feat: add terminal broadcast, context menu, and shell close

Complete multi-pane broadcast, standard terminal right-click actions, batch host selection with progress, and native ssh_close_shell so closing a pane tears down the remote shell.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/components/AiTerminalPanel.test.tsx

@@ -2,6 +2,7 @@ import { fireEvent, render, screen, waitFor, within } from '@testing-library/rea
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import AiTerminalPanel from '../../src/components/ai/AiTerminalPanel'
 import { useAiProviderStore } from '../../src/stores/aiProviderStore'
+import { useSettingsStore } from '../../src/stores/settingsStore'
 import { mockDesktopApi } from '../setup'
 
 describe('terminal Agent CLI panel', () => {
@@ -27,6 +28,9 @@ describe('terminal Agent CLI panel', () => {
       catalogProviders: [],
       catalogUpdatedAt: null,
     })
+    useSettingsStore.setState((state) => ({
+      settings: { ...state.settings, agentSafetyMode: 'balanced' },
+    }))
   })
 
   it('uses one task entry, Enter to run, Shift+Enter for a newline, and selected context only', async () => {
@@ -61,7 +65,7 @@ describe('terminal Agent CLI panel', () => {
     expect(await screen.findByText('这是远端 Bash TMOUT 策略导致的自动退出。')).toBeVisible()
   })
 
-  it('runs a bounded observe loop on the active SSH connection with confirmation before every command', async () => {
+  it('runs safe diagnostic commands automatically in the default balanced mode', async () => {
     vi.mocked(mockDesktopApi.aiComplete)
       .mockResolvedValueOnce({ success: true, text: '```bash\nuptime\n```', model: 'test', redactedCount: 0 })
       .mockResolvedValueOnce({ success: true, text: 'FINAL: 负载正常，任务完成。', model: 'test', redactedCount: 0 })
@@ -85,19 +89,67 @@ describe('terminal Agent CLI panel', () => {
     })
     fireEvent.click(screen.getByRole('button', { name: '执行' }))
 
-    const dialog = await screen.findByRole('dialog')
-    expect(within(dialog).getByText(/root@opsbase.cn/)).toBeVisible()
-    expect(within(dialog).getByText(/uptime/)).toBeVisible()
-    expect(mockDesktopApi.sshExec).not.toHaveBeenCalled()
-    fireEvent.click(within(dialog).getByRole('button', { name: '执行' }))
-
     await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'uptime'))
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     expect(await screen.findByText('load average: 0.01')).toBeVisible()
     expect(await screen.findByText('负载正常，任务完成。')).toBeVisible()
     expect(mockDesktopApi.aiComplete).toHaveBeenCalledTimes(2)
     expect(vi.mocked(mockDesktopApi.aiComplete).mock.calls[1][0].context).toContain('[exit_code=0]')
   })
 
+  it('asks for confirmation for high-risk commands in the default balanced mode', async () => {
+    vi.mocked(mockDesktopApi.aiComplete)
+      .mockResolvedValueOnce({ success: true, text: '```bash\nsystemctl restart nginx\n```', model: 'test', redactedCount: 0 })
+      .mockResolvedValueOnce({ success: true, text: 'FINAL: nginx 已重启。', model: 'test', redactedCount: 0 })
+    vi.mocked(mockDesktopApi.sshExec).mockResolvedValueOnce({ success: true, result: 'ok', exitCode: 0 })
+
+    render(
+      <AiTerminalPanel
+        capture={() => ({ selection: '', viewport: '' })}
+        onClose={vi.fn()}
+        connectionId="ssh-active-1"
+        targetLabel="root@opsbase.cn"
+      />
+    )
+    fireEvent.change(screen.getByPlaceholderText('输入任务描述，回车发送（Shift+回车换行）'), {
+      target: { value: '重启 nginx' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: '执行' }))
+
+    const dialog = await screen.findByRole('dialog')
+    expect(within(dialog).getByText(/均衡/)).toBeVisible()
+    expect(within(dialog).getByText(/systemctl restart nginx/)).toBeVisible()
+    expect(mockDesktopApi.sshExec).not.toHaveBeenCalled()
+    fireEvent.click(within(dialog).getByRole('button', { name: '确认风险并执行' }))
+    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledTimes(1))
+  })
+
+  it('lets strict mode require confirmation from medium risk upward', async () => {
+    vi.mocked(mockDesktopApi.aiComplete).mockResolvedValueOnce({
+      success: true,
+      text: '```bash\ntouch /tmp/opsxshell-agent-test\n```',
+      model: 'test',
+      redactedCount: 0,
+    })
+    render(
+      <AiTerminalPanel
+        capture={() => ({ selection: '', viewport: '' })}
+        onClose={vi.fn()}
+        connectionId="ssh-active-1"
+        targetLabel="root@opsbase.cn"
+      />
+    )
+    fireEvent.click(screen.getByRole('radio', { name: '严格' }))
+    fireEvent.change(screen.getByPlaceholderText('输入任务描述，回车发送（Shift+回车换行）'), {
+      target: { value: '创建临时文件' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: '执行' }))
+
+    const dialog = await screen.findByRole('dialog')
+    expect(within(dialog).getByText(/touch \/tmp\/opsxshell-agent-test/)).toBeVisible()
+    expect(mockDesktopApi.sshExec).not.toHaveBeenCalled()
+  })
+
   it('hard-denies critical destructive commands without offering confirmation', async () => {
     vi.mocked(mockDesktopApi.aiComplete).mockResolvedValueOnce({
       success: true,
@@ -153,7 +205,7 @@ describe('terminal Agent CLI panel', () => {
     expect(mockDesktopApi.sshExec).not.toHaveBeenCalled()
   })
 
-  it('asks again before a second command in the same task', async () => {
+  it('automatically executes multiple read-only commands in the same balanced task', async () => {
     vi.mocked(mockDesktopApi.aiComplete)
       .mockResolvedValueOnce({ success: true, text: '```bash\ndate\n```', model: 'test', redactedCount: 0 })
       .mockResolvedValueOnce({ success: true, text: '```bash\nuname -a\n```', model: 'test', redactedCount: 0 })
@@ -175,16 +227,8 @@ describe('terminal Agent CLI panel', () => {
     })
     fireEvent.click(screen.getByRole('button', { name: '执行' }))
 
-    let dialog = await screen.findByRole('dialog')
-    fireEvent.click(within(dialog).getByRole('button', { name: '执行' }))
-    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledTimes(1))
-
-    dialog = await screen.findByRole('dialog')
-    expect(within(dialog).getByText(/uname -a/)).toBeVisible()
-    expect(mockDesktopApi.sshExec).toHaveBeenCalledTimes(1)
-    fireEvent.click(within(dialog).getByRole('button', { name: '执行' }))
-
     await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledTimes(2))
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     expect(await screen.findByText('两项检查已完成。')).toBeVisible()
   })
 })