@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/services/dream-consolidation.js

@@ -0,0 +1,151 @@
+/**
+ * Dream consolidation — the LLM tool-call loop that cleans up the `dream`
+ * memory scope (deduplicate, merge, drop stale, improve descriptions).
+ *
+ * This logic used to live as two private methods on Engine
+ * (`runDreamLoop` + `dispatchDreamTool`). It was extracted here so it can be
+ * driven from two places:
+ *   - the end-of-session auto-dream pipeline (Engine.runDreamLoop delegates here)
+ *   - a manual "整理 / Dream" trigger from the desktop host, which constructs a
+ *     seed Engine purely to obtain a toolRegistry + LLM client and then calls
+ *     this directly (it never runs a turn).
+ *
+ * The loop is intentionally small and offline:
+ *   - No streaming, no UI events — it runs in the background.
+ *   - No permission prompts — there is no interactive backend on this path, so
+ *     we hard-reject any attempt to Save/Delete in the "user" scope before
+ *     dispatching. The "dream" scope is the LLM's workspace and goes through
+ *     freely.
+ *   - Capped at MAX_TURNS LLM round-trips and MAX_WRITES total mutations to
+ *     bound damage on misbehavior.
+ */
+import { MemoryManager } from "../session/memory.js";
+import { buildDreamSystemPrompt, buildDreamUserPrompt, } from "./auto-dream.js";
+import { logger } from "../logging/logger.js";
+const MAX_TURNS = 8;
+const MAX_WRITES = 10;
+const MEMORY_TOOL_NAMES = ["MemoryList", "MemoryRead", "MemorySave", "MemoryDelete"];
+/**
+ * Drive the dream-scope consolidation tool-call loop.
+ *
+ * Loads both scopes (user is read-only context; dream is the workspace),
+ * builds the dream prompts, and runs the LLM with a whitelisted subset of
+ * memory tools until it stops calling tools or hits the turn cap.
+ *
+ * Returns `ran: false` if the registry is missing the memory tools (nothing
+ * happened); otherwise `ran: true` with the final summary text.
+ */
+export async function runDreamConsolidation(input) {
+    const { llmClient, toolRegistry, projectDir, sessionId } = input;
+    const memoryTools = MEMORY_TOOL_NAMES
+        .map((n) => toolRegistry.getTool(n))
+        .filter((t) => t != null);
+    if (memoryTools.length < MEMORY_TOOL_NAMES.length) {
+        logger.warn("memory.dream_missing_tools", {
+            sessionId,
+            found: memoryTools.map((t) => t.name),
+        });
+        return { ran: false, summary: "" };
+    }
+    // Dream sees BOTH scopes — user/ is read-only context so it can spot
+    // duplicates spanning scopes, dream/ is the workspace it edits.
+    const mm = new MemoryManager({ projectDir });
+    const userMems = mm.loadScope("user");
+    const dreamMems = mm.loadScope("dream");
+    const systemPrompt = buildDreamSystemPrompt();
+    const userPrompt = buildDreamUserPrompt(userMems, dreamMems);
+    // Strip RegisteredTool down to the shape createMessage expects.
+    const toolDefs = memoryTools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema,
+    }));
+    const toolCtx = {
+        ...input.toolContext,
+        cwd: projectDir ?? process.cwd(),
+    };
+    const messages = [{ role: "user", content: userPrompt }];
+    let writeBudget = MAX_WRITES;
+    for (let turn = 0; turn < MAX_TURNS; turn++) {
+        const resp = await llmClient.createMessage({
+            systemPrompt,
+            messages,
+            tools: toolDefs,
+            maxTokens: 2048,
+            recordUsage: false,
+            reasoning: { mode: "off" },
+        });
+        if (resp.toolCalls.length === 0) {
+            logger.info("memory.dream_finished", {
+                sessionId,
+                turn,
+                finalText: resp.text.slice(0, 500),
+            });
+            return { ran: true, summary: resp.text };
+        }
+        // Echo the assistant turn back so subsequent turns see the tool_use ids.
+        const assistantContent = [];
+        if (resp.text)
+            assistantContent.push({ type: "text", text: resp.text });
+        for (const tc of resp.toolCalls) {
+            assistantContent.push({
+                type: "tool_use",
+                id: tc.id,
+                name: tc.toolName,
+                input: tc.args,
+            });
+        }
+        messages.push({ role: "assistant", content: assistantContent });
+        // Dispatch every tool call requested in this turn.
+        const toolResults = [];
+        for (const tc of resp.toolCalls) {
+            const result = await dispatchDreamTool(tc, toolRegistry, toolCtx, () => {
+                if (writeBudget <= 0)
+                    return false;
+                writeBudget--;
+                return true;
+            });
+            toolResults.push({
+                type: "tool_result",
+                tool_use_id: tc.id,
+                content: result,
+            });
+        }
+        messages.push({ role: "user", content: toolResults });
+    }
+    logger.warn("memory.dream_hit_turn_cap", { sessionId, maxTurns: MAX_TURNS });
+    return { ran: true, summary: "" };
+}
+/**
+ * Execute one memory tool call inside the dream loop. Enforces the two
+ * dream-loop invariants the prompt also states:
+ *   - Only the 4 memory tools are dispatchable.
+ *   - Save/Delete in "user" scope is refused (returned as a tool error)
+ *     because dream runs without an interactive permission backend.
+ */
+async function dispatchDreamTool(tc, toolRegistry, ctx, consumeWriteBudget) {
+    const allowed = new Set(MEMORY_TOOL_NAMES);
+    if (!allowed.has(tc.toolName)) {
+        return `Error: tool "${tc.toolName}" is not available in the dream loop`;
+    }
+    const isWrite = tc.toolName === "MemorySave" || tc.toolName === "MemoryDelete";
+    if (isWrite) {
+        const scope = tc.args?.scope;
+        if (scope !== "dream") {
+            return (`Error: dream loop may only write to scope "dream", got "${scope}". ` +
+                `User-scope changes require interactive permission, which is not available here.`);
+        }
+        if (!consumeWriteBudget()) {
+            return "Error: dream write budget exhausted — stop calling write tools and summarize instead.";
+        }
+    }
+    try {
+        const result = await toolRegistry.executeTool(tc.toolName, tc.args, { ctx });
+        if (result.isError)
+            return result.error ?? `Error executing ${tc.toolName}`;
+        return result.result ?? "";
+    }
+    catch (err) {
+        return `Error executing ${tc.toolName}: ${err.message}`;
+    }
+}

package/dist/services/extract-memories.d.ts

@@ -6,6 +6,14 @@
  */
 export interface ExtractedMemory {
     type: "user" | "feedback" | "project" | "reference";
+    /**
+     * Storage location (用户拍板). "global" = a general lesson/preference that
+     * still holds in a different project (→ ~/.code-shell/memory). "project" =
+     * specific to the current repo (→ projects/<hash>/memory). Decided by the
+     * extracting LLM. Missing/invalid → "project" (conservative: don't pollute
+     * the global layer with one-off events).
+     */
+    scope: "global" | "project";
     name: string;
     description: string;
     content: string;
@@ -27,5 +35,10 @@ export declare function buildExtractionPrompt(transcript: Array<{
 export declare const MAX_MEMORIES_PER_EXTRACTION = 2;
 /**
  * Parse extracted memories from LLM response.
+ *
+ * `maxCount` caps how many memories are accepted from one pass (the code-side
+ * guarantee of the prompt rule). Defaults to MAX_MEMORIES_PER_EXTRACTION; a
+ * caller can pass `settings.memories.maxCount` to tune it. Non-positive or
+ * absent → the default.
  */
-export declare function parseExtractionResponse(response: string): ExtractedMemory[];
+export declare function parseExtractionResponse(response: string, maxCount?: number): ExtractedMemory[];

package/dist/services/extract-memories.js

@@ -23,22 +23,31 @@ ${existingList}
 ${conversationText.slice(0, 30000)}
 
 ## Instructions
-Identify NEW information that should be saved as persistent memories. Categories:
+Identify NEW information that should be saved as persistent memories. Categories (type):
 - **user**: Information about the user's role, preferences, or expertise
 - **feedback**: Guidance about how to approach work (corrections or confirmations)
 - **project**: Non-obvious facts about ongoing work, goals, or decisions
 - **reference**: Pointers to external resources or systems
 
+Also decide each memory's storage SCOPE. **Be VERY conservative about "global" — default to "project".**
+- **global** (RARE — strong bar): ONLY a general working principle, durable user preference, or fact about WHO THE USER IS that would be useful in literally ANY project or task. Examples that qualify: "the user prefers Chinese replies", "always grep for consumers before declaring code dead", "git subprocess args need a -- separator".
+  - A concrete task's setup or domain data is NOT global even though it isn't tied to a code repo. Counter-examples that are **project, NOT global**: a specific daily-news / morning-briefing workflow and its data sources; how to log into a specific website; a particular model's config parameters; one integration's auth choice. These are task/domain specifics → "project".
+- **project** (DEFAULT): anything specific to this repo, this task, or this domain — including the counter-examples above.
+- The test for global: "is this a general way-of-working or who-the-user-is that applies across EVERY project?" Only then global. When in any doubt → project.
+
 Rules:
 - Extract AT MOST 2 memories per session. Prefer 0 to a marginal one — most sessions are noise.
+- AT MOST 1 of the extracted memories may be "global". The global layer is injected every session, so keep it tiny and high-value. If two candidates both seem global, keep the single most universal one global and make the other "project".
 - Only extract information that would be useful in FUTURE conversations
 - Do not duplicate existing memories (re-read the "Existing Memories" list above carefully)
 - Do not extract code patterns, file structures, or git history (derivable from code)
 - Do not extract ephemeral task details, progress snapshots, or in-flight work state — those belong in the conversation, not memory
 - Do not extract one-off research products (news reports, AI industry summaries, slide deck content, daily progress dumps) — they're done and not "durable, reusable information"
+- NEVER include secrets: API keys, tokens, passwords, private URLs with credentials. If the durable fact involves a credential, describe WHERE it lives (e.g. "key is in .env as FOO_KEY"), never the value itself
 - Each memory should have a clear, specific description
 
-Respond with a JSON array of objects with fields: type, name, description, content
+Respond with a JSON array of objects with fields: type, scope, name, description, content
+(scope must be "global" or "project")
 If nothing worth remembering, respond with an empty array: []`;
 }
 /** Max memories to accept from a single extraction pass. Code-side cap that
@@ -47,8 +56,16 @@ If nothing worth remembering, respond with an empty array: []`;
 export const MAX_MEMORIES_PER_EXTRACTION = 2;
 /**
  * Parse extracted memories from LLM response.
+ *
+ * `maxCount` caps how many memories are accepted from one pass (the code-side
+ * guarantee of the prompt rule). Defaults to MAX_MEMORIES_PER_EXTRACTION; a
+ * caller can pass `settings.memories.maxCount` to tune it. Non-positive or
+ * absent → the default.
  */
-export function parseExtractionResponse(response) {
+export function parseExtractionResponse(response, maxCount) {
+    const cap = typeof maxCount === "number" && maxCount > 0
+        ? Math.floor(maxCount)
+        : MAX_MEMORIES_PER_EXTRACTION;
     try {
         // Find JSON array in response
         const jsonMatch = response.match(/\[[\s\S]*\]/);
@@ -57,13 +74,35 @@ export function parseExtractionResponse(response) {
         const parsed = JSON.parse(jsonMatch[0]);
         if (!Array.isArray(parsed))
             return [];
-        const valid = parsed.filter((m) => typeof m === "object" &&
+        const valid = parsed
+            .filter((m) => typeof m === "object" &&
             m !== null &&
             typeof m.type === "string" &&
             typeof m.name === "string" &&
             typeof m.content === "string" &&
-            ["user", "feedback", "project", "reference"].includes(m.type));
-        return valid.slice(0, MAX_MEMORIES_PER_EXTRACTION);
+            ["user", "feedback", "project", "reference"].includes(m.type))
+            // Normalize scope: only "global" survives as global; everything else
+            // (absent, "project", typos) → "project" — never promote to global by accident.
+            .map((m) => ({
+            type: m.type,
+            scope: m.scope === "global" ? "global" : "project",
+            name: m.name,
+            description: m.description,
+            content: m.content,
+        }));
+        // Hard cap (用户拍板 克制): at most 1 global per extraction. The prompt asks
+        // for this, but the model may ignore it — enforce in code. Keep the first
+        // global as-is; demote any further globals to project.
+        let globalSeen = false;
+        const capped = valid.map((m) => {
+            if (m.scope !== "global")
+                return m;
+            if (globalSeen)
+                return { ...m, scope: "project" };
+            globalSeen = true;
+            return m;
+        });
+        return capped.slice(0, cap);
     }
     catch {
         return [];

package/dist/services/memory-orchestrator.d.ts

@@ -35,12 +35,33 @@ export interface MemoryOrchestratorOptions {
     projectDir?: string;
     /** Optional pre-constructed MemoryManager (avoids re-creating for every call). */
     memoryManager?: MemoryManager;
+    /**
+     * Max memories to accept per extraction pass. From settings.memories.maxCount;
+     * undefined → the built-in MAX_MEMORIES_PER_EXTRACTION default.
+     */
+    maxCount?: number;
+    /**
+     * From settings.memories.autoExtract. `false` skips step 1 (LLM memory
+     * extraction) entirely — the user-curated store stops accumulating
+     * extractor noise — while session summaries and auto-dream keep running.
+     * Absent/true = extract (default behavior).
+     */
+    autoExtract?: boolean;
+    /**
+     * Recall-based TTL in days (用户拍板 C). A `project`-type memory not read for
+     * this many days is soft-deleted (moved to memory-trash). Stable types
+     * (user/feedback/reference) and pinned entries are never pruned. From
+     * settings.memories.recallTtlDays; undefined/<=0 → no sweep.
+     */
+    recallTtlDays?: number;
 }
 export interface MemoryOrchestratorResult {
     /** Number of new memory entries extracted and saved. */
     extracted: number;
     /** Whether the auto-dream consolidation was triggered. */
     dreamTriggered: boolean;
+    /** Names of memories pruned by the recall-TTL sweep. */
+    pruned: string[];
 }
 export declare class MemoryOrchestrator {
     private readonly options;

package/dist/services/memory-orchestrator.js

@@ -15,6 +15,8 @@
 import { MemoryManager } from "../session/memory.js";
 import { buildExtractionPrompt, parseExtractionResponse } from "./extract-memories.js";
 import { saveSessionMemory, buildSessionMemoryPrompt } from "./session-memory.js";
+import { extractJSON } from "../utils/json.js";
+import { redactSecrets } from "../logging/sanitize-messages.js";
 import { shouldAutoDream, recordSession, recordDreamComplete, buildDreamSystemPrompt, buildDreamUserPrompt } from "./auto-dream.js";
 import { logger } from "../logging/logger.js";
 export class MemoryOrchestrator {
@@ -34,33 +36,83 @@ export class MemoryOrchestrator {
         const mm = this.options.memoryManager ?? new MemoryManager({ projectDir: this.options.projectDir });
         const startTime = Date.now();
         // --------------- 1. Extract durable memories ---------------
+        // settings.memories.autoExtract=false skips the extractor entirely (the
+        // curated store stops accumulating noise); summaries + dream still run.
         let extracted = 0;
-        try {
-            const existing = mm.loadAll();
-            const extractionPrompt = buildExtractionPrompt(transcript, existing);
-            const response = await this.options.callLLM("You are a memory extraction assistant. Extract only durable, reusable information worth carrying into future sessions.", extractionPrompt);
-            const entries = parseExtractionResponse(response);
-            for (const entry of entries) {
-                mm.save({
-                    type: entry.type,
-                    name: entry.name,
-                    description: entry.description,
-                    content: entry.content,
+        if (this.options.autoExtract === false) {
+            logger.info("memory.extraction_skipped", { sessionId, reason: "autoExtract=false" });
+        }
+        else
+            try {
+                let t = Date.now();
+                const existing = mm.loadAll();
+                const loadMs = Date.now() - t;
+                t = Date.now();
+                const extractionPrompt = buildExtractionPrompt(transcript, existing);
+                const promptMs = Date.now() - t;
+                t = Date.now();
+                const response = await this.options.callLLM("You are a memory extraction assistant. Extract only durable, reusable information worth carrying into future sessions.", extractionPrompt);
+                const llmMs = Date.now() - t;
+                t = Date.now();
+                const entries = parseExtractionResponse(response, this.options.maxCount);
+                const parseMs = Date.now() - t;
+                t = Date.now();
+                // Route by scope (用户拍板 审批门): "project" memories auto-land in the
+                // per-project store (`mm`). "global" memories do NOT auto-land global —
+                // they go to the GLOBAL pending scope and wait for the user to approve in
+                // the settings panel. Nothing auto-writes the injected global store.
+                let pendingMm = null;
+                let globalCount = 0;
+                for (const entry of entries) {
+                    const isGlobal = entry.scope === "global";
+                    const target = isGlobal
+                        ? (pendingMm ??= new MemoryManager({ scope: "pending" }))
+                        : mm;
+                    target.save({
+                        type: entry.type,
+                        name: entry.name,
+                        // Defense-in-depth: the extraction prompt forbids secrets, but a prompt
+                        // is not a guarantee. An auto-extracted memory is persisted with no user
+                        // review, so run the model-authored strings through the same
+                        // redactSecrets the logging path uses — a leaked key never lands on disk.
+                        description: redactSecrets(entry.description),
+                        content: redactSecrets(entry.content),
+                        // Provenance mark (feedback#18 方案 C): extractor writes are "auto"
+                        // so the UI can tell curated memories from extractor noise.
+                        origin: "auto",
+                        // 审批门: stamp the source project on pending entries so "不批准/降级"
+                        // can fall them back to the project they were extracted in.
+                        ...(isGlobal && this.options.projectDir
+                            ? { originProject: this.options.projectDir }
+                            : {}),
+                    });
+                    if (isGlobal)
+                        globalCount++;
+                }
+                const saveMs = Date.now() - t;
+                extracted = entries.length;
+                logger.info("memory.extraction_done", {
+                    sessionId,
+                    extracted,
+                    pendingGlobalCount: globalCount, // global candidates queued for approval
+                    projectCount: extracted - globalCount,
+                    elapsedMs: Date.now() - startTime,
+                    loadMs,
+                    promptMs,
+                    llmMs,
+                    parseMs,
+                    saveMs,
+                    existingCount: existing.length,
+                    transcriptMessages: transcript.length,
+                    responseChars: response.length,
+                });
+            }
+            catch (err) {
+                logger.warn("memory.extraction_failed", {
+                    sessionId,
+                    error: err.message,
                 });
             }
-            extracted = entries.length;
-            logger.info("memory.extraction_done", {
-                sessionId,
-                extracted,
-                elapsedMs: Date.now() - startTime,
-            });
-        }
-        catch (err) {
-            logger.warn("memory.extraction_failed", {
-                sessionId,
-                error: err.message,
-            });
-        }
         // --------------- 2. Session summary ---------------
         try {
             // Only summarise sessions with enough content to be meaningful.
@@ -68,9 +120,23 @@ export class MemoryOrchestrator {
             if (messageCount >= 3) {
                 const smPrompt = buildSessionMemoryPrompt(transcript);
                 const smResponse = await this.options.callLLM("You are a session summariser. Output only valid JSON.", smPrompt);
-                const jsonMatch = smResponse.match(/\{[\s\S]*\}/);
-                if (jsonMatch) {
-                    const parsed = JSON.parse(jsonMatch[0]);
+                // LLM 摘要常带 markdown 围栏 / 围栏外解释文字 / 末尾逗号 → 裸 JSON.parse 易碎。
+                // 复用 utils/json 的 extractJSON(剥围栏 + 花括号配平,识别字符串/转义)拿到候选,
+                // 解析失败再修一次常见错误(末尾逗号),都不行才放弃(走 catch,该 session 无摘要)。
+                const candidate = extractJSON(smResponse);
+                let parsed = null;
+                try {
+                    parsed = JSON.parse(candidate);
+                }
+                catch {
+                    try {
+                        parsed = JSON.parse(candidate.replace(/,(\s*[}\]])/g, "$1"));
+                    }
+                    catch {
+                        parsed = null;
+                    }
+                }
+                if (parsed) {
                     saveSessionMemory({
                         sessionId,
                         summary: String(parsed.summary ?? "").slice(0, 1000),
@@ -99,14 +165,17 @@ export class MemoryOrchestrator {
         let dreamTriggered = false;
         try {
             if (shouldAutoDream() && this.options.runDream) {
-                // Dream sees BOTH scopes — user/ is read-only context so it can spot
-                // duplicates spanning scopes, dream/ is the workspace it edits.
+                // Dream sees project user/ (read-only context) + project dream/
+                // (workspace) + global dream/ (cross-project workspace it also cleans).
                 const userMems = mm.loadScope("user");
                 const dreamMems = mm.loadScope("dream");
-                if (userMems.length + dreamMems.length > 0) {
+                const globalDreamMems = this.options.projectDir
+                    ? new MemoryManager({ scope: "dream" }).loadScope("dream")
+                    : [];
+                if (userMems.length + dreamMems.length + globalDreamMems.length > 0) {
                     const ran = await this.options.runDream({
                         systemPrompt: buildDreamSystemPrompt(),
-                        userPrompt: buildDreamUserPrompt(userMems, dreamMems),
+                        userPrompt: buildDreamUserPrompt(userMems, dreamMems, globalDreamMems),
                         projectDir: this.options.projectDir,
                     });
                     if (ran) {
@@ -128,6 +197,30 @@ export class MemoryOrchestrator {
                 error: err.message,
             });
         }
-        return { extracted, dreamTriggered };
+        // --------------- 5. Recall-based TTL sweep (用户拍板 C) ---------------
+        // Soft-delete project-type memories not read for recallTtlDays. Runs on
+        // both the project store and the global store (global also accumulates
+        // project-type events if the LLM mis-scopes). Never throws into the result.
+        const pruned = [];
+        try {
+            const ttl = this.options.recallTtlDays;
+            if (ttl && ttl > 0) {
+                pruned.push(...mm.pruneByRecall(ttl));
+                // Only sweep the global store when we're not already it (projectDir set).
+                if (this.options.projectDir) {
+                    pruned.push(...new MemoryManager({ scope: "user" }).pruneByRecall(ttl));
+                }
+                if (pruned.length > 0) {
+                    logger.info("memory.recall_ttl_pruned", { sessionId, pruned, ttlDays: ttl });
+                }
+            }
+        }
+        catch (err) {
+            logger.warn("memory.recall_ttl_failed", {
+                sessionId,
+                error: err.message,
+            });
+        }
+        return { extracted, dreamTriggered, pruned };
     }
 }

package/dist/services/notifier.d.ts

@@ -15,6 +15,14 @@ export interface NotificationOptions {
  * Send a desktop notification.
  */
 export declare function notify(options: NotificationOptions): void;
+/** Escape a string for embedding inside an AppleScript double-quoted literal. */
+export declare function escapeAppleScriptString(str: string): string;
+/** Build the osascript argv (a single `-e <script>` pair). */
+export declare function buildOsascriptArgs(title: string, message: string, sound: boolean): string[];
+/** Build the notify-send argv with title/message as separate tokens. */
+export declare function buildNotifySendArgs(title: string, message: string, urgency: "low" | "normal" | "critical"): string[];
+/** Build the powershell.exe argv (a single `-Command <script>` element). */
+export declare function buildPowershellArgs(title: string, message: string): string[];
 /**
  * Send a notification that a task/agent has completed.
  */

package/dist/services/notifier.js

@@ -4,7 +4,7 @@
  * Sends notifications when tasks complete, agents finish, or errors occur.
  * Falls back gracefully when no notification system is available.
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 /**
  * Send a desktop notification.
  */
@@ -12,37 +12,54 @@ export function notify(options) {
     const { title, message, sound = false, urgency = "normal" } = options;
     try {
         if (process.platform === "darwin") {
-            // macOS: osascript
-            const soundFlag = sound ? 'sound name "default"' : "";
-            execSync(`osascript -e 'display notification "${escape(message)}" with title "${escape(title)}" ${soundFlag}'`, { timeout: 5000 });
+            // macOS: osascript. Pass the script as a single -e argv element via
+            // execFileSync (no shell), so title/message are never seen by the shell.
+            execFileSync("osascript", buildOsascriptArgs(title, message, sound), { timeout: 5000 });
         }
         else if (process.platform === "linux") {
-            // Linux: notify-send
-            const urgencyFlag = urgency === "critical" ? "-u critical" : urgency === "low" ? "-u low" : "-u normal";
-            execSync(`notify-send ${urgencyFlag} "${escape(title)}" "${escape(message)}"`, {
-                timeout: 5000,
-            });
+            // Linux: notify-send. argv keeps title/message as separate tokens.
+            execFileSync("notify-send", buildNotifySendArgs(title, message, urgency), { timeout: 5000 });
         }
         else if (process.platform === "win32") {
-            // Windows: PowerShell toast
-            const ps = `
-        [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
-        $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)
-        $text = $xml.GetElementsByTagName('text')
-        $text[0].AppendChild($xml.CreateTextNode('${escape(title)}')) | Out-Null
-        $text[1].AppendChild($xml.CreateTextNode('${escape(message)}')) | Out-Null
-        $toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
-        [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('CodeShell').Show($toast)
-      `.trim();
-            execSync(`powershell.exe -NoProfile -Command "${ps.replace(/\n/g, "; ")}"`, {
-                timeout: 5000,
-            });
+            // Windows: PowerShell toast. The script is one -Command argv element
+            // (no outer shell); title/message are escaped for PowerShell single
+            // quotes (' → '').
+            execFileSync("powershell.exe", buildPowershellArgs(title, message), { timeout: 5000 });
         }
     }
     catch {
         // Silently fail — notifications are best-effort
     }
 }
+/** Escape a string for embedding inside an AppleScript double-quoted literal. */
+export function escapeAppleScriptString(str) {
+    return str.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, " ");
+}
+/** Build the osascript argv (a single `-e <script>` pair). */
+export function buildOsascriptArgs(title, message, sound) {
+    const soundClause = sound ? ' sound name "default"' : "";
+    const script = `display notification "${escapeAppleScriptString(message)}"` +
+        ` with title "${escapeAppleScriptString(title)}"${soundClause}`;
+    return ["-e", script];
+}
+/** Build the notify-send argv with title/message as separate tokens. */
+export function buildNotifySendArgs(title, message, urgency) {
+    return ["-u", urgency, title, message];
+}
+/** Build the powershell.exe argv (a single `-Command <script>` element). */
+export function buildPowershellArgs(title, message) {
+    const esc = (s) => s.replace(/'/g, "''").replace(/\n/g, " ");
+    const ps = [
+        "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+        "$xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)",
+        "$text = $xml.GetElementsByTagName('text')",
+        `$text[0].AppendChild($xml.CreateTextNode('${esc(title)}')) | Out-Null`,
+        `$text[1].AppendChild($xml.CreateTextNode('${esc(message)}')) | Out-Null`,
+        "$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)",
+        "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('CodeShell').Show($toast)",
+    ].join("; ");
+    return ["-NoProfile", "-Command", ps];
+}
 /**
  * Send a notification that a task/agent has completed.
  */
@@ -64,6 +81,3 @@ export function notifyError(context, error) {
         urgency: "critical",
     });
 }
-function escape(str) {
-    return str.replace(/['"\\]/g, "\\$&").replace(/\n/g, " ");
-}

package/dist/services/oauth.js

@@ -5,7 +5,8 @@
  */
 import { createServer } from "node:http";
 import { randomBytes, createHash } from "node:crypto";
-import { exec } from "node:child_process";
+import { execFile } from "node:child_process";
+import { browserOpenCommand } from "./browser-open.js";
 /**
  * Generate PKCE code verifier and challenge.
  */
@@ -18,12 +19,9 @@ function generatePKCE() {
  * Open a URL in the system browser.
  */
 function openBrowser(url) {
-    const cmd = process.platform === "darwin"
-        ? `open "${url}"`
-        : process.platform === "win32"
-            ? `start "${url}"`
-            : `xdg-open "${url}"`;
-    exec(cmd, () => { });
+    // execFile with an argv array — no shell, so the URL can't be interpreted.
+    const { cmd, args } = browserOpenCommand(process.platform, url);
+    execFile(cmd, args, () => { });
 }
 /**
  * Run the OAuth authorization code flow.

package/dist/services/session-memory-sort.d.ts

@@ -0,0 +1,8 @@
+import type { SessionMemoryEntry } from "./session-memory.js";
+/**
+ * Order session memories most-recent-first by their `createdAt` field. The
+ * caller previously sorted by filename (= sessionId), which has no
+ * chronological meaning (review-2026-05-30). Returns a new array; input is not
+ * mutated.
+ */
+export declare function sortSessionMemoriesByRecency(entries: SessionMemoryEntry[]): SessionMemoryEntry[];

package/dist/services/session-memory-sort.js

@@ -0,0 +1,9 @@
+/**
+ * Order session memories most-recent-first by their `createdAt` field. The
+ * caller previously sorted by filename (= sessionId), which has no
+ * chronological meaning (review-2026-05-30). Returns a new array; input is not
+ * mutated.
+ */
+export function sortSessionMemoriesByRecency(entries) {
+    return [...entries].sort((a, b) => (a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0));
+}