@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.2

package/dist/plugins/pluginCommandHook.js

@@ -32,6 +32,7 @@
  */
 import { spawn } from "node:child_process";
 import { MAX_HOOK_OUTPUT_BYTES } from "../hooks/hook-output.js";
+import { killChildTree } from "../runtime/spawn-common.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
 /**
  * Extract the user-facing context string from a CC plugin's stdout JSON.
@@ -116,20 +117,8 @@ export async function runPluginCommandHook(spec, ctx) {
         const timer = setTimeout(() => {
             // eslint-disable-next-line no-console
             console.warn(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} timed out after ${timeoutMs}ms`);
-            try {
-                child.kill("SIGTERM");
-                setTimeout(() => {
-                    try {
-                        child.kill("SIGKILL");
-                    }
-                    catch {
-                        /* already exited */
-                    }
-                }, 1000);
-            }
-            catch {
-                /* already exited */
-            }
+            // win32: taskkill /T reaps the tree; POSIX: SIGTERM → grace → SIGKILL.
+            killChildTree(child, 1000);
             settle({});
         }, timeoutMs);
         child.stdout?.on("data", (chunk) => {
@@ -139,10 +128,7 @@ export async function runPluginCommandHook(spec, ctx) {
                     stdoutCapped = true;
                     // eslint-disable-next-line no-console
                     console.warn(`[plugin-hook] ${spec.pluginKey} ${ctx.eventName} stdout exceeded ${MAX_HOOK_OUTPUT_BYTES} bytes — killing`);
-                    try {
-                        child.kill("SIGTERM");
-                    }
-                    catch { /* already exited */ }
+                    killChildTree(child, 1000);
                 }
                 return;
             }

package/dist/plugins/pluginContent.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Plugin content inventory (插件详情页) — enumerate everything one installed
+ * plugin contributes: skills, commands, agents, hooks, MCP servers. The
+ * plugins list only showed "N skills", so users couldn't see what a plugin
+ * actually installs (feedback#15). Read-only; reuses the same parsers the
+ * loaders use so the inventory can't drift from what actually loads.
+ */
+import { type PluginHookEntry } from "./loadPluginHooks.js";
+export interface PluginContentInventory {
+    /** skills/<name>/SKILL.md — name + frontmatter description when present. */
+    skills: {
+        name: string;
+        description?: string;
+    }[];
+    /** commands/<name>.md */
+    commands: string[];
+    /** agents/<name>.md */
+    agents: string[];
+    /** hooks/hooks.json entries (event + command), owner-filtered. */
+    hooks: PluginHookEntry[];
+    /** MCP server names as merged (keyed `<plugin>:<server>` — bare name here). */
+    mcpServers: string[];
+}
+/**
+ * Inventory one plugin's contributions. `pluginName` is the bare name (no
+ * @marketplace); `installPath` its install dir. Hooks/MCP go through the same
+ * scanners the runtime loaders use (filtered to this plugin) so naming —
+ * e.g. MCP's `<plugin>:<server>` record keys — matches what users see live.
+ */
+export declare function describePluginContent(pluginName: string, installPath: string): PluginContentInventory;

package/dist/plugins/pluginContent.js

@@ -0,0 +1,83 @@
+/**
+ * Plugin content inventory (插件详情页) — enumerate everything one installed
+ * plugin contributes: skills, commands, agents, hooks, MCP servers. The
+ * plugins list only showed "N skills", so users couldn't see what a plugin
+ * actually installs (feedback#15). Read-only; reuses the same parsers the
+ * loaders use so the inventory can't drift from what actually loads.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { parseFrontmatter } from "../skills/frontmatter.js";
+import { listPluginHooks } from "./loadPluginHooks.js";
+import { mergePluginMcpServers } from "./installer/loadPluginMcp.js";
+function listMdNames(dir) {
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir)
+            .filter((f) => f.endsWith(".md"))
+            .map((f) => f.replace(/\.md$/, ""))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+function listSkills(installPath) {
+    const dir = join(installPath, "skills");
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    try {
+        for (const entry of readdirSync(dir).sort()) {
+            const skillMd = join(dir, entry, "SKILL.md");
+            try {
+                if (!statSync(join(dir, entry)).isDirectory() || !existsSync(skillMd))
+                    continue;
+                const { frontmatter } = parseFrontmatter(readFileSync(skillMd, "utf-8"));
+                const desc = typeof frontmatter.description === "string" ? frontmatter.description : undefined;
+                out.push({ name: entry, description: desc });
+            }
+            catch {
+                // unreadable skill dir — skip, same as the loader would
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    return out;
+}
+/**
+ * Inventory one plugin's contributions. `pluginName` is the bare name (no
+ * @marketplace); `installPath` its install dir. Hooks/MCP go through the same
+ * scanners the runtime loaders use (filtered to this plugin) so naming —
+ * e.g. MCP's `<plugin>:<server>` record keys — matches what users see live.
+ */
+export function describePluginContent(pluginName, installPath) {
+    const mcpPrefix = `${pluginName}:`;
+    let mcpServers = [];
+    try {
+        mcpServers = Object.keys(mergePluginMcpServers({}))
+            .filter((k) => k.startsWith(mcpPrefix))
+            .map((k) => k.slice(mcpPrefix.length))
+            .sort();
+    }
+    catch {
+        mcpServers = [];
+    }
+    let hooks = [];
+    try {
+        hooks = listPluginHooks().filter((h) => h.plugin === pluginName);
+    }
+    catch {
+        hooks = [];
+    }
+    return {
+        skills: listSkills(installPath),
+        commands: listMdNames(join(installPath, "commands")),
+        agents: listMdNames(join(installPath, "agents")),
+        hooks,
+        mcpServers,
+    };
+}

package/dist/plugins/pluginInstaller.d.ts

@@ -5,6 +5,19 @@
  * sparse-checkout, no npm/pip.
  */
 import type { PluginInstallEntry } from "./types.js";
+/**
+ * Compose the on-disk cache directory for a plugin version. Every path segment
+ * (marketplace / plugin / version) can originate from an attacker-controlled
+ * marketplace manifest, so each must be validated as a single safe path
+ * segment before it enters `join`. Without this a manifest entry named `..`
+ * (or containing a separator) would let the materialized plugin tree be
+ * written outside the plugin cache root — a supply-chain path traversal.
+ *
+ * Reuses `assertSafePluginName` (rejects empty / "." / ".." / separators /
+ * NUL). Exported so the segment-validation contract can be unit-tested
+ * directly.
+ */
+export declare function pluginCacheDir(marketplace: string, plugin: string, version: string): string;
 /**
  * Resolve a candidate `installPath` to a realpath and verify it lives strictly
  * underneath the plugin cache root. Returns the resolved path on success, or

package/dist/plugins/pluginInstaller.js

@@ -4,7 +4,7 @@
  * source types (path / git / github / git-subdir), no dependencies, no
  * sparse-checkout, no npm/pip.
  */
-import { existsSync, realpathSync, rmSync } from "node:fs";
+import { existsSync, realpathSync, rmSync, rmdirSync } from "node:fs";
 import { cp, mkdir, mkdtemp, rm } from "node:fs/promises";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { homedir, tmpdir } from "node:os";
@@ -13,13 +13,30 @@ import { loadMarketplace } from "./marketplaceManager.js";
 import { readKnownMarketplaces } from "./knownMarketplaces.js";
 import { appendInstallEntry, pluginInstallKey, readInstalledPlugins, removeInstallEntries, } from "./installedPlugins.js";
 import { rewritePluginVars } from "./varRewrite.js";
+import { assertSafePluginName } from "./installer/paths.js";
+import { pruneDisabledSettingsForPlugin } from "./installer/pruneDisabled.js";
 function userHome() {
     return process.env.HOME ?? homedir();
 }
 function pluginCacheRoot() {
     return join(userHome(), ".code-shell", "plugins", "cache");
 }
-function pluginCacheDir(marketplace, plugin, version) {
+/**
+ * Compose the on-disk cache directory for a plugin version. Every path segment
+ * (marketplace / plugin / version) can originate from an attacker-controlled
+ * marketplace manifest, so each must be validated as a single safe path
+ * segment before it enters `join`. Without this a manifest entry named `..`
+ * (or containing a separator) would let the materialized plugin tree be
+ * written outside the plugin cache root — a supply-chain path traversal.
+ *
+ * Reuses `assertSafePluginName` (rejects empty / "." / ".." / separators /
+ * NUL). Exported so the segment-validation contract can be unit-tested
+ * directly.
+ */
+export function pluginCacheDir(marketplace, plugin, version) {
+    assertSafePluginName(marketplace);
+    assertSafePluginName(plugin);
+    assertSafePluginName(version);
     return join(pluginCacheRoot(), marketplace, plugin, version);
 }
 /**
@@ -80,7 +97,7 @@ async function materializeGit(url, ref, cacheTarget) {
     await mkdir(dirname(cacheTarget), { recursive: true });
     if (existsSync(cacheTarget))
         await rm(cacheTarget, { recursive: true, force: true });
-    const clone = await gitClone(url, cacheTarget, ref ? { ref } : undefined);
+    const clone = await gitClone(url, cacheTarget, { full: true, ...(ref ? { ref } : {}) });
     if (!clone.ok)
         return { ok: false, error: clone.error };
     const head = await gitRevParseHead(cacheTarget);
@@ -92,7 +109,7 @@ async function materializeGitSubdir(url, subPath, ref, cacheTarget) {
     // Clone to a tempdir, then copy the subdir over.
     const tmp = await mkdtemp(join(tmpdir(), "plugin-clone-"));
     try {
-        const clone = await gitClone(url, tmp + "/repo", ref ? { ref } : undefined);
+        const clone = await gitClone(url, tmp + "/repo", { full: true, ...(ref ? { ref } : {}) });
         if (!clone.ok)
             return { ok: false, error: clone.error };
         const head = await gitRevParseHead(tmp + "/repo");
@@ -152,7 +169,11 @@ async function materialize(source, marketplaceInstallLocation, marketplace, plug
         // present, so we ignore the result and let materializePath report a real
         // missing-path error if the subdir truly isn't there.
         if (!isAbsolute(source)) {
-            await gitSparseCheckoutAdd(marketplaceInstallLocation, source);
+            // Strip a leading "./" — in non-cone sparse mode the literal "./" prefix
+            // doesn't match repo paths (which are stored without it), so the
+            // expand would silently no-op and the tree would stay un-materialized.
+            const sparseRel = source.replace(/^\.\//, "");
+            await gitSparseCheckoutAdd(marketplaceInstallLocation, sparseRel);
         }
         const r = await materializePath(marketplaceInstallLocation, source, placeholder);
         if (!r.ok)
@@ -244,7 +265,18 @@ export async function installPlugin(pluginName, marketplaceName) {
     if (!entry) {
         return { ok: false, error: `plugin "${pluginName}" not found in marketplace "${marketplaceName}".` };
     }
-    const mat = await materialize(entry.source, km.installLocation, marketplaceName, pluginName);
+    // materialize() validates every cache path segment (marketplace / plugin /
+    // version) and throws a PluginInstallError on an unsafe one. Convert that to
+    // a clean failure result — every caller (bootstrap / marketplace-service /
+    // tui handler) consumes { ok, error } and must not be crashed by a hostile
+    // marketplace manifest.
+    let mat;
+    try {
+        mat = await materialize(entry.source, km.installLocation, marketplaceName, pluginName);
+    }
+    catch (e) {
+        return { ok: false, error: e.message };
+    }
     if (!mat.ok)
         return mat;
     // Rewrite ${CLAUDE_PLUGIN_ROOT} → ${CODESHELL_PLUGIN_ROOT} across every
@@ -304,14 +336,16 @@ export function uninstallPlugin(pluginName, marketplaceName) {
         const pluginParent = join(pluginCacheRoot(), marketplaceName, pluginName);
         try {
             // rmdir succeeds only when empty; ignore failures.
-            const fs = require("node:fs");
-            fs.rmdirSync(pluginParent);
+            rmdirSync(pluginParent);
         }
         catch {
             // not empty or doesn't exist — fine
         }
     }
     const removedFromManifest = removeInstallEntries(key);
+    // Clear orphaned disable flags (disabledSkills "name:skill" /
+    // disabledPlugins "name") so a removed plugin leaves no dangling entries.
+    pruneDisabledSettingsForPlugin(pluginName);
     return { ok: removedFromManifest || removedFromDisk, removedFromManifest, removedFromDisk };
 }
 export function listInstalled() {

package/dist/plugins/schemas.js

@@ -123,6 +123,7 @@ export function validatePluginEntry(raw, index) {
             category: typeof raw.category === "string" ? raw.category : undefined,
             source: source.value,
             homepage: typeof raw.homepage === "string" ? raw.homepage : undefined,
+            version: typeof raw.version === "string" ? raw.version : undefined,
         },
     };
 }

package/dist/plugins/types.d.ts

@@ -48,6 +48,12 @@ export interface PluginMarketplaceEntry {
     category?: string;
     source: PluginEntrySource;
     homepage?: string;
+    /**
+     * Declared version from the marketplace manifest, when the author wrote
+     * one. CC's marketplace.json has no version convention, so this is often
+     * absent — the UI hides it rather than showing a placeholder.
+     */
+    version?: string;
 }
 export interface PluginMarketplace {
     name: string;

package/dist/preset/index.d.ts

@@ -51,8 +51,14 @@ export declare function listPresetNames(): string[];
 export declare function resolveAgentPreset(name?: string): AgentPreset;
 /**
  * Build the full system prompt for a preset by loading and joining its sections.
+ *
+ * `activeToolNames` (the turn's effective tool set, post capability-override
+ * filtering) gates tool-coupled sections: the "browser" section is dropped when
+ * no browser tool is active, so the browser capability is a single on/off unit
+ * (tools + usage instructions disappear together). Omit `activeToolNames` to
+ * include all sections (e.g. when assembling a generic/preview prompt).
  */
-export declare function buildPresetSystemPrompt(preset: AgentPreset): string;
+export declare function buildPresetSystemPrompt(preset: AgentPreset, activeToolNames?: readonly string[]): string;
 export declare function resolveBuiltinToolNames(options?: {
     preset?: string;
     enabledBuiltinTools?: string[];

package/dist/preset/index.js

@@ -18,9 +18,25 @@ const GENERAL_BUILTIN_TOOLS = [
     "Glob",
     "Grep",
     "Bash",
+    // Bash(run_in_background=true) companions — without these in the preset
+    // whitelist, the registry skips them (registerBuiltins filters BUILTIN_TOOLS
+    // by the selected set), so a model that correctly calls BashOutput after
+    // launching a background shell hits "Tool not found" and the turn dies.
+    "BashOutput",
+    "KillShell",
+    "ListShells",
+    // Browser automation (drive the in-app webview) — 3 semantic tools. Same
+    // whitelist requirement as the BashOutput trio above: registerBuiltins filters
+    // BUILTIN_TOOLS by the preset set, so without these the model calling
+    // browser_observe/etc. hits "Tool not found". They self-degrade to a clear
+    // error when no browser panel is wired (headless), so listing is safe.
+    "browser_observe",
+    "browser_act",
+    "browser_navigate",
     "WebSearch",
     "WebFetch",
     "GenerateImage",
+    "GenerateVideo",
     "AskUserQuestion",
     "Agent",
     // AgentStatus removed: background agents now write to ~/.code-shell/agents/
@@ -36,11 +52,22 @@ const GENERAL_BUILTIN_TOOLS = [
     "CronCreate",
     "CronDelete",
     "CronList",
+    // cc-orchestrator:驱动外部 claude CLI 跑一轮。同 BashOutput/UseCredential/
+    // EditModelCatalog 的 whitelist 要求:已在 BUILTIN_TOOLS 注册,但 registerBuiltins
+    // 按 preset 集过滤 → 名单里没有它,agent 就没有「指挥 Claude Code」的工具,只能幻觉
+    // RemoteTrigger / 兜底 Bash `claude -p`(用户实测「为什么驱动 cc 没作为工具」)。
+    // 定时/循环驱动统一走 CronCreate(到点跑一轮引擎,prompt 里调 DriveAgent);
+    // 无人值守审批由 DriveAgent 自身 bypass 解决,不需要定时层专门的 CC 调度工具。
+    // DriveAgent 是通用驱动(cli: claude|codex);DriveClaudeCode 保留为 cli:claude 的
+    // 别名(老 prompt/记忆兼容)。两个都要在白名单里,否则 registerBuiltins 滤掉。
+    "DriveAgent",
+    "DriveClaudeCode",
+    // 编排时读 CC/Codex 剩余额度做规划(开几个/等重置/换 provider)。
+    "CheckQuota",
     "Skill",
     "MCPTool",
     "ListMcpResources",
     "ReadMcpResource",
-    "RemoteTrigger",
     "REPL",
     "PowerShell",
     // Persistent cross-session memory. Including these in the default preset is
@@ -54,6 +81,28 @@ const GENERAL_BUILTIN_TOOLS = [
     "MemoryRead",
     "MemorySave",
     "MemoryDelete",
+    // AI 取用已存凭证(cookie/token/link)给 yt-dlp/curl 等。必须在 preset 白名单里
+    // 否则 registerBuiltins 滤掉它 → 即使存了凭证、注册了工具,AI 列表里也没有
+    // UseCredential(用户实测「找不到这个工具」的真因)。它带 isUseCredentialAvailable
+    // guard:cwd 凭证库为空时仍自动隐藏,所以无条件列入是安全的(空库不会冒出来)。
+    "UseCredential",
+    // 同理:把 cookie 凭证注入内置浏览器(恢复登录态后用 browser_* 工具)。带
+    // isInjectCredentialAvailable guard(无 cookie 凭证时自动隐藏),无条件列入安全。
+    "InjectCredential",
+    // AI 增/改模型 catalog(写 ~/.code-shell/model-catalog.user.json)。同 BashOutput/
+    // UseCredential 一样的 whitelist 要求:registerBuiltins 按 preset 集过滤 BUILTIN_TOOLS,
+    // 名单里没有它 → 即使工具已注册,AI 列表里也没有 → 用户实测「找不到这个工具」。
+    // permissionDefault: "ask",列入只是让 AI 看得到,调用仍走审批,无条件列入安全。
+    "EditModelCatalog",
+    // Goal-mode control tools. Same whitelist requirement as the rest:
+    // registerBuiltins filters BUILTIN_TOOLS by the preset set, so a goal tool
+    // absent here is registered-but-invisible — the model never sees it and can
+    // neither self-declare completion (complete_goal) nor honor a user's request
+    // to abandon the goal (cancel_goal), stranding a persistent goal that only a
+    // manual disk edit could clear. cancel_goal is the "strong intent" escape
+    // hatch (requires confirm+reason); the turn-loop enforces the guard.
+    "complete_goal",
+    "cancel_goal",
 ];
 const TERMINAL_CODING_EXTRA_TOOLS = [
     "EnterWorktree",
@@ -80,13 +129,31 @@ const GENERAL_PERMISSION_RULES = [
     { tool: "TodoWrite", decision: "allow" },
     { tool: "Sleep", decision: "allow" },
     { tool: "CronList", decision: "allow" },
+    { tool: "CheckQuota", decision: "allow" },
     { tool: "Skill", decision: "allow" },
+    // ListMcpResources only enumerates resource names (and the executor filters
+    // the list to this session's enabled servers). ReadMcpResource pulls actual
+    // content and is intentionally NOT auto-allowed here — it falls back to its
+    // tool-level "ask" default so a default-mode session confirms the read.
     { tool: "ListMcpResources", decision: "allow" },
-    { tool: "ReadMcpResource", decision: "allow" },
     // Reading memory is always safe; writes (MemorySave/MemoryDelete) stay gated
     // by the tools' own permissionDefault so the user confirms each change.
     { tool: "MemoryList", decision: "allow" },
     { tool: "MemoryRead", decision: "allow" },
+    // Browser automation (3 semantic tools). Rules are first-match-wins, ordered
+    // by specificity — so the action-gating rule for browser_act MUST come first:
+    // click/type/select mutate the page/form → "ask"; all other actions (hover/
+    // scroll/wait/press_key/list_tabs/switch_tab) fall through to browser_act's
+    // tool-level "allow". observe (read-only) and navigate auto-allow.
+    // (Main-side sensitive-action + domain-whitelist enforcement also applies.)
+    {
+        tool: "browser_act",
+        argsPattern: { action: "^(click|type|select)$" },
+        decision: "ask",
+        reason: "browser_act click/type/select mutate the page",
+    },
+    { tool: "browser_observe", decision: "allow" },
+    { tool: "browser_navigate", decision: "allow" },
 ];
 // ─── Preset definitions ──────────────────────────────────────────
 export const BUILTIN_AGENT_PRESETS = {
@@ -94,7 +161,7 @@ export const BUILTIN_AGENT_PRESETS = {
         name: "general",
         label: "General Orchestrator",
         description: "Domain-agnostic orchestration for research, operations, automation, and long-running tasks.",
-        promptSections: ["base", "orchestration", "tone"],
+        promptSections: ["base", "orchestration", "browser", "tone"],
         injectGitStatus: false,
         builtinTools: [...GENERAL_BUILTIN_TOOLS],
         defaultPermissionRules: GENERAL_PERMISSION_RULES,
@@ -103,7 +170,7 @@ export const BUILTIN_AGENT_PRESETS = {
         name: "terminal-coding",
         label: "Terminal Coding Assistant",
         description: "General orchestration plus coding-focused guidance and code-navigation tools.",
-        promptSections: ["base", "orchestration", "coding", "tone"],
+        promptSections: ["base", "orchestration", "coding", "browser", "tone"],
         injectGitStatus: true,
         builtinTools: [...GENERAL_BUILTIN_TOOLS, ...TERMINAL_CODING_EXTRA_TOOLS],
         defaultPermissionRules: [
@@ -156,11 +223,34 @@ export function resolveAgentPreset(name) {
     const allowed = listPresetNames().join(", ");
     throw new Error(`Unknown agent preset "${name}". Available presets: ${allowed}`);
 }
+/** Tool names that gate the "browser" prompt section — if NONE of these are in
+ *  the active tool set (browser capability turned off), the section is dropped
+ *  so the model isn't told how to use tools it can't see. Keep in sync with the
+ *  browser tools registered in builtin/index.ts. */
+const BROWSER_SECTION_TOOLS = ["browser_observe", "browser_act", "browser_navigate"];
+/** Prompt sections whose inclusion is gated by an active tool being present. */
+const TOOL_GATED_SECTIONS = {
+    browser: BROWSER_SECTION_TOOLS,
+};
 /**
  * Build the full system prompt for a preset by loading and joining its sections.
+ *
+ * `activeToolNames` (the turn's effective tool set, post capability-override
+ * filtering) gates tool-coupled sections: the "browser" section is dropped when
+ * no browser tool is active, so the browser capability is a single on/off unit
+ * (tools + usage instructions disappear together). Omit `activeToolNames` to
+ * include all sections (e.g. when assembling a generic/preview prompt).
  */
-export function buildPresetSystemPrompt(preset) {
-    return loadSections(preset.promptSections);
+export function buildPresetSystemPrompt(preset, activeToolNames) {
+    let sections = preset.promptSections;
+    if (activeToolNames) {
+        const active = new Set(activeToolNames);
+        sections = sections.filter((s) => {
+            const gate = TOOL_GATED_SECTIONS[s];
+            return !gate || gate.some((t) => active.has(t));
+        });
+    }
+    return loadSections(sections);
 }
 export function resolveBuiltinToolNames(options) {
     const preset = resolveAgentPreset(options?.preset);

package/dist/product/types.d.ts

@@ -21,7 +21,7 @@
 import type { PermissionRule, MCPServerConfig } from "../types.js";
 import type { Evaluator } from "../run/Evaluator.js";
 import type { RegisteredTool } from "../types.js";
-import type { EngineHookConfig } from "../engine/engine.js";
+import type { EngineHookConfig } from "../engine/types.js";
 export interface ProductPreset {
     /** Unique name for this product's preset. */
     name: string;

package/dist/prompt/composer.d.ts

@@ -33,6 +33,20 @@ export interface ComposerOptions {
      * `${pluginName}:` is filtered. See scanSkills(opts.disabledPlugins).
      */
     disabledPlugins?: string[];
+    /**
+     * Sub-agent skill allowlist (hard isolation). When set, only these skills
+     * appear in the LLM's skills listing — applied on top of the disabled
+     * lists. Undefined → the full (non-disabled) pool. Mirrors
+     * scanSkills(opts.skillAllowlist) so the prompt matches the Skill tool's
+     * dispatch gate.
+     */
+    skillAllowlist?: string[];
+    /**
+     * settings.memories.maxAge (days). When > 0, memories whose file mtime is
+     * older than this are dropped from the injected memory context (TODO 8.1).
+     * Undefined/0 → inject all.
+     */
+    memoriesMaxAgeDays?: number;
 }
 export declare class PromptComposer {
     private readonly options;
@@ -52,6 +66,19 @@ export declare class PromptComposer {
      * Only injects git status if the resolved preset opts in.
      */
     buildSystemContext(): Promise<string>;
+    /**
+     * Per-turn dynamic context, delivered as a trailing <system-reminder> user
+     * message rather than baked into the system prefix.
+     *
+     * Holds the two things that change *within* a session — the skills listing
+     * (changes when a skill is installed/disabled) and the git-status snapshot
+     * (changes whenever the working tree changes). Keeping them out of the
+     * system prompt means installing a skill or editing a file no longer
+     * invalidates the cached system prefix. Placed at the END of the messages
+     * array (after the user task) so it sits past the conversation's cache
+     * breakpoint — a change here never re-bills the history prefix.
+     */
+    buildDynamicContextMessage(): Promise<Message | null>;
     invalidateCache(sectionName?: string): void;
     private getSections;
     private getInstructions;