@cjhyy/code-shell-core 0.5.0-rc.0 → 0.5.0-rc.2

package/dist/plugins/pluginInstaller.js

@@ -4,10 +4,11 @@
  * source types (path / git / github / git-subdir), no dependencies, no
  * sparse-checkout, no npm/pip.
  */
-import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { existsSync, realpathSync, rmSync } from "node:fs";
+import { cp, mkdir, mkdtemp, rm } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { homedir, tmpdir } from "node:os";
-import { gitClone, gitRevParseHead, githubRepoToCloneUrl } from "./gitOps.js";
+import { gitClone, gitRevParseHead, gitSparseCheckoutAdd, githubRepoToCloneUrl, } from "./gitOps.js";
 import { loadMarketplace } from "./marketplaceManager.js";
 import { readKnownMarketplaces } from "./knownMarketplaces.js";
 import { appendInstallEntry, pluginInstallKey, readInstalledPlugins, removeInstallEntries, } from "./installedPlugins.js";
@@ -21,6 +22,47 @@ function pluginCacheRoot() {
 function pluginCacheDir(marketplace, plugin, version) {
     return join(pluginCacheRoot(), marketplace, plugin, version);
 }
+/**
+ * Resolve a candidate `installPath` to a realpath and verify it lives strictly
+ * underneath the plugin cache root. Returns the resolved path on success, or
+ * null when the path is missing, escapes the cache, equals the cache root
+ * itself, or is otherwise unsafe to remove.
+ *
+ * Exported so tests can exercise the safety predicate directly without
+ * arranging a full uninstall — the contract this defends (no rmSync outside
+ * the plugin cache) is the entire point of T2 / Workstream A2.
+ */
+export function resolveSafePluginPath(installPath, cacheRoot) {
+    if (typeof installPath !== "string" || installPath.length === 0)
+        return null;
+    // Realpath the cache root once. We require it to exist; if the cache root
+    // itself can't be resolved, refuse all deletions rather than fall back to
+    // a string-only check.
+    let safeCacheRoot;
+    try {
+        safeCacheRoot = realpathSync(cacheRoot);
+    }
+    catch {
+        return null;
+    }
+    // Realpath the target. A missing target (dangling symlink, already removed,
+    // typo in installed_plugins.json) returns null — caller will skip silently.
+    let resolvedTarget;
+    try {
+        resolvedTarget = realpathSync(installPath);
+    }
+    catch {
+        return null;
+    }
+    // Strict containment: must start with cacheRoot + separator. Equal-to-root
+    // is explicitly rejected so a tampered entry can't wipe the whole cache.
+    const rootWithSep = safeCacheRoot.endsWith(sep) ? safeCacheRoot : safeCacheRoot + sep;
+    if (resolvedTarget === safeCacheRoot)
+        return null;
+    if (!resolvedTarget.startsWith(rootWithSep))
+        return null;
+    return resolvedTarget;
+}
 async function materializePath(marketplaceInstallLocation, relativePath, cacheTarget) {
     const src = isAbsolute(relativePath)
         ? relativePath
@@ -28,16 +70,16 @@ async function materializePath(marketplaceInstallLocation, relativePath, cacheTa
     if (!existsSync(src)) {
         return { ok: false, error: `plugin source path "${relativePath}" not found in marketplace` };
     }
-    mkdirSync(dirname(cacheTarget), { recursive: true });
+    await mkdir(dirname(cacheTarget), { recursive: true });
     if (existsSync(cacheTarget))
-        rmSync(cacheTarget, { recursive: true, force: true });
-    cpSync(src, cacheTarget, { recursive: true });
+        await rm(cacheTarget, { recursive: true, force: true });
+    await cp(src, cacheTarget, { recursive: true });
     return { ok: true, sha: undefined };
 }
 async function materializeGit(url, ref, cacheTarget) {
-    mkdirSync(dirname(cacheTarget), { recursive: true });
+    await mkdir(dirname(cacheTarget), { recursive: true });
     if (existsSync(cacheTarget))
-        rmSync(cacheTarget, { recursive: true, force: true });
+        await rm(cacheTarget, { recursive: true, force: true });
     const clone = await gitClone(url, cacheTarget, ref ? { ref } : undefined);
     if (!clone.ok)
         return { ok: false, error: clone.error };
@@ -48,7 +90,7 @@ async function materializeGit(url, ref, cacheTarget) {
 }
 async function materializeGitSubdir(url, subPath, ref, cacheTarget) {
     // Clone to a tempdir, then copy the subdir over.
-    const tmp = mkdtempSync(join(tmpdir(), "plugin-clone-"));
+    const tmp = await mkdtemp(join(tmpdir(), "plugin-clone-"));
     try {
         const clone = await gitClone(url, tmp + "/repo", ref ? { ref } : undefined);
         if (!clone.ok)
@@ -63,14 +105,14 @@ async function materializeGitSubdir(url, subPath, ref, cacheTarget) {
                 error: `git-subdir path "${subPath}" not found in cloned repository`,
             };
         }
-        mkdirSync(dirname(cacheTarget), { recursive: true });
+        await mkdir(dirname(cacheTarget), { recursive: true });
         if (existsSync(cacheTarget))
-            rmSync(cacheTarget, { recursive: true, force: true });
-        cpSync(src, cacheTarget, { recursive: true });
+            await rm(cacheTarget, { recursive: true, force: true });
+        await cp(src, cacheTarget, { recursive: true });
         return { ok: true, sha: head.stdout };
     }
     finally {
-        rmSync(tmp, { recursive: true, force: true });
+        await rm(tmp, { recursive: true, force: true });
     }
 }
 function shortSha(sha) {
@@ -78,20 +120,49 @@ function shortSha(sha) {
         return "unknown";
     return sha.slice(0, 12);
 }
+/**
+ * Compare a marketplace-declared SHA against the cloned HEAD. The
+ * declaration is allowed to be a short prefix (>= 7 chars, standard git
+ * abbreviation length); for stricter integrity guarantees marketplaces
+ * should pin the full 40-char hash. Case-insensitive.
+ *
+ * Exported so a unit test can pin the policy without spinning up a real
+ * clone.
+ */
+export function shaMatches(declared, actual) {
+    if (typeof declared !== "string" || typeof actual !== "string")
+        return false;
+    const d = declared.trim().toLowerCase();
+    const a = actual.trim().toLowerCase();
+    if (d.length < 7)
+        return false; // refuse 6-or-less; too collision-prone
+    if (d.length > 40)
+        return false; // not a valid SHA
+    return a.startsWith(d);
+}
 async function materialize(source, marketplaceInstallLocation, marketplace, plugin) {
     // First pass: install into a placeholder dir, then rename to the SHA dir
     // once we know it. For path sources there's no SHA — use "local".
     const placeholder = pluginCacheDir(marketplace, plugin, "_pending_");
     if (typeof source === "string") {
+        // The marketplace was cloned sparse (only the manifest dirs are on disk),
+        // so a local-path plugin's tree may not be checked out yet. Expand the
+        // sparse-checkout to include it before reading. Best-effort: on a
+        // non-sparse (full) clone this errors harmlessly and the files are already
+        // present, so we ignore the result and let materializePath report a real
+        // missing-path error if the subdir truly isn't there.
+        if (!isAbsolute(source)) {
+            await gitSparseCheckoutAdd(marketplaceInstallLocation, source);
+        }
         const r = await materializePath(marketplaceInstallLocation, source, placeholder);
         if (!r.ok)
             return r;
         const finalDir = pluginCacheDir(marketplace, plugin, "local");
         if (existsSync(finalDir))
-            rmSync(finalDir, { recursive: true, force: true });
-        mkdirSync(dirname(finalDir), { recursive: true });
-        cpSync(placeholder, finalDir, { recursive: true });
-        rmSync(placeholder, { recursive: true, force: true });
+            await rm(finalDir, { recursive: true, force: true });
+        await mkdir(dirname(finalDir), { recursive: true });
+        await cp(placeholder, finalDir, { recursive: true });
+        await rm(placeholder, { recursive: true, force: true });
         return { ok: true, cacheDir: finalDir, version: "local", sha: undefined };
     }
     if (source.source === "git" || source.source === "github") {
@@ -99,32 +170,51 @@ async function materialize(source, marketplaceInstallLocation, marketplace, plug
         const r = await materializeGit(url, source.ref, placeholder);
         if (!r.ok) {
             if (existsSync(placeholder))
-                rmSync(placeholder, { recursive: true, force: true });
+                await rm(placeholder, { recursive: true, force: true });
             return r;
         }
+        // Supply-chain check: when the marketplace entry pins a SHA, fail the
+        // install if the cloned HEAD doesn't match. Without this the `sha`
+        // field is decorative — present in metadata, never enforced.
+        if (source.sha && !shaMatches(source.sha, r.sha)) {
+            if (existsSync(placeholder))
+                await rm(placeholder, { recursive: true, force: true });
+            return {
+                ok: false,
+                error: `sha mismatch for ${plugin}: expected ${source.sha}, got ${r.sha}`,
+            };
+        }
         const version = shortSha(r.sha);
         const finalDir = pluginCacheDir(marketplace, plugin, version);
         if (existsSync(finalDir))
-            rmSync(finalDir, { recursive: true, force: true });
-        mkdirSync(dirname(finalDir), { recursive: true });
-        cpSync(placeholder, finalDir, { recursive: true });
-        rmSync(placeholder, { recursive: true, force: true });
+            await rm(finalDir, { recursive: true, force: true });
+        await mkdir(dirname(finalDir), { recursive: true });
+        await cp(placeholder, finalDir, { recursive: true });
+        await rm(placeholder, { recursive: true, force: true });
         return { ok: true, cacheDir: finalDir, version, sha: r.sha };
     }
     if (source.source === "git-subdir") {
         const r = await materializeGitSubdir(source.url, source.path, source.ref, placeholder);
         if (!r.ok) {
             if (existsSync(placeholder))
-                rmSync(placeholder, { recursive: true, force: true });
+                await rm(placeholder, { recursive: true, force: true });
             return r;
         }
+        if (source.sha && !shaMatches(source.sha, r.sha)) {
+            if (existsSync(placeholder))
+                await rm(placeholder, { recursive: true, force: true });
+            return {
+                ok: false,
+                error: `sha mismatch for ${plugin}: expected ${source.sha}, got ${r.sha}`,
+            };
+        }
         const version = shortSha(r.sha);
         const finalDir = pluginCacheDir(marketplace, plugin, version);
         if (existsSync(finalDir))
-            rmSync(finalDir, { recursive: true, force: true });
-        mkdirSync(dirname(finalDir), { recursive: true });
-        cpSync(placeholder, finalDir, { recursive: true });
-        rmSync(placeholder, { recursive: true, force: true });
+            await rm(finalDir, { recursive: true, force: true });
+        await mkdir(dirname(finalDir), { recursive: true });
+        await cp(placeholder, finalDir, { recursive: true });
+        await rm(placeholder, { recursive: true, force: true });
         return { ok: true, cacheDir: finalDir, version, sha: r.sha };
     }
     return { ok: false, error: `unsupported source type "${source.source}"` };
@@ -194,10 +284,19 @@ export function uninstallPlugin(pluginName, marketplaceName) {
     const data = readInstalledPlugins();
     const entries = data.plugins[key];
     let removedFromDisk = false;
+    const cacheRoot = pluginCacheRoot();
     if (entries) {
         for (const e of entries) {
-            if (e.installPath && existsSync(e.installPath)) {
-                rmSync(e.installPath, { recursive: true, force: true });
+            if (!e.installPath)
+                continue;
+            // Containment check: the on-disk installed_plugins.json can be tampered
+            // with to point at arbitrary paths (e.g. "/", "$HOME"). Refuse to rm
+            // anything that doesn't realpath to a strict child of the plugin cache.
+            const safePath = resolveSafePluginPath(e.installPath, cacheRoot);
+            if (!safePath)
+                continue;
+            if (existsSync(safePath)) {
+                rmSync(safePath, { recursive: true, force: true });
                 removedFromDisk = true;
             }
         }

package/dist/plugins/schemas.js

@@ -44,6 +44,30 @@ export function validatePluginEntrySource(raw, path) {
             },
         };
     }
+    if (kind === "local") {
+        // Codex / agents-format marketplaces (e.g. awesome-codex-plugins) express
+        // a local plugin as { source: "local", path }. Our installer's local path
+        // source is a bare string, so normalize onto that.
+        if (typeof raw.path !== "string" || !raw.path) {
+            return { ok: false, error: `${path}: local source requires path` };
+        }
+        return { ok: true, value: raw.path };
+    }
+    if (kind === "url") {
+        // The official claude-plugins-official marketplace emits a "url" source
+        // type for "clone this git repo" (optionally a subdir via `path`). It is
+        // semantically identical to our git / git-subdir sources, so normalize it
+        // onto those rather than carrying a fourth code path through the installer.
+        if (typeof raw.url !== "string" || !raw.url) {
+            return { ok: false, error: `${path}: url source requires url` };
+        }
+        const ref = typeof raw.ref === "string" ? raw.ref : undefined;
+        const sha = typeof raw.sha === "string" ? raw.sha : undefined;
+        if (typeof raw.path === "string" && raw.path) {
+            return { ok: true, value: { source: "git-subdir", url: raw.url, path: raw.path, ref, sha } };
+        }
+        return { ok: true, value: { source: "git", url: raw.url, ref, sha } };
+    }
     if (kind === "git-subdir") {
         if (typeof raw.url !== "string" || !raw.url) {
             return { ok: false, error: `${path}: git-subdir source requires url` };
@@ -108,8 +132,21 @@ export function validateMarketplace(raw) {
     if (typeof raw.name !== "string" || !raw.name) {
         return { ok: false, error: "marketplace.json: name is required" };
     }
-    if (!isObject(raw.owner) || typeof raw.owner.name !== "string") {
-        return { ok: false, error: "marketplace.json: owner.name is required" };
+    // Claude Code marketplaces carry a top-level `owner: { name }`. Codex /
+    // agents-format marketplaces omit it and instead carry `interface.displayName`.
+    // Accept either, falling back to the marketplace name as a last resort, so a
+    // Codex manifest is not rejected purely for lacking an owner.
+    let ownerName;
+    let ownerEmail;
+    if (isObject(raw.owner) && typeof raw.owner.name === "string") {
+        ownerName = raw.owner.name;
+        ownerEmail = typeof raw.owner.email === "string" ? raw.owner.email : undefined;
+    }
+    else if (isObject(raw.interface) && typeof raw.interface.displayName === "string") {
+        ownerName = raw.interface.displayName;
+    }
+    else {
+        ownerName = raw.name;
     }
     if (!Array.isArray(raw.plugins)) {
         return { ok: false, error: "marketplace.json: plugins must be an array" };
@@ -126,10 +163,7 @@ export function validateMarketplace(raw) {
         value: {
             name: raw.name,
             description: typeof raw.description === "string" ? raw.description : undefined,
-            owner: {
-                name: raw.owner.name,
-                email: typeof raw.owner.email === "string" ? raw.owner.email : undefined,
-            },
+            owner: { name: ownerName, email: ownerEmail },
             plugins,
         },
     };

package/dist/plugins/types.d.ts

@@ -11,10 +11,14 @@ export type MarketplaceSource = {
     source: "git";
     url: string;
 };
+/** Which plugin-manifest convention a cloned marketplace ships. */
+export type MarketplaceFormat = "claude-code" | "codex" | "universal";
 export interface KnownMarketplace {
     source: MarketplaceSource;
     installLocation: string;
     lastUpdated: string;
+    /** Optional: absent on entries written before format detection existed. */
+    format?: MarketplaceFormat;
 }
 export type KnownMarketplaces = Record<string, KnownMarketplace>;
 export type PluginEntrySource = string | {

package/dist/preset/index.js

@@ -20,6 +20,7 @@ const GENERAL_BUILTIN_TOOLS = [
     "Bash",
     "WebSearch",
     "WebFetch",
+    "GenerateImage",
     "AskUserQuestion",
     "Agent",
     // AgentStatus removed: background agents now write to ~/.code-shell/agents/
@@ -42,6 +43,17 @@ const GENERAL_BUILTIN_TOOLS = [
     "RemoteTrigger",
     "REPL",
     "PowerShell",
+    // Persistent cross-session memory. Including these in the default preset is
+    // what lets the LLM list/read/save/delete memories during a normal session,
+    // AND what makes the end-of-session auto-dream consolidation work — its
+    // tool-call loop pulls these from the registry, so without them every dream
+    // run bailed with "missing memory tools". Save/Delete in the user scope stay
+    // permission-gated (the tools declare permissionDefault: "ask"); dream-scope
+    // writes go through freely.
+    "MemoryList",
+    "MemoryRead",
+    "MemorySave",
+    "MemoryDelete",
 ];
 const TERMINAL_CODING_EXTRA_TOOLS = [
     "EnterWorktree",
@@ -71,6 +83,10 @@ const GENERAL_PERMISSION_RULES = [
     { tool: "Skill", decision: "allow" },
     { tool: "ListMcpResources", decision: "allow" },
     { tool: "ReadMcpResource", decision: "allow" },
+    // Reading memory is always safe; writes (MemorySave/MemoryDelete) stay gated
+    // by the tools' own permissionDefault so the user confirms each change.
+    { tool: "MemoryList", decision: "allow" },
+    { tool: "MemoryRead", decision: "allow" },
 ];
 // ─── Preset definitions ──────────────────────────────────────────
 export const BUILTIN_AGENT_PRESETS = {

package/dist/prompt/composer.d.ts

@@ -16,6 +16,10 @@ export interface ComposerOptions {
     preset?: AgentPreset;
     customSystemPrompt?: string;
     appendSystemPrompt?: string;
+    /** User's preferred response language (free text), injected as a stable system section. */
+    responseLanguage?: string;
+    /** How to address the user / short profile (free text). */
+    userProfile?: string;
     /**
      * Skill names (full names including any "<plugin>:" prefix) the user
      * has disabled in settings. Filtered out of the LLM's skills listing
@@ -23,6 +27,12 @@ export interface ComposerOptions {
      * dispatch — see scanSkills(opts.disabledSkills) and skillTool.
      */
     disabledSkills?: string[];
+    /**
+     * Plugin names the user has totally disabled. Coarser knob than
+     * disabledSkills — every skill whose namespaced name starts with
+     * `${pluginName}:` is filtered. See scanSkills(opts.disabledPlugins).
+     */
+    disabledPlugins?: string[];
 }
 export declare class PromptComposer {
     private readonly options;

package/dist/prompt/composer.js

@@ -34,7 +34,11 @@ export class PromptComposer {
         const memoryContext = this.getMemoryContext();
         if (!instructions && !memoryContext)
             return null;
-        const currentDate = `Today's date is ${new Date().toISOString().split("T")[0]}.`;
+        // Local date, not UTC — toISOString() is UTC and would show the wrong
+        // "today" for users whose timezone has crossed midnight (review-2026-05-30).
+        const now = new Date();
+        const ymd = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
+        const currentDate = `Today's date is ${ymd}.`;
         let content = `<system-reminder>\n${currentDate}\n\n`;
         if (instructions)
             content += `${instructions}\n\n`;
@@ -111,13 +115,16 @@ export class PromptComposer {
                 compute: () => this.options.customSystemPrompt,
             });
         }
-        // Tool definitions
+        // Tool listing — name + one-line description only. The full JSON schema
+        // is NOT repeated here: the provider clients already send it in the
+        // native `tools` field (Anthropic tools / OpenAI functions), so dumping
+        // `Parameters: {...}` into the system prompt sent every tool's schema
+        // twice — a large, per-request token cost for no added model signal.
         if (tools.length > 0) {
             sections.push({
                 name: "tool_definitions",
                 compute: () => {
-                    const toolLines = tools.map((t) => `### ${t.name}\n${t.description}\n` +
-                        `Parameters: ${JSON.stringify(t.inputSchema, null, 2)}`);
+                    const toolLines = tools.map((t) => `### ${t.name}\n${t.description}`);
                     return `# Available Tools\n\n${toolLines.join("\n\n")}`;
                 },
             });
@@ -136,6 +143,7 @@ export class PromptComposer {
             compute: () => {
                 const skills = scanSkills(this.options.cwd, {
                     disabledSkills: this.options.disabledSkills,
+                    disabledPlugins: this.options.disabledPlugins,
                 });
                 return buildSkillListing(skills);
             },
@@ -147,6 +155,23 @@ export class PromptComposer {
                 compute: () => this.options.appendSystemPrompt,
             });
         }
+        // Personalization — stable user preferences (language + how to address
+        // the user). Placed in the cacheable system prefix because it doesn't
+        // change per-turn. Only emitted when at least one field is set.
+        const { responseLanguage, userProfile } = this.options;
+        if (responseLanguage || userProfile) {
+            sections.push({
+                name: "personalization",
+                compute: () => {
+                    const lines = ["# User & Response Preferences"];
+                    if (userProfile)
+                        lines.push(`- About the user: ${userProfile}`);
+                    if (responseLanguage)
+                        lines.push(`- Response language: ${responseLanguage}`);
+                    return lines.join("\n");
+                },
+            });
+        }
         return sections;
     }
     getInstructions() {

package/dist/prompt/sections/orchestration.md

@@ -6,6 +6,14 @@
  - Avoid creating files unless they are genuinely needed. Prefer editing existing files to creating new ones.
  - Avoid giving time estimates or predictions for how long tasks will take.
 
+# Delegating to sub-agents (Agent)
+ - A sub-agent runs in its own **clean, isolated context** and returns only its final report. It is stateless — you cannot send follow-up messages, so its prompt must be a complete, self-contained task description.
+ - **The primary reason to delegate is context hygiene, not speed.** When a task needs to read many files or run a long exploration but you only need the *conclusion*, hand it to a sub-agent: it does the noisy work in its own context and you keep the answer, not the file dumps. This is the default move for any sweep that would otherwise flood your own context with intermediate output.
+ - **Parallel fan-out is the exception, not the default.** Only launch several sub-agents at once when the work genuinely splits into independent pieces with no shared state or ordering. Don't open multiple agents just because a task *could* be subdivided — one well-scoped delegation usually beats a swarm.
+ - **Delegate the dirty work, keep the thinking.** Push file-reading, searching, and broad investigation into sub-agents; do the synthesis, decisions, and edits yourself in the main thread.
+ - **Don't delegate trivial lookups.** If you know the file/symbol/value and expect a few matches, use Read/Grep/Glob directly — spinning up an agent for that wastes a turn and tokens.
+ - If you delegate a chunk of work, add a TodoWrite item for it so the user sees it without reading the sub-agent's transcript.
+
 # Task tracking (TodoWrite)
  - When the user's request decomposes into 3+ discrete steps, call **TodoWrite** with the complete list up front. The user has a pinned task panel and relies on it to see what's queued, in progress, and done.
  - **TodoWrite takes the complete list each time** — there is no per-item update. To change a status, call TodoWrite again with the whole list, only that item's `status` changed. Your previous TodoWrite input IS the source of truth — re-read it before rewriting.

package/dist/protocol/chat-session-manager.d.ts

@@ -2,7 +2,7 @@ import { ChatSession } from "./chat-session.js";
 import type { Engine } from "../engine/engine.js";
 import type { EngineRuntime } from "../engine/runtime.js";
 import type { EngineConfig } from "../engine/engine.js";
-export type EngineConfigSlice = Pick<EngineConfig, "permissionMode" | "preset" | "customSystemPrompt" | "appendSystemPrompt" | "maxTurns" | "maxContextTokens" | "cwd">;
+export type EngineConfigSlice = Pick<EngineConfig, "permissionMode" | "preset" | "customSystemPrompt" | "appendSystemPrompt" | "goal" | "maxTurns" | "maxContextTokens" | "cwd">;
 export interface ChatSessionManagerOptions {
     /**
      * Shared runtime, supplied here so callers and engineFactory closures
@@ -24,6 +24,13 @@ export declare class ChatSessionManager {
     constructor(opts: ChatSessionManagerOptions);
     getOrCreate(sessionId: string, slice: EngineConfigSlice): ChatSession;
     get(sessionId: string): ChatSession | undefined;
+    /**
+     * Iterate every live session once. Public iterator so callers (e.g. the
+     * protocol server's config hot-reload / sessions query) don't reach into
+     * the private `sessions` map with an `as any` cast. Iterates a snapshot of
+     * the values so a callback that closes a session can't perturb the walk.
+     */
+    forEachSession(fn: (s: ChatSession) => void): void;
     close(sessionId: string): void;
     closeAll(): void;
     sessionCount(): number;

package/dist/protocol/chat-session-manager.js

@@ -29,6 +29,16 @@ export class ChatSessionManager {
     get(sessionId) {
         return this.sessions.get(sessionId);
     }
+    /**
+     * Iterate every live session once. Public iterator so callers (e.g. the
+     * protocol server's config hot-reload / sessions query) don't reach into
+     * the private `sessions` map with an `as any` cast. Iterates a snapshot of
+     * the values so a callback that closes a session can't perturb the walk.
+     */
+    forEachSession(fn) {
+        for (const s of [...this.sessions.values()])
+            fn(s);
+    }
     close(sessionId) {
         const s = this.sessions.get(sessionId);
         if (!s)

package/dist/protocol/chat-session.d.ts

@@ -10,6 +10,9 @@ export interface TurnOpts {
      *  configured cwd. */
     cwd?: string;
     onStream?: (event: StreamEvent) => void;
+    /** Goal mode for this turn — forwarded to engine.run (loop-until-done).
+     *  String objective or full GoalConfig (objective + optional budgets). */
+    goal?: string | import("../engine/goal.js").GoalConfig;
 }
 /**
  * One ChatSession per UI chat tab. Owns a single Engine, an AbortController
@@ -32,6 +35,13 @@ export declare class ChatSession {
     private active;
     private controller;
     private readonly defaultOnStream?;
+    /**
+     * Model-pool key requested via requestModelSwitch while a turn was in
+     * flight. Applied at the next run boundary (before the next turn starts) so
+     * we never swap the model out from under a running LLM client — the bug the
+     * session-isolation research flagged. null = nothing pending.
+     */
+    private pendingModel;
     constructor(opts: ChatSessionOptions);
     enqueueTurn(task: string, opts: TurnOpts): Promise<EngineResult>;
     /**
@@ -44,6 +54,13 @@ export declare class ChatSession {
      */
     cancel(): void;
     isBusy(): boolean;
+    /**
+     * Switch this session's active model (per-session, not worker-global).
+     * Applies immediately when idle; defers to the next run boundary when a
+     * turn is in flight so a hot switch never mutates the model under a
+     * running LLM client.
+     */
+    requestModelSwitch(key: string): void;
     queueDepth(): number;
     private pump;
 }

package/dist/protocol/chat-session.js

@@ -19,6 +19,13 @@ export class ChatSession {
     active = null;
     controller = null;
     defaultOnStream;
+    /**
+     * Model-pool key requested via requestModelSwitch while a turn was in
+     * flight. Applied at the next run boundary (before the next turn starts) so
+     * we never swap the model out from under a running LLM client — the bug the
+     * session-isolation research flagged. null = nothing pending.
+     */
+    pendingModel = null;
     constructor(opts) {
         this.id = opts.id;
         this.engine = opts.engine;
@@ -50,6 +57,19 @@ export class ChatSession {
     isBusy() {
         return this.active !== null;
     }
+    /**
+     * Switch this session's active model (per-session, not worker-global).
+     * Applies immediately when idle; defers to the next run boundary when a
+     * turn is in flight so a hot switch never mutates the model under a
+     * running LLM client.
+     */
+    requestModelSwitch(key) {
+        if (this.isBusy()) {
+            this.pendingModel = key;
+            return;
+        }
+        this.engine.switchModel(key);
+    }
     queueDepth() {
         return this.queue.length;
     }
@@ -68,6 +88,7 @@ export class ChatSession {
                 sessionId: this.id,
                 signal: this.controller.signal,
                 onStream,
+                goal: next.opts.goal,
             });
             this.lastActivityAt = Date.now();
             next.resolve(result);
@@ -78,6 +99,13 @@ export class ChatSession {
         finally {
             this.active = null;
             this.controller = null;
+            // Run boundary: apply any model switch that was deferred because it was
+            // requested mid-run. Done here (not in pump) so it still applies when
+            // no further turn is queued.
+            if (this.pendingModel !== null) {
+                this.engine.switchModel(this.pendingModel);
+                this.pendingModel = null;
+            }
             // Drain the next turn if one is waiting.
             if (this.queue.length > 0)
                 void this.pump();

package/dist/protocol/redact.d.ts

@@ -0,0 +1,50 @@
+/** Produce a short preview (`sk-…abcd`) so UIs can render presence without revealing the secret. */
+export declare function makeApiKeyPreview(apiKey: string | undefined | null): string | undefined;
+/**
+ * Return true when a dotted setting key path points at a secret field.
+ * Used to decide whether `config_get`'s response should redact the value.
+ */
+export declare function isSecretKeyPath(key: string): boolean;
+/**
+ * Redact a single value returned by config_get.
+ *
+ * Two-stage rule:
+ *   1. If the caller-supplied key path itself looks secret
+ *      ("llm.apiKey", "headers.authorization", …) → collapse to "[redacted]".
+ *   2. Otherwise, if the value is an object/array (e.g. config_get("llm") or
+ *      config_get("providers")), walk it with the shared secret redactor
+ *      from logging/sanitize-messages so nested apiKey / token / Bearer
+ *      fields don't slip through verbatim. Primitives pass unchanged.
+ *
+ * Pre-fix this only inspected the top-level key string, so
+ * config_get("providers") returned an array of provider objects with raw
+ * apiKey values intact. That defeated the purpose of the boundary.
+ */
+export declare function maskSecretValue<T>(key: string, value: T): T | "[redacted]";
+/**
+ * Shape of the LLM block returned to clients. We deliberately omit `apiKey`
+ * and surface presence/preview instead. Callers that need the raw key already
+ * have it server-side; clients should never see it.
+ */
+export interface RedactedLlmConfig {
+    provider?: string;
+    model?: string;
+    baseUrl?: string;
+    maxTokens?: number;
+    /** True when an apiKey is configured. */
+    hasApiKey: boolean;
+    /** Short preview when an apiKey is configured; omitted otherwise. */
+    apiKeyPreview?: string;
+}
+/**
+ * Rewrite the LLM section of a config snapshot for transport. We only forward
+ * fields the client legitimately needs to render status; secrets become
+ * derived flags.
+ */
+export declare function redactLlmConfig(llm: {
+    provider?: string;
+    model?: string;
+    apiKey?: string;
+    baseUrl?: string;
+    maxTokens?: number;
+}): RedactedLlmConfig;