@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.2

package/dist/cc-orchestrator/external-agent-driver.js

@@ -0,0 +1,69 @@
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { pathWithCommonBins } from "./cc-capability.js";
+/** Pure: reduce collected output lines + exit code to a result. Unit-testable. */
+export function runWithLines(adapter, lines, exitCode) {
+    const parsed = adapter.parseResult(lines);
+    return { ...parsed, exitCode, lines };
+}
+/** Spawn ONE headless agent run, collect stream-json to exit, return result.
+ *  No time concept — a single turn. Honors AbortSignal (kills the child). */
+export function runAgentOnce(adapter, opts, signal) {
+    return new Promise((resolve, reject) => {
+        const args = adapter.buildArgs({
+            prompt: opts.prompt,
+            resumeSessionId: opts.resumeSessionId,
+            permissionMode: opts.permissionMode ?? "default",
+            cwd: opts.cwd,
+        });
+        // claude takes the prompt in argv (`-p <prompt>`) and wants stdin closed
+        // (verified: avoids a 3s wait). codex `exec` reads the prompt from stdin
+        // (argv ends with `-`), so adapters that set promptViaStdin get a piped
+        // stdin we write the prompt to.
+        const viaStdin = adapter.promptViaStdin === true;
+        const child = spawn(opts.command, args, {
+            cwd: opts.cwd,
+            env: { ...process.env, PATH: pathWithCommonBins() },
+            // NOT detached: this child is owned by the (long-lived) worker that reads
+            // its stdout. Detaching orphaned it across a worker/app restart — the
+            // reader promise then never resolved and the completion notification never
+            // fired (the "后台任务没返回" bug). Bound to the worker, it lives or dies
+            // with the process that's actually listening for its result.
+            detached: false,
+            stdio: [viaStdin ? "pipe" : "ignore", "pipe", "pipe"],
+        });
+        if (viaStdin && child.stdin) {
+            child.stdin.end(opts.prompt);
+        }
+        const lines = [];
+        if (child.stdout) {
+            const rl = createInterface({ input: child.stdout });
+            rl.on("line", (line) => lines.push(line));
+        }
+        // Not detached → no own process group, so kill the child directly (a
+        // negative-pid group kill would target the worker's group). claude has no
+        // long-lived child tree of its own here, so a direct SIGTERM is sufficient.
+        const onAbort = () => {
+            try {
+                child.kill("SIGTERM");
+            }
+            catch { /* already gone */ }
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        child.on("error", (err) => {
+            signal?.removeEventListener("abort", onAbort);
+            // A missing binary is the most common failure (user hasn't installed the
+            // CLI, or GUI-launched Electron's PATH misses it). Turn the cryptic
+            // "spawn codex ENOENT" into something actionable that names the command.
+            if (err.code === "ENOENT") {
+                reject(new Error(`未找到命令 "${opts.command}"。请先安装该 CLI 并确保它在 PATH 中（${adapter.kind === "codex" ? "Codex CLI" : "Claude Code CLI"}）。`));
+                return;
+            }
+            reject(err);
+        });
+        child.on("exit", (code) => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve(runWithLines(adapter, lines, code));
+        });
+    });
+}

package/dist/cc-orchestrator/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./cc-capability.js";
+export * from "./agent-adapter.js";
+export * from "./external-agent-driver.js";
+export * from "./session-discovery.js";
+export * from "./codex-session-discovery.js";
+export * from "./relevance-judge.js";
+export * from "./session-history.js";
+export * from "./codex-session-history.js";

package/dist/cc-orchestrator/index.js

@@ -0,0 +1,8 @@
+export * from "./cc-capability.js";
+export * from "./agent-adapter.js";
+export * from "./external-agent-driver.js";
+export * from "./session-discovery.js";
+export * from "./codex-session-discovery.js";
+export * from "./relevance-judge.js";
+export * from "./session-history.js";
+export * from "./codex-session-history.js";

package/dist/cc-orchestrator/relevance-judge.d.ts

@@ -0,0 +1,15 @@
+export interface JudgeDecision {
+    action: "continue-same" | "continue-fresh" | "stop";
+    handoffSummary?: string;
+    reason: string;
+}
+export interface JudgeInput {
+    goal?: string;
+    lastResult: string;
+    nextPrompt: string;
+}
+/** Injected aux-model call: takes a prompt, returns raw text. */
+export type AuxLlm = (prompt: string) => Promise<string>;
+export declare function buildJudgePrompt(input: JudgeInput): string;
+export declare function parseJudgeResponse(raw: string): JudgeDecision;
+export declare function judgeContinuation(input: JudgeInput, llm: AuxLlm): Promise<JudgeDecision>;

package/dist/cc-orchestrator/relevance-judge.js

@@ -0,0 +1,29 @@
+const SYSTEM = `You decide how a scheduled task loop should continue after one run.
+Reply with ONLY a JSON object: {"action": "continue-same"|"continue-fresh"|"stop", "handoffSummary"?: string, "reason": string}.
+- "stop": the goal is met; no more runs needed.
+- "continue-same": next run should resume the SAME session (work is related, keep context).
+- "continue-fresh": next run should start a FRESH session because the next step is unrelated to what was just done; put a short context summary in handoffSummary.`;
+export function buildJudgePrompt(input) {
+    return [
+        SYSTEM,
+        input.goal ? `\nOverall goal: ${input.goal}` : "",
+        `\nWhat the last run produced:\n${input.lastResult.slice(0, 4000)}`,
+        `\nThe next scheduled prompt:\n${input.nextPrompt}`,
+        `\nDecision JSON:`,
+    ].join("\n");
+}
+export function parseJudgeResponse(raw) {
+    try {
+        const m = raw.match(/\{[\s\S]*\}/);
+        const d = JSON.parse(m ? m[0] : raw);
+        if (d.action === "stop" || d.action === "continue-fresh" || d.action === "continue-same") {
+            return { action: d.action, handoffSummary: typeof d.handoffSummary === "string" ? d.handoffSummary : undefined, reason: typeof d.reason === "string" ? d.reason : "" };
+        }
+    }
+    catch { /* fall through */ }
+    return { action: "continue-same", reason: "unparseable judge output; defaulting to continue-same" };
+}
+export async function judgeContinuation(input, llm) {
+    const raw = await llm(buildJudgePrompt(input));
+    return parseJudgeResponse(raw);
+}

package/dist/cc-orchestrator/session-discovery.d.ts

@@ -0,0 +1,46 @@
+/** Encode a cwd to claude's project dir name: every non-[A-Za-z0-9] char → '-'.
+ *  Mirrors `~/.claude/projects/<encoded>` (verified against real layout). */
+export declare function encodeCwd(cwd: string): string;
+export interface DiscoveredSession {
+    sessionId: string;
+    firstMessage: string;
+    lastModified: number;
+    messageCount: number;
+}
+/**
+ * Bound how many sessions a discovery scan deep-reads + returns. Without this,
+ * `discoverSessions` read EVERY `.jsonl` file fully (title + message count) on
+ * every list open — O(all history) work that makes the CC/Codex room list slow
+ * and unwieldy once a project accumulates sessions. The default surfaces only
+ * the recent, useful slice; the UI fetches older ones on demand by passing a
+ * larger `limit` (or `sinceMs: 0`).
+ */
+export interface DiscoverOptions {
+    /** Max sessions to return (after the recency filter), newest first.
+     *  undefined or <= 0 = no cap. */
+    limit?: number;
+    /** Only include sessions modified within this many ms of `now`.
+     *  undefined or <= 0 = no window. */
+    sinceMs?: number;
+    /** Injectable clock for tests. Defaults to Date.now(). */
+    now?: number;
+}
+/** Default room-list window: last 2 weeks AND at most 20 — the intersection. */
+export declare const DEFAULT_DISCOVER_LIMIT = 20;
+export declare const DEFAULT_DISCOVER_SINCE_MS: number;
+/**
+ * Apply the recency window + limit to mtime-sorted stats, returning the slice to
+ * deep-read. Shared by the claude + codex discovery paths so they bound work
+ * identically. `total` (caller-side) lets the UI show a "load more" affordance.
+ */
+export declare function selectRecentStats<T extends {
+    mtimeMs: number;
+}>(stats: T[], opts?: DiscoverOptions): T[];
+/** List claude sessions for `cwd`. `claudeHome` defaults to ~/.claude (override
+ *  for tests). Read-only, on-demand scan; no index. Stats every file cheaply,
+ *  then deep-reads (title + count) ONLY the recent slice (opts) so an old,
+ *  large history doesn't get fully read on every list open. */
+export declare function discoverSessions(cwd: string, claudeHome?: string, opts?: DiscoverOptions): DiscoveredSession[];
+/** Count of all session files for `cwd`, cheaply (stat only). Lets the UI know
+ *  whether a bounded `discoverSessions` left older sessions unshown. */
+export declare function countSessions(cwd: string, claudeHome?: string): number;

package/dist/cc-orchestrator/session-discovery.js

@@ -0,0 +1,125 @@
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+/** Encode a cwd to claude's project dir name: every non-[A-Za-z0-9] char → '-'.
+ *  Mirrors `~/.claude/projects/<encoded>` (verified against real layout). */
+export function encodeCwd(cwd) {
+    return cwd.replace(/[^A-Za-z0-9]/g, "-");
+}
+/** Default room-list window: last 2 weeks AND at most 20 — the intersection. */
+export const DEFAULT_DISCOVER_LIMIT = 20;
+export const DEFAULT_DISCOVER_SINCE_MS = 14 * 24 * 60 * 60 * 1000;
+function claudeProjectsDir(claudeHome) {
+    return join(claudeHome, "projects");
+}
+/** Extract first *real* user message text, skipping caveat/command noise. */
+function firstUserMessage(lines) {
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        let d;
+        try {
+            d = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (d.type !== "user")
+            continue;
+        const c = d.message?.content;
+        const text = typeof c === "string"
+            ? c
+            : Array.isArray(c)
+                ? c.map((p) => (typeof p?.text === "string" ? p.text : "")).join("")
+                : "";
+        const t = text.trim();
+        if (!t)
+            continue;
+        if (t.startsWith("<local-command-caveat>") || t.startsWith("<command-name>"))
+            continue;
+        return t.slice(0, 200);
+    }
+    return "";
+}
+function countUserMessages(lines) {
+    let n = 0;
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        try {
+            if (JSON.parse(line).type === "user")
+                n++;
+        }
+        catch { /* skip */ }
+    }
+    return n;
+}
+/** Cheap (sessionId, mtime) pairs for every session file — stat only, no read. */
+function listSessionStats(dir) {
+    const stats = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".jsonl"))
+            continue;
+        const file = join(dir, name);
+        let st;
+        try {
+            st = statSync(file);
+        }
+        catch {
+            continue;
+        }
+        stats.push({ sessionId: name.replace(/\.jsonl$/, ""), file, mtimeMs: st.mtimeMs });
+    }
+    return stats;
+}
+/**
+ * Apply the recency window + limit to mtime-sorted stats, returning the slice to
+ * deep-read. Shared by the claude + codex discovery paths so they bound work
+ * identically. `total` (caller-side) lets the UI show a "load more" affordance.
+ */
+export function selectRecentStats(stats, opts = {}) {
+    const now = opts.now ?? Date.now();
+    let sel = stats.slice().sort((a, b) => b.mtimeMs - a.mtimeMs);
+    if (opts.sinceMs && opts.sinceMs > 0) {
+        const cutoff = now - opts.sinceMs;
+        sel = sel.filter((s) => s.mtimeMs >= cutoff);
+    }
+    if (opts.limit && opts.limit > 0)
+        sel = sel.slice(0, opts.limit);
+    return sel;
+}
+/** List claude sessions for `cwd`. `claudeHome` defaults to ~/.claude (override
+ *  for tests). Read-only, on-demand scan; no index. Stats every file cheaply,
+ *  then deep-reads (title + count) ONLY the recent slice (opts) so an old,
+ *  large history doesn't get fully read on every list open. */
+export function discoverSessions(cwd, claudeHome = join(homedir(), ".claude"), opts = {}) {
+    const dir = join(claudeProjectsDir(claudeHome), encodeCwd(cwd));
+    if (!existsSync(dir))
+        return [];
+    const selected = selectRecentStats(listSessionStats(dir), opts);
+    const out = [];
+    for (const s of selected) {
+        let lines;
+        try {
+            lines = readFileSync(s.file, "utf-8").split("\n");
+        }
+        catch {
+            continue;
+        }
+        out.push({
+            sessionId: s.sessionId,
+            firstMessage: firstUserMessage(lines),
+            lastModified: s.mtimeMs,
+            messageCount: countUserMessages(lines),
+        });
+    }
+    return out;
+}
+/** Count of all session files for `cwd`, cheaply (stat only). Lets the UI know
+ *  whether a bounded `discoverSessions` left older sessions unshown. */
+export function countSessions(cwd, claudeHome = join(homedir(), ".claude")) {
+    const dir = join(claudeProjectsDir(claudeHome), encodeCwd(cwd));
+    if (!existsSync(dir))
+        return 0;
+    return listSessionStats(dir).length;
+}

package/dist/cc-orchestrator/session-history.d.ts

@@ -0,0 +1,19 @@
+export interface HistoryMessage {
+    role: "user" | "assistant";
+    text: string;
+    /** `summary` is a lossy one-field preview; `args` is the full tool_use input
+     *  (e.g. a sub-agent's `prompt`) so a replayed tool card can show the real
+     *  parameters, not just the whitelisted field. */
+    tools?: {
+        name: string;
+        summary: string;
+        args?: Record<string, unknown>;
+    }[];
+    ts?: number;
+}
+/** Read the last `limit` user/assistant messages from a claude session jsonl. */
+export declare function readRecentHistory(cwd: string, sessionId: string, limit: number, claudeHome?: string): {
+    messages: HistoryMessage[];
+    hasMore: boolean;
+    totalCount: number;
+};

package/dist/cc-orchestrator/session-history.js

@@ -0,0 +1,67 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { encodeCwd } from "./session-discovery.js";
+const NOISE = ["<local-command-caveat>", "<command-name>"];
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content))
+        return content.map((p) => (typeof p?.text === "string" ? p.text : "")).join("");
+    return "";
+}
+function toolsOf(content) {
+    if (!Array.isArray(content))
+        return [];
+    const out = [];
+    for (const p of content) {
+        if (p?.type === "tool_use") {
+            const inp = p.input ?? {};
+            const summary = inp.command ?? inp.file_path ?? inp.path ?? inp.url ?? inp.pattern ?? inp.query ?? "";
+            const args = inp && typeof inp === "object" && Object.keys(inp).length > 0 ? inp : undefined;
+            out.push({ name: typeof p.name === "string" ? p.name : "tool", summary: String(summary).slice(0, 120), args });
+        }
+    }
+    return out;
+}
+/** Read the last `limit` user/assistant messages from a claude session jsonl. */
+export function readRecentHistory(cwd, sessionId, limit, claudeHome = join(homedir(), ".claude")) {
+    const file = join(claudeHome, "projects", encodeCwd(cwd), `${sessionId}.jsonl`);
+    if (!existsSync(file))
+        return { messages: [], hasMore: false, totalCount: 0 };
+    let raw;
+    try {
+        raw = readFileSync(file, "utf-8");
+    }
+    catch {
+        return { messages: [], hasMore: false, totalCount: 0 };
+    }
+    const all = [];
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        let d;
+        try {
+            d = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (d.type === "user") {
+            const t = textOf(d.message?.content).trim();
+            if (!t || NOISE.some((n) => t.startsWith(n)))
+                continue;
+            all.push({ role: "user", text: t.slice(0, 4000) });
+        }
+        else if (d.type === "assistant") {
+            const t = textOf(d.message?.content).trim();
+            const tools = toolsOf(d.message?.content);
+            if (!t && tools.length === 0)
+                continue;
+            all.push({ role: "assistant", text: t.slice(0, 4000), tools: tools.length ? tools : undefined });
+        }
+    }
+    const lim = limit > 0 ? limit : 20;
+    const start = Math.max(0, all.length - lim);
+    return { messages: all.slice(start), hasMore: start > 0, totalCount: all.length };
+}

package/dist/cli/agent-server-stdio.d.ts

@@ -30,7 +30,7 @@
  * bootstrap is invisible to them.
  */
 import type { EngineConfigSlice } from "../protocol/chat-session-manager.js";
-import type { ValidatedSettings } from "../settings/schema.js";
+import { type ValidatedSettings } from "../settings/schema.js";
 /**
  * Resolve per-session agent config: protocol slice overrides win, else fall
  * back to disk settings.agent.*. Fixes the bug where settings.agent.* never
@@ -41,3 +41,17 @@ export declare function resolveSessionAgentConfig(slice: EngineConfigSlice, sett
     customSystemPrompt: string | undefined;
     appendSystemPrompt: string | undefined;
 };
+/**
+ * Resolve a session's effective cwd. A protocol slice with an explicit cwd
+ * points the session at that project; a slice WITHOUT a cwd is a no-repo
+ * "纯聊天" session (the renderer omits cwd when no project is selected) and must
+ * land in the no-repo sandbox (~/.code-shell/no-repo) — NOT the worker's boot
+ * cwd.
+ *
+ * Why not the boot cwd: this stdio worker is long-lived and reused across
+ * sessions/projects, so its boot cwd is whatever project first spawned it.
+ * Inheriting it for a no-repo chat would (a) silently run the chat against a
+ * stale, unrelated project's files and (b) defeat the no-repo skill/plugin
+ * whitelist inversion (which only fires when cwd === noRepoDir).
+ */
+export declare function resolveSessionCwd(slice: EngineConfigSlice): string;

package/dist/cli/agent-server-stdio.js

@@ -32,16 +32,24 @@
 import { Engine } from "../engine/engine.js";
 import { EngineRuntime } from "../engine/runtime.js";
 import { ChatSessionManager } from "../protocol/chat-session-manager.js";
+import { SessionManager } from "../session/session-manager.js";
+import { validateSettings } from "../settings/schema.js";
 import { AgentServer } from "../protocol/server.js";
 import { StdioTransport } from "../protocol/transport.js";
-import { SettingsManager } from "../settings/manager.js";
+import { createNotification } from "../protocol/types.js";
+import { setCronChangedSink } from "../tool-system/builtin/cron.js";
+import { SettingsManager, noRepoDir } from "../settings/manager.js";
 import { personalizationFrom } from "../settings/personalization.js";
 import { MCPManager } from "../tool-system/mcp-manager.js";
 import { mergePluginMcpServers } from "../plugins/installer/loadPluginMcp.js";
+import { computeEffectiveDisabledLists } from "../capability-control/disabled-lists.js";
 import { CostTracker } from "../cost-tracker.js";
 import { installGracefulShutdown } from "./graceful-shutdown.js";
+import { backgroundShellManager } from "../runtime/background-shell.js";
+import { logger } from "../logging/logger.js";
 import { cronScheduler } from "../automation/scheduler.js";
 import { CronStore, defaultCronStorePath } from "../automation/store.js";
+import { resolveLLMConfigForTag } from "../engine/resolve-llm-config.js";
 /**
  * Resolve per-session agent config: protocol slice overrides win, else fall
  * back to disk settings.agent.*. Fixes the bug where settings.agent.* never
@@ -54,24 +62,55 @@ export function resolveSessionAgentConfig(slice, settings) {
         appendSystemPrompt: slice.appendSystemPrompt ?? settings.agent.appendSystemPrompt,
     };
 }
+/**
+ * Resolve a session's effective cwd. A protocol slice with an explicit cwd
+ * points the session at that project; a slice WITHOUT a cwd is a no-repo
+ * "纯聊天" session (the renderer omits cwd when no project is selected) and must
+ * land in the no-repo sandbox (~/.code-shell/no-repo) — NOT the worker's boot
+ * cwd.
+ *
+ * Why not the boot cwd: this stdio worker is long-lived and reused across
+ * sessions/projects, so its boot cwd is whatever project first spawned it.
+ * Inheriting it for a no-repo chat would (a) silently run the chat against a
+ * stale, unrelated project's files and (b) defeat the no-repo skill/plugin
+ * whitelist inversion (which only fires when cwd === noRepoDir).
+ */
+export function resolveSessionCwd(slice) {
+    return slice.cwd ?? noRepoDir();
+}
 // ─── Read base config from environment / settings ─────────────────
 const cwd = process.env.AGENT_CWD ?? process.cwd();
 // Load settings once to derive llm config for the seed engine.
 // Desktop is a host application: read the full disk hierarchy (incl. the
 // user's ~/.code-shell). The SDK default 'project' would skip user config.
 const settingsManager = new SettingsManager(cwd, "full");
-const settings = settingsManager.get();
+// Bootstrap load must NOT crash the worker on a schema-invalid (but JSON-valid)
+// settings file: a hand-edited settings.json with e.g. `permissions.defaultMode:
+// "ask"` or `env.FOO: 123` makes SettingsSchema.parse throw a ZodError at module
+// top level, which the desktop/mobile host sees as "connection lost" / a
+// nonzero-exit worker. Fall back to schema defaults and print a readable,
+// truncated reason so the user can fix the file (freshSettings() applies the
+// same best-effort contract per session once the worker is up).
+let settings;
+try {
+    settings = settingsManager.get();
+}
+catch (err) {
+    const reason = (err instanceof Error ? err.message : String(err)).slice(0, 2000);
+    console.error(`[agent-server] settings.json 校验失败,已回退到默认配置(请修正后重启):\n${reason}`);
+    settings = validateSettings({});
+}
 // LLMConfig is pure model identity now — only the bare identity fields go here.
 // temperature/imageDetail/timeout/retryMaxAttempts are ClientDefaults, derived
-// inside Engine.populateModelPoolFromSettings from settings.model.temperature
-// and settings.images.detail.
-const llmConfig = {
-    provider: settings.model.provider,
-    model: settings.model.name,
-    apiKey: settings.model.apiKey ?? "",
-    baseUrl: settings.model.baseUrl,
-    maxTokens: settings.model.maxTokens,
-};
+// inside Engine.populateModelPoolFromSettings (temperature is a ClientDefaults
+// knob; imageDetail from settings.images.detail).
+const seedLlm = resolveLLMConfigForTag(settings, "text", settings.defaults?.text);
+if (!seedLlm) {
+    console.error(`[agent-server] 没有可用的文本模型连接(defaults.text=${settings.defaults?.text ?? "未设置"})。` +
+        `请在「连接」页添加并填写凭证。`);
+    process.exit(1);
+}
+const llmConfig = seedLlm;
 // ─── Step 1: seed engine — populates model pool from settings ─────
 const seedEngine = new Engine({
     llm: llmConfig,
@@ -84,7 +123,7 @@ const modelPool = seedEngine.getModelPool();
 const toolRegistry = seedEngine.getToolRegistry();
 // Capture the seed engine's resolved llmConfig + clientDefaults
 // (post-populateModelPoolFromSettings). Session engines inherit defaults so
-// settings.model.temperature / images.detail apply uniformly without each
+// the temperature ClientDefault / images.detail apply uniformly without each
 // factory call re-reading settings.
 const resolvedLlmConfig = seedEngine.getConfig().llm;
 const resolvedClientDefaults = seedEngine.getConfig().clientDefaults;
@@ -138,14 +177,42 @@ const chatManager = new ChatSessionManager({
     // each time the factory fires; fall back to the snapshot only when the
     // pool can't resolve (no active key — shouldn't happen in practice).
     engineFactory: (slice) => {
-        const live = freshSettings();
+        // Effective cwd for THIS session: explicit slice.cwd → that project; absent
+        // → the no-repo sandbox (NOT the worker's stale boot cwd). See
+        // resolveSessionCwd for the full rationale.
+        const sessionCwd = resolveSessionCwd(slice);
+        // Read settings for THIS session's cwd, not the worker's boot cwd. A single
+        // worker serves many projects; the boot-cwd `freshSettings()` snapshot pins
+        // every session to the first project's project-layer settings, so project
+        // `mcpServers` / `agent.*` / permissions from the boot project would leak
+        // into (and shadow) other projects' sessions. A per-session SettingsManager
+        // still reads the full hierarchy (user ~/.code-shell + THIS project's
+        // .code-shell), keeping user-global settings while picking up the correct
+        // project overlay. Falls back to the boot snapshot if this project's file is
+        // malformed (same best-effort contract as freshSettings()).
+        const sessionSettingsManager = new SettingsManager(sessionCwd, "full");
+        let live;
+        try {
+            live = sessionSettingsManager.load();
+        }
+        catch {
+            live = freshSettings();
+        }
+        // Fold project capabilityOverrides over the global disabledPlugins before
+        // the MCP merge — a plugin force-enabled in 能力总览 (project "on") must
+        // contribute its MCP servers even while globally disabled, and vice versa.
+        // Raw `live.disabledPlugins` alone ignored the project layer.
+        const { disabledPlugins } = computeEffectiveDisabledLists(sessionSettingsManager, sessionCwd);
         return new Engine({
             llm: runtime.modelPool.resolveLLMConfig() ?? resolvedLlmConfig,
             // Inherit the seed engine's resolved clientDefaults so every session
             // engine sees the user's temperature/imageDetail without each factory
             // call re-running populateModelPoolFromSettings.
             clientDefaults: resolvedClientDefaults,
-            cwd,
+            // sessionCwd resolves slice.cwd → no-repo sandbox (never the stale boot
+            // cwd). The slice.cwd spread below is now redundant with this but kept
+            // for clarity / explicitness.
+            cwd: sessionCwd,
             runtime,
             // This stdio worker exists only to serve the desktop app, so every
             // session it creates is a desktop-origin session.
@@ -160,7 +227,7 @@ const chatManager = new ChatSessionManager({
             // the first session to connect populates connections for the worker.
             // Plugin-provided MCP servers (mcp-servers.json in installed plugins)
             // are merged in here so the model can actually call them.
-            mcpServers: mergePluginMcpServers(live.mcpServers ?? {}, live.disabledPlugins ?? []),
+            mcpServers: mergePluginMcpServers(live.mcpServers ?? {}, disabledPlugins, live.mcpServerOverrides ?? {}),
             // Per-session overrides from the protocol request; fall back to
             // settings.agent.* so the user's 个性化 settings actually apply
             // (previously slice arrived with only permissionMode+cwd, so these
@@ -168,6 +235,10 @@ const chatManager = new ChatSessionManager({
             // `live` is re-read from disk per session, so settings edits take effect
             // on the next session without a worker restart.
             permissionMode: slice.permissionMode,
+            // Workspace trust for this project (asserted by desktop main's
+            // trust-store, threaded via RunParams). When false, core strips the
+            // project's dangerous .code-shell settings (permissions/env/hooks/…).
+            projectTrusted: slice.projectTrusted,
             ...resolveSessionAgentConfig(slice, live),
             // Personalization + instruction compat come from disk settings only
             // (not per-request protocol overrides), so they read straight from
@@ -176,7 +247,7 @@ const chatManager = new ChatSessionManager({
             ...personalizationFrom(live.agent),
             maxTurns: slice.maxTurns,
             maxContextTokens: slice.maxContextTokens,
-            ...(slice.cwd ? { cwd: slice.cwd } : {}),
+            // cwd already set to sessionCwd above (slice.cwd → no-repo fallback).
         });
     },
     maxSessions: 16,
@@ -199,6 +270,19 @@ cronScheduler.setExecutionEnabled(false);
 cronScheduler.loadJobs();
 // ─── Step 5: AgentServer over stdio ──────────────────────────────
 const stdioTransport = new StdioTransport(process.stdin, process.stdout);
+// Cron jobs are persisted by this worker but only main arms/executes their
+// timers (this worker keeps setExecutionEnabled(false) above). When an AI tool
+// creates/deletes a cron job here, notify main over stdio so it reloads the
+// store and (re)arms its scheduler — otherwise AI-created jobs never fire.
+setCronChangedSink(() => {
+    stdioTransport.send(createNotification("agent/cronChanged", {}));
+});
+// Disk-only active-goal reader for agent/goalGet. In worker mode there is no
+// legacyEngine, and reopening a session after restart doesn't create a live
+// ChatSession (that only happens on a send), so chatManager.get() misses. This
+// reads the same ~/.code-shell/sessions/<id>/state.json every Engine writes, so
+// the goal block re-surfaces on load ("goal 还在但页面不显示" fix).
+const goalDiskReader = new SessionManager();
 const agentServer = new AgentServer({
     chatManager,
     transport: stdioTransport,
@@ -206,11 +290,25 @@ const agentServer = new AgentServer({
     // engineFactory uses for new sessions, so a reloaded running session and a
     // newly-created session converge on identical disk config (no divergence).
     settingsReader: freshSettings,
+    readActiveGoalFromDisk: (sessionId) => goalDiskReader.readActiveGoal(sessionId),
 });
 // Clean up on termination signals. Without this, SIGTERM (parent kill),
 // SIGINT (Ctrl+C), or SIGHUP would drop the process without closing sessions,
 // clearing the idle sweeper, or terminating child MCP/tool processes.
-// AgentServer.close() also closes the chatManager's sessions.
+// AgentServer.close() → chatManager.closeAll() also reaps background shells.
 installGracefulShutdown(agentServer);
+// Reap orphaned background shells left by a previously-crashed worker
+// (design §难点1): a worker crash detaches its `npm run dev` children, which
+// keep holding ports. Scanning pidfiles on boot lists still-alive groups as
+// `orphaned` (so ListShells/KillShell can clean them) and deletes stale ones.
+try {
+    const orphans = backgroundShellManager.reapOrphansFromPidfiles();
+    if (orphans.length > 0) {
+        logger.info("bg_shell.orphans_found", { count: orphans.length });
+    }
+}
+catch {
+    /* best-effort — never block worker startup on this */
+}
 // Keep the process alive — readline in StdioTransport holds the event loop.
 // On parent close / stdin EOF the process will exit naturally.