feat: ship enterprise control and desktop governance

tests/local-agent-codex-task-runner.test.mjs

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import os from "node:os";
 import path from "node:path";
-import { mkdtemp, mkdir, rm } from "node:fs/promises";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
 
 import {
@@ -90,6 +90,10 @@ test("conversation reply resumes the real Codex thread when thread ref is availa
     {
       taskType: "conversation_reply",
       executionPrompt: "请回复用户",
+      sourceMessageId: "msg-1",
+      sourceMessageBody: "请回复用户",
+      sourceMessageSentAt: "2026-04-21T09:00:00.000Z",
+      mirrorBossUserMessageToCodexDesktop: true,
       targetCodexThreadRef: "019d-thread-real",
       targetCodexFolderRef: "/Users/kris/code/meiyesaas",
     },
@@ -109,6 +113,13 @@ test("conversation reply resumes the real Codex thread when thread ref is availa
     "019d-thread-real",
     "请回复用户",
   ]);
+  assert.deepEqual(execution.desktopMirror, {
+    enabled: true,
+    targetThreadRef: "019d-thread-real",
+    sourceMessageId: "msg-1",
+    sourceMessageBody: "请回复用户",
+    sourceMessageSentAt: "2026-04-21T09:00:00.000Z",
+  });
 });
 
 test("dispatch execution falls back to targetThreadId when codex thread ref is missing", () => {
@@ -167,6 +178,38 @@ test("master agent reply without target thread stays on ephemeral exec", () => {
     "gpt-5.4",
     "你是主 Agent",
   ]);
+  assert.deepEqual(execution.desktopMirror, { enabled: false });
+});
+
+test("relay conversation reply mirrors the clean Boss user message into the desktop child thread", () => {
+  const execution = buildCodexTaskExecution(
+    {
+      masterAgentWorkdir: "/Users/kris/code/boss",
+      masterAgentSandbox: "workspace-write",
+      masterAgentModel: "gpt-5.4",
+    },
+    {
+      taskType: "conversation_reply",
+      executionPrompt: "你是主 Agent",
+      relayViaMasterAgent: true,
+      sourceMessageId: "msg-relay",
+      sourceMessageBody: "帮我推进当前线程",
+      sourceMessageSentAt: "2026-04-21T09:10:00.000Z",
+      mirrorBossUserMessageToCodexDesktop: true,
+      targetCodexThreadRef: "019d-thread-real",
+      targetCodexFolderRef: "/Users/kris/code/meiyesaas",
+    },
+    "/tmp/master.txt",
+  );
+
+  assert.deepEqual(execution.desktopMirror, {
+    enabled: true,
+    targetThreadRef: "019d-thread-real",
+    sourceMessageId: "msg-relay",
+    sourceMessageBody: "帮我推进当前线程",
+    sourceMessageSentAt: "2026-04-21T09:10:00.000Z",
+  });
+  assert.notEqual(execution.desktopMirror.sourceMessageBody, execution.args.at(-1));
 });
 
 test("conversation reply preflight fails closed when target cwd is missing", async () => {
@@ -199,6 +242,55 @@ test("conversation reply preflight fails closed when target cwd is missing", asy
   assert.match(result.error.message, /missing-workdir/);
 });
 
+test("conversation reply preflight accepts session-only Codex threads when state db is stale", async () => {
+  const root = await ensureRuntimeRoot();
+  const validCwd = path.join(root, "session-only-project");
+  const sessionsDir = path.join(root, "sessions-only", "2026", "05", "02");
+  const threadId = "019d-session-only-task";
+  await mkdir(validCwd, { recursive: true });
+  await mkdir(sessionsDir, { recursive: true });
+  await writeFile(
+    path.join(sessionsDir, `rollout-2026-05-02T10-10-00-${threadId}.jsonl`),
+    `${JSON.stringify({
+      timestamp: "2026-05-02T02:10:00.000Z",
+      type: "session_meta",
+      payload: {
+        id: threadId,
+        cwd: validCwd,
+      },
+    })}\n`,
+    "utf8",
+  );
+  const stateDbPath = await createCodexStateDb([
+    {
+      id: "019d-thread-other",
+      cwd: validCwd,
+      title: "Other thread",
+    },
+  ]);
+
+  const result = await prepareCodexTaskExecution(
+    {
+      masterAgentWorkdir: "/Users/kris/code/boss",
+      masterAgentSandbox: "workspace-write",
+      codexStateDbPath: stateDbPath,
+      codexSessionsDir: path.join(root, "sessions-only"),
+    },
+    {
+      taskType: "conversation_reply",
+      executionPrompt: "请回复用户",
+      targetCodexThreadRef: threadId,
+      targetCodexFolderRef: validCwd,
+    },
+    "/tmp/reply.txt",
+  );
+
+  assert.equal(result.ok, true);
+  assert.equal(result.execution.mode, "resume");
+  assert.equal(result.execution.cwd, validCwd);
+  assert.deepEqual(result.execution.args.slice(-2), [threadId, "请回复用户"]);
+});
+
 test("dispatch execution preflight fails closed when target thread ref is missing", async () => {
   const result = await prepareCodexTaskExecution(
     {