@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.10

package/dist/tool-system/executor.js

@@ -2,10 +2,18 @@
  * Tool executor — orchestrates permission checks, hooks, and execution.
  */
 import { setMaxListeners } from "node:events";
+import { resolve as resolvePath, isAbsolute as isAbsolutePath } from "node:path";
+import { classifyBashCommand } from "./permission.js";
+import { ToolNotFoundError } from "../exceptions.js";
 import { logger as rootLogger, getCurrentSid } from "../logging/logger.js";
 import { recordToolCall, recordToolResult } from "../logging/session-recorder.js";
 import { validateToolArgs } from "./validation.js";
 import { PLAN_MODE_ALLOWED_TOOLS } from "./plan-mode-allowlist.js";
+import { enforcePathPolicyWithApproval } from "./path-policy.js";
+import { parsePatch } from "./builtin/apply-patch/parser.js";
+import { BUILTIN_TOOL_GUARDS } from "./builtin/index.js";
+import { COMPLETE_GOAL_TOOL_NAME } from "./builtin/complete-goal.js";
+import { CANCEL_GOAL_TOOL_NAME } from "./builtin/cancel-goal.js";
 // A1 hardening: hooks must never promote a non-`allow` classifier
 // decision to `allow`. They may otherwise adjust the decision freely
 // (e.g. tighten `allow` to `deny`/`ask`, or relax `deny` to `ask` to
@@ -114,22 +122,95 @@ export class ToolExecutor {
                 isError: true,
             };
         }
-        // 0. Plan mode: only allow read-only tools — no file writes at all
-        if (this.toolCtx?.planMode) {
-            // Shared with engine.ts's tool-visibility filter so the set the model
-            // SEES and the set the executor RUNS can't drift (they had).
-            if (!PLAN_MODE_ALLOWED_TOOLS.has(call.toolName)) {
-                if (call.toolName === "Bash" && this.isReadOnlyBashCommand(call.args)) {
-                    // Read-only bash is fine
+        if ((call.toolName === COMPLETE_GOAL_TOOL_NAME || call.toolName === CANCEL_GOAL_TOOL_NAME) &&
+            this.toolCtx?.toolVisibility?.hasGoal !== true) {
+            return {
+                id: call.id,
+                toolName: call.toolName,
+                error: `Tool ${call.toolName} is only available while an active goal is present. Do NOT retry this tool call unless a goal is active.`,
+                isError: true,
+            };
+        }
+        const visibilityGuard = BUILTIN_TOOL_GUARDS.get(call.toolName);
+        if (visibilityGuard && this.toolCtx?.toolVisibility && !visibilityGuard(this.toolCtx.toolVisibility)) {
+            return {
+                id: call.id,
+                toolName: call.toolName,
+                error: `Tool ${call.toolName} is not available in the current session context. Do NOT retry this tool call unless the relevant context changes.`,
+                isError: true,
+            };
+        }
+        // Same gate for MCP tools: the registry is worker-shared, so it can hold
+        // tools from servers OTHER sessions enabled. Visibility filtering hides
+        // them from this session's tool list; this rejects a direct call anyway.
+        if (this.toolCtx?.allowedMcpServers) {
+            const allowed = this.toolCtx.allowedMcpServers;
+            const reg = this.registry.getTool(call.toolName);
+            if (reg?.source === "mcp" && !allowed.has(reg.serverName ?? "")) {
+                return {
+                    id: call.id,
+                    toolName: call.toolName,
+                    error: `Tool ${call.toolName} belongs to an MCP server that is not enabled for this project. Do NOT retry this tool call.`,
+                    isError: true,
+                };
+            }
+            // The generic MCP builtins (MCPTool / ReadMcpResource) take the target
+            // server as an ARGUMENT and call MCPManager directly, so the source==="mcp"
+            // check above can't see them — without this a session could invoke a tool
+            // or read a resource on a server only ANOTHER session enabled. Gate on the
+            // server arg. ListMcpResources has an optional server filter and would
+            // otherwise enumerate every connected server's resources, so we inject the
+            // allowlist for it to filter by (see mcp-tools.ts).
+            if (call.toolName === "MCPTool" || call.toolName === "ReadMcpResource") {
+                const server = String(call.args.server ?? "");
+                if (!allowed.has(server)) {
+                    return {
+                        id: call.id,
+                        toolName: call.toolName,
+                        error: `MCP server "${server}" is not enabled for this project. Do NOT retry this tool call.`,
+                        isError: true,
+                    };
                 }
-                else {
+            }
+            else if (call.toolName === "ListMcpResources") {
+                const server = String(call.args.server ?? "");
+                if (server && !allowed.has(server)) {
                     return {
                         id: call.id,
                         toolName: call.toolName,
-                        error: `Plan mode: ${call.toolName} is blocked. Only read-only tools (Read, Glob, Grep, WebSearch, WebFetch, Bash read-only) are allowed. You MUST output your plan as text in the conversation instead. Do NOT retry this tool call.`,
+                        error: `MCP server "${server}" is not enabled for this project. Do NOT retry this tool call.`,
                         isError: true,
                     };
                 }
+                call.args.__allowedMcpServers = allowed;
+            }
+        }
+        // 0. Plan mode: only allow read-only tools — no file writes at all
+        if (this.toolCtx?.planMode) {
+            // Shared with engine.ts's tool-visibility filter so the set the model
+            // SEES and the set the executor RUNS can't drift (they had).
+            // Bash is in the allow-list so the model can SEE it for read-only probing,
+            // but membership alone must NOT grant write access: a Bash command that
+            // modifies files (echo >, sed -i, mv, ...) has to be blocked here too, or it
+            // would slip past plan mode into the normal permission flow (where the user
+            // could approve it) AND leave no diff, since it never touches Write/Edit.
+            const allowed = PLAN_MODE_ALLOWED_TOOLS.has(call.toolName);
+            // Defer to the canonical shell classifier (the same one the permission
+            // flow uses) instead of a second hand-rolled allowlist that drifted and
+            // let find -delete / awk system() / process substitution / git difftool
+            // through. Plan mode is strictly read-only, so ONLY "safe-read" passes —
+            // safe-write (mkdir/touch/cp), unsafe, and dangerous are all blocked.
+            const bashWrite = call.toolName === "Bash" &&
+                classifyBashCommand(String(call.args.command ?? "")) !== "safe-read";
+            if (!allowed || bashWrite) {
+                return {
+                    id: call.id,
+                    toolName: call.toolName,
+                    error: allowed && bashWrite
+                        ? `Plan mode is read-only: this Bash command writes or modifies files, which is not allowed while planning. To carry it out, first call ExitPlanMode (after the user approves your plan), then run it. Do NOT retry this command in plan mode.`
+                        : `Plan mode: ${call.toolName} is blocked. Only read-only tools (Read, Glob, Grep, WebSearch, WebFetch, Bash read-only) are allowed. You MUST output your plan as text in the conversation instead. Do NOT retry this tool call.`,
+                    isError: true,
+                };
             }
         }
         // 0.5. Validate tool args
@@ -182,6 +263,19 @@ export class ToolExecutor {
                 toolCallId: call.id,
             });
         }
+        // 0.65. Centralized file path policy. Tool handlers declare their file
+        // path surface on RegisteredTool.pathPolicy; the executor enforces it
+        // after hooks have had a chance to rewrite args, but before permission
+        // classification or the handler can touch the filesystem.
+        const pathPolicyError = await this.enforceDeclaredPathPolicy(toolDef, call.args);
+        if (pathPolicyError) {
+            return {
+                id: call.id,
+                toolName: call.toolName,
+                error: pathPolicyError,
+                isError: true,
+            };
+        }
         // A1 hardening: pre_tool_use can no longer pre-approve a tool via
         // `decision === "allow"`. Hooks may relax `allow` and may force
         // `ask`/`deny`, but they cannot promote a `deny`/`ask` decision to
@@ -201,7 +295,7 @@ export class ToolExecutor {
         // the hook and the user together have decided.
         if (hookResult.decision === "ask") {
             const reason = hookResult.messages?.join("\n") ?? undefined;
-            const approved = await this.permission.handleAsk(call.toolName, call.args, reason);
+            const approved = await this.permission.handleAsk(call.toolName, call.args, reason, { sessionId: this.toolCtx?.sessionId });
             if (!approved) {
                 return {
                     id: call.id,
@@ -274,7 +368,9 @@ export class ToolExecutor {
             }
             if (decision === "ask") {
                 const reason = permHook.messages?.join("\n");
-                const approved = await this.permission.handleAsk(call.toolName, call.args, reason);
+                const approved = await this.permission.handleAsk(call.toolName, call.args, reason, {
+                    sessionId: this.toolCtx?.sessionId,
+                });
                 if (!approved) {
                     return {
                         id: call.id,
@@ -321,6 +417,18 @@ export class ToolExecutor {
                 durationMs: Date.now() - toolStartedAt,
                 error: err instanceof Error ? err.stack ?? err.message : String(err),
             });
+            // A model calling a tool that isn't in the registry (hallucinated name,
+            // or a builtin missing from the active preset's whitelist) must not kill
+            // the turn. Feed it back as a normal tool error so the model can retry
+            // or pick a different tool — same path as permission denials above.
+            if (err instanceof ToolNotFoundError) {
+                return {
+                    id: call.id,
+                    toolName: call.toolName,
+                    error: `Tool not found: ${call.toolName}. It is not available in this session — do not call it again; use a different tool.`,
+                    isError: true,
+                };
+            }
             throw err;
         }
         result.id = call.id;
@@ -386,86 +494,85 @@ export class ToolExecutor {
         }
         return result;
     }
-    isReadOnlyBashCommand(args) {
-        const cmd = String(args.command ?? "").trim();
-        // Reject shell metacharacters that could chain a write command after a
-        // read-only prefix: ; && || ` $(...) redirections. A single pipe (|) is
-        // still allowed — the per-part whitelist further down validates it.
-        const DANGEROUS = /;|&&|\|\||`|\$\(|>/;
-        if (DANGEROUS.test(cmd))
-            return false;
-        // Extract the base command (first word, ignoring env vars like VAR=val)
-        const baseCmd = cmd.replace(/^(\w+=\S+\s+)*/, "").split(/\s/)[0];
-        const readOnlyCommands = new Set([
-            "ls",
-            "find",
-            "cat",
-            "head",
-            "tail",
-            "wc",
-            "file",
-            "stat",
-            "tree",
-            "du",
-            "df",
-            "pwd",
-            "echo",
-            "which",
-            "type",
-            "env",
-            "printenv",
-            "grep",
-            "rg",
-            "ag",
-            "awk",
-            "less",
-            "more",
-            "sort",
-            "uniq",
-            "diff",
-            "readlink",
-            "realpath",
-            "basename",
-            "dirname",
-            "date",
-            "whoami",
-            "uname",
-            "hostname",
-            "id",
-            "groups",
-            "locale",
-            "uptime",
-        ]);
-        // Whitelisted read-only git/tool subcommands.
-        // Deliberately exclude `node -e`, `python -c`, `sed -n`, etc. — those can
-        // execute arbitrary code even though they "look read-only".
-        const readOnlyPrefixes = [
-            "git log",
-            "git status",
-            "git diff",
-            "git branch",
-            "git show",
-            "git blame",
-            "git remote",
-            "git tag",
-            "git stash list",
-            "git rev-parse",
-            "npx tsc --noEmit",
-        ];
-        if (readOnlyCommands.has(baseCmd))
-            return true;
-        if (readOnlyPrefixes.some((p) => cmd.startsWith(p)))
-            return true;
-        // Allow piped commands if all parts are read-only. Redirections were
-        // already rejected above, so a bare `|` here is a real pipeline.
-        if (cmd.includes("|")) {
-            const parts = cmd.split("|").map((p) => p.trim());
-            return parts.every((part) => {
-                const partBase = part.replace(/^(\w+=\S+\s+)*/, "").split(/\s/)[0];
-                return readOnlyCommands.has(partBase);
-            });
+    resolvePolicyOperation(op, args) {
+        if (op === "read" || op === "write")
+            return op;
+        const raw = args[op.fromArg];
+        const value = typeof raw === "string" ? raw : String(raw ?? "");
+        if (op.readValues?.includes(value))
+            return "read";
+        if (op.writeValues?.includes(value))
+            return "write";
+        return op.default;
+    }
+    async enforceDeclaredPathPolicy(tool, args) {
+        const policies = tool?.pathPolicy;
+        if (!policies?.length)
+            return null;
+        for (const policy of policies) {
+            const targets = this.resolvePathPolicyTargets(policy, args);
+            if (typeof targets === "string")
+                return targets;
+            const operation = this.resolvePolicyOperation(policy.operation, args);
+            for (const target of targets) {
+                const blocked = await enforcePathPolicyWithApproval(target, operation, this.toolCtx);
+                if (blocked)
+                    return blocked;
+            }
+        }
+        return null;
+    }
+    resolvePathPolicyTargets(policy, args) {
+        if (policy.kind === "arg") {
+            const raw = args[policy.arg];
+            if (typeof raw === "string" && raw.length > 0) {
+                // Resolve a RELATIVE single-string path arg against ctx.cwd before
+                // classification, mirroring the array branch below and the apply_patch
+                // branch — otherwise classifyPath's process.cwd()-based resolution
+                // mis-places an in-workspace relative path (e.g. Read "src/x.ts") as
+                // "outside workspace" and over-prompts. Absolute paths pass through.
+                const cwd = this.toolCtx?.cwd ?? process.cwd();
+                return [isAbsolutePath(raw) ? raw : resolvePath(cwd, raw)];
+            }
+            // Array path args (e.g. GenerateImage `referenceImages`, GenerateVideo
+            // `images`): enforce EVERY element. Without this an array yielded zero
+            // targets, so out-of-workspace reads bypassed the path-policy "ask" gate
+            // that Read/Write enforce. http(s) URLs aren't file reads → skip them.
+            // Relative paths resolve against ctx.cwd (the workspace) before
+            // classification, like the apply_patch branch — otherwise classifyPath's
+            // process.cwd()-based resolution would mis-place an in-workspace relative
+            // path as "outside" and over-prompt. Non-string / empty elements skipped.
+            if (Array.isArray(raw)) {
+                const cwd = this.toolCtx?.cwd ?? process.cwd();
+                const paths = raw
+                    .filter((v) => typeof v === "string" && v.length > 0)
+                    .filter((v) => !/^https?:\/\//i.test(v))
+                    .map((v) => (isAbsolutePath(v) ? v : resolvePath(cwd, v)));
+                if (paths.length > 0)
+                    return paths;
+            }
+            if (policy.defaultToCwd && this.toolCtx?.cwd)
+                return [this.toolCtx.cwd];
+            return [];
+        }
+        const rawPatch = args[policy.arg];
+        if (typeof rawPatch !== "string" || rawPatch.length === 0)
+            return [];
+        try {
+            const parsed = parsePatch(rawPatch, "lenient");
+            const cwd = this.toolCtx?.cwd ?? process.cwd();
+            const targets = [];
+            for (const hunk of parsed.hunks) {
+                targets.push(resolvePath(cwd, hunk.path));
+                if (hunk.kind === "update" && hunk.movePath) {
+                    targets.push(resolvePath(cwd, hunk.movePath));
+                }
+            }
+            return targets;
+        }
+        catch (err) {
+            return `Error: ${err.message}`;
         }
-        return false;
     }
     /**
      * Convert tool results into Message entries for the transcript.

package/dist/tool-system/investigation-guard.js

@@ -16,7 +16,7 @@
  *
  * Everything decays naturally on any write/Bash/AskUser tool (state reset).
  */
-const READ_ONLY_TOOLS = new Set(["Read", "Grep", "Glob", "WebFetch", "WebSearch", "ToolSearch"]);
+import { READ_ONLY_TOOLS } from "./plan-mode-allowlist.js";
 const READ_BUDGET = 3;
 const SILENT_TURN_BUDGET = 3;
 const DEDUPE_OFFSET_BUCKET = 50;

package/dist/tool-system/mcp-manager.d.ts

@@ -6,6 +6,36 @@
 import type { Tool as McpTool } from "@modelcontextprotocol/sdk/types.js";
 import type { MCPServerConfig, RegisteredTool } from "../types.js";
 import { ToolRegistry } from "./registry.js";
+/**
+ * Read a required secret from `process.env` by NAME (Codex-style env-secret
+ * handling — the value is never persisted in MCP config). A referenced env var
+ * that is undefined OR empty string is treated as missing so the connection
+ * fails with a clear, actionable error naming the server, the config field,
+ * and the env var.
+ */
+export declare function readRequiredEnv(serverName: string, field: string, envName: string): string;
+/**
+ * Build the spawned stdio server's environment. Priority (lowest → highest):
+ * a minimal inherited allowlist < forwarded `envVars` (read from process.env by
+ * name) < explicit plaintext `config.env`. Returns `undefined` when neither
+ * `env` nor `envVars` is present, preserving the old "inherit nothing extra"
+ * behavior (transport gets `env: undefined`). Pure + exported for unit testing.
+ */
+export declare function buildStdioEnv(serverName: string, config: MCPServerConfig): Record<string, string> | undefined;
+/**
+ * Build the HTTP transport's request headers. Static `config.headers` form the
+ * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
+ * and win on conflict. Pure + exported for unit testing.
+ */
+export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => string | undefined): Record<string, string>;
+/**
+ * Infer the transport when the config doesn't name one: a url-only entry is
+ * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
+ * plugin-bundled servers commonly write just `{ "url": "..." }`, and the old
+ * blind `?? "stdio"` default then failed them with "command is required for
+ * stdio transport" despite a perfectly good url. Pure + exported for testing.
+ */
+export declare function inferTransportType(config: MCPServerConfig): NonNullable<MCPServerConfig["transport"]>;
 /**
  * Persist an MCP-returned image to disk and return the textual
  * reference the LLM should see. Images larger than
@@ -27,6 +57,8 @@ export declare class MCPManager {
     private readonly toolRegistry;
     private static instance;
     private connections;
+    private registeredToolsByServer;
+    private desiredServerNames;
     /**
      * In-flight connect()s keyed by server name. When the broadcast config
      * reload (server.ts forEachSession → every session's refreshRuntimeConfig)
@@ -39,12 +71,17 @@ export declare class MCPManager {
      * connect can be retried later.
      */
     private connecting;
+    /** Per-owner (engine) desired server sets — see reconcile()'s shared-pool note. */
+    private desiredByOwner;
     constructor(toolRegistry: ToolRegistry);
     static getInstance(): MCPManager;
     /**
      * Connect to all configured MCP servers and register their tools.
      */
-    connectAll(servers: Record<string, MCPServerConfig>): Promise<void>;
+    connectAll(servers: Record<string, MCPServerConfig>, owner?: unknown): Promise<void>;
+    reconcile(servers: Record<string, MCPServerConfig>, owner?: unknown): Promise<void>;
+    /** Union of every registered owner's desired set; null when none registered. */
+    private unionDesired;
     /**
      * Connect to a single MCP server.
      *
@@ -68,6 +105,7 @@ export declare class MCPManager {
      * Disconnect all MCP servers.
      */
     disconnectAll(): Promise<void>;
+    disconnect(name: string): Promise<void>;
     /**
      * List connected servers.
      */
@@ -75,11 +113,11 @@ export declare class MCPManager {
     /**
      * Call a tool on a specific MCP server.
      */
-    callTool(serverName: string, toolName: string, args: Record<string, unknown>): Promise<unknown>;
+    callTool(serverName: string, toolName: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<unknown>;
     /**
      * List resources from MCP servers.
      */
-    listResources(serverName?: string): Promise<Array<{
+    listResources(serverName?: string, signal?: AbortSignal): Promise<Array<{
         uri: string;
         name: string;
         description?: string;
@@ -87,5 +125,5 @@ export declare class MCPManager {
     /**
      * Read a resource from an MCP server.
      */
-    readResource(serverName: string, uri: string): Promise<string>;
+    readResource(serverName: string, uri: string, signal?: AbortSignal): Promise<string>;
 }