', 'report', 'ask', 'submit-plan', 'review', 'respond'].includes(input.kind))
+                throw new CollaborationError('INTEGRATION_OPERATION_DENIED', '此操作需要用户或原执行成员身份', 403);
             const coordination = actor === null || sameMember(actor, task.coordinator);
             if (['assign', 'coordinator', 'close', 'reopen', 'revise', 'request-review', 'coordinate', 'pause', 'resume', 'retry'].includes(input.kind) && !coordination)
                 throw new CollaborationError('TASK_PERMISSION_DENIED', '此操作需要用户或当前协调者', 403);
             if (['answer', 'accept', 'approve-plan'].includes(input.kind) && actor !== null)
                 throw new CollaborationError('USER_DECISION_REQUIRED', '回答、方案确认与验收需要用户操作', 403);
-            if (!['report', 'ask', 'submit-plan', 'review', 'comment', 'answer'].includes(input.kind) && input.expectedRevision !== task.revision)
+            if (!['report', 'ask', 'submit-plan', 'review', 'comment', 'respond', 'answer'].includes(input.kind) && input.expectedRevision !== task.revision)
                 throw new CollaborationError('TASK_CHANGED', '任务已更新，请查看最新记录后重试', 409);
             const userFollowup = actor === null && input.kind === 'revise' && !!content;
-            if (task.status !== 'open' && !['reopen', 'report'].includes(input.kind) && !(task.status === 'accepted' && userFollowup))
+            if (task.status !== 'open' && !['reopen', 'report'].includes(input.kind) && !(task.status === 'accepted' && (userFollowup || ['comment', 'respond'].includes(input.kind))))
                 throw new CollaborationError('TASK_ARCHIVED', '任务已归档；需要继续时请重新打开', 409);
-            if (task.workflow && task.status !== 'open' && input.kind !== 'reopen' && !(task.status === 'accepted' && userFollowup))
+            if (task.workflow && task.status !== 'open' && input.kind !== 'reopen' && !(task.status === 'accepted' && (userFollowup || ['comment', 'respond'].includes(input.kind))))
                 throw new CollaborationError('TASK_ARCHIVED', '自动协作的已完成版本不能追加执行报告，请先重新打开', 409);
             const root = task.workflow?.rootTaskId ? doc.tasks.find(t => t.id === task.workflow.rootTaskId) : undefined;
-            if (root && root.status !== 'open' && !(root.status === 'accepted' && userFollowup))
+            if (root && root.status !== 'open' && !(root.status === 'accepted' && (userFollowup || ['comment', 'respond'].includes(input.kind))))
                 throw new CollaborationError('GOAL_ARCHIVED', '请先重新打开所属目标，再继续子任务', 409);
             if (userFollowup && task.status === 'accepted') {
                 task.status = 'open';
@@ -418,8 +442,26 @@ export class CollaborationTaskStore {
                 const event = this.event(task, 'report', actor, content, attempt.id);
                 event.reportStatus = input.status;
                 event.evidence = input.evidence;
-                if (input.status === 'complete')
-                    task.artifacts.push({ id: id(), attemptId: attempt.id, kind: 'result', content, ...(summary ? { summary } : {}), evidence: input.evidence, actor: actor, createdAt: event.createdAt });
+                if (input.status === 'complete' && task.status === 'accepted') {
+                    task.status = 'open';
+                    delete task.acceptedArtifactId;
+                    delete task.completionMode;
+                }
+                if (input.status === 'complete') {
+                    event.artifactId = id();
+                    task.artifacts.push({ id: event.artifactId, attemptId: attempt.id, kind: 'result', content, ...(summary ? { summary } : {}), evidence: input.evidence, actor: actor, createdAt: event.createdAt });
+                }
+            }
+            else if (input.kind === 'respond') {
+                const original = task.events.find(e => e.id === input.replyToEventId && e.kind === 'comment');
+                const originalAttempt = original && task.attempts.find(a => a.id === original.attemptId);
+                if (!original || !originalAttempt || originalAttempt.id !== input.attemptId || !sameMember(actor, originalAttempt.assignee))
+                    throw new CollaborationError('RESPONSE_PERMISSION_DENIED', '请由原追问对应的执行成员回复，并指定原事件和分派', 403);
+                if (!content)
+                    throw new CollaborationError('INVALID_RESPONSE', '答复不能为空');
+                const response = this.event(task, 'respond', actor, content, originalAttempt.id);
+                response.replyToEventId = original.id;
+                response.evidence = input.evidence;
             }
             else if (input.kind === 'ask') {
                 if (!content || input.options !== undefined && (!Array.isArray(input.options) || input.options.length > 8 || input.options.some(v => typeof v !== 'string' || !v.trim() || v.length > 500)))
@@ -439,7 +481,7 @@ export class CollaborationTaskStore {
                 this.event(task, 'answer', null, content, decision.attemptId);
                 const recipient = task.attempts.find(a => a.id === decision.attemptId);
                 doc.outbox.push({ id: id(), taskId: task.id, attemptId: recipient.id, target: recipient.assignee, kind: 'message', threadId: recipient.threadId,
-                    content: `任务「${task.title}」问题已回答\n问题：${decision.question}\n用户回答：${content}\n任务 ID：${task.id}\n尝试 ID：${recipient.id}` });
+                    content: `任务「${task.title}」问题已回答\n问题：${decision.question}\n${origin ? '外部接入回答' : '用户回答'}：${content}\n任务 ID：${task.id}\n尝试 ID：${recipient.id}` });
             }
             else if (input.kind === 'submit-plan' || input.kind === 'review') {
                 if (!content || !actor)
@@ -519,7 +561,7 @@ export class CollaborationTaskStore {
                     event.target = recipient.assignee;
                     event.deliveryId = id();
                     doc.outbox.push({ id: event.deliveryId, taskId: task.id, attemptId: recipient.id, target: recipient.assignee,
-                        kind: 'message', threadId: recipient.threadId, content: `任务「${task.title}」${input.kind === 'revise' ? actor === null ? '用户要求继续跟进' : '修改要求' : '补充反馈'}：\n${content}\n任务 ID：${task.id}\n尝试 ID：${recipient.id}${task.workflow?.kind === 'goal' ? `\n本轮继续沿用此目标和已交付证据，只推进新增要求。\n${this.goalInstructions(task)}` : '\n按这次要求继续当前分派，重新提交 complete 和摘要；新版本会重新独立评审。'}` });
+                        kind: 'message', threadId: recipient.threadId, replyToEventId: event.id, content: `任务「${task.title}」${input.kind === 'revise' ? actor === null ? origin ? '外部接入要求继续跟进' : '用户要求继续跟进' : '修改要求' : '补充反馈'}：\n${content}\n任务 ID：${task.id}\n尝试 ID：${recipient.id}${input.kind === 'comment' ? `\n这是纯咨询，保留当前结果与验收。请用 td collab --session ${recipient.assignee.sessionId} task respond ${task.id} --attempt ${recipient.id} --to-event ${event.id} --content '答复' 关联回复；只有明确提交新的交付物才用 complete。` : task.workflow?.kind === 'goal' ? `\n本轮继续沿用此目标和已交付证据，只推进新增要求。\n${this.goalInstructions(task)}` : '\n按这次要求继续当前分派，重新提交 complete 和摘要；新版本会重新独立评审。'}` });
                     if (task.workflow?.kind === 'goal' && task.coordination) {
                         task.coordination.notifiedSequence = event.sequence;
                         task.coordination.notifiedAt = Date.now();
@@ -584,21 +626,21 @@ export class CollaborationTaskStore {
             }
             else
                 throw new CollaborationError('INVALID_TASK_OPERATION', '不支持的任务操作');
-            if (['report', 'ask', 'answer', 'submit-plan', 'review', 'accept', 'revise', 'close', 'reopen'].includes(input.kind))
+            if (['report', 'respond', 'ask', 'answer', 'submit-plan', 'review', 'accept', 'revise', 'close', 'reopen'].includes(input.kind))
                 this.notifyCoordinator(doc, task, task.events.at(-1));
             if (task.events.length > 1000 || task.artifacts.length > 200 || task.attempts.length > 100)
                 throw new CollaborationError('TASK_HISTORY_LIMIT', '此任务历史达到上限，请建立后续任务并保留本任务为历史', 409);
             task.revision++;
             task.updatedAt = Math.max(Date.now(), task.updatedAt + 1);
-            if (task.workflow && input.kind !== 'coordinate')
+            if (task.workflow && !['coordinate', 'comment', 'respond'].includes(input.kind))
                 this.touchParent(doc, task, `${input.kind}${input.status ? ` / ${input.status}` : ''}：${content.slice(0, 1500)}`);
             if (task.workflow && ['blocked', 'failed'].includes(input.status ?? ''))
                 task.automationIssue = content.slice(0, 1000);
             if (task.workflow && input.kind === 'report' && ['ack', 'working', 'complete'].includes(input.status ?? ''))
                 delete task.automationIssue;
-            doc.requests[request.key] = { hash: request.hash, taskId };
+            doc.requests[request.key] = { hash: request.hash, taskId, eventId: task.events.at(-1)?.id };
             return task;
-        });
+        }, origin);
     }
     touchParent(doc, task, content) {
         const root = task.workflow?.rootTaskId ? doc.tasks.find(t => t.id === task.workflow.rootTaskId) : undefined;
@@ -717,7 +759,7 @@ export class CollaborationTaskStore {
                     this.touchParent(doc, task, '独立评审通过，后续依赖可以接续');
                 }
                 else if (action === 'review-feedback') {
-                    const boundary = task.events.filter(e => e.kind === 'revise' && e.source === 'user' && e.attemptId === task.activeAttemptId).at(-1)?.sequence ?? 0;
+                    const boundary = task.events.filter(e => e.kind === 'revise' && ['user', 'integration'].includes(e.source ?? '') && e.attemptId === task.activeAttemptId).at(-1)?.sequence ?? 0;
                     const rounds = task.events.filter(e => e.kind === 'revise' && e.actor === null && e.artifactId && e.attemptId === task.activeAttemptId && e.sequence > boundary).length;
                     const blocked = review.verdict === 'blocked' || rounds >= task.workflow.maxRevisions;
                     const event = this.event(task, blocked ? 'review-blocked' : 'revise', null, review.content);

package/dist/server/agent/integrationCli.js

@@ -0,0 +1,227 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { INTEGRATION_PROTOCOL } from './integrationStore.js';
+import { integrationSocketPath } from './integrationServer.js';
+import { CollaborationError } from './collaborationProtocol.js';
+import { executeCollaborationCommand, duration } from './collaborationCli.js';
+import { getTermdockVersion } from '../utils/version.js';
+export const INTEGRATION_HELP = `td integration — local scoped integration administration
+  groups | list
+  create --file <policy.json> --credential-file <private-output.json>
+  revoke <principal-id>
+Credentials are saved as a private file and never printed. Workers set
+TERMDOCK_INTEGRATION_CREDENTIAL_FILE, then use td collab --principal <id> …
+Only the local administrator can provision/revoke grants. See docs/integrations.md.`;
+export function readIntegrationCredential(file, principalId) {
+    const info = fs.lstatSync(file);
+    if (!info.isFile() || info.size > 4096 || (info.mode & 0o077) || process.getuid && info.uid !== process.getuid())
+        throw new CollaborationError('INTEGRATION_CREDENTIAL_FILE_DENIED', 'Credential file must be owned by this user and private (0600)', 403);
+    const credential = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (credential.id !== principalId || !credential.token || credential.protocol !== INTEGRATION_PROTOCOL)
+        throw new CollaborationError('INTEGRATION_CREDENTIAL_MISMATCH', 'Credential identity/protocol does not match the requested principal', 403);
+    return credential;
+}
+function headers(credential, adminToken) {
+    return { 'Content-Type': 'application/json', 'x-termdock-integration-protocol': String(INTEGRATION_PROTOCOL),
+        'x-termdock-cli-version': getTermdockVersion(),
+        ...(credential ? { 'x-termdock-integration-id': credential.id, authorization: `Bearer ${credential.token}` } : {}),
+        ...(adminToken ? { 'x-termdock-local-token': adminToken } : {}) };
+}
+function request(socketPath, method, route, body, requestHeaders, timeout = 30000) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ socketPath, method, path: route, headers: requestHeaders }, res => {
+            let raw = '';
+            res.setEncoding('utf8');
+            res.on('data', chunk => { raw += chunk; if (raw.length > 4 * 1024 * 1024)
+                req.destroy(new Error('Integration response exceeds limit')); });
+            res.once('end', () => resolve({ statusCode: res.statusCode ?? 500, body: raw }));
+            res.once('error', reject);
+        });
+        req.setTimeout(timeout, () => req.destroy(new Error('Integration request timed out')));
+        req.once('error', reject);
+        req.end(body === undefined ? undefined : JSON.stringify(body));
+    });
+}
+function parsed(response) {
+    const result = JSON.parse(response.body);
+    if (response.statusCode >= 300)
+        throw new CollaborationError(result.code ?? 'INTEGRATION_REQUEST_FAILED', result.error ?? 'Integration request failed', response.statusCode);
+    return result;
+}
+export async function runIntegrationAdmin(argv, port, adminToken, write) {
+    let reserved;
+    try {
+        const action = argv[0] ?? 'help', options = {};
+        if (action === 'help' || action === '--help') {
+            write(INTEGRATION_HELP);
+            return 0;
+        }
+        for (let index = 1; index < argv.length; index += 2) {
+            const flag = argv[index];
+            if (!['--file', '--credential-file'].includes(flag) || !argv[index + 1] || options[flag])
+                throw new Error('Invalid integration arguments');
+            options[flag] = argv[index + 1];
+        }
+        const socketPath = integrationSocketPath(port);
+        if (action === 'groups' || action === 'list') {
+            if (argv.length !== 1)
+                throw new Error('Unexpected arguments');
+            write(JSON.stringify(parsed(await request(socketPath, 'GET', action === 'groups' ? '/admin/groups' : '/admin/principals', undefined, headers(undefined, adminToken)))));
+            return 0;
+        }
+        if (action === 'create') {
+            if (!options['--file'] || !options['--credential-file'] || Object.keys(options).length !== 2)
+                throw new Error('create requires --file and --credential-file');
+            const policy = JSON.parse(fs.readFileSync(options['--file'], 'utf8'));
+            const destination = path.resolve(options['--credential-file']);
+            fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+            fs.closeSync(fs.openSync(destination, 'wx', 0o600));
+            reserved = destination;
+            const credential = parsed(await request(socketPath, 'POST', '/admin/principals', policy, headers(undefined, adminToken)));
+            fs.writeFileSync(reserved, JSON.stringify(credential), { mode: 0o600 });
+            write(JSON.stringify({ ok: true, id: credential.id, credential_file: reserved }));
+            reserved = undefined;
+            return 0;
+        }
+        throw new Error('Unknown integration operation');
+    }
+    catch (error) {
+        if (reserved)
+            fs.unlinkSync(reserved);
+        write(JSON.stringify({ ok: false, code: error instanceof CollaborationError ? error.code : 'INTEGRATION_ADMIN_ERROR', error: error instanceof CollaborationError ? error.message : 'Integration administration failed; inspect arguments and private file paths' }));
+        return 1;
+    }
+}
+export async function revokeIntegration(id, port, adminToken, write) {
+    try {
+        write(JSON.stringify(parsed(await request(integrationSocketPath(port), 'POST', `/admin/principals/${encodeURIComponent(id)}/revoke`, {}, headers(undefined, adminToken)))));
+        return 0;
+    }
+    catch (error) {
+        write(JSON.stringify({ ok: false, code: error instanceof CollaborationError ? error.code : 'INTEGRATION_ADMIN_ERROR', error: error instanceof CollaborationError ? error.message : 'Integration revocation failed' }));
+        return 1;
+    }
+}
+export async function runIntegrationCollab(command, port, io) {
+    try {
+        const principalId = String(command.options.principal), file = process.env.TERMDOCK_INTEGRATION_CREDENTIAL_FILE;
+        if (!file)
+            throw new CollaborationError('INTEGRATION_CREDENTIAL_REQUIRED', 'Set TERMDOCK_INTEGRATION_CREDENTIAL_FILE to a private credential file', 401);
+        const credential = readIntegrationCredential(file, principalId), socketPath = integrationSocketPath(port);
+        const capability = parsed(await request(socketPath, 'GET', '/capabilities', undefined, headers(credential)));
+        if (capability.integration_protocol !== INTEGRATION_PROTOCOL)
+            throw new CollaborationError('INCOMPATIBLE_INTEGRATION_PROTOCOL', 'CLI/service protocols are incompatible', 409);
+        if (command.action === 'capabilities') {
+            io.write(JSON.stringify({ ...capability, cli_version: getTermdockVersion() }));
+            return 0;
+        }
+        if (command.action === 'events') {
+            const consumer = String(command.options.consumer ?? 'default');
+            if (command.operation === 'ack') {
+                io.write(JSON.stringify(parsed(await request(socketPath, 'POST', '/events/ack', { consumer, cursor: command.target }, headers(credential)))));
+                return 0;
+            }
+            const params = new URLSearchParams({ consumer });
+            if (command.options.group)
+                params.set('group', String(command.options.group));
+            return subscribe(socketPath, `/events?${params}`, credential, command.options.timeout ? duration(String(command.options.timeout)) : undefined, io.write);
+        }
+        if (command.action === 'session') {
+            const route = command.operation === 'create' ? '/sessions' : `/sessions/${encodeURIComponent(command.target)}${command.operation === 'restore' ? '/restore' : ''}`;
+            const body = command.operation === 'create' ? { group_id: command.options.group, launch_profile: command.options['launch-profile'], cwd: command.options.cwd, idempotency_key: command.options['idempotency-key'] }
+                : command.operation === 'restore' ? { idempotency_key: command.options['idempotency-key'] } : undefined;
+            io.write(JSON.stringify(parsed(await request(socketPath, command.operation === 'get' ? 'GET' : 'POST', route, body, headers(credential)))));
+            return 0;
+        }
+        if (!['task', 'message', 'help'].includes(command.action) || command.action === 'message' && command.operation !== 'get')
+            throw new CollaborationError('INTEGRATION_OPERATION_DENIED', 'Command is not exposed to integration identities', 403);
+        return executeCollaborationCommand(command, {}, { ...io, request: async (method, endpoint, body, timeout) => {
+                const origin = { source: command.options.source, externalActor: command.options['external-actor'] ? JSON.parse(String(command.options['external-actor'])) : undefined,
+                    externalMessageId: command.options['external-message-id'], metadata: command.options.metadata ? JSON.parse(String(command.options.metadata)) : undefined };
+                return request(socketPath, method, endpoint.replace('/api/terminal/operations/orchestration', ''), body === undefined ? undefined : { ...body, origin }, headers(credential), timeout);
+            } });
+    }
+    catch (error) {
+        io.write(JSON.stringify({ ok: false, code: error instanceof CollaborationError ? error.code : 'INTEGRATION_CONNECTION_FAILED', error: error instanceof CollaborationError ? error.message : 'Local integration connection failed; credentials were not sent to a public service' }));
+        return 1;
+    }
+}
+async function subscribe(socketPath, route, credential, timeout, write) {
+    const deadline = timeout ? Date.now() + timeout : Infinity;
+    let backoff = 1000;
+    while (Date.now() < deadline) {
+        const outcome = await new Promise(resolve => {
+            let timer;
+            const req = http.request({ socketPath, method: 'GET', path: route, headers: headers(credential) }, res => {
+                res.setEncoding('utf8');
+                let pending = '', ended = false;
+                res.on('data', chunk => {
+                    pending += chunk;
+                    if (pending.length > 2 * 1024 * 1024) {
+                        ended = true;
+                        req.destroy();
+                        resolve('stop');
+                        return;
+                    }
+                    for (;;) {
+                        const newline = pending.indexOf('\n');
+                        if (newline < 0)
+                            break;
+                        const line = pending.slice(0, newline);
+                        pending = pending.slice(newline + 1);
+                        if (!line.trim())
+                            continue;
+                        let event;
+                        try {
+                            event = JSON.parse(line);
+                        }
+                        catch {
+                            write(JSON.stringify({ type: 'error', code: 'INVALID_EVENT_RESPONSE', retryable: false }));
+                            ended = true;
+                            req.destroy();
+                            resolve('stop');
+                            return;
+                        }
+                        write(line);
+                        if (event.type === 'error' && !event.retryable) {
+                            ended = true;
+                            req.destroy();
+                            resolve('stop');
+                        }
+                    }
+                });
+                res.once('end', () => {
+                    if ((res.statusCode ?? 500) >= 300 && pending) {
+                        try {
+                            const error = JSON.parse(pending);
+                            write(JSON.stringify(error));
+                        }
+                        catch {
+                            write(JSON.stringify({ type: 'error', code: 'INVALID_EVENT_RESPONSE', retryable: false }));
+                        }
+                        resolve((res.statusCode ?? 500) >= 500 ? 'retry' : 'stop');
+                    }
+                    else if (!ended)
+                        resolve('retry');
+                });
+                res.once('close', () => { if (!ended)
+                    resolve('retry'); });
+            });
+            req.once('error', () => resolve('retry'));
+            req.once('close', () => { if (timer)
+                clearTimeout(timer); });
+            if (Number.isFinite(deadline))
+                timer = setTimeout(() => { resolve('timeout'); req.destroy(); }, Math.max(1, deadline - Date.now()));
+            req.end();
+        });
+        if (outcome === 'stop')
+            return 1;
+        if (outcome === 'timeout')
+            return 0;
+        write(JSON.stringify({ type: 'connection', state: 'reconnecting', retry_in_ms: backoff }));
+        await new Promise(resolve => setTimeout(resolve, Math.min(backoff, Math.max(0, deadline - Date.now()))));
+        backoff = Math.min(backoff * 2, 30000);
+    }
+    return 0;
+}