@cjhyy/code-shell-capability-coding 0.8.20 → 0.9.1

package/dist/tools/apply-patch/applier.d.ts

@@ -2,6 +2,8 @@ import { Hunk } from "./types.js";
 export interface ApplyPatchOptions {
     /** Working directory for resolving relative paths in the patch. */
     cwd: string;
+    /** Immutable roots authorized for this run. Relative patch paths still resolve from cwd. */
+    workspaceRoots?: readonly string[];
     /**
      * If true, skip the snapshot/rollback safety net and apply each planned
      * change one at a time, leaving partial work on disk if a later write

package/dist/tools/apply-patch/applier.js

@@ -27,10 +27,10 @@ export async function applyPatch(hunks, options) {
     if (hunks.length === 0) {
         throw new Error("No files were modified.");
     }
-    const planned = await planHunks(hunks, options.cwd);
+    const planned = await planHunks(hunks, options.cwd, options.workspaceRoots ?? [options.cwd]);
     return commitPlanned(planned, !!options.allowPartialOnCommit);
 }
-async function planHunks(hunks, cwd) {
+async function planHunks(hunks, cwd, workspaceRoots) {
     const set = {
         byPath: new Map(),
         added: [],
@@ -45,7 +45,7 @@ async function planHunks(hunks, cwd) {
     }
     for (const hunk of hunks) {
         const original = hunk.path;
-        const sourcePath = resolveAgainst(original, cwd);
+        const sourcePath = resolveAgainst(original, cwd, workspaceRoots);
         if (hunk.kind === "add") {
             const existed = await readIfExists(sourcePath);
             schedule(sourcePath, {
@@ -87,7 +87,7 @@ async function planHunks(hunks, cwd) {
         const originalText = toLf(originalRaw);
         const newText = applyEol(applyChunksToText(originalText, hunk.chunks, sourcePath), eol);
         if (hunk.movePath !== undefined) {
-            const destPath = resolveAgainst(hunk.movePath, cwd);
+            const destPath = resolveAgainst(hunk.movePath, cwd, workspaceRoots);
             if (destPath === sourcePath) {
                 // Rename to self → degenerate update.
                 schedule(sourcePath, {
@@ -248,12 +248,12 @@ async function writeChange(change) {
  * symlink planted inside cwd that points outside — a plain string `resolve()`
  * would look contained while the write follows the link out.
  */
-function resolveAgainst(p, cwd) {
+function resolveAgainst(p, cwd, workspaceRoots) {
     const resolved = isAbsolute(p) ? p : resolve(cwd, p);
-    const realCwd = nearestRealPath(cwd);
     const realTarget = nearestRealPath(resolved);
-    if (!isInside(realTarget, realCwd)) {
-        throw new Error(`Refusing to apply patch outside the working directory: "${p}" resolves to "${realTarget}", which escapes "${realCwd}".`);
+    const realRoots = workspaceRoots.map(nearestRealPath);
+    if (!realRoots.some((root) => isInside(realTarget, root))) {
+        throw new Error(`Refusing to apply patch outside the workspace roots: "${p}" resolves to "${realTarget}".`);
     }
     return resolved;
 }

package/dist/tools/apply-patch/index.js

@@ -72,7 +72,10 @@ export async function applyPatchTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
     let result;
     try {
-        result = await applyPatch(parsed.hunks, { cwd });
+        result = await applyPatch(parsed.hunks, {
+            cwd,
+            workspaceRoots: ctx?.workspace?.roots.map((root) => root.path),
+        });
     }
     catch (err) {
         return `Error applying patch: ${err.message}`;

package/dist/tools/drive-agent.js

@@ -275,6 +275,23 @@ function safeFinalizeDriveWorktree(managed) {
         };
     }
 }
+/**
+ * Finalize a managed worktree once `run` settles, never before.
+ *
+ * Aborting a run only starts the driver's async process-tree teardown, so the
+ * external CLI can still be holding the worktree (and git's index.lock) when
+ * abort() returns. Cleaning up synchronously races that; waiting for the run to
+ * settle does not. Doubles as the rejection sink for an aborted run.
+ */
+function finalizeDriveWorktreeAfter(run, managed) {
+    void run
+        .catch(() => undefined)
+        .then(() => {
+        // safeFinalizeDriveWorktree already degrades a failed cleanup to a
+        // "kept" note rather than throwing, so nothing can escape this chain.
+        safeFinalizeDriveWorktree(managed);
+    });
+}
 function summarizePrompt(prompt, max = 120) {
     const oneLine = prompt.replace(/\s+/g, " ").trim();
     if (oneLine.length <= max)
@@ -607,6 +624,16 @@ function attachDriveCompletion(params) {
     });
 }
 function trackBackgroundRun(params) {
+    const { sessionId } = params;
+    if (!isValidSessionId(sessionId)) {
+        // Mirrors the background:true refusal above: a job whose completion
+        // notification cannot be routed would run and then vanish. Say so instead
+        // of registering work nobody can track. The caller aborts the run and
+        // finalizes any managed worktree on this error path.
+        return {
+            error: "Error: cannot track this DriveAgent run without a session — its result notification would be dropped. Re-run inside a session, or keep the task short enough to finish in the foreground.",
+        };
+    }
     const conflict = duplicateCwdError(params.effectiveWorkspaceCwd, params.effectiveWorkspaceRoot, params.writable);
     if (conflict)
         return { error: conflict };
@@ -616,7 +643,7 @@ function trackBackgroundRun(params) {
         // Publish ownership before starting the external process. Registry
         // listeners are synchronous and may re-enter session teardown from the
         // start notification; starting first would leave that process orphaned.
-        backgroundJobRegistry.start(jobId, params.sessionId, params.label, {
+        backgroundJobRegistry.start(jobId, sessionId, params.label, {
             kind: "drive-agent",
             launchCwd: params.cwd,
             effectiveWorkspaceCwd: params.effectiveWorkspaceCwd,
@@ -660,7 +687,7 @@ function trackBackgroundRun(params) {
         backgroundJobRegistry.finish(jobId, { status: "failed", finalText: message });
         return { error: `Error: failed to start DriveAgent job: ${message}` };
     }
-    attachDriveCompletion({ ...params, jobId, run });
+    attachDriveCompletion({ ...params, sessionId, jobId, run });
     return { jobId };
 }
 async function waitForForegroundOrHandoff(run, handoffMs) {
@@ -963,13 +990,26 @@ export function makeDriveAgentTool(runner = defaultRunner, fixedCli, options = {
             lease.release();
             return appendLifecycleNote(`${cliName} 运行出错：${error instanceof Error ? error.message : String(error)}`, lifecycle);
         }
-        if (result.kind === "handoff" && isValidSessionId(ctx?.sessionId)) {
+        if (result.kind === "handoff") {
+            // Handing off is NOT gated on a valid ctx.sessionId. Gating it there left
+            // a session-less foreground run falling through to `await run`, blocking
+            // until the 30min tool cap whose abort kills the external CLI — the work
+            // was destroyed with no jobId and no notification path. trackBackgroundRun
+            // owns the session check instead: it registers a tracked job when the
+            // session can receive the completion, and otherwise returns an error the
+            // branch below turns into an abort + deferred cleanup + explanation.
+            //
             // Registration below is synchronous. Release the foreground lease and
             // replace it with the background registry entry in the same event-loop
-            // turn, so another dispatch cannot slip into a gap.
+            // turn, so another dispatch cannot slip into a gap. The same invariant
+            // covers the failure path: the lease is dropped and no job exists between
+            // here and the return below, so that span MUST stay synchronous — an
+            // await would open the gap to a concurrent writable dispatch. Worktree
+            // finalization is deliberately NOT in that span: it is deferred to run
+            // settlement, after this turn has already returned.
             lease.release();
             const tracked = trackBackgroundRun({
-                sessionId: ctx.sessionId,
+                sessionId: ctx?.sessionId,
                 label,
                 cli,
                 cwd,
@@ -993,9 +1033,16 @@ export function makeDriveAgentTool(runner = defaultRunner, fixedCli, options = {
                 originClientMessageId: ctx?.originClientMessageId,
             });
             if ("error" in tracked) {
+                // abort() only STARTS teardown (SIGTERM, grace, SIGKILL); the CLI is
+                // still alive when it returns. Finalizing here would race the live
+                // process for the worktree and git's index.lock, so defer cleanup to
+                // run settlement and consume the abort rejection while we are at it.
+                // The message must not claim a cleanup that has not happened yet.
                 foregroundAbort.abort();
-                const lifecycle = safeFinalizeDriveWorktree(managedWorktree);
-                return appendLifecycleNote(tracked.error, lifecycle);
+                finalizeDriveWorktreeAfter(run, managedWorktree);
+                return managedWorktree
+                    ? `${tracked.error}\n\n[worktree lifecycle] Cleaning up ${managedWorktree.session.worktreePath} once ${cliName} exits.`
+                    : tracked.error;
             }
             ctx?.runYield?.request("background_notification");
             return [

package/dist/tools/worktree.js

@@ -27,7 +27,7 @@ export async function switchSessionWorkspaceTool(args, ctx) {
     const target = stringArg(args.target);
     if (!target)
         return "Error: target is required";
-    const bridge = ctx?.workspace;
+    const bridge = workspaceBridgeForContext(ctx);
     if (!bridge) {
         return ("SwitchSessionWorkspace is not available in this host. " +
             "Use the host's supported workspace controls instead.");
@@ -48,6 +48,22 @@ export async function switchSessionWorkspaceTool(args, ctx) {
         return `Error: switching workspace failed: ${err.message}`;
     }
 }
+function workspaceBridgeForContext(ctx) {
+    if (ctx?.workspaceBridge)
+        return ctx.workspaceBridge;
+    // Before multi-root authority landed, the host bridge occupied `workspace`.
+    // Keep those single-root hosts and injected harnesses working, but never
+    // interpret a versioned/root-bearing WorkspaceContext as an executable bridge.
+    const legacy = ctx?.workspace;
+    if (!legacy || typeof legacy !== "object")
+        return undefined;
+    if ("version" in legacy || "roots" in legacy || "projectId" in legacy)
+        return undefined;
+    const candidate = legacy;
+    return typeof candidate.switch === "function"
+        ? candidate
+        : undefined;
+}
 export const enterWorktreeToolDef = {
     name: "EnterWorktree",
     description: "Switch the current session workspace. Target can be a new worktree slug, " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-capability-coding",
-  "version": "0.8.20",
+  "version": "0.9.1",
   "description": "Coding capability pack for the generic code-shell agent core.",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,7 +39,7 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-core": "0.8.20"
+    "@cjhyy/code-shell-core": "0.9.1"
   },
   "engines": {
     "node": ">=20.10"