@cjhyy/code-shell-core 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/tool-system/builtin/image-uploader.d.ts

@@ -0,0 +1,33 @@
+export interface UploaderCreds {
+    baseUrl: string;
+    apiKey: string;
+}
+export type UploadResult = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    error: string;
+};
+export interface ImageUploader {
+    readonly kind: string;
+    /** http/https → unchanged; local path → upload, return public URL. */
+    toUrl(pathOrUrl: string, creds: UploaderCreds, signal?: AbortSignal): Promise<UploadResult>;
+}
+export declare function isHttpUrl(s: string): boolean;
+export declare class FalStorageUploader implements ImageUploader {
+    private readonly fetchImpl;
+    readonly kind = "fal";
+    private static readonly UPLOAD_BASE;
+    constructor(fetchImpl?: typeof fetch);
+    toUrl(pathOrUrl: string, creds: UploaderCreds, signal?: AbortSignal): Promise<UploadResult>;
+    /**
+     * Upload raw bytes to fal storage, return the public URL. Two-step flow
+     * (verified against live API 2026-06-10):
+     *   1. POST {UPLOAD_BASE}/storage/upload/initiate → { file_url, upload_url }
+     *   2. PUT <upload_url> with the bytes (signed URL, no Authorization)
+     *   3. file_url is the final public URL.
+     */
+    private uploadBytes;
+}
+export declare function getImageUploader(kind: string, fetchImpl?: typeof fetch): ImageUploader | null;

package/dist/tool-system/builtin/image-uploader.js

@@ -0,0 +1,74 @@
+/**
+ * ImageUploader — pluggable "local path → public URL" so image-to-video /
+ * reference-to-video can accept local files, not just URLs. fal storage is the
+ * first impl; swapping in another image host = another impl, no provider change.
+ */
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+export function isHttpUrl(s) {
+    return /^https?:\/\//i.test(s);
+}
+function mimeFromName(name) {
+    const ext = name.toLowerCase().split(".").pop() ?? "";
+    const map = { png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", webp: "image/webp", gif: "image/gif" };
+    return map[ext] ?? "application/octet-stream";
+}
+export class FalStorageUploader {
+    fetchImpl;
+    kind = "fal";
+    // fal upload lives on a different host than queue.fal.run.
+    static UPLOAD_BASE = "https://rest.alpha.fal.ai";
+    constructor(fetchImpl = fetch) {
+        this.fetchImpl = fetchImpl;
+    }
+    async toUrl(pathOrUrl, creds, signal) {
+        if (isHttpUrl(pathOrUrl))
+            return { ok: true, url: pathOrUrl };
+        try {
+            const bytes = await readFile(pathOrUrl);
+            const url = await this.uploadBytes(bytes, basename(pathOrUrl), creds, signal);
+            return { ok: true, url };
+        }
+        catch (err) {
+            return { ok: false, error: `fal upload error for ${pathOrUrl}: ${err.message}` };
+        }
+    }
+    /**
+     * Upload raw bytes to fal storage, return the public URL. Two-step flow
+     * (verified against live API 2026-06-10):
+     *   1. POST {UPLOAD_BASE}/storage/upload/initiate → { file_url, upload_url }
+     *   2. PUT <upload_url> with the bytes (signed URL, no Authorization)
+     *   3. file_url is the final public URL.
+     */
+    async uploadBytes(bytes, name, creds, signal) {
+        const mime = mimeFromName(name);
+        const ini = await this.fetchImpl(`${FalStorageUploader.UPLOAD_BASE}/storage/upload/initiate`, {
+            method: "POST",
+            headers: { Authorization: `Key ${creds.apiKey}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ content_type: mime, file_name: name }),
+            signal,
+        });
+        if (!ini.ok)
+            throw new Error(`initiate failed: HTTP ${ini.status}`);
+        const { file_url, upload_url } = (await ini.json());
+        if (!file_url || !upload_url)
+            throw new Error("initiate: missing file_url/upload_url");
+        const put = await this.fetchImpl(upload_url, {
+            method: "PUT",
+            headers: { "Content-Type": mime },
+            body: bytes,
+            signal,
+        });
+        if (!put.ok)
+            throw new Error(`upload PUT failed: HTTP ${put.status}`);
+        return file_url;
+    }
+}
+export function getImageUploader(kind, fetchImpl = fetch) {
+    switch (kind) {
+        case "fal":
+            return new FalStorageUploader(fetchImpl);
+        default:
+            return null;
+    }
+}

package/dist/tool-system/builtin/index.d.ts

@@ -12,9 +12,32 @@ import type { RegisteredTool } from "../../types.js";
  * ctx is optional in the signature so legacy call sites (and tests) that
  * pass only args still type-check; ToolRegistry always passes ctx at runtime.
  */
-export type BuiltinToolFn = (args: Record<string, unknown>, ctx?: import("../context.js").ToolContext) => Promise<string>;
+/**
+ * 内置工具返回值:大多数返回纯文本字符串。需要回传图片(或其它结构化
+ * 内容块)的工具(view_image)可改为返回 `{ contentBlocks }`;此时
+ * registry 会把它放进 ToolResult.contentBlocks。可选的 `result` 字段是给
+ * transcript / 摘要用的纯文本镜像。沙箱执行类工具(Bash 等)可返回
+ * `{ result, sandbox }`,registry 把 sandbox 透传到 ToolResult.sandbox 供 UI 显示。
+ */
+export type BuiltinToolResult = string | {
+    contentBlocks: import("../../types.js").ContentBlock[];
+    result?: string;
+} | {
+    result: string;
+    sandbox: import("../../types.js").ToolResult["sandbox"];
+};
+export type BuiltinToolFn = (args: Record<string, unknown>, ctx?: import("../context.js").ToolContext) => Promise<BuiltinToolResult>;
 export interface BuiltinTool {
     definition: RegisteredTool;
     execute: BuiltinToolFn;
 }
 export declare const BUILTIN_TOOLS: BuiltinTool[];
+/**
+ * Per-tool availability predicates. A tool listed here is filtered OUT of the
+ * exposed toolDefs when its predicate returns false for the active cwd (see
+ * engine.ts toolDefs assembly). Tools NOT listed here are always visible.
+ * Keyed by the tool's `name` (must match the toolDef name).
+ */
+export declare const BUILTIN_TOOL_GUARDS: Map<string, (cwd: string) => boolean>;
+/** UseCredential is available when the cwd's CredentialStore has ≥1 credential. */
+export declare function isUseCredentialAvailable(cwd: string): boolean;

package/dist/tool-system/builtin/index.js

@@ -3,33 +3,45 @@
  */
 import { readToolDef, readTool } from "./read.js";
 import { writeToolDef, writeTool } from "./write.js";
+import { generateImageToolDef, generateImageTool, isGenerateImageAvailable } from "./generate-image.js";
+import { editModelCatalogToolDef, editModelCatalogTool } from "./edit-model-catalog.js";
+import { generateVideoToolDef, generateVideoTool, isGenerateVideoAvailable } from "./generate-video.js";
+import { viewImageToolDef, viewImageTool } from "./view-image.js";
 import { editToolDef, editTool } from "./edit.js";
 import { applyPatchToolDef, applyPatchTool } from "./apply-patch/index.js";
 import { globToolDef, globTool } from "./glob.js";
 import { grepToolDef, grepTool } from "./grep.js";
 import { bashToolDef, bashTool } from "./bash.js";
-import { webSearchToolDef, webSearchTool } from "./web-search.js";
+import { webSearchToolDef, webSearchTool, isWebSearchAvailable } from "./web-search.js";
 import { webFetchToolDef, webFetchTool } from "./web-fetch.js";
 import { askUserToolDef, askUserTool } from "./ask-user.js";
-import { agentToolDef, agentTool, agentStatusToolDef, agentStatusTool, agentCancelToolDef, agentCancelTool, } from "./agent.js";
+import { agentToolDef, agentTool, agentStatusToolDef, agentStatusTool, agentCancelToolDef, agentCancelTool, agentSendInputToolDef, agentSendInputTool, } from "./agent.js";
 import { enterPlanModeToolDef, enterPlanModeTool, exitPlanModeToolDef, exitPlanModeTool } from "./plan.js";
 import { toolSearchToolDef, toolSearchTool } from "./tool-search.js";
 import { todoWriteToolDef, todoWriteTool } from "./task.js";
 import { enterWorktreeToolDef, enterWorktreeTool, exitWorktreeToolDef, exitWorktreeTool } from "./worktree.js";
-import { sendMessageToolDef, sendMessageTool } from "./send-message.js";
 import { sleepToolDef, sleepTool } from "./sleep.js";
 import { configToolDef, configTool } from "./config.js";
 import { notebookEditToolDef, notebookEditTool } from "./notebook-edit.js";
 import { lspToolDef, lspTool } from "./lsp.js";
 import { cronCreateToolDef, cronCreateTool, cronDeleteToolDef, cronDeleteTool, cronListToolDef, cronListTool } from "./cron.js";
+import { driveClaudeCodeToolDef, driveClaudeCodeTool, driveAgentToolDef, driveAgentTool } from "./drive-claude-code.js";
+import { checkQuotaToolDef, checkQuotaTool } from "./check-quota.js";
 import { skillToolDef, skillTool } from "./skill.js";
 import { mcpToolDef, mcpToolExecute, listMcpResourcesToolDef, listMcpResourcesTool, readMcpResourceToolDef, readMcpResourceTool } from "./mcp-tools.js";
-import { remoteTriggerToolDef, remoteTriggerTool } from "./remote-trigger.js";
 import { replToolDef, replTool } from "./repl.js";
 import { briefToolDef, briefTool } from "./brief.js";
 import { powershellToolDef, powershellTool } from "./powershell.js";
 import { arenaToolDef, arenaTool } from "./arena.js";
 import { memoryListToolDef, memoryListTool, memoryReadToolDef, memoryReadTool, memorySaveToolDef, memorySaveTool, memoryDeleteToolDef, memoryDeleteTool, } from "./memory.js";
+import { completeGoalToolDef, completeGoalTool } from "./complete-goal.js";
+import { cancelGoalToolDef, cancelGoalTool } from "./cancel-goal.js";
+import { addMarketplaceToolDef, addMarketplaceTool } from "./add-marketplace.js";
+import { bashOutputToolDef, bashOutputTool, killShellToolDef, killShellTool, listShellsToolDef, listShellsTool, } from "./background-shell-tools.js";
+import { browserObserveToolDef, browserObserveTool, browserActToolDef, browserActTool, browserNavigateToolDef, browserNavigateTool, } from "./browser-tools.js";
+import { useCredentialToolDef, useCredentialTool } from "../../credentials/use-credential-tool.js";
+import { injectCredentialToolDef, injectCredentialTool, isInjectCredentialAvailable, } from "../../credentials/inject-credential-tool.js";
+import { CredentialStore } from "../../credentials/store.js";
 export const BUILTIN_TOOLS = [
     {
         definition: {
@@ -38,6 +50,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
         },
         execute: readTool,
     },
@@ -48,9 +61,69 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: writeTool,
     },
+    {
+        definition: {
+            ...editModelCatalogToolDef,
+            source: "builtin",
+            permissionDefault: "ask", // writes user config — confirm before each write
+            isReadOnly: false,
+            isConcurrencySafe: false, // serializes writes to the single catalog file
+        },
+        execute: editModelCatalogTool,
+    },
+    {
+        definition: {
+            ...generateImageToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            // Independent external I/O with no shared state — same class as WebFetch/GenerateVideo.
+            // Each call writes its own collision-free file (Date.now()+random suffix), so N images
+            // in one turn run concurrently (~3min for 6 instead of ~15min serial). Dependent chains
+            // (image → video) are forced across turns and serialize naturally via the drain barrier.
+            isConcurrencySafe: true,
+            timeoutMs: 600_000, // 10min — high-quality / large image generation routinely exceeds the 120s default; give slow renders ample room while still bounding a hung request (Stop / ctx.signal cancels sooner)
+            // `referenceImages` are local files read off disk and shipped to the
+            // provider — gate them through the path-policy layer like Read, so an
+            // out-of-workspace ref ("../../etc/passwd") prompts for approval instead
+            // of silently leaking. (array arg → executor enforces each element)
+            pathPolicy: [{ kind: "arg", arg: "referenceImages", operation: "read" }],
+        },
+        execute: generateImageTool,
+    },
+    {
+        definition: {
+            ...generateVideoToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: true,
+            // Returns fast (fire-and-forget: submits + backgrounds the poll loop),
+            // so the default timeout is plenty — the long poll runs detached.
+            // `images`/`image` may be local files (uploaded to the provider) — same
+            // path-policy gating as GenerateImage's referenceImages.
+            pathPolicy: [
+                { kind: "arg", arg: "images", operation: "read" },
+                { kind: "arg", arg: "image", operation: "read" },
+            ],
+        },
+        execute: generateVideoTool,
+    },
+    {
+        definition: {
+            ...viewImageToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read" }],
+        },
+        execute: viewImageTool,
+    },
     {
         definition: {
             ...editToolDef,
@@ -58,6 +131,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: editTool,
     },
@@ -68,6 +142,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "apply_patch", arg: "patch", operation: "write" }],
         },
         execute: applyPatchTool,
     },
@@ -78,6 +153,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read", defaultToCwd: true }],
         },
         execute: globTool,
     },
@@ -88,6 +164,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read", defaultToCwd: true }],
         },
         execute: grepTool,
     },
@@ -102,6 +179,37 @@ export const BUILTIN_TOOLS = [
         },
         execute: bashTool,
     },
+    // ─── Background shells (Bash run_in_background companions) ──────
+    {
+        definition: {
+            ...bashOutputToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: bashOutputTool,
+    },
+    {
+        definition: {
+            ...killShellToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: killShellTool,
+    },
+    {
+        definition: {
+            ...listShellsToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: listShellsTool,
+    },
     {
         definition: {
             ...webSearchToolDef,
@@ -164,6 +272,17 @@ export const BUILTIN_TOOLS = [
         },
         execute: agentCancelTool,
     },
+    {
+        definition: {
+            ...agentSendInputToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+            timeoutMs: 1_800_000, // 30min — a continuation may execute many tool calls, like Agent
+        },
+        execute: agentSendInputTool,
+    },
     {
         definition: {
             ...enterPlanModeToolDef,
@@ -225,16 +344,6 @@ export const BUILTIN_TOOLS = [
         },
         execute: exitWorktreeTool,
     },
-    {
-        definition: {
-            ...sendMessageToolDef,
-            source: "builtin",
-            permissionDefault: "allow",
-            isReadOnly: false,
-            isConcurrencySafe: true,
-        },
-        execute: sendMessageTool,
-    },
     // ─── Phase 5: Utility Tools ────────────────────────────────────
     {
         definition: {
@@ -263,6 +372,13 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [
+                {
+                    kind: "arg",
+                    arg: "file_path",
+                    operation: { fromArg: "action", readValues: ["read"], default: "write" },
+                },
+            ],
         },
         execute: notebookEditTool,
     },
@@ -274,6 +390,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
         },
         execute: lspTool,
     },
@@ -308,6 +425,43 @@ export const BUILTIN_TOOLS = [
         },
         execute: cronListTool,
     },
+    // ─── Drive external coding-agent CLI (claude / codex) ──────────
+    {
+        definition: {
+            ...driveAgentToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: driveAgentTool,
+    },
+    // Back-compat alias: DriveClaudeCode = DriveAgent pinned to cli:claude. Kept
+    // registered so old prompts/memories that name DriveClaudeCode still resolve.
+    {
+        definition: {
+            ...driveClaudeCodeToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: driveClaudeCodeTool,
+    },
+    // ─── Check remaining CC/Codex subscription quota ──────────────
+    {
+        definition: {
+            ...checkQuotaToolDef,
+            source: "builtin",
+            // Read-only intent (reports quota, mutates nothing). Note: the "claude"
+            // path sends a 1-token probe (Anthropic exposes quota only via response
+            // headers) — that tiny cost is documented in the tool description.
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: checkQuotaTool,
+    },
     // ─── Phase 7: Missing tools from restored-src ─────────────────
     {
         definition: {
@@ -343,22 +497,17 @@ export const BUILTIN_TOOLS = [
         definition: {
             ...readMcpResourceToolDef,
             source: "builtin",
-            permissionDefault: "allow",
+            // Reading resource CONTENT (unlike enumerating names) can pull arbitrary
+            // data — potentially secrets — from a connected MCP server. Default to ask
+            // rather than the old unconditional allow so a default-mode session
+            // confirms the read; the executor also gates the target server against the
+            // session's allowedMcpServers.
+            permissionDefault: "ask",
             isReadOnly: true,
             isConcurrencySafe: true,
         },
         execute: readMcpResourceTool,
     },
-    {
-        definition: {
-            ...remoteTriggerToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: remoteTriggerTool,
-    },
     {
         definition: {
             ...replToolDef,
@@ -446,4 +595,140 @@ export const BUILTIN_TOOLS = [
         },
         execute: memoryDeleteTool,
     },
+    // ─── Goal mode: model-declared completion ──────────────────────
+    // Lets the model explicitly declare the active goal complete. The
+    // turn-loop short-circuits on this call; the tool itself only records an
+    // acknowledgement string, so it's read-only and concurrency-safe.
+    {
+        definition: {
+            ...completeGoalToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: completeGoalTool,
+    },
+    // ─── Goal mode: user-initiated cancellation ────────────────────
+    // Distinct from complete_goal — the user explicitly asked to abandon the
+    // goal. The turn-loop short-circuits on this call (only when confirm===true)
+    // AND clears the persisted goal. The tool itself only records an
+    // acknowledgement string, so it's read-only and concurrency-safe.
+    {
+        definition: {
+            ...cancelGoalToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: cancelGoalTool,
+    },
+    // ─── Plugin marketplace: model-driven source registration ──────
+    {
+        definition: {
+            ...addMarketplaceToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+            timeoutMs: 120_000, // git clone over network
+        },
+        execute: addMarketplaceTool,
+    },
+    // Browser automation — 3 semantic tools driving the in-app webview via the
+    // BrowserBridge (CDP). All serial on one webview (isConcurrencySafe:false).
+    // browser_observe is read-only. browser_act is permissionDefault "allow"; its
+    // sensitive actions (click/type/select) are escalated to "ask" by a preset
+    // PermissionRule keyed on argsPattern { action } (see preset/index.ts §4.6) —
+    // so one tool carries per-action gating. Sensitive-action + domain-whitelist
+    // enforcement also lives main-side in the bridge. Tools self-gate to
+    // unavailable when no bridge is wired (headless).
+    {
+        definition: {
+            ...browserObserveToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: false,
+            timeoutMs: 30_000, // wait/observe can sit through a load; RPC headroom
+        },
+        execute: browserObserveTool,
+    },
+    {
+        definition: {
+            ...browserActToolDef,
+            source: "builtin",
+            permissionDefault: "allow", // per-action gating via preset rule (argsPattern.action)
+            isReadOnly: false,
+            isConcurrencySafe: false,
+            timeoutMs: 30_000, // the wait action internally bounds; give RPC headroom
+        },
+        execute: browserActTool,
+    },
+    {
+        definition: {
+            ...browserNavigateToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: browserNavigateTool,
+    },
+    // ─── Credentials: AI 取用已存凭证(token/link/cookie) ──────────
+    // permissionDefault:"allow" —— 取用审批由工具内部的 CredentialUseGate 负责
+    // (默认问/本会话记住/全自动),不走工具级权限层,避免双重弹窗。
+    // 读取凭证库本身不写文件(cookie 物化成临时 cookies.txt 是用完即弃的副产物)。
+    {
+        definition: {
+            ...useCredentialToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: useCredentialTool,
+    },
+    // InjectCredential:把 cookie 凭证注入内置浏览器(恢复登录态)。审批由工具内部
+    // CredentialUseGate 负责(逐条 autoInjectByAI),故 permissionDefault:"allow"。
+    // 改浏览器登录态有副作用 → 非 read-only。
+    {
+        definition: {
+            ...injectCredentialToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: injectCredentialTool,
+    },
 ];
+/**
+ * Per-tool availability predicates. A tool listed here is filtered OUT of the
+ * exposed toolDefs when its predicate returns false for the active cwd (see
+ * engine.ts toolDefs assembly). Tools NOT listed here are always visible.
+ * Keyed by the tool's `name` (must match the toolDef name).
+ */
+export const BUILTIN_TOOL_GUARDS = new Map([
+    [webSearchToolDef.name, isWebSearchAvailable],
+    [generateImageToolDef.name, isGenerateImageAvailable],
+    [generateVideoToolDef.name, isGenerateVideoAvailable],
+    // UseCredential is hidden until at least one credential exists — keeps it out
+    // of the tool list (and the context) for the common no-credentials case,
+    // matching the spec's "quiet when empty" intent (true ToolSearch-deferral for
+    // builtins isn't wired in the engine).
+    [useCredentialToolDef.name, isUseCredentialAvailable],
+    // InjectCredential hidden until ≥1 cookie credential exists (browser injection
+    // is cookie-only). Also degrades at call time if no browser bridge is wired.
+    [injectCredentialToolDef.name, isInjectCredentialAvailable],
+]);
+/** UseCredential is available when the cwd's CredentialStore has ≥1 credential. */
+export function isUseCredentialAvailable(cwd) {
+    try {
+        return new CredentialStore(cwd).listMasked().length > 0;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/tool-system/builtin/mcp-tools.js

@@ -28,10 +28,13 @@ export async function mcpToolExecute(args) {
     const server = args.server;
     const tool = args.tool;
     const toolArgs = args.arguments ?? {};
+    // Forward the run's abort signal (registry injects __signal) so Stop cancels
+    // an in-flight MCP call instead of waiting out the SDK's default timeout.
+    const signal = args.__signal;
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const result = await manager.callTool(server, tool, toolArgs);
+        const result = await manager.callTool(server, tool, toolArgs, signal);
         return typeof result === "string" ? result : JSON.stringify(result, null, 2);
     }
     catch (err) {
@@ -54,10 +57,26 @@ export const listMcpResourcesToolDef = {
 };
 export async function listMcpResourcesTool(args) {
     const server = args.server ?? "";
+    // The executor injects the session's allowed-server set (see executor.ts).
+    // When no explicit server filter is given, we must only enumerate resources
+    // from servers THIS session enabled — otherwise a shared worker leaks another
+    // session's MCP resources. An undefined set means "no gating" (legacy/sub-agent).
+    const allowed = args.__allowedMcpServers;
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const resources = await manager.listResources(server || undefined);
+        // Forward the run's abort signal (registry injects __signal) so Stop cancels
+        // promptly instead of waiting out the SDK's default request timeout.
+        const signal = args.__signal;
+        let resources = await manager.listResources(server || undefined, signal);
+        if (allowed && resources) {
+            resources = resources.filter((r) => {
+                // Resource entries may carry the owning server on `serverName`/`server`;
+                // when unknown, drop it under gating rather than risk a cross-session leak.
+                const owner = (r.serverName ?? r.server);
+                return owner ? allowed.has(owner) : false;
+            });
+        }
         if (!resources || resources.length === 0) {
             return "No MCP resources available.";
         }
@@ -93,7 +112,8 @@ export async function readMcpResourceTool(args) {
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const content = await manager.readResource(server, uri);
+        const signal = args.__signal;
+        const content = await manager.readResource(server, uri, signal);
         return typeof content === "string" ? content : JSON.stringify(content, null, 2);
     }
     catch (err) {