@cjhyy/code-shell-capability-coding 0.9.44 → 0.9.47

package/dist/capability-runtime.js

@@ -56,7 +56,10 @@ export const gitDynamicContextProvider = ({ cwd, preset }) => {
     const log = getGitLog(cwd, 5);
     const parts = [`gitStatus: Current branch: ${branch}`];
     if (status.length > 0) {
-        parts.push(`Status:\n${status.map((entry) => `${entry.status} ${entry.path}`).join("\n")}`);
+        const lines = status.map((entry) => entry.origPath
+            ? `${entry.status} ${entry.origPath} -> ${entry.path}`
+            : `${entry.status} ${entry.path}`);
+        parts.push(`Status:\n${lines.join("\n")}`);
     }
     if (log.length > 0) {
         parts.push(`Recent commits:\n${log.map((entry) => `${entry.hash} ${entry.message}`).join("\n")}`);

package/dist/cc-orchestrator/codex-session-history.d.ts

@@ -35,5 +35,7 @@ export declare function parseCodexRecentHistory(raw: string, limit: number): {
  * authoritative rendered stream; parallel `event_msg.agent_message` records
  * are deliberately ignored to avoid duplicate assistant bubbles. */
 export declare function parseCodexTranscriptLine(line: string): SessionTailEvent[];
-/** Find the rollout file whose `session_meta` matches both `threadId` and `cwd`. */
+/** Find the rollout file whose `session_meta` matches both `threadId` and `cwd`.
+ *  A resumed thread can own several rollouts; pick the newest by mtime, the
+ *  same file the room list dedupes to, so list title and history agree. */
 export declare function findCodexRolloutFile(codexHome: string, cwd: string, threadId: string): string | undefined;

package/dist/cc-orchestrator/codex-session-history.js

@@ -182,23 +182,30 @@ function argsOf(payload) {
         return { input: payload.input };
     return undefined;
 }
-/** Find the rollout file whose `session_meta` matches both `threadId` and `cwd`. */
+/** Find the rollout file whose `session_meta` matches both `threadId` and `cwd`.
+ *  A resumed thread can own several rollouts; pick the newest by mtime, the
+ *  same file the room list dedupes to, so list title and history agree. */
 export function findCodexRolloutFile(codexHome, cwd, threadId) {
     const root = join(codexHome, "sessions");
     if (!existsSync(root))
         return undefined;
+    let best;
     for (const file of walkRollouts(root)) {
         let meta;
+        let mtimeMs;
         try {
             meta = readSessionMeta(file);
+            mtimeMs = statSync(file).mtimeMs;
         }
         catch {
             continue;
         }
-        if (meta && meta.id === threadId && meta.cwd === cwd)
-            return file;
+        if (!meta || meta.id !== threadId || meta.cwd !== cwd)
+            continue;
+        if (!best || mtimeMs > best.mtimeMs)
+            best = { file, mtimeMs };
     }
-    return undefined;
+    return best?.file;
 }
 /** Recursively yield every `rollout-*.jsonl` file under `root`. */
 function* walkRollouts(root) {

package/dist/cc-orchestrator/external-agent-changes.js

@@ -1,7 +1,8 @@
-import { readFileSync, existsSync, readdirSync, statSync, openSync, readSync, closeSync, } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { encodeCwd } from "./session-discovery.js";
+import { findCodexRolloutFile } from "./codex-session-history.js";
 import { logger } from "@cjhyy/code-shell-core/extension";
 /**
  * #6 — attribute file changes made by a background external agent (DriveAgent
@@ -107,9 +108,10 @@ function filesFromCodexArgs(name, raw) {
         return [];
     if (name === "apply_patch" || name === "ApplyPatch") {
         // apply_patch payload wraps a patch; headers look like `*** Update File: <p>`
-        // or `*** Add File: <p>`. Match those directly off the raw text.
+        // or `*** Add File: <p>`, and a rename follows Update with `*** Move to: <p>`.
+        // Match those directly off the raw text so a rename keeps both paths.
         const out = [];
-        const re = /\*\*\*\s+(?:Update|Add|Delete) File:\s+(.+)/g;
+        const re = /\*\*\*\s+(?:(?:Update|Add|Delete) File|Move to):\s+(.+)/g;
         let m;
         while ((m = re.exec(raw)) !== null) {
             const f = m[1]?.trim();
@@ -129,7 +131,8 @@ function filesFromCodexArgs(name, raw) {
 }
 /** Locate a codex rollout by threadId+cwd under `<codexHome>/sessions` and extract changes. */
 export function readCodexChangedFiles(cwd, threadId, codexHome = join(homedir(), ".codex")) {
-    const file = findRolloutFile(codexHome, cwd, threadId);
+    // Same locator as history/tails: a resumed thread uses its newest rollout.
+    const file = findCodexRolloutFile(codexHome, cwd, threadId);
     if (!file)
         return [];
     let text;
@@ -168,64 +171,3 @@ export function readExternalChangedFiles(cli, cwd, sessionId) {
         return [];
     }
 }
-// ── codex rollout location (mirrors codex-session-history.ts) ──────────────
-function findRolloutFile(codexHome, cwd, threadId) {
-    const root = join(codexHome, "sessions");
-    if (!existsSync(root))
-        return undefined;
-    for (const file of walkRollouts(root)) {
-        let meta;
-        try {
-            meta = readSessionMeta(file);
-        }
-        catch {
-            continue;
-        }
-        if (meta && meta.id === threadId && meta.cwd === cwd)
-            return file;
-    }
-    return undefined;
-}
-function* walkRollouts(root) {
-    let entries;
-    try {
-        entries = readdirSync(root);
-    }
-    catch {
-        return;
-    }
-    for (const name of entries) {
-        const full = join(root, name);
-        let st;
-        try {
-            st = statSync(full);
-        }
-        catch {
-            continue;
-        }
-        if (st.isDirectory())
-            yield* walkRollouts(full);
-        else if (name.startsWith("rollout-") && name.endsWith(".jsonl"))
-            yield full;
-    }
-}
-function readSessionMeta(file, maxBytes = 1 << 16) {
-    const fd = openSync(file, "r");
-    let text;
-    try {
-        const buf = Buffer.alloc(maxBytes);
-        const n = readSync(fd, buf, 0, maxBytes, 0);
-        text = buf.toString("utf-8", 0, n);
-    }
-    finally {
-        closeSync(fd);
-    }
-    const nl = text.indexOf("\n");
-    const first = (nl === -1 ? text : text.slice(0, nl)).trim();
-    if (!first)
-        return undefined;
-    const d = JSON.parse(first);
-    if (d.type !== "session_meta" || !d.payload)
-        return undefined;
-    return { id: d.payload.id, cwd: d.payload.cwd };
-}

package/dist/cc-orchestrator/external-agent-driver.js

@@ -1,7 +1,7 @@
 import { execFile, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import { pathWithCommonBins } from "./cc-capability.js";
-import { killProcessGroup } from "@cjhyy/code-shell-core/extension";
+import { killProcessGroup, recordExternalModelCall } from "@cjhyy/code-shell-core/extension";
 /** Pure: reduce collected output lines + exit code to a result. Unit-testable. */
 export function runWithLines(adapter, lines, exitCode) {
     const parsed = adapter.parseResult(lines);
@@ -199,6 +199,7 @@ export function detectCodexImageInput(command, cwd, signal) {
  *  No time concept — a single turn. Honors AbortSignal (kills the child). */
 export function runAgentOnce(adapter, opts, signal) {
     return new Promise((resolve, reject) => {
+        let finishTrace = () => { };
         void (async () => {
             throwIfAborted(signal);
             const codexImageInputSupported = adapter.kind === "codex" && (opts.imagePaths?.length ?? 0) > 0
@@ -234,6 +235,53 @@ export function runAgentOnce(adapter, opts, signal) {
                 detached: false,
                 stdio: [viaStdin ? "pipe" : "ignore", "pipe", "pipe"],
             });
+            const common = {
+                provider: adapter.kind,
+                model: opts.model ?? "CLI default",
+                source: `drive-agent-${adapter.kind}-cli`,
+                purpose: "external_delegation",
+                startedAt: Date.now(),
+            };
+            const initialTrace = recordExternalModelCall({
+                ...common,
+                status: "running",
+                input: {
+                    messages: [{ role: "user", content: opts.prompt }],
+                    parameters: {
+                        cliArguments: args,
+                        promptViaStdin: viaStdin,
+                        launchCwd: opts.cwd,
+                        resumeExternalSessionId: opts.resumeSessionId,
+                        imagePaths: opts.imagePaths,
+                        additionalReadDirs: opts.additionalReadDirs,
+                        limitation: "CLI entry input and visible final result only; private model requests, retries, and provider usage are opaque.",
+                    },
+                },
+            });
+            let traceFinished = false;
+            finishTrace = (result, error) => {
+                if (!initialTrace || traceFinished)
+                    return;
+                traceFinished = true;
+                const status = signal?.aborted
+                    ? "cancelled"
+                    : error || result?.isError || result?.exitCode !== 0
+                        ? "failed"
+                        : "completed";
+                const captured = initialTrace.inputState !== "not-recorded";
+                recordExternalModelCall({
+                    ...common,
+                    id: initialTrace.id,
+                    status,
+                    endedAt: Date.now(),
+                    output: captured && result ? { text: result.finalText, stopReason: status } : undefined,
+                    error: error
+                        ? captured
+                            ? String(error instanceof Error ? error.message : error)
+                            : "External CLI request failed"
+                        : undefined,
+                });
+            };
             let reportedSessionId = "";
             const reportSessionId = (candidate) => {
                 if (reportedSessionId || typeof candidate !== "string" || !candidate.trim())
@@ -287,6 +335,7 @@ export function runAgentOnce(adapter, opts, signal) {
                     return;
                 settled = true;
                 cleanup();
+                finishTrace(undefined, err);
                 // A missing binary is the most common failure (user hasn't installed the
                 // CLI, or GUI-launched Electron's PATH misses it). Turn the cryptic
                 // "spawn codex ENOENT" into something actionable that names the command.
@@ -301,12 +350,21 @@ export function runAgentOnce(adapter, opts, signal) {
                     return;
                 settled = true;
                 cleanup();
-                void (termination ?? Promise.resolve()).then(() => {
+                void (termination ?? Promise.resolve())
+                    .then(() => {
                     const result = runWithLines(adapter, lines, code);
+                    finishTrace(result);
                     reportSessionId(result.sessionId);
                     resolve(result);
+                })
+                    .catch((error) => {
+                    finishTrace(undefined, error);
+                    reject(error);
                 });
             });
-        })().catch(reject);
+        })().catch((error) => {
+            finishTrace(undefined, error);
+            reject(error);
+        });
     });
 }

package/dist/cc-orchestrator/session-discovery.d.ts

@@ -94,6 +94,8 @@ export interface ClaudeSessionDiscoveryDiagnostics {
  * the larger bounded content read used to find the card title.
  */
 export declare function discoverRecentClaudeSessions(opts?: DiscoverOptions, claudeHome?: string, scope?: ExternalSessionDiscoveryScope, diagnostics?: ClaudeSessionDiscoveryDiagnostics): RecentExternalSession[];
-/** Count of all session files for `cwd`, cheaply (stat only). Lets the UI know
- *  whether a bounded `discoverSessions` left older sessions unshown. */
+/** Count of session files for `cwd`, cheaply (stat + small identity probe).
+ *  Lets the UI know whether a bounded `discoverSessions` left older sessions
+ *  unshown. An identity the probe cannot read is counted, so this may only
+ *  overestimate the authoritative discovered length. */
 export declare function countSessions(cwd: string, claudeHome?: string): number;

package/dist/cc-orchestrator/session-discovery.js

@@ -75,7 +75,7 @@ function firstUserMessage(lines) {
         catch {
             continue;
         }
-        if (d.type !== "user")
+        if (d?.type !== "user")
             continue;
         const c = d.message?.content;
         const text = typeof c === "string"
@@ -92,6 +92,39 @@ function firstUserMessage(lines) {
     }
     return "";
 }
+/** First top-level `cwd` recorded in a transcript: the launch cwd Claude used
+ *  to name the project dir (later records may follow in-session `cd`s). */
+function firstRecordedCwd(lines) {
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        let d;
+        try {
+            d = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!d || typeof d !== "object")
+            continue;
+        const recorded = d.cwd;
+        if (typeof recorded === "string")
+            return recorded;
+    }
+    return undefined;
+}
+/**
+ * True when a transcript's recorded cwd is a different path that merely shares
+ * `cwd`'s lossy project-dir encoding (`/foo-bar` vs `/foo/bar`). A missing
+ * cwd cannot disprove ownership, so legacy transcripts stay in their bucket.
+ */
+function isCollidingClaudeCwd(recordedCwd, cwd) {
+    if (recordedCwd === undefined)
+        return false;
+    const recorded = resolve(recordedCwd);
+    const expected = resolve(cwd);
+    return recorded !== expected && encodeCwd(recorded) === encodeCwd(expected);
+}
 function countUserMessages(lines) {
     let n = 0;
     for (const line of lines) {
@@ -149,9 +182,17 @@ export function discoverSessions(cwd, claudeHome = join(homedir(), ".claude"), o
     const dir = join(claudeProjectsDir(claudeHome), encodeCwd(cwd));
     if (!existsSync(dir))
         return [];
-    const selected = selectRecentStats(listSessionStats(dir), opts);
+    // Window first, then apply the limit while skipping collided identities so a
+    // foreign session in the shared bucket never displaces one of this cwd's.
+    const windowed = selectRecentStats(listSessionStats(dir), {
+        sinceMs: opts.sinceMs,
+        now: opts.now,
+    });
+    const limit = opts.limit && opts.limit > 0 ? opts.limit : Infinity;
     const out = [];
-    for (const s of selected) {
+    for (const s of windowed) {
+        if (out.length >= limit)
+            break;
         let lines;
         try {
             lines = readFileSync(s.file, "utf-8").split("\n");
@@ -159,6 +200,8 @@ export function discoverSessions(cwd, claudeHome = join(homedir(), ".claude"), o
         catch {
             continue;
         }
+        if (isCollidingClaudeCwd(firstRecordedCwd(lines), cwd))
+            continue;
         out.push({
             sessionId: s.sessionId,
             cwd,
@@ -285,11 +328,25 @@ export function discoverRecentClaudeSessions(opts = {}, claudeHome = join(homedi
     }
     return out;
 }
-/** Count of all session files for `cwd`, cheaply (stat only). Lets the UI know
- *  whether a bounded `discoverSessions` left older sessions unshown. */
+/** Count of session files for `cwd`, cheaply (stat + small identity probe).
+ *  Lets the UI know whether a bounded `discoverSessions` left older sessions
+ *  unshown. An identity the probe cannot read is counted, so this may only
+ *  overestimate the authoritative discovered length. */
 export function countSessions(cwd, claudeHome = join(homedir(), ".claude")) {
     const dir = join(claudeProjectsDir(claudeHome), encodeCwd(cwd));
     if (!existsSync(dir))
         return 0;
-    return listSessionStats(dir).length;
+    let count = 0;
+    for (const s of listSessionStats(dir)) {
+        let recorded;
+        try {
+            recorded = readSessionIdentityCwd(s.file);
+        }
+        catch {
+            continue;
+        }
+        if (!isCollidingClaudeCwd(recorded, cwd))
+            count++;
+    }
+    return count;
 }

package/dist/cc-orchestrator/session-history.js

@@ -52,6 +52,9 @@ export function parseRecentHistory(raw, limit) {
         catch {
             continue;
         }
+        // A valid JSON scalar (e.g. `null`) is not a record; skip it like noise.
+        if (!d || typeof d !== "object")
+            continue;
         if (d.type === "user") {
             const t = textOf(d.message?.content).trim();
             if (!t || NOISE.some((n) => t.startsWith(n)))
@@ -80,6 +83,8 @@ export function parseClaudeTranscriptLine(line) {
     catch {
         return [];
     }
+    if (!d || typeof d !== "object")
+        return [];
     const out = [];
     if (d.type === "user") {
         const content = d.message?.content;

package/dist/external-runtimes/claude-code/event-translator.d.ts

@@ -33,6 +33,13 @@ export declare class ClaudeEventTranslator {
     private terminal;
     /** Accumulates `input_json_delta` per tool block so args land as one object. */
     private readonly toolInput;
+    /**
+     * Prompt usage of the latest top-level model request in this turn. The
+     * terminal `result.usage` sums every request of the process, which is right
+     * for accounting but overstates the context N-fold (each request re-reads the
+     * cache), so the context anchor comes from here.
+     */
+    private lastRequestUsage?;
     constructor(options: ClaudeEventTranslatorOptions);
     /** Reset turn-scoped state while preserving the durable Claude session id. */
     beginTurn(): void;

package/dist/external-runtimes/claude-code/event-translator.js

@@ -6,6 +6,21 @@ function asRecord(value) {
 function str(value) {
     return typeof value === "string" && value ? value : undefined;
 }
+function count(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+function normaliseUsage(usage) {
+    const input = count(usage?.input_tokens);
+    if (input === undefined)
+        return undefined;
+    const cacheReadTokens = count(usage?.cache_read_input_tokens);
+    const cacheCreationTokens = count(usage?.cache_creation_input_tokens);
+    return {
+        promptTokens: input + (cacheReadTokens ?? 0) + (cacheCreationTokens ?? 0),
+        ...(cacheReadTokens !== undefined ? { cacheReadTokens } : {}),
+        ...(cacheCreationTokens !== undefined ? { cacheCreationTokens } : {}),
+    };
+}
 /**
  * Map Claude's terminal reason onto CodeShell's.
  *
@@ -27,6 +42,13 @@ export class ClaudeEventTranslator {
     terminal = false;
     /** Accumulates `input_json_delta` per tool block so args land as one object. */
     toolInput = new Map();
+    /**
+     * Prompt usage of the latest top-level model request in this turn. The
+     * terminal `result.usage` sums every request of the process, which is right
+     * for accounting but overstates the context N-fold (each request re-reads the
+     * cache), so the context anchor comes from here.
+     */
+    lastRequestUsage;
     constructor(options) {
         this.options = options;
         this.codeshellServer = options.codeshellServerName ?? "codeshell_tools";
@@ -35,6 +57,7 @@ export class ClaudeEventTranslator {
     beginTurn() {
         this.terminal = false;
         this.toolInput.clear();
+        this.lastRequestUsage = undefined;
     }
     /** Claude session id, learned from the `system/init` line. */
     runtimeSessionId;
@@ -86,6 +109,13 @@ export class ClaudeEventTranslator {
         if (!event || !type)
             return [];
         if (type === "message_start") {
+            // A sub-agent's request (Task tool) carries its parent tool id; its prompt
+            // is not this conversation's context.
+            if (message.parent_tool_use_id == null) {
+                const usage = normaliseUsage(asRecord(asRecord(event.message)?.usage));
+                if (usage)
+                    this.lastRequestUsage = usage;
+            }
             this.turnNumber += 1;
             return [{ type: "stream_request_start", turnNumber: this.turnNumber }];
         }
@@ -111,6 +141,12 @@ export class ClaudeEventTranslator {
                 const text = str(delta?.text);
                 return text ? [{ type: "text_delta", text }] : [];
             }
+            if (deltaType === "thinking_delta") {
+                // Same event the native engine emits for extended thinking. The
+                // accompanying `signature_delta` is an opaque integrity token, not text.
+                const text = str(delta?.thinking);
+                return text ? [{ type: "thinking_delta", text }] : [];
+            }
             if (deltaType === "input_json_delta") {
                 // Arguments stream as JSON fragments; buffer and emit once complete.
                 const partial = typeof delta?.partial_json === "string" ? delta.partial_json : "";
@@ -199,20 +235,33 @@ export class ClaudeEventTranslator {
         this.terminal = true;
         const events = [];
         const usage = asRecord(message.usage);
-        const number = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
-        const promptTokens = number(usage?.input_tokens);
-        if (promptTokens !== undefined) {
-            const completionTokens = number(usage?.output_tokens);
-            const cacheReadTokens = number(usage?.cache_read_input_tokens);
-            const cacheCreationTokens = number(usage?.cache_creation_input_tokens);
+        const total = normaliseUsage(usage);
+        if (total) {
+            // `promptTokens`/`cache*` describe the latest request (the context, as in
+            // the native stream); `singleTurn*` carry this submission's aggregate, which
+            // is what accounting adds up. Without a per-request reading the aggregate is
+            // the best available context estimate.
+            const latest = this.lastRequestUsage ?? total;
+            const completionTokens = count(usage?.output_tokens);
             events.push({
                 type: "usage_update",
-                promptTokens,
+                promptTokens: latest.promptTokens,
+                singleTurnPromptTokens: total.promptTokens,
                 promptTokensSource: "provider_usage",
                 promptTokensConfidence: "high",
                 ...(completionTokens !== undefined ? { completionTokens } : {}),
-                ...(cacheReadTokens !== undefined ? { cacheReadTokens } : {}),
-                ...(cacheCreationTokens !== undefined ? { cacheCreationTokens } : {}),
+                ...(latest.cacheReadTokens !== undefined
+                    ? { cacheReadTokens: latest.cacheReadTokens }
+                    : {}),
+                ...(total.cacheReadTokens !== undefined
+                    ? { singleTurnCacheReadTokens: total.cacheReadTokens }
+                    : {}),
+                ...(latest.cacheCreationTokens !== undefined
+                    ? { cacheCreationTokens: latest.cacheCreationTokens }
+                    : {}),
+                ...(total.cacheCreationTokens !== undefined
+                    ? { singleTurnCacheCreationTokens: total.cacheCreationTokens }
+                    : {}),
             });
         }
         const reason = terminalReasonFor(str(message.subtype), message.is_error === true);

package/dist/external-runtimes/claude-code/mcp-config.d.ts

@@ -34,6 +34,14 @@ export interface ClaudeMcpConfigFile {
  * files", it was "avoid mutating persistent user config".
  */
 export declare function writeClaudeMcpConfigFile(options: ClaudeMcpConfigOptions): ClaudeMcpConfigFile;
+/**
+ * Write per-invocation host guidance for `--append-system-prompt-file`.
+ *
+ * A file rather than `--append-system-prompt <text>`: the guidance includes the
+ * renderer's session brief and related-session list, and argv is readable by
+ * every local user (see {@link buildClaudeMcpConfig}).
+ */
+export declare function writeClaudeSystemPromptFile(text: string): ClaudeMcpConfigFile;
 /**
  * Fully-qualified tool names for `--allowed-tools`.
  *

package/dist/external-runtimes/claude-code/mcp-config.js

@@ -58,9 +58,22 @@ export function buildClaudeMcpConfig(options) {
  * files", it was "avoid mutating persistent user config".
  */
 export function writeClaudeMcpConfigFile(options) {
-    const dir = mkdtempSync(join(tmpdir(), "codeshell-mcp-"));
-    const path = join(dir, "mcp-config.json");
-    writeFileSync(path, buildClaudeMcpConfig(options), { mode: 0o600 });
+    return writePrivateTempFile("codeshell-mcp-", "mcp-config.json", buildClaudeMcpConfig(options));
+}
+/**
+ * Write per-invocation host guidance for `--append-system-prompt-file`.
+ *
+ * A file rather than `--append-system-prompt <text>`: the guidance includes the
+ * renderer's session brief and related-session list, and argv is readable by
+ * every local user (see {@link buildClaudeMcpConfig}).
+ */
+export function writeClaudeSystemPromptFile(text) {
+    return writePrivateTempFile("codeshell-claude-prompt-", "append-system-prompt.md", text);
+}
+function writePrivateTempFile(prefix, name, content) {
+    const dir = mkdtempSync(join(tmpdir(), prefix));
+    const path = join(dir, name);
+    writeFileSync(path, content, { mode: 0o600 });
     // Set explicitly as well: writeFileSync's mode is subject to umask.
     chmodSync(path, 0o600);
     return {

package/dist/external-runtimes/claude-code/permissions.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Claude Code's NATIVE tool permissions under a CodeShell host.
+ *
+ * CodeShell Host Tools (`mcp__codeshell_tools__*`) are authorized by
+ * `ToolExecutor` whatever Claude decides. Claude's own tools (Bash, Edit, Write,
+ * WebFetch, …) are not: they obey only the CLI's permission mode and whoever
+ * answers its permission prompts. Two things therefore have to be explicit:
+ *
+ *  1. `--permission-mode`, derived from the host's selection. Leaving it out is
+ *     not neutral: the CLI then falls back to the user's own
+ *     `~/.claude/settings.json` `defaultMode`, which may be far wider than what
+ *     the user picked in CodeShell.
+ *  2. `--permission-prompt-tool`, so an "ask" reaches the host's approval UI. In
+ *     `-p` mode without one, every ask is denied outright.
+ *
+ * The prompt tool is an MCP tool on the session's own bridge. Claude calls it
+ * with `{ tool_name, input, tool_use_id }` and expects a JSON text result,
+ * `{ behavior: "allow", updatedInput }` or `{ behavior: "deny", message }`
+ * (shape read from the CLI's own result schema; not run against a real account).
+ */
+import type { PermissionMode } from "@cjhyy/code-shell-core/extension";
+import type { BridgeToolHost } from "../shared/mcp-bridge.js";
+/** Values passed to `claude --permission-mode`. */
+export declare const CLAUDE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "dontAsk", "bypassPermissions"];
+export type ClaudePermissionMode = (typeof CLAUDE_PERMISSION_MODES)[number];
+/**
+ * Map a CodeShell permission selection onto Claude's.
+ *
+ * Never escalates: Plan wins over everything; full access maps to
+ * `bypassPermissions` only when CodeShell itself is in `bypassPermissions`; and
+ * anything without an exact Claude equivalent — notably CodeShell's legacy
+ * `auto`, which in Claude would mean a model-classifier auto-approval — becomes
+ * `default`.
+ */
+export declare function claudePermissionModeFor(selection: {
+    permissionMode: PermissionMode | undefined;
+    planMode: boolean;
+}): ClaudePermissionMode;
+/**
+ * Whether native asks should be routed to the host in this mode. Plan stays
+ * read-only (an approved ExitPlanMode would otherwise leave it); `dontAsk` means
+ * "do not ask"; `bypassPermissions` never asks.
+ */
+export declare function claudeModeUsesPermissionPrompt(mode: ClaudePermissionMode): boolean;
+/** Plain CodeShell-side name; the bridge qualifies it as `mcp__<server>__…`. */
+export declare const CLAUDE_PERMISSION_PROMPT_TOOL = "CodeShellPermissionPrompt";
+export interface ClaudePermissionPromptRequest {
+    /** Claude's tool name, e.g. `Bash`, `Edit`, `mcp__other__tool`. */
+    toolName: string;
+    input: Record<string, unknown>;
+    toolUseId?: string;
+}
+export type ClaudePermissionPromptDecider = (request: ClaudePermissionPromptRequest, signal?: AbortSignal) => Promise<{
+    approved: boolean;
+    reason?: string;
+}>;
+/**
+ * Add the permission-prompt tool to a session's bridge surface.
+ *
+ * Answers, in order:
+ *  - the prompt tool itself → deny. It is visible to the model like any MCP
+ *    tool; a direct call must not raise a host approval dialog.
+ *  - this server's own tools → allow without asking. `ToolExecutor` authorizes
+ *    them; asking here too would approve one operation twice (the same rule the
+ *    Codex adapter applies to its MCP elicitations).
+ *  - `ExitPlanMode` → deny. The mode is CodeShell's selection, not the model's.
+ *  - everything else → `decide`, failing closed on any error or abort.
+ */
+export declare function withClaudePermissionPrompt(host: BridgeToolHost, decide: ClaudePermissionPromptDecider, serverName: string): BridgeToolHost;