@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/capability-control/project.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Pure projection functions: each turns one loader's output + the relevant
+ * slice of current settings into CapabilityDescriptor[]. No I/O, no state —
+ * the CapabilityService feeds them and composes the results.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+import type { RegisteredTool, MCPServerConfig } from "../types.js";
+import type { SkillDefinition } from "../skills/scanner.js";
+import type { AgentDefinition } from "../agent/agent-definition.js";
+import type { CapabilityDescriptor } from "./types.js";
+/**
+ * Builtin tools. A tool's switch lives in the denylist when it ships in the
+ * preset default set (turning it off = adding to agent.disabledBuiltinTools),
+ * and in the allowlist otherwise (turning it on = adding to
+ * agent.enabledBuiltinTools). This mirrors resolveBuiltinToolNames, whose
+ * effective set is `preset.builtinTools ∪ enabled − disabled`.
+ */
+export declare function projectBuiltin(input: {
+    tools: RegisteredTool[];
+    presetDefaults: string[];
+    effective: string[];
+}): CapabilityDescriptor[];
+/**
+ * MCP, projected per server (not per tool). Every configured server gets a
+ * descriptor — including unconnected ones — driven by the mcpServers config;
+ * tool counts come from the registry's connected mcp tools (0 if none).
+ */
+export declare function projectMcp(input: {
+    mcpServers: Record<string, MCPServerConfig>;
+    mcpTools: RegisteredTool[];
+}): CapabilityDescriptor[];
+/**
+ * Project/user skills. The caller MUST pass the FULL skill set (scanSkills
+ * with empty opts), because scanSkills filters disabled entries out — passing
+ * a filtered set would drop disabled skills from the list, leaving the UI no
+ * way to re-enable them. Plugin-sourced skills are excluded here; they surface
+ * under their plugin via projectPlugins.
+ */
+export declare function projectSkills(input: {
+    skills: SkillDefinition[];
+    disabledSkills: string[];
+}): CapabilityDescriptor[];
+/**
+ * Project/user sub-agent roles, projected per role. Like projectSkills, the
+ * caller MUST pass the FULL agent set (loaded WITHOUT the disabled filter), so
+ * disabled roles still appear in the list and can be re-enabled. Plugin-sourced
+ * agents are excluded — they ride their plugin's switch via projectPlugins, and
+ * disabledAgents only governs user/project roles. Toggling writes the top-level
+ * `disabledAgents` denylist (same key the 子代理 tab uses), so the two stay in
+ * sync; the project overlay layers on via capabilityOverrides.agents.
+ */
+export declare function projectAgents(input: {
+    agents: AgentDefinition[];
+    disabledAgents: string[];
+}): CapabilityDescriptor[];
+/**
+ * Installed plugins, projected per plugin. Install keys are `<plugin>@<market>`;
+ * the bare plugin name is the substring before the last `@` and matches the
+ * `plugin:` prefix that disabledPlugins controls.
+ */
+export declare function projectPlugins(input: {
+    installed: Record<string, unknown>;
+    disabledPlugins: string[];
+}): CapabilityDescriptor[];

package/dist/capability-control/project.js

@@ -0,0 +1,147 @@
+/**
+ * Pure projection functions: each turns one loader's output + the relevant
+ * slice of current settings into CapabilityDescriptor[]. No I/O, no state —
+ * the CapabilityService feeds them and composes the results.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+/**
+ * Builtin tools. A tool's switch lives in the denylist when it ships in the
+ * preset default set (turning it off = adding to agent.disabledBuiltinTools),
+ * and in the allowlist otherwise (turning it on = adding to
+ * agent.enabledBuiltinTools). This mirrors resolveBuiltinToolNames, whose
+ * effective set is `preset.builtinTools ∪ enabled − disabled`.
+ */
+export function projectBuiltin(input) {
+    const defaults = new Set(input.presetDefaults);
+    const on = new Set(input.effective);
+    return input.tools.map((t) => {
+        const inPreset = defaults.has(t.name);
+        return {
+            id: `builtin:${t.name}`,
+            kind: "builtin",
+            name: t.name,
+            description: t.description,
+            enabled: on.has(t.name),
+            control: inPreset
+                ? {
+                    settingsKey: "agent.disabledBuiltinTools",
+                    mode: "denylist",
+                    token: t.name,
+                }
+                : {
+                    settingsKey: "agent.enabledBuiltinTools",
+                    mode: "allowlist",
+                    token: t.name,
+                },
+            origin: { isReadOnly: t.isReadOnly },
+        };
+    });
+}
+/**
+ * MCP, projected per server (not per tool). Every configured server gets a
+ * descriptor — including unconnected ones — driven by the mcpServers config;
+ * tool counts come from the registry's connected mcp tools (0 if none).
+ */
+export function projectMcp(input) {
+    const counts = new Map();
+    for (const t of input.mcpTools) {
+        if (t.source !== "mcp" || !t.serverName)
+            continue;
+        counts.set(t.serverName, (counts.get(t.serverName) ?? 0) + 1);
+    }
+    return Object.entries(input.mcpServers).map(([serverName, cfg]) => {
+        const toolCount = counts.get(serverName) ?? 0;
+        return {
+            id: `mcp:${serverName}`,
+            kind: "mcp",
+            name: serverName,
+            description: `${toolCount} tools`,
+            enabled: cfg.enabled !== false,
+            control: {
+                settingsKey: "mcpServers",
+                mode: "record-flag",
+                token: serverName,
+            },
+            origin: { serverName, toolCount },
+        };
+    });
+}
+/**
+ * Project/user skills. The caller MUST pass the FULL skill set (scanSkills
+ * with empty opts), because scanSkills filters disabled entries out — passing
+ * a filtered set would drop disabled skills from the list, leaving the UI no
+ * way to re-enable them. Plugin-sourced skills are excluded here; they surface
+ * under their plugin via projectPlugins.
+ */
+export function projectSkills(input) {
+    const disabled = new Set(input.disabledSkills);
+    return input.skills
+        .filter((s) => s.source === "project" || s.source === "user")
+        .map((s) => ({
+        id: `skill:${s.name}`,
+        kind: "skill",
+        name: s.name,
+        description: s.description,
+        enabled: !disabled.has(s.name),
+        control: {
+            settingsKey: "disabledSkills",
+            mode: "denylist",
+            token: s.name,
+        },
+        origin: { filePath: s.filePath },
+    }));
+}
+/**
+ * Project/user sub-agent roles, projected per role. Like projectSkills, the
+ * caller MUST pass the FULL agent set (loaded WITHOUT the disabled filter), so
+ * disabled roles still appear in the list and can be re-enabled. Plugin-sourced
+ * agents are excluded — they ride their plugin's switch via projectPlugins, and
+ * disabledAgents only governs user/project roles. Toggling writes the top-level
+ * `disabledAgents` denylist (same key the 子代理 tab uses), so the two stay in
+ * sync; the project overlay layers on via capabilityOverrides.agents.
+ */
+export function projectAgents(input) {
+    const disabled = new Set(input.disabledAgents);
+    return input.agents
+        .filter((a) => a.source === "project" || a.source === "user")
+        .map((a) => ({
+        id: `agent:${a.name}`,
+        kind: "agent",
+        name: a.name,
+        description: a.description,
+        enabled: !disabled.has(a.name),
+        control: {
+            settingsKey: "disabledAgents",
+            mode: "denylist",
+            token: a.name,
+        },
+        origin: { filePath: a.filePath },
+    }));
+}
+/**
+ * Installed plugins, projected per plugin. Install keys are `<plugin>@<market>`;
+ * the bare plugin name is the substring before the last `@` and matches the
+ * `plugin:` prefix that disabledPlugins controls.
+ */
+export function projectPlugins(input) {
+    const disabled = new Set(input.disabledPlugins);
+    const names = new Set();
+    for (const key of Object.keys(input.installed)) {
+        const at = key.lastIndexOf("@");
+        names.add(at > 0 ? key.slice(0, at) : key);
+    }
+    return [...names].map((name) => ({
+        id: `plugin:${name}`,
+        kind: "plugin",
+        name,
+        description: "",
+        enabled: !disabled.has(name),
+        control: {
+            settingsKey: "disabledPlugins",
+            mode: "denylist",
+            token: name,
+        },
+        origin: { pluginName: name },
+    }));
+}

package/dist/capability-control/service.d.ts

@@ -0,0 +1,70 @@
+/**
+ * CapabilityService — the single control-layer entry point.
+ *
+ *  - list(): composes the four projections into one CapabilityDescriptor[].
+ *  - setEnabled(id, on): reads the target descriptor's inlined `control` and
+ *    routes the write to the right settings key. It never branches on `kind`.
+ *
+ * Dependencies are injected (not imported) so the service is unit-testable
+ * without touching disk: the engine / desktop wiring supplies the real
+ * ToolRegistry, SettingsManager, and loaders.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+import type { ToolRegistry } from "../tool-system/registry.js";
+import type { SettingsManager } from "../settings/manager.js";
+import type { SkillDefinition } from "../skills/scanner.js";
+import type { AgentDefinition } from "../agent/agent-definition.js";
+import type { InstalledPluginsV2 } from "../plugins/types.js";
+import type { CapabilityDescriptor, WriteScope, CapabilityOverrideState } from "./types.js";
+export interface CapabilityServiceDeps {
+    registry: Pick<ToolRegistry, "listToolsDetailed">;
+    settings: Pick<SettingsManager, "get" | "saveUserSetting" | "saveProjectSetting" | "deleteProjectSetting" | "getForScope">;
+    cwd: string;
+    scanSkills: (cwd: string, opts?: {
+        disabledSkills?: string[];
+        disabledPlugins?: string[];
+    }) => SkillDefinition[];
+    /** Full agent role set for `cwd` (user + project), loaded WITHOUT the
+     *  disabled filter so disabled roles still list and can be re-enabled. */
+    scanAgents: (cwd: string) => AgentDefinition[];
+    readInstalledPlugins: () => InstalledPluginsV2;
+    resolveBuiltinToolNames: (o?: {
+        preset?: string;
+        enabledBuiltinTools?: string[];
+        disabledBuiltinTools?: string[];
+    }) => string[];
+}
+export declare class CapabilityService {
+    private readonly deps;
+    constructor(deps: CapabilityServiceDeps);
+    /**
+     * List capability descriptors. With no `cwd` this is the user/global view
+     * (enabled === global baseline). With a `cwd` it's that project's view:
+     * each descriptor gains globalEnabled / projectOverride / effectiveSource
+     * and `enabled` reflects the tri-state overlay (spec §6.1).
+     */
+    list(cwd?: string): CapabilityDescriptor[];
+    /**
+     * Toggle a capability. Default scope is "user" (back-compat: old callers
+     * pass no opts → global write, unchanged). scope:"project" maps on/off to a
+     * tri-state override and writes capabilityOverrides (requires cwd).
+     */
+    setEnabled(id: string, on: boolean, opts?: {
+        scope?: WriteScope;
+        cwd?: string;
+    }): void;
+    /**
+     * Write a project tri-state override. "inherit" deletes the key (we never
+     * persist the literal). All capability kinds — including builtin, which
+     * writes to capabilityOverrides.builtin.<token> — now support project
+     * overrides; only a kind with no bucket (bucketForKind returns undefined)
+     * is rejected.
+     */
+    setOverride(id: string, state: CapabilityOverrideState, opts: {
+        scope: "project";
+        cwd: string;
+    }): void;
+    /** Existing global write path — unchanged behavior, refactored out of setEnabled. */
+    private writeUserScope;
+}

package/dist/capability-control/service.js

@@ -0,0 +1,147 @@
+/**
+ * CapabilityService — the single control-layer entry point.
+ *
+ *  - list(): composes the four projections into one CapabilityDescriptor[].
+ *  - setEnabled(id, on): reads the target descriptor's inlined `control` and
+ *    routes the write to the right settings key. It never branches on `kind`.
+ *
+ * Dependencies are injected (not imported) so the service is unit-testable
+ * without touching disk: the engine / desktop wiring supplies the real
+ * ToolRegistry, SettingsManager, and loaders.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+import { CapabilityNotFoundError } from "./types.js";
+import { projectBuiltin, projectMcp, projectSkills, projectPlugins, projectAgents, } from "./project.js";
+import { applyOverride, bucketForKind, overrideTokenForId, overrideFor, } from "./overlay.js";
+export class CapabilityService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * List capability descriptors. With no `cwd` this is the user/global view
+     * (enabled === global baseline). With a `cwd` it's that project's view:
+     * each descriptor gains globalEnabled / projectOverride / effectiveSource
+     * and `enabled` reflects the tri-state overlay (spec §6.1).
+     */
+    list(cwd) {
+        const s = this.deps.settings.get();
+        const agent = (s.agent ?? {});
+        const tools = this.deps.registry.listToolsDetailed();
+        const preset = agent.preset;
+        const base = [
+            ...projectBuiltin({
+                tools: tools.filter((t) => t.source === "builtin"),
+                presetDefaults: this.deps.resolveBuiltinToolNames({ preset }),
+                effective: this.deps.resolveBuiltinToolNames({
+                    preset,
+                    enabledBuiltinTools: agent.enabledBuiltinTools ?? [],
+                    disabledBuiltinTools: agent.disabledBuiltinTools ?? [],
+                }),
+            }),
+            ...projectMcp({
+                mcpServers: s.mcpServers ?? {},
+                mcpTools: tools.filter((t) => t.source === "mcp"),
+            }),
+            ...projectSkills({
+                skills: this.deps.scanSkills(this.deps.cwd, {}),
+                disabledSkills: s.disabledSkills ?? [],
+            }),
+            ...projectPlugins({
+                installed: this.deps.readInstalledPlugins().plugins,
+                disabledPlugins: s.disabledPlugins ?? [],
+            }),
+            ...projectAgents({
+                agents: this.deps.scanAgents(this.deps.cwd),
+                disabledAgents: s.disabledAgents ?? [],
+            }),
+        ];
+        const overrides = cwd
+            ? this.deps.settings.getForScope("project", cwd).capabilityOverrides
+            : undefined;
+        return base.map((d) => {
+            const globalEnabled = d.enabled;
+            const token = overrideTokenForId(d.id);
+            const ov = cwd ? overrideFor(overrides, d.kind, token) : undefined;
+            const enabled = applyOverride(globalEnabled, ov);
+            return {
+                ...d,
+                enabled,
+                globalEnabled,
+                projectOverride: ov,
+                effectiveSource: ov ? "project" : cwd ? "default" : "user",
+            };
+        });
+    }
+    /**
+     * Toggle a capability. Default scope is "user" (back-compat: old callers
+     * pass no opts → global write, unchanged). scope:"project" maps on/off to a
+     * tri-state override and writes capabilityOverrides (requires cwd).
+     */
+    setEnabled(id, on, opts) {
+        if (opts?.scope === "project") {
+            this.setOverride(id, on ? "on" : "off", {
+                scope: "project",
+                cwd: opts.cwd ?? this.deps.cwd,
+            });
+            return;
+        }
+        this.writeUserScope(id, on);
+    }
+    /**
+     * Write a project tri-state override. "inherit" deletes the key (we never
+     * persist the literal). All capability kinds — including builtin, which
+     * writes to capabilityOverrides.builtin.<token> — now support project
+     * overrides; only a kind with no bucket (bucketForKind returns undefined)
+     * is rejected.
+     */
+    setOverride(id, state, opts) {
+        const descriptor = this.list().find((c) => c.id === id);
+        if (!descriptor)
+            throw new CapabilityNotFoundError(id);
+        const bucket = bucketForKind(descriptor.kind);
+        if (!bucket)
+            throw new Error(`Capability kind '${descriptor.kind}' has no project override`);
+        if (!opts.cwd)
+            throw new Error("project override requires cwd");
+        const token = overrideTokenForId(id);
+        const path = `capabilityOverrides.${bucket}.${token}`;
+        if (state === "inherit")
+            this.deps.settings.deleteProjectSetting(path, opts.cwd);
+        else
+            this.deps.settings.saveProjectSetting(path, state, opts.cwd);
+    }
+    /** Existing global write path — unchanged behavior, refactored out of setEnabled. */
+    writeUserScope(id, on) {
+        const descriptor = this.list().find((c) => c.id === id);
+        if (!descriptor)
+            throw new CapabilityNotFoundError(id);
+        const { settingsKey, mode, token } = descriptor.control;
+        const s = this.deps.settings.get();
+        if (mode === "record-flag") {
+            const servers = { ...(s.mcpServers ?? {}) };
+            // Never conjure a server that was never configured.
+            if (!servers[token])
+                return;
+            servers[token] = { ...servers[token], enabled: on };
+            this.deps.settings.saveUserSetting("mcpServers", servers);
+            return;
+        }
+        const arr = new Set(readArray(s, settingsKey));
+        // denylist: present ⇒ OFF, so we want it present when turning off.
+        const wantPresent = mode === "allowlist" ? on : !on;
+        if (wantPresent)
+            arr.add(token);
+        else
+            arr.delete(token);
+        this.deps.settings.saveUserSetting(settingsKey, [...arr]);
+    }
+}
+/** Read an array at a dotted settings path (e.g. agent.disabledBuiltinTools). */
+function readArray(s, key) {
+    let cur = s;
+    for (const part of key.split("."))
+        cur = cur?.[part];
+    return Array.isArray(cur) ? cur : [];
+}

package/dist/capability-control/types.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Capability-control descriptor types.
+ *
+ * A read-only projection layer over the four extension-capability loaders
+ * (builtin tools, MCP servers, skills, plugins). A CapabilityDescriptor is a
+ * computed view, never a source of truth — the truth stays in the loaders +
+ * settings. Each descriptor carries an inlined `control` describing how to
+ * toggle it, so the switch router never has to branch on `kind`.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+/** A uniform, read-only projection of one extension capability. */
+export interface CapabilityDescriptor {
+    /** Globally unique; the source prefix isolates the namespace. */
+    id: string;
+    kind: "builtin" | "mcp" | "skill" | "plugin" | "agent";
+    /** Display name: builtin=tool, mcp=server, skill=skill, plugin=plugin, agent=role. */
+    name: string;
+    /** One-line description pulled from the underlying metadata. */
+    description: string;
+    /** Computed from preset defaults + the relevant switch config. */
+    enabled: boolean;
+    /** Which settings key the switch writes, and how. */
+    control: CapabilityControl;
+    /** user/global baseline enablement, before any project overlay. */
+    globalEnabled?: boolean;
+    /** Project overlay state in a project-scope view. Absent === inherit. */
+    projectOverride?: "on" | "off";
+    /** Where the effective `enabled` value came from. */
+    effectiveSource?: "user" | "project" | "default";
+    /** Source details for UI grouping / navigation. */
+    origin?: {
+        serverName?: string;
+        pluginName?: string;
+        filePath?: string;
+        toolCount?: number;
+        isReadOnly?: boolean;
+    };
+}
+/** Describes which settings key the switch writes and the write semantics. */
+export interface CapabilityControl {
+    settingsKey: "agent.enabledBuiltinTools" | "agent.disabledBuiltinTools" | "mcpServers" | "disabledSkills" | "disabledPlugins" | "disabledAgents";
+    /**
+     *  - "denylist"    → off = token present in array (disabled*); on = removed
+     *  - "allowlist"   → on  = token present in array (enabled*); off = removed
+     *  - "record-flag" → flip mcpServers[token].enabled
+     */
+    mode: "denylist" | "allowlist" | "record-flag";
+    /** Identifier written into the array, or used as the record key. */
+    token: string;
+}
+export declare class CapabilityNotFoundError extends Error {
+    constructor(id: string);
+}
+/**
+ * Which settings file a capability write targets. Distinct from
+ * SettingsManager's disk-READ scope ("isolated" | "project" | "full"): this is
+ * the WRITE scope — user → global settings, project → capabilityOverrides.
+ */
+export type WriteScope = "user" | "project";
+/** Tri-state project override as seen by callers. */
+export type CapabilityOverrideState = "inherit" | "on" | "off";

package/dist/capability-control/types.js

@@ -0,0 +1,17 @@
+/**
+ * Capability-control descriptor types.
+ *
+ * A read-only projection layer over the four extension-capability loaders
+ * (builtin tools, MCP servers, skills, plugins). A CapabilityDescriptor is a
+ * computed view, never a source of truth — the truth stays in the loaders +
+ * settings. Each descriptor carries an inlined `control` describing how to
+ * toggle it, so the switch router never has to branch on `kind`.
+ *
+ * See docs/superpowers/specs/2026-05-29-capability-control-design.md
+ */
+export class CapabilityNotFoundError extends Error {
+    constructor(id) {
+        super(`Capability not found: ${id}`);
+        this.name = "CapabilityNotFoundError";
+    }
+}

package/dist/cc-orchestrator/agent-adapter.d.ts

@@ -0,0 +1,50 @@
+export type PermissionMode = "default" | "acceptEdits" | "bypassPermissions";
+export interface BuildArgsOpts {
+    prompt: string;
+    resumeSessionId?: string;
+    permissionMode: PermissionMode;
+    cwd: string;
+}
+export interface ParsedResult {
+    sessionId: string;
+    finalText: string;
+    isError: boolean;
+}
+export interface AgentAdapter {
+    /** Display name, e.g. "claude" / "codex". */
+    kind: string;
+    /** Build the CLI argv (command itself excluded). */
+    buildArgs(opts: BuildArgsOpts): string[];
+    /** Reduce collected stream-json output lines to {sessionId, finalText, isError}. */
+    parseResult(lines: string[]): ParsedResult;
+    /**
+     * When true, the prompt is fed over stdin instead of being passed in argv.
+     * claude takes the prompt as `-p <prompt>` (argv) so leaves this unset; codex
+     * `exec` reads the prompt from stdin (its argv ends with a bare `-`).
+     */
+    promptViaStdin?: boolean;
+}
+/**
+ * Soft cost-guard appended to a driven CC's system prompt. Workflow fans out a
+ * fleet of agents and is the main token sink; we ask CC to surface intent and
+ * get a go-ahead before running one, so a human can intervene (rooms) and the
+ * model stays cost-aware even where Workflow isn't hard-disabled. Shared so the
+ * room's resident process can reuse the exact same wording.
+ */
+export declare const CC_COST_GUARD_PROMPT: string;
+export declare const claudeAdapter: AgentAdapter;
+/**
+ * Drives the OpenAI Codex CLI via `codex exec`. Mirrors claudeAdapter but for
+ * codex's different surface:
+ *  - prompt is fed over STDIN (argv ends with a bare `-`), not argv → promptViaStdin
+ *  - permission is a spawn-time SANDBOX choice, not a per-tool approval loop:
+ *      default        → --sandbox read-only      (codex can read, not write)
+ *      acceptEdits    → --sandbox workspace-write (codex can write the workspace)
+ *      bypassPermissions → --dangerously-bypass-approvals-and-sandbox (full auto)
+ *    (Matches the only model codex supports — same choice the `wand` tool makes;
+ *    codex has no `--permission-prompt-tool stdio` equivalent.)
+ *  - JSONL event shape differs: session id is `thread.started`.thread_id, the
+ *    final answer is the last `item.completed` of item.type "agent_message", and
+ *    failure is `turn.failed` / `error` events (no `is_error` flag).
+ */
+export declare const codexAdapter: AgentAdapter;