feat(cli): add read-only Agent View coordination primitives

[yiliang114]

What this PR does

This stacked draft adds the first executable coordination slice from RFC #8718 on top of #7802. A caller can dispatch a background Agent View session with an explicit read-only profile, receive a machine-readable acknowledgement, and collect a one-shot terminal snapshot by session ID.

The read-only worker starts with a fixed four-tool inspection surface, ignores ambient settings that could add startup side effects, disables hooks, MCP discovery, extensions, cron, memory writes, delegation, shell execution, and sandbox configuration, and rejects nested background dispatch from inside a worker. The supervisor-to-worker sideband now uses ephemeral per-generation credentials and ordered, acknowledged events so stale, duplicated, or out-of-order lifecycle updates cannot mutate the current session.

Why it's needed

Qwen Code already has Agent View lifecycle infrastructure, but it does not yet expose a safe primitive for a coordinator to fan out independent read-only investigations and collect their results. This slice establishes that boundary before adding higher-level task graphs, writer agents, or worktree orchestration, keeping orchestration behavior separable from tool-restriction evaluation as requested in the RFC review.

Reviewer Test Plan

How to verify

1. Start a background inspection with qwen --bg --read-only --output-format json "Inspect the repository and summarize the relevant code."; confirm stdout is one JSON dispatch acknowledgement containing the session ID, created state, and read-only profile.
2. Run qwen collect <session-id>; confirm it returns one JSON snapshot with the session state, process state, and current result, and that a unique session-ID prefix is accepted while ambiguous or missing IDs fail clearly.
3. Confirm a read-only worker exposes exactly read-file, grep, glob, and directory-listing tools even when project or user settings configure hooks, extensions, MCP servers, cron, memory, tool discovery, output-language customization, or sandboxing.
4. From a worker process, attempt another qwen --bg ...; confirm it is rejected before contacting the supervisor.
5. Restart or respawn a worker and confirm persisted launch metadata contains no sideband credential, the credential and worker generation rotate, duplicate event sequences are acknowledged idempotently, and stale or gapped sequences are rejected.

Evidence (Before & After)

Before: #7802 exposes foreground/background Agent View lifecycle commands but has no read-only background profile or collect command.

After: the focused CLI suites pass 480 tests, the CLI startup suite passes 61 tests, the focused core suites pass 514 tests, core typechecking passes, and all changed TypeScript files pass Prettier and ESLint. Full CLI typechecking is currently blocked by the inherited #7802 branch's Ink selection API dependency mismatch; filtering its output reports no errors in this change's files.

Tested on

OS	Status
🍏 macOS	✅
🪟 Windows	⚠️
🐧 Linux	⚠️

Environment (optional)

Node.js 22 workspace install; focused Vitest suites and TypeScript/ESLint/Prettier checks.

Risk & Scope

• Main risk or tradeoff: this changes the internal Agent View sideband protocol; supervisor and workers must run the same build, and older live sessions may need to be restarted.
• Not validated / out of scope: task-file prompts, task lineage and DAG scheduling, multi-session aggregation, checkout-digest stale-result marking, writer/worktree isolation, Agent Team teammate integration, coordinator skills, and benchmark gates remain follow-up RFC phases.
• Breaking changes / migration notes: no public stable API migration is intended; this PR is stacked on feat(cli): Expose agent view commands #7802 and should be reviewed or rebased with that dependency.

Linked Issues

Related to #8718. Design RFC: #8719. Stacked on #7802.

中文说明

这个 PR 做了什么

这个叠加式 Draft PR 在 #7802 之上实现了 RFC #8718 的第一个可执行协作切片。调用方可以用明确的只读配置分发后台 Agent View 会话，获得机器可读的确认消息，并按会话 ID 一次性收集终态快照。

只读 worker 启动时固定只暴露四个检查工具，并忽略可能引入启动副作用的环境配置；hooks、MCP 发现、扩展、cron、记忆写入、委派、shell 执行和 sandbox 配置均被关闭，同时禁止 worker 内部再次后台分发。supervisor 到 worker 的 sideband 改为使用每个 generation 独立的临时凭据和带确认的有序事件，因此过期、重复或乱序的生命周期更新不能修改当前会话。

为什么需要它

Qwen Code 已有 Agent View 生命周期基础设施，但还没有为 coordinator 提供一个安全的基础能力，用于并发分发独立的只读调研并收集结果。这个切片先建立安全边界，再继续增加高层任务图、writer agent 或 worktree 编排，也让 orchestration 行为和工具限制能够按照 RFC 评审建议分别评测。

Reviewer 测试计划

如何验证

1. 运行 qwen --bg --read-only --output-format json "Inspect the repository and summarize the relevant code." 启动后台检查；确认 stdout 仅输出一条 JSON 分发确认，其中包含会话 ID、created 状态和 read-only profile。
2. 运行 qwen collect <session-id>；确认返回一条包含会话状态、进程状态和当前结果的 JSON 快照；唯一的会话 ID 前缀可以使用，歧义或不存在的 ID 会明确失败。
3. 即使项目或用户设置配置了 hooks、扩展、MCP servers、cron、记忆、工具发现、输出语言定制或 sandbox，也要确认只读 worker 只暴露 read-file、grep、glob 和目录列表四个工具。
4. 在 worker 进程中尝试再次执行 qwen --bg ...；确认在接触 supervisor 前即被拒绝。
5. 重启或 respawn worker，确认持久化启动元数据中没有 sideband credential，credential 和 worker generation 会轮换，重复事件序号被幂等确认，过期或跳号事件被拒绝。

证据（Before & After）

Before：#7802 暴露了前台/后台 Agent View 生命周期命令，但没有只读后台 profile 或 collect 命令。

After：CLI 聚焦测试通过 480 项，CLI 启动测试通过 61 项，core 聚焦测试通过 514 项，core typecheck 通过，全部变更的 TypeScript 文件通过 Prettier 和 ESLint。CLI 全量 typecheck 当前被继承自 #7802 分支的 Ink selection API 依赖不匹配阻塞；过滤输出后，本次变更文件没有错误。

测试平台

OS	状态
🍏 macOS	✅
🪟 Windows	⚠️
🐧 Linux	⚠️

环境（可选）

Node.js 22 workspace 安装；执行了聚焦 Vitest、TypeScript、ESLint 和 Prettier 检查。

风险与范围

• 主要风险或权衡：内部 Agent View sideband 协议发生变化；supervisor 与 worker 必须运行同一个 build，旧的运行中会话可能需要重启。
• 未验证或不在范围内：task-file prompt、任务 lineage 与 DAG 调度、多会话聚合、checkout digest 过期结果标记、writer/worktree 隔离、Agent Team teammate 集成、coordinator skill 和 benchmark gate 留给 RFC 后续阶段。
• 破坏性变化或迁移说明：不涉及稳定公开 API 的迁移；本 PR 叠加在 feat(cli): Expose agent view commands #7802 上，应与该依赖一起评审或后续 rebase。

关联 Issue

关联 #8718。设计 RFC：#8719。叠加在 #7802 上。

[yiliang114]

Superseded by #8804. The implementation now targets main directly and provides /coordinate through the existing native subagent runtime, without depending on Agent View or persistent Agent Team infrastructure. Closing this draft keeps review focused on the usable v1.

中文说明

该草稿已由 #8804 替代。新实现直接基于 main，通过现有原生子 Agent 运行时提供 /coordinate，不依赖 Agent View 或持久 Agent Team 基础设施。关闭此草稿，以便 review 聚焦于可直接使用的 v1。