wechatbridge-cli 1.4.8__tar.gz → 1.5.0__tar.gz

{wechatbridge_cli-1.4.8/wechatbridge_cli.egg-info → wechatbridge_cli-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.4.8
+Version: 1.5.0
 Summary: Bridge WeChat messages to agy, Grok Build, or Codex CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT
@@ -36,21 +36,21 @@ Dynamic: license-file
 ![license](https://img.shields.io/badge/license-MIT-blue.svg)
 ![python](https://img.shields.io/badge/python-3.10+-blue.svg)
 
-WeChatBridge connects a WeChat bot to agentic coding CLIs (Google's agy / Antigravity, xAI's Grok Build, or OpenAI's Codex). From WeChat you can send text, images, files, and voice-as-text to the active CLI, get replies back, and receive certain generated files over the WeChat CDN. Switch backends per user with `/backend` — no restart.
+WeChatBridge connects a WeChat bot to agentic coding CLIs (Google's agy / Antigravity, xAI's Grok Build, OpenAI's Codex, or DeepSeek Harness' dsh). From WeChat you can send text, images, files, and voice-as-text to the active CLI, get replies back, and receive certain generated files over the WeChat CDN. Switch backends per user with `/backend` — no restart.
 
 ```
-WeChat (phone)  ⇄  iLink bot API  ⇄  WeChatBridge  ⇄  agy / grok / codex CLI
+WeChat (phone)  ⇄  iLink bot API  ⇄  WeChatBridge  ⇄  agy / grok / codex / dsh CLI
                                      (this project)    (runs tools)
 ```
 
-The bridge process stays up and long-polls iLink. For prompts that go to a CLI, it spawns one `agy` or `grok` child (`-p` single-turn) and exits that child when done — the child does not stay resident. Many slash commands (`/help`, `/backend`, `/persona`, …) are handled inside the bridge and never start a CLI. Only artifacts the bridge can detect under the user's allowed session paths are pushed back via CDN.
+The bridge process stays up and long-polls iLink. For prompts that go to a CLI, it spawns one `agy` / `grok` / `codex` / `dsh` child (single-turn) and exits that child when done — the child does not stay resident. Many slash commands (`/help`, `/backend`, `/persona`, …) are handled inside the bridge and never start a CLI. Only artifacts the bridge can detect under the user's allowed session paths are pushed back via CDN.
 
 ## Features
 
-- Text, image, file, and voice (WeChat server-side transcription only) go to the **active** backend (`agy`, `grok`, or `codex`)
+- Text, image, file, and voice (WeChat server-side transcription only) go to the **active** backend (`agy`, `grok`, `codex`, or `dsh`)
 - Detected CLI artifacts under the per-user allowed tree can be sent back (size-capped); not every file the CLI touches
 - Each WeChat user gets an isolated workspace; model / effort / mode are remembered **per backend**
-- Runtime backend switch: `/backend agy`, `/backend grok`, or `/backend codex` (clears that backend's continuation state — the agy/grok continuation flag and the codex `thread_id`/resume state — so the next CLI turn starts a fresh session; history files on disk are not wiped immediately)
+- Runtime backend switch: `/backend agy`, `/backend grok`, `/backend codex`, or `/backend dsh` (clears that backend's continuation state — the agy/grok continuation flag and the codex `thread_id`/resume state — so the next CLI turn starts a fresh session; history files on disk are not wiped immediately)
 - Slash commands for model, session reset, persona, and more (see below)
 - Dangerous-prompt gate: a **keyword list** of concrete destructive patterns asks for confirmation before run
 - Sender whitelist (`WECHATBRIDGE_ALLOWED_SENDERS`; empty = allow all)
@@ -72,19 +72,28 @@ Default data paths expand from `~` (e.g. `~/.local/share/wechatbridge/<instance>
 - **agy** (default) — Google Antigravity CLI
 - **grok** — xAI Grok Build CLI
 - **codex** — OpenAI Codex CLI
+- **dsh** — DeepSeek Harness CLI (one-shot `headless` profile)
 
-Per-user switch: `/backend agy`, `/backend grok`, or `/backend codex`. Each backend keeps its own model / effort / mode memory and persona file layout. Global default is `WECHATBRIDGE_BACKEND`.
+Per-user switch: `/backend agy`, `/backend grok`, `/backend codex`, or `/backend dsh`. Each backend keeps its own model / effort / mode memory and persona file layout. Global default is `WECHATBRIDGE_BACKEND`.
+
+### dsh backend notes
+
+- **Single-turn:** the `headless` profile always creates a fresh session per invocation (`session-<uuid>`), so every WeChat message starts a new dsh session. `/clear` / `/new` are accepted but are no-ops, and `/model`, `/fast`, `/planning`, `/persona`, `/add-dir` are not wired yet (they return a short "not supported" notice).
+- Runs `dsh --profile headless -- <prompt>` with `cwd` = the per-user session directory (per-user workspace; model-created files land there and can be sent back via CDN).
+- Image and file attachments are merged into the prompt text as `@/absolute/path` mentions. Verified in dsh v0.1.1-rc.2: `headless` passes the prompt text directly to the model without pre-reading or inlining mentions; the model receives system guidance on @-paths and may invoke file tools (e.g. `read`) if needed. The bridge only filters out-of-bounds mentions starting with absolute paths, `~`, or `file://` (`@/abs`, `@~/x`, `@file://`, replaced with `[blocked-path]`), which is best-effort prompt text filtering rather than a sandbox boundary.
+- Auth / profiles are **machine-wide** (`~/.dsh`, same model as grok's machine-wide login): the child's `HOME` points at the per-user session dir, so the bridge always passes `DSH_HOME` explicitly. Set `WECHATBRIDGE_DSH_HOME` to configure a dedicated service home with automatic session retention cleanup; when unset, it reuses the host `~/.dsh` without automatic session cleanup (managed by the operator). `DSH_BIN_PATH`, `DSH_PROFILE`, and `DSH_TIMEOUT` are configurable.
+- Status: implemented from the published `dsh` CLI contract (headless bundle source) plus a fake CLI in the test suite; final acceptance depends on a real `dsh login` + headless run.
 
 ### Grok backend notes
 
 - Isolation: each WeChat user runs with `HOME` pointed at their own session directory. Conversation state stays there; login is machine-wide.
-- Auth: the session links to the host `~/.grok/auth.json` (copied as a fallback), reusing the host `grok login`. Alternatively, set `XAI_API_KEY` in the bridge process environment (the grok child is given that key after env sanitizing). A grok-remote TUI session being signed in is not the same as the host CLI login. No key or token values are stored in this repository.
+- Auth: the session links to the host `~/.grok/auth.json` (copied as a fallback), reusing the host `grok login`. The grok CLI rewrites `auth.json` via temp-file + rename, which replaces the session symlink with a regular file; the bridge promotes such session files back to the host (atomic copy) and re-links, so refreshed tokens never get overwritten by the revoked host copy. Alternatively, set `XAI_API_KEY` in the bridge process environment (the grok child is given that key after env sanitizing). A grok-remote TUI session being signed in is not the same as the host CLI login. No key or token values are stored in this repository.
 
 ### Codex backend notes
 
 - Runs `codex exec --json` for each single turn; conversation continuation uses `codex exec resume <thread_id> <prompt>` with the thread id persisted per user.
 - Isolation: each WeChat user runs with `HOME` and `CODEX_HOME` pointed at their own per-user session directory (`session_dir/.codex`), so sessions, logs, and caches never cross users.
-- Auth: the per-user session links to the host `~/.codex/auth.json` (copied as a fallback), reusing the host `codex login`. Alternatively, set `CODEX_API_KEY` in the bridge process environment to authenticate. No key or token values are stored in this repository.
+- Auth: the per-user session links to the host `~/.codex/auth.json` (copied as a fallback), reusing the host `codex login`. The codex CLI rewrites `auth.json` via temp-file + rename, which replaces the session symlink with a regular file; the bridge promotes such session files back to the host (atomic copy) and re-links, so refreshed tokens never get overwritten by the revoked host copy. Alternatively, set `CODEX_API_KEY` in the bridge process environment to authenticate. No key or token values are stored in this repository.
 - **Status:** there is currently no real Codex subscription or CLI available for live testing. The codex backend is implemented from source research, a JSONL fixture, and a fake CLI used by the test suite (which passes). Final acceptance depends on a real user running it against the actual Codex CLI.
 
 ## Prerequisites
@@ -93,7 +102,8 @@ Per-user switch: `/backend agy`, `/backend grok`, or `/backend codex`. Each back
   - **agy** on `PATH`, or set `AGY_BIN_PATH`
   - **and/or grok** on `PATH`, or set `GROK_BIN_PATH`
   - **and/or codex** on `PATH`, or set `CODEX_BIN_PATH`
-  - Antigravity is Google's terminal agentic coding CLI (successor to Gemini CLI). Grok Build is xAI's counterpart; Codex is OpenAI's terminal agentic coding CLI.
+  - **and/or dsh** on `PATH`, or set `DSH_BIN_PATH` (DeepSeek Harness, `dsh login` required)
+  - Antigravity is Google's terminal agentic coding CLI (successor to Gemini CLI). Grok Build is xAI's counterpart; Codex is OpenAI's terminal agentic coding CLI; dsh is DeepSeek Harness' CLI.
 - A WeChat account with a [ClawBot / iLink](https://ilinkai.weixin.qq.com) bot (QR bind on first run)
 - Python 3.10+
 
@@ -164,10 +174,14 @@ Key variables (all have defaults):
 | `AGY_BIN_PATH` | `agy` | path to the agy binary |
 | `GROK_BIN_PATH` | `grok` | path to the grok binary |
 | `CODEX_BIN_PATH` | `codex` | path to the codex binary |
-| `WECHATBRIDGE_BACKEND` | `agy` | global default backend (`agy` / `grok` / `codex`; overridable per user via `/backend`) |
+| `DSH_BIN_PATH` | `dsh` | path to the dsh binary |
+| `DSH_PROFILE` | `headless` | dsh profile booted for one-shot tasks |
+| `DSH_TIMEOUT` | `600` | dsh CLI run timeout in seconds |
+| `WECHATBRIDGE_DSH_HOME` | _empty_ | explicit `DSH_HOME` passed to the dsh child. Explicitly set = dedicated home + auto session cleanup; unset = reuse host `~/.dsh` without auto cleanup |
+| `WECHATBRIDGE_BACKEND` | `agy` | global default backend (`agy` / `grok` / `codex` / `dsh`; overridable per user via `/backend`) |
 | `WECHATBRIDGE_INSTANCE` | `default` | instance name; state / session / QR paths derive from it |
 | `WECHATBRIDGE_ALLOWED_SENDERS` | _empty_ | comma-separated WeChat IDs (empty = allow all) |
-| `AGY_TIMEOUT` | `600` | CLI run timeout in seconds (all three backends) |
+| `AGY_TIMEOUT` | `600` | CLI run timeout in seconds (agy / grok / codex backends) |
 | `WECHATBRIDGE_MAX_OUTBOUND_BYTES` | `104857600` | max file size sent back to WeChat (100 MB) |
 | `WECHATBRIDGE_MAX_INBOUND_BYTES` | `20971520` | max inbound image/file after download (20 MB) |
 | `WECHATBRIDGE_MAX_CONCURRENT` | `4` | global concurrent process slots; same user serial (queue does not hold a slot); extras get a busy reply |
@@ -253,7 +267,7 @@ See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
 | Command | Action |
 |---|---|
 | `/help` | list supported commands for the active backend |
-| `/backend <agy\|grok\|codex>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
+| `/backend <agy\|grok\|codex\|dsh>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
 | `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
 | `/model <name>` | set model (all backends validate against a live list: agy/grok via CLI `models`; codex via `codex debug models` [then `--bundled`]; unknown name or list-fetch failure refuse and do not write prefs; see `/models`) |
 | `/models` | list models — agy/grok/codex all query the live CLI (codex: `debug models`; falls back to a built-in reference note only if the live list cannot be fetched) |
@@ -273,7 +287,7 @@ Other `/…` commands are either rejected (e.g. `/exit`), reported as unsupporte
 ## Ops & security (what the bridge actually enforces)
 
 - **Whitelist first.** Empty `WECHATBRIDGE_ALLOWED_SENDERS` means anyone who can message the bot can use it.
-- **Auto-approve CLIs.** agy runs with `--dangerously-skip-permissions`; grok with `--always-approve` (unless planning mode). Treat this as trusted-user tooling, not a multi-tenant sandbox.
+- **Auto-approve CLIs.** agy runs with `--dangerously-skip-permissions`; grok with `--always-approve` (unless planning mode); dsh tools run without host path restrictions. Treat this as trusted-user tooling, not a multi-tenant sandbox.
 - **Danger gate is keyword-based**, not full intent understanding. Defaults target concrete patterns (`rm -rf /`, pipe-to-shell, `mkfs`, `format c:`, a few heavy Chinese phrases, …). Everyday wording like bare “delete” is **not** gated. Override list via `WECHATBRIDGE_CONFIRM_KEYWORDS`; approve with `WECHATBRIDGE_CONFIRM_TOKEN` (default `y`), TTL `WECHATBRIDGE_PENDING_TTL`.
 - **Inbound media** is size-capped (default 20 MB), streamed, and CDN hosts are allowlisted. Missing `aes_key` returns a clear error.
 - **Outbound artifacts** only leave the allowed per-user tree (agy: session scratch; grok: under session dir), after `realpath` checks, and only if under `WECHATBRIDGE_MAX_OUTBOUND_BYTES`.
@@ -285,8 +299,10 @@ Other `/…` commands are either rejected (e.g. `/exit`), reported as unsupporte
 
 ## Limitations
 
-- Not a standalone agent — requires agy and/or grok and/or codex.
+- Not a standalone agent — requires agy and/or grok and/or codex and/or dsh.
 - The **codex** backend is not yet verified against a real Codex subscription/CLI; it is validated by source research, a JSONL fixture, and a fake CLI in tests. Treat it as community-tested until a real user confirms.
+- The **dsh** backend is single-turn only (the `headless` profile always starts a fresh session) and has not yet been verified against a real `dsh login` + headless run; it is validated against the published headless bundle contract and a fake CLI in tests.
+- dsh model/effort/mode/persona slash commands are not wired yet; `/model`, `/fast`, `/planning`, `/persona`, `/add-dir` return a "not supported" notice on the dsh backend.
 - Voice is WeChat speech-to-text only; no local ASR; empty transcript → “type instead”.
 - No video send/receive; no native WeChat voice-bubble replies (no silk encode).
 - One WeChat binding per process; multiple accounts need multiple instances (`WECHATBRIDGE_INSTANCE`).

{wechatbridge_cli-1.4.8 → wechatbridge_cli-1.5.0}/README.md

@@ -5,21 +5,21 @@
 ![license](https://img.shields.io/badge/license-MIT-blue.svg)
 ![python](https://img.shields.io/badge/python-3.10+-blue.svg)
 
-WeChatBridge connects a WeChat bot to agentic coding CLIs (Google's agy / Antigravity, xAI's Grok Build, or OpenAI's Codex). From WeChat you can send text, images, files, and voice-as-text to the active CLI, get replies back, and receive certain generated files over the WeChat CDN. Switch backends per user with `/backend` — no restart.
+WeChatBridge connects a WeChat bot to agentic coding CLIs (Google's agy / Antigravity, xAI's Grok Build, OpenAI's Codex, or DeepSeek Harness' dsh). From WeChat you can send text, images, files, and voice-as-text to the active CLI, get replies back, and receive certain generated files over the WeChat CDN. Switch backends per user with `/backend` — no restart.
 
 ```
-WeChat (phone)  ⇄  iLink bot API  ⇄  WeChatBridge  ⇄  agy / grok / codex CLI
+WeChat (phone)  ⇄  iLink bot API  ⇄  WeChatBridge  ⇄  agy / grok / codex / dsh CLI
                                      (this project)    (runs tools)
 ```
 
-The bridge process stays up and long-polls iLink. For prompts that go to a CLI, it spawns one `agy` or `grok` child (`-p` single-turn) and exits that child when done — the child does not stay resident. Many slash commands (`/help`, `/backend`, `/persona`, …) are handled inside the bridge and never start a CLI. Only artifacts the bridge can detect under the user's allowed session paths are pushed back via CDN.
+The bridge process stays up and long-polls iLink. For prompts that go to a CLI, it spawns one `agy` / `grok` / `codex` / `dsh` child (single-turn) and exits that child when done — the child does not stay resident. Many slash commands (`/help`, `/backend`, `/persona`, …) are handled inside the bridge and never start a CLI. Only artifacts the bridge can detect under the user's allowed session paths are pushed back via CDN.
 
 ## Features
 
-- Text, image, file, and voice (WeChat server-side transcription only) go to the **active** backend (`agy`, `grok`, or `codex`)
+- Text, image, file, and voice (WeChat server-side transcription only) go to the **active** backend (`agy`, `grok`, `codex`, or `dsh`)
 - Detected CLI artifacts under the per-user allowed tree can be sent back (size-capped); not every file the CLI touches
 - Each WeChat user gets an isolated workspace; model / effort / mode are remembered **per backend**
-- Runtime backend switch: `/backend agy`, `/backend grok`, or `/backend codex` (clears that backend's continuation state — the agy/grok continuation flag and the codex `thread_id`/resume state — so the next CLI turn starts a fresh session; history files on disk are not wiped immediately)
+- Runtime backend switch: `/backend agy`, `/backend grok`, `/backend codex`, or `/backend dsh` (clears that backend's continuation state — the agy/grok continuation flag and the codex `thread_id`/resume state — so the next CLI turn starts a fresh session; history files on disk are not wiped immediately)
 - Slash commands for model, session reset, persona, and more (see below)
 - Dangerous-prompt gate: a **keyword list** of concrete destructive patterns asks for confirmation before run
 - Sender whitelist (`WECHATBRIDGE_ALLOWED_SENDERS`; empty = allow all)
@@ -41,19 +41,28 @@ Default data paths expand from `~` (e.g. `~/.local/share/wechatbridge/<instance>
 - **agy** (default) — Google Antigravity CLI
 - **grok** — xAI Grok Build CLI
 - **codex** — OpenAI Codex CLI
+- **dsh** — DeepSeek Harness CLI (one-shot `headless` profile)
 
-Per-user switch: `/backend agy`, `/backend grok`, or `/backend codex`. Each backend keeps its own model / effort / mode memory and persona file layout. Global default is `WECHATBRIDGE_BACKEND`.
+Per-user switch: `/backend agy`, `/backend grok`, `/backend codex`, or `/backend dsh`. Each backend keeps its own model / effort / mode memory and persona file layout. Global default is `WECHATBRIDGE_BACKEND`.
+
+### dsh backend notes
+
+- **Single-turn:** the `headless` profile always creates a fresh session per invocation (`session-<uuid>`), so every WeChat message starts a new dsh session. `/clear` / `/new` are accepted but are no-ops, and `/model`, `/fast`, `/planning`, `/persona`, `/add-dir` are not wired yet (they return a short "not supported" notice).
+- Runs `dsh --profile headless -- <prompt>` with `cwd` = the per-user session directory (per-user workspace; model-created files land there and can be sent back via CDN).
+- Image and file attachments are merged into the prompt text as `@/absolute/path` mentions. Verified in dsh v0.1.1-rc.2: `headless` passes the prompt text directly to the model without pre-reading or inlining mentions; the model receives system guidance on @-paths and may invoke file tools (e.g. `read`) if needed. The bridge only filters out-of-bounds mentions starting with absolute paths, `~`, or `file://` (`@/abs`, `@~/x`, `@file://`, replaced with `[blocked-path]`), which is best-effort prompt text filtering rather than a sandbox boundary.
+- Auth / profiles are **machine-wide** (`~/.dsh`, same model as grok's machine-wide login): the child's `HOME` points at the per-user session dir, so the bridge always passes `DSH_HOME` explicitly. Set `WECHATBRIDGE_DSH_HOME` to configure a dedicated service home with automatic session retention cleanup; when unset, it reuses the host `~/.dsh` without automatic session cleanup (managed by the operator). `DSH_BIN_PATH`, `DSH_PROFILE`, and `DSH_TIMEOUT` are configurable.
+- Status: implemented from the published `dsh` CLI contract (headless bundle source) plus a fake CLI in the test suite; final acceptance depends on a real `dsh login` + headless run.
 
 ### Grok backend notes
 
 - Isolation: each WeChat user runs with `HOME` pointed at their own session directory. Conversation state stays there; login is machine-wide.
-- Auth: the session links to the host `~/.grok/auth.json` (copied as a fallback), reusing the host `grok login`. Alternatively, set `XAI_API_KEY` in the bridge process environment (the grok child is given that key after env sanitizing). A grok-remote TUI session being signed in is not the same as the host CLI login. No key or token values are stored in this repository.
+- Auth: the session links to the host `~/.grok/auth.json` (copied as a fallback), reusing the host `grok login`. The grok CLI rewrites `auth.json` via temp-file + rename, which replaces the session symlink with a regular file; the bridge promotes such session files back to the host (atomic copy) and re-links, so refreshed tokens never get overwritten by the revoked host copy. Alternatively, set `XAI_API_KEY` in the bridge process environment (the grok child is given that key after env sanitizing). A grok-remote TUI session being signed in is not the same as the host CLI login. No key or token values are stored in this repository.
 
 ### Codex backend notes
 
 - Runs `codex exec --json` for each single turn; conversation continuation uses `codex exec resume <thread_id> <prompt>` with the thread id persisted per user.
 - Isolation: each WeChat user runs with `HOME` and `CODEX_HOME` pointed at their own per-user session directory (`session_dir/.codex`), so sessions, logs, and caches never cross users.
-- Auth: the per-user session links to the host `~/.codex/auth.json` (copied as a fallback), reusing the host `codex login`. Alternatively, set `CODEX_API_KEY` in the bridge process environment to authenticate. No key or token values are stored in this repository.
+- Auth: the per-user session links to the host `~/.codex/auth.json` (copied as a fallback), reusing the host `codex login`. The codex CLI rewrites `auth.json` via temp-file + rename, which replaces the session symlink with a regular file; the bridge promotes such session files back to the host (atomic copy) and re-links, so refreshed tokens never get overwritten by the revoked host copy. Alternatively, set `CODEX_API_KEY` in the bridge process environment to authenticate. No key or token values are stored in this repository.
 - **Status:** there is currently no real Codex subscription or CLI available for live testing. The codex backend is implemented from source research, a JSONL fixture, and a fake CLI used by the test suite (which passes). Final acceptance depends on a real user running it against the actual Codex CLI.
 
 ## Prerequisites
@@ -62,7 +71,8 @@ Per-user switch: `/backend agy`, `/backend grok`, or `/backend codex`. Each back
   - **agy** on `PATH`, or set `AGY_BIN_PATH`
   - **and/or grok** on `PATH`, or set `GROK_BIN_PATH`
   - **and/or codex** on `PATH`, or set `CODEX_BIN_PATH`
-  - Antigravity is Google's terminal agentic coding CLI (successor to Gemini CLI). Grok Build is xAI's counterpart; Codex is OpenAI's terminal agentic coding CLI.
+  - **and/or dsh** on `PATH`, or set `DSH_BIN_PATH` (DeepSeek Harness, `dsh login` required)
+  - Antigravity is Google's terminal agentic coding CLI (successor to Gemini CLI). Grok Build is xAI's counterpart; Codex is OpenAI's terminal agentic coding CLI; dsh is DeepSeek Harness' CLI.
 - A WeChat account with a [ClawBot / iLink](https://ilinkai.weixin.qq.com) bot (QR bind on first run)
 - Python 3.10+
 
@@ -133,10 +143,14 @@ Key variables (all have defaults):
 | `AGY_BIN_PATH` | `agy` | path to the agy binary |
 | `GROK_BIN_PATH` | `grok` | path to the grok binary |
 | `CODEX_BIN_PATH` | `codex` | path to the codex binary |
-| `WECHATBRIDGE_BACKEND` | `agy` | global default backend (`agy` / `grok` / `codex`; overridable per user via `/backend`) |
+| `DSH_BIN_PATH` | `dsh` | path to the dsh binary |
+| `DSH_PROFILE` | `headless` | dsh profile booted for one-shot tasks |
+| `DSH_TIMEOUT` | `600` | dsh CLI run timeout in seconds |
+| `WECHATBRIDGE_DSH_HOME` | _empty_ | explicit `DSH_HOME` passed to the dsh child. Explicitly set = dedicated home + auto session cleanup; unset = reuse host `~/.dsh` without auto cleanup |
+| `WECHATBRIDGE_BACKEND` | `agy` | global default backend (`agy` / `grok` / `codex` / `dsh`; overridable per user via `/backend`) |
 | `WECHATBRIDGE_INSTANCE` | `default` | instance name; state / session / QR paths derive from it |
 | `WECHATBRIDGE_ALLOWED_SENDERS` | _empty_ | comma-separated WeChat IDs (empty = allow all) |
-| `AGY_TIMEOUT` | `600` | CLI run timeout in seconds (all three backends) |
+| `AGY_TIMEOUT` | `600` | CLI run timeout in seconds (agy / grok / codex backends) |
 | `WECHATBRIDGE_MAX_OUTBOUND_BYTES` | `104857600` | max file size sent back to WeChat (100 MB) |
 | `WECHATBRIDGE_MAX_INBOUND_BYTES` | `20971520` | max inbound image/file after download (20 MB) |
 | `WECHATBRIDGE_MAX_CONCURRENT` | `4` | global concurrent process slots; same user serial (queue does not hold a slot); extras get a busy reply |
@@ -222,7 +236,7 @@ See [`deploy/wechatbridge-windows.md`](deploy/wechatbridge-windows.md).
 | Command | Action |
 |---|---|
 | `/help` | list supported commands for the active backend |
-| `/backend <agy\|grok\|codex>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
+| `/backend <agy\|grok\|codex\|dsh>` | switch CLI backend for this WeChat user (on real change: clears that backend's continuation state — agy/grok flag and codex `thread_id`/resume — so the next turn starts a fresh session; history files may remain until retention cleanup) |
 | `/clear` or `/new` | drop continue flag so the next CLI turn is a new conversation (does not instantly delete history files) |
 | `/model <name>` | set model (all backends validate against a live list: agy/grok via CLI `models`; codex via `codex debug models` [then `--bundled`]; unknown name or list-fetch failure refuse and do not write prefs; see `/models`) |
 | `/models` | list models — agy/grok/codex all query the live CLI (codex: `debug models`; falls back to a built-in reference note only if the live list cannot be fetched) |
@@ -242,7 +256,7 @@ Other `/…` commands are either rejected (e.g. `/exit`), reported as unsupporte
 ## Ops & security (what the bridge actually enforces)
 
 - **Whitelist first.** Empty `WECHATBRIDGE_ALLOWED_SENDERS` means anyone who can message the bot can use it.
-- **Auto-approve CLIs.** agy runs with `--dangerously-skip-permissions`; grok with `--always-approve` (unless planning mode). Treat this as trusted-user tooling, not a multi-tenant sandbox.
+- **Auto-approve CLIs.** agy runs with `--dangerously-skip-permissions`; grok with `--always-approve` (unless planning mode); dsh tools run without host path restrictions. Treat this as trusted-user tooling, not a multi-tenant sandbox.
 - **Danger gate is keyword-based**, not full intent understanding. Defaults target concrete patterns (`rm -rf /`, pipe-to-shell, `mkfs`, `format c:`, a few heavy Chinese phrases, …). Everyday wording like bare “delete” is **not** gated. Override list via `WECHATBRIDGE_CONFIRM_KEYWORDS`; approve with `WECHATBRIDGE_CONFIRM_TOKEN` (default `y`), TTL `WECHATBRIDGE_PENDING_TTL`.
 - **Inbound media** is size-capped (default 20 MB), streamed, and CDN hosts are allowlisted. Missing `aes_key` returns a clear error.
 - **Outbound artifacts** only leave the allowed per-user tree (agy: session scratch; grok: under session dir), after `realpath` checks, and only if under `WECHATBRIDGE_MAX_OUTBOUND_BYTES`.
@@ -254,8 +268,10 @@ Other `/…` commands are either rejected (e.g. `/exit`), reported as unsupporte
 
 ## Limitations
 
-- Not a standalone agent — requires agy and/or grok and/or codex.
+- Not a standalone agent — requires agy and/or grok and/or codex and/or dsh.
 - The **codex** backend is not yet verified against a real Codex subscription/CLI; it is validated by source research, a JSONL fixture, and a fake CLI in tests. Treat it as community-tested until a real user confirms.
+- The **dsh** backend is single-turn only (the `headless` profile always starts a fresh session) and has not yet been verified against a real `dsh login` + headless run; it is validated against the published headless bundle contract and a fake CLI in tests.
+- dsh model/effort/mode/persona slash commands are not wired yet; `/model`, `/fast`, `/planning`, `/persona`, `/add-dir` return a "not supported" notice on the dsh backend.
 - Voice is WeChat speech-to-text only; no local ASR; empty transcript → “type instead”.
 - No video send/receive; no native WeChat voice-bubble replies (no silk encode).
 - One WeChat binding per process; multiple accounts need multiple instances (`WECHATBRIDGE_INSTANCE`).

wechatbridge_cli-1.5.0/tests/test_codex_auth.py

@@ -0,0 +1,266 @@
+"""Unit tests for wechatbridge.codex auth promote/re-link (symlink credential sync).
+
+Mirrors tests/test_grok_auth.py: the CLI rewrites auth.json via
+temp-file + rename, which replaces the session symlink with a regular file.
+The bridge must promote that regular file back to host atomically (creating
+the host dir when missing) and then re-link the session. All tests mock
+_host_codex_dir to a temp dir; the real /root/.codex/auth.json is never
+touched. Fixtures are fake {"probe": ...} JSON — no real tokens.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import tempfile
+import unittest
+from unittest import mock
+from unittest.mock import AsyncMock, MagicMock
+
+from wechatbridge.codex import (
+    _session_auth_is_regular,
+    _sync_codex_auth,
+)
+
+
+def _write_json(path: str, data) -> None:
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump(data, f)
+
+
+def _read_json(path: str) -> dict:
+    with open(path, "r", encoding="utf-8") as f:
+        return json.load(f)
+
+
+def _is_symlink_to(path: str, target: str) -> bool:
+    return os.path.islink(path) and os.path.realpath(path) == os.path.realpath(target)
+
+
+class CodexAuthSyncTest(unittest.TestCase):
+    """_sync_codex_auth promote / re-link behavior."""
+
+    def setUp(self):
+        self.td = tempfile.mkdtemp(prefix="wb-codex-auth-")
+        self.host_dir = os.path.join(self.td, "host_codex")
+        os.makedirs(self.host_dir, mode=0o700)
+        self.codex_dir = os.path.join(self.td, "session", ".codex")
+        os.makedirs(self.codex_dir, mode=0o700)
+        self.host_auth = os.path.join(self.host_dir, "auth.json")
+        self.dest = os.path.join(self.codex_dir, "auth.json")
+        self._host_patcher = mock.patch(
+            "wechatbridge.codex._host_codex_dir", return_value=self.host_dir
+        )
+        self._host_patcher.start()
+
+    def tearDown(self):
+        self._host_patcher.stop()
+        shutil.rmtree(self.td, ignore_errors=True)
+
+    def test_regular_session_file_promotes_to_host_and_relinks(self):
+        # session carries NEW credentials as a regular file (CLI rename broke
+        # the symlink); host still has OLD credentials
+        _write_json(self.dest, {"probe": "new"})
+        _write_json(self.host_auth, {"probe": "old"})
+
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertEqual(_read_json(self.host_auth), {"probe": "new"})
+        self.assertTrue(_is_symlink_to(self.dest, self.host_auth))
+
+    def test_cli_rename_over_symlink_promotes_on_next_sync(self):
+        # start as a correct symlink
+        _write_json(self.host_auth, {"probe": "old"})
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertTrue(_is_symlink_to(self.dest, self.host_auth))
+
+        # simulate CLI refresh: temp file + os.replace replaces the symlink
+        # with a regular file holding the new credentials
+        fd, tmp = tempfile.mkstemp(dir=self.codex_dir, prefix=".auth.json.", suffix=".tmp")
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            json.dump({"probe": "new"}, f)
+        os.replace(tmp, self.dest)
+        self.assertTrue(_session_auth_is_regular(self.dest))
+
+        # next message sync must promote and re-link
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertEqual(_read_json(self.host_auth), {"probe": "new"})
+        self.assertTrue(_is_symlink_to(self.dest, self.host_auth))
+
+    def test_correct_symlink_untouched(self):
+        _write_json(self.host_auth, {"probe": "old"})
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        link_target = os.readlink(self.dest)
+
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertEqual(os.readlink(self.dest), link_target)
+        self.assertEqual(_read_json(self.host_auth), {"probe": "old"})
+
+    def test_missing_session_file_creates_symlink(self):
+        _write_json(self.host_auth, {"probe": "old"})
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertTrue(_is_symlink_to(self.dest, self.host_auth))
+
+    def test_promote_failure_keeps_session_file(self):
+        _write_json(self.dest, {"probe": "new"})
+        _write_json(self.host_auth, {"probe": "old"})
+        with mock.patch(
+            "wechatbridge.codex._atomic_copy_auth", return_value=False
+        ) as copy_mock:
+            self.assertTrue(_sync_codex_auth(self.codex_dir))
+
+        # session file must NOT be unlinked; host must NOT be overwritten
+        self.assertTrue(_session_auth_is_regular(self.dest))
+        self.assertEqual(_read_json(self.dest), {"probe": "new"})
+        self.assertEqual(_read_json(self.host_auth), {"probe": "old"})
+        copy_mock.assert_called_once_with(self.dest, self.host_auth)
+
+    def test_host_missing_regular_session_promotes_and_creates_host_dir(self):
+        # no host dir / auth.json at all; session has refreshed credentials
+        shutil.rmtree(self.host_dir)
+        _write_json(self.dest, {"probe": "new"})
+
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertEqual(_read_json(self.host_auth), {"probe": "new"})
+        self.assertTrue(_is_symlink_to(self.dest, self.host_auth))
+
+    def test_empty_session_file_not_promoted(self):
+        # CLI left a 0-byte / half-written auth.json behind: must not be
+        # promoted over host credentials, and the session file stays put
+        _write_json(self.host_auth, {"probe": "old"})
+        open(self.dest, "wb").close()
+        self.assertTrue(_session_auth_is_regular(self.dest))
+
+        self.assertTrue(_sync_codex_auth(self.codex_dir))
+        self.assertEqual(_read_json(self.host_auth), {"probe": "old"})
+        self.assertTrue(_session_auth_is_regular(self.dest))
+        self.assertEqual(os.path.getsize(self.dest), 0)
+
+
+class CodexRunPromoteTest(unittest.IsolatedAsyncioTestCase):
+    """run_codex / _run_codex_subcommand harvest (promote) after exit."""
+
+    async def asyncSetUp(self):
+        self.td = tempfile.mkdtemp(prefix="wb-codex-run-")
+        self.session_dir = os.path.join(self.td, "s1")
+        os.makedirs(os.path.join(self.session_dir, ".codex"), mode=0o700)
+        self._patchers = [
+            mock.patch(
+                "wechatbridge.codex.ensure_user_codex",
+                return_value=self.session_dir,
+            ),
+            mock.patch("wechatbridge.codex.is_dangerous", return_value=False),
+            mock.patch("wechatbridge.codex.is_first_message", return_value=True),
+            mock.patch("wechatbridge.codex.load_prefs", return_value={}),
+            mock.patch(
+                "wechatbridge.codex._resolve_add_dirs", return_value=[]
+            ),
+            mock.patch(
+                "wechatbridge.codex._build_codex_command",
+                return_value=["codex", "exec", "--json", "hi"],
+            ),
+            mock.patch(
+                "wechatbridge.codex._snapshot_regular_files", return_value=[]
+            ),
+            mock.patch(
+                "wechatbridge.codex.sanitize_env",
+                side_effect=lambda d: {"HOME": d},
+            ),
+            mock.patch(
+                "wechatbridge.codex._collect_fallback_artifacts",
+                return_value=[],
+            ),
+            mock.patch(
+                "wechatbridge.codex._parse_codex_output",
+                return_value=("ok", [], None, False),
+            ),
+        ]
+        for p in self._patchers:
+            p.start()
+
+    async def asyncTearDown(self):
+        for p in self._patchers:
+            p.stop()
+        shutil.rmtree(self.td, ignore_errors=True)
+
+    def _fake_proc(self, returncode: int = 0, out: bytes = b"", err: bytes = b""):
+        proc = MagicMock()
+        proc.returncode = returncode
+        proc.communicate = AsyncMock(return_value=(out, err))
+        return proc
+
+    async def test_run_codex_exit_harvests_and_keeps_session_env(self):
+        from wechatbridge import codex as codex_mod
+
+        proc = self._fake_proc(returncode=0, out=b"ok")
+        with mock.patch.object(
+            codex_mod.asyncio,
+            "create_subprocess_exec",
+            AsyncMock(return_value=proc),
+        ) as spawn:
+            with mock.patch.object(
+                codex_mod, "_promote_session_auth", return_value=True
+            ) as promote:
+                display, artifacts = await codex_mod.run_codex(
+                    "hi", "u1", timeout=30
+                )
+
+        promote.assert_called_once_with(
+            os.path.join(self.session_dir, ".codex")
+        )
+        self.assertEqual(display, "ok")
+        self.assertEqual(artifacts, [])
+        env = spawn.call_args.kwargs["env"]
+        # HOME still points at the session dir; CODEX_HOME stays session-private
+        self.assertEqual(env["HOME"], self.session_dir)
+        self.assertEqual(
+            env["CODEX_HOME"], os.path.join(self.session_dir, ".codex")
+        )
+
+    async def test_run_codex_nonzero_exit_still_promotes(self):
+        from wechatbridge import codex as codex_mod
+
+        proc = self._fake_proc(returncode=1, err=b"boom")
+        with mock.patch.object(
+            codex_mod.asyncio,
+            "create_subprocess_exec",
+            AsyncMock(return_value=proc),
+        ):
+            with mock.patch.object(
+                codex_mod, "_promote_session_auth", return_value=True
+            ) as promote:
+                display, artifacts = await codex_mod.run_codex(
+                    "hi", "u1", timeout=30
+                )
+
+        promote.assert_called_once_with(
+            os.path.join(self.session_dir, ".codex")
+        )
+        self.assertEqual(artifacts, [])
+        # 非零退出 → 格式化错误气泡（"boom" 无已知分类时是通用执行失败）
+        self.assertIn("❌", display)
+
+    async def test_subcommand_exit_harvests(self):
+        from wechatbridge import codex as codex_mod
+
+        proc = self._fake_proc(returncode=0, out=b"models list")
+        with mock.patch.object(
+            codex_mod.asyncio,
+            "create_subprocess_exec",
+            AsyncMock(return_value=proc),
+        ):
+            with mock.patch.object(
+                codex_mod, "_promote_session_auth", return_value=True
+            ) as promote:
+                result = await codex_mod._run_codex_subcommand(
+                    ["debug", "models"], "u1"
+                )
+
+        promote.assert_called_once_with(
+            os.path.join(self.session_dir, ".codex")
+        )
+        self.assertIn("models", result)
+
+
+if __name__ == "__main__":
+    unittest.main()