@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.2

package/dist/tool-system/builtin/index.js

@@ -4,6 +4,8 @@
 import { readToolDef, readTool } from "./read.js";
 import { writeToolDef, writeTool } from "./write.js";
 import { generateImageToolDef, generateImageTool, isGenerateImageAvailable } from "./generate-image.js";
+import { editModelCatalogToolDef, editModelCatalogTool } from "./edit-model-catalog.js";
+import { generateVideoToolDef, generateVideoTool, isGenerateVideoAvailable } from "./generate-video.js";
 import { viewImageToolDef, viewImageTool } from "./view-image.js";
 import { editToolDef, editTool } from "./edit.js";
 import { applyPatchToolDef, applyPatchTool } from "./apply-patch/index.js";
@@ -13,27 +15,33 @@ import { bashToolDef, bashTool } from "./bash.js";
 import { webSearchToolDef, webSearchTool, isWebSearchAvailable } from "./web-search.js";
 import { webFetchToolDef, webFetchTool } from "./web-fetch.js";
 import { askUserToolDef, askUserTool } from "./ask-user.js";
-import { agentToolDef, agentTool, agentStatusToolDef, agentStatusTool, agentCancelToolDef, agentCancelTool, } from "./agent.js";
+import { agentToolDef, agentTool, agentStatusToolDef, agentStatusTool, agentCancelToolDef, agentCancelTool, agentSendInputToolDef, agentSendInputTool, } from "./agent.js";
 import { enterPlanModeToolDef, enterPlanModeTool, exitPlanModeToolDef, exitPlanModeTool } from "./plan.js";
 import { toolSearchToolDef, toolSearchTool } from "./tool-search.js";
 import { todoWriteToolDef, todoWriteTool } from "./task.js";
 import { enterWorktreeToolDef, enterWorktreeTool, exitWorktreeToolDef, exitWorktreeTool } from "./worktree.js";
-import { sendMessageToolDef, sendMessageTool } from "./send-message.js";
 import { sleepToolDef, sleepTool } from "./sleep.js";
 import { configToolDef, configTool } from "./config.js";
 import { notebookEditToolDef, notebookEditTool } from "./notebook-edit.js";
 import { lspToolDef, lspTool } from "./lsp.js";
 import { cronCreateToolDef, cronCreateTool, cronDeleteToolDef, cronDeleteTool, cronListToolDef, cronListTool } from "./cron.js";
+import { driveClaudeCodeToolDef, driveClaudeCodeTool, driveAgentToolDef, driveAgentTool } from "./drive-claude-code.js";
+import { checkQuotaToolDef, checkQuotaTool } from "./check-quota.js";
 import { skillToolDef, skillTool } from "./skill.js";
 import { mcpToolDef, mcpToolExecute, listMcpResourcesToolDef, listMcpResourcesTool, readMcpResourceToolDef, readMcpResourceTool } from "./mcp-tools.js";
-import { remoteTriggerToolDef, remoteTriggerTool } from "./remote-trigger.js";
 import { replToolDef, replTool } from "./repl.js";
 import { briefToolDef, briefTool } from "./brief.js";
 import { powershellToolDef, powershellTool } from "./powershell.js";
 import { arenaToolDef, arenaTool } from "./arena.js";
 import { memoryListToolDef, memoryListTool, memoryReadToolDef, memoryReadTool, memorySaveToolDef, memorySaveTool, memoryDeleteToolDef, memoryDeleteTool, } from "./memory.js";
 import { completeGoalToolDef, completeGoalTool } from "./complete-goal.js";
+import { cancelGoalToolDef, cancelGoalTool } from "./cancel-goal.js";
 import { addMarketplaceToolDef, addMarketplaceTool } from "./add-marketplace.js";
+import { bashOutputToolDef, bashOutputTool, killShellToolDef, killShellTool, listShellsToolDef, listShellsTool, } from "./background-shell-tools.js";
+import { browserObserveToolDef, browserObserveTool, browserActToolDef, browserActTool, browserNavigateToolDef, browserNavigateTool, } from "./browser-tools.js";
+import { useCredentialToolDef, useCredentialTool } from "../../credentials/use-credential-tool.js";
+import { injectCredentialToolDef, injectCredentialTool, isInjectCredentialAvailable, } from "../../credentials/inject-credential-tool.js";
+import { CredentialStore } from "../../credentials/store.js";
 export const BUILTIN_TOOLS = [
     {
         definition: {
@@ -42,6 +50,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
         },
         execute: readTool,
     },
@@ -52,20 +61,58 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: writeTool,
     },
+    {
+        definition: {
+            ...editModelCatalogToolDef,
+            source: "builtin",
+            permissionDefault: "ask", // writes user config — confirm before each write
+            isReadOnly: false,
+            isConcurrencySafe: false, // serializes writes to the single catalog file
+        },
+        execute: editModelCatalogTool,
+    },
     {
         definition: {
             ...generateImageToolDef,
             source: "builtin",
             permissionDefault: "ask",
             isReadOnly: false,
-            isConcurrencySafe: false,
+            // Independent external I/O with no shared state — same class as WebFetch/GenerateVideo.
+            // Each call writes its own collision-free file (Date.now()+random suffix), so N images
+            // in one turn run concurrently (~3min for 6 instead of ~15min serial). Dependent chains
+            // (image → video) are forced across turns and serialize naturally via the drain barrier.
+            isConcurrencySafe: true,
             timeoutMs: 600_000, // 10min — high-quality / large image generation routinely exceeds the 120s default; give slow renders ample room while still bounding a hung request (Stop / ctx.signal cancels sooner)
+            // `referenceImages` are local files read off disk and shipped to the
+            // provider — gate them through the path-policy layer like Read, so an
+            // out-of-workspace ref ("../../etc/passwd") prompts for approval instead
+            // of silently leaking. (array arg → executor enforces each element)
+            pathPolicy: [{ kind: "arg", arg: "referenceImages", operation: "read" }],
         },
         execute: generateImageTool,
     },
+    {
+        definition: {
+            ...generateVideoToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: true,
+            // Returns fast (fire-and-forget: submits + backgrounds the poll loop),
+            // so the default timeout is plenty — the long poll runs detached.
+            // `images`/`image` may be local files (uploaded to the provider) — same
+            // path-policy gating as GenerateImage's referenceImages.
+            pathPolicy: [
+                { kind: "arg", arg: "images", operation: "read" },
+                { kind: "arg", arg: "image", operation: "read" },
+            ],
+        },
+        execute: generateVideoTool,
+    },
     {
         definition: {
             ...viewImageToolDef,
@@ -73,6 +120,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read" }],
         },
         execute: viewImageTool,
     },
@@ -83,6 +131,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "write" }],
         },
         execute: editTool,
     },
@@ -93,6 +142,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [{ kind: "apply_patch", arg: "patch", operation: "write" }],
         },
         execute: applyPatchTool,
     },
@@ -103,6 +153,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read", defaultToCwd: true }],
         },
         execute: globTool,
     },
@@ -113,6 +164,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "path", operation: "read", defaultToCwd: true }],
         },
         execute: grepTool,
     },
@@ -127,6 +179,37 @@ export const BUILTIN_TOOLS = [
         },
         execute: bashTool,
     },
+    // ─── Background shells (Bash run_in_background companions) ──────
+    {
+        definition: {
+            ...bashOutputToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: bashOutputTool,
+    },
+    {
+        definition: {
+            ...killShellToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: killShellTool,
+    },
+    {
+        definition: {
+            ...listShellsToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: listShellsTool,
+    },
     {
         definition: {
             ...webSearchToolDef,
@@ -189,6 +272,17 @@ export const BUILTIN_TOOLS = [
         },
         execute: agentCancelTool,
     },
+    {
+        definition: {
+            ...agentSendInputToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+            timeoutMs: 1_800_000, // 30min — a continuation may execute many tool calls, like Agent
+        },
+        execute: agentSendInputTool,
+    },
     {
         definition: {
             ...enterPlanModeToolDef,
@@ -250,16 +344,6 @@ export const BUILTIN_TOOLS = [
         },
         execute: exitWorktreeTool,
     },
-    {
-        definition: {
-            ...sendMessageToolDef,
-            source: "builtin",
-            permissionDefault: "allow",
-            isReadOnly: false,
-            isConcurrencySafe: true,
-        },
-        execute: sendMessageTool,
-    },
     // ─── Phase 5: Utility Tools ────────────────────────────────────
     {
         definition: {
@@ -288,6 +372,13 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "ask",
             isReadOnly: false,
             isConcurrencySafe: false,
+            pathPolicy: [
+                {
+                    kind: "arg",
+                    arg: "file_path",
+                    operation: { fromArg: "action", readValues: ["read"], default: "write" },
+                },
+            ],
         },
         execute: notebookEditTool,
     },
@@ -299,6 +390,7 @@ export const BUILTIN_TOOLS = [
             permissionDefault: "allow",
             isReadOnly: true,
             isConcurrencySafe: true,
+            pathPolicy: [{ kind: "arg", arg: "file_path", operation: "read" }],
         },
         execute: lspTool,
     },
@@ -333,6 +425,43 @@ export const BUILTIN_TOOLS = [
         },
         execute: cronListTool,
     },
+    // ─── Drive external coding-agent CLI (claude / codex) ──────────
+    {
+        definition: {
+            ...driveAgentToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: driveAgentTool,
+    },
+    // Back-compat alias: DriveClaudeCode = DriveAgent pinned to cli:claude. Kept
+    // registered so old prompts/memories that name DriveClaudeCode still resolve.
+    {
+        definition: {
+            ...driveClaudeCodeToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: driveClaudeCodeTool,
+    },
+    // ─── Check remaining CC/Codex subscription quota ──────────────
+    {
+        definition: {
+            ...checkQuotaToolDef,
+            source: "builtin",
+            // Read-only intent (reports quota, mutates nothing). Note: the "claude"
+            // path sends a 1-token probe (Anthropic exposes quota only via response
+            // headers) — that tiny cost is documented in the tool description.
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: checkQuotaTool,
+    },
     // ─── Phase 7: Missing tools from restored-src ─────────────────
     {
         definition: {
@@ -368,22 +497,17 @@ export const BUILTIN_TOOLS = [
         definition: {
             ...readMcpResourceToolDef,
             source: "builtin",
-            permissionDefault: "allow",
+            // Reading resource CONTENT (unlike enumerating names) can pull arbitrary
+            // data — potentially secrets — from a connected MCP server. Default to ask
+            // rather than the old unconditional allow so a default-mode session
+            // confirms the read; the executor also gates the target server against the
+            // session's allowedMcpServers.
+            permissionDefault: "ask",
             isReadOnly: true,
             isConcurrencySafe: true,
         },
         execute: readMcpResourceTool,
     },
-    {
-        definition: {
-            ...remoteTriggerToolDef,
-            source: "builtin",
-            permissionDefault: "ask",
-            isReadOnly: false,
-            isConcurrencySafe: false,
-        },
-        execute: remoteTriggerTool,
-    },
     {
         definition: {
             ...replToolDef,
@@ -485,6 +609,21 @@ export const BUILTIN_TOOLS = [
         },
         execute: completeGoalTool,
     },
+    // ─── Goal mode: user-initiated cancellation ────────────────────
+    // Distinct from complete_goal — the user explicitly asked to abandon the
+    // goal. The turn-loop short-circuits on this call (only when confirm===true)
+    // AND clears the persisted goal. The tool itself only records an
+    // acknowledgement string, so it's read-only and concurrency-safe.
+    {
+        definition: {
+            ...cancelGoalToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: cancelGoalTool,
+    },
     // ─── Plugin marketplace: model-driven source registration ──────
     {
         definition: {
@@ -497,6 +636,73 @@ export const BUILTIN_TOOLS = [
         },
         execute: addMarketplaceTool,
     },
+    // Browser automation — 3 semantic tools driving the in-app webview via the
+    // BrowserBridge (CDP). All serial on one webview (isConcurrencySafe:false).
+    // browser_observe is read-only. browser_act is permissionDefault "allow"; its
+    // sensitive actions (click/type/select) are escalated to "ask" by a preset
+    // PermissionRule keyed on argsPattern { action } (see preset/index.ts §4.6) —
+    // so one tool carries per-action gating. Sensitive-action + domain-whitelist
+    // enforcement also lives main-side in the bridge. Tools self-gate to
+    // unavailable when no bridge is wired (headless).
+    {
+        definition: {
+            ...browserObserveToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: false,
+            timeoutMs: 30_000, // wait/observe can sit through a load; RPC headroom
+        },
+        execute: browserObserveTool,
+    },
+    {
+        definition: {
+            ...browserActToolDef,
+            source: "builtin",
+            permissionDefault: "allow", // per-action gating via preset rule (argsPattern.action)
+            isReadOnly: false,
+            isConcurrencySafe: false,
+            timeoutMs: 30_000, // the wait action internally bounds; give RPC headroom
+        },
+        execute: browserActTool,
+    },
+    {
+        definition: {
+            ...browserNavigateToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: browserNavigateTool,
+    },
+    // ─── Credentials: AI 取用已存凭证(token/link/cookie) ──────────
+    // permissionDefault:"allow" —— 取用审批由工具内部的 CredentialUseGate 负责
+    // (默认问/本会话记住/全自动),不走工具级权限层,避免双重弹窗。
+    // 读取凭证库本身不写文件(cookie 物化成临时 cookies.txt 是用完即弃的副产物)。
+    {
+        definition: {
+            ...useCredentialToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: true,
+            isConcurrencySafe: true,
+        },
+        execute: useCredentialTool,
+    },
+    // InjectCredential:把 cookie 凭证注入内置浏览器(恢复登录态)。审批由工具内部
+    // CredentialUseGate 负责(逐条 autoInjectByAI),故 permissionDefault:"allow"。
+    // 改浏览器登录态有副作用 → 非 read-only。
+    {
+        definition: {
+            ...injectCredentialToolDef,
+            source: "builtin",
+            permissionDefault: "allow",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+        },
+        execute: injectCredentialTool,
+    },
 ];
 /**
  * Per-tool availability predicates. A tool listed here is filtered OUT of the
@@ -507,4 +713,22 @@ export const BUILTIN_TOOLS = [
 export const BUILTIN_TOOL_GUARDS = new Map([
     [webSearchToolDef.name, isWebSearchAvailable],
     [generateImageToolDef.name, isGenerateImageAvailable],
+    [generateVideoToolDef.name, isGenerateVideoAvailable],
+    // UseCredential is hidden until at least one credential exists — keeps it out
+    // of the tool list (and the context) for the common no-credentials case,
+    // matching the spec's "quiet when empty" intent (true ToolSearch-deferral for
+    // builtins isn't wired in the engine).
+    [useCredentialToolDef.name, isUseCredentialAvailable],
+    // InjectCredential hidden until ≥1 cookie credential exists (browser injection
+    // is cookie-only). Also degrades at call time if no browser bridge is wired.
+    [injectCredentialToolDef.name, isInjectCredentialAvailable],
 ]);
+/** UseCredential is available when the cwd's CredentialStore has ≥1 credential. */
+export function isUseCredentialAvailable(cwd) {
+    try {
+        return new CredentialStore(cwd).listMasked().length > 0;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/tool-system/builtin/mcp-tools.js

@@ -28,10 +28,13 @@ export async function mcpToolExecute(args) {
     const server = args.server;
     const tool = args.tool;
     const toolArgs = args.arguments ?? {};
+    // Forward the run's abort signal (registry injects __signal) so Stop cancels
+    // an in-flight MCP call instead of waiting out the SDK's default timeout.
+    const signal = args.__signal;
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const result = await manager.callTool(server, tool, toolArgs);
+        const result = await manager.callTool(server, tool, toolArgs, signal);
         return typeof result === "string" ? result : JSON.stringify(result, null, 2);
     }
     catch (err) {
@@ -54,10 +57,26 @@ export const listMcpResourcesToolDef = {
 };
 export async function listMcpResourcesTool(args) {
     const server = args.server ?? "";
+    // The executor injects the session's allowed-server set (see executor.ts).
+    // When no explicit server filter is given, we must only enumerate resources
+    // from servers THIS session enabled — otherwise a shared worker leaks another
+    // session's MCP resources. An undefined set means "no gating" (legacy/sub-agent).
+    const allowed = args.__allowedMcpServers;
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const resources = await manager.listResources(server || undefined);
+        // Forward the run's abort signal (registry injects __signal) so Stop cancels
+        // promptly instead of waiting out the SDK's default request timeout.
+        const signal = args.__signal;
+        let resources = await manager.listResources(server || undefined, signal);
+        if (allowed && resources) {
+            resources = resources.filter((r) => {
+                // Resource entries may carry the owning server on `serverName`/`server`;
+                // when unknown, drop it under gating rather than risk a cross-session leak.
+                const owner = (r.serverName ?? r.server);
+                return owner ? allowed.has(owner) : false;
+            });
+        }
         if (!resources || resources.length === 0) {
             return "No MCP resources available.";
         }
@@ -93,7 +112,8 @@ export async function readMcpResourceTool(args) {
     try {
         const { MCPManager } = await import("../mcp-manager.js");
         const manager = MCPManager.getInstance();
-        const content = await manager.readResource(server, uri);
+        const signal = args.__signal;
+        const content = await manager.readResource(server, uri, signal);
         return typeof content === "string" ? content : JSON.stringify(content, null, 2);
     }
     catch (err) {

package/dist/tool-system/builtin/memory.js

@@ -25,9 +25,23 @@ function parseScope(raw) {
     }
     return raw;
 }
-function mmFor(ctx, scope) {
-    return new MemoryManager({ projectDir: ctx?.cwd, scope });
+/** Location: "global" → cross-project store (no projectDir); "project"
+ *  (default, back-compat) → this repo's store. Anything else → "project". */
+function parseLocation(raw) {
+    return raw === "global" ? "global" : "project";
 }
+function mmFor(ctx, scope, location = "project") {
+    // location=global → omit projectDir so the manager points at the global store.
+    return new MemoryManager({
+        projectDir: location === "global" ? undefined : ctx?.cwd,
+        scope,
+    });
+}
+const LOCATION_SCHEMA = {
+    type: "string",
+    enum: ["global", "project"],
+    description: 'Which store: "global" (applies across all projects) or "project" (this repo only). Defaults to "project".',
+};
 // ─── MemoryList ────────────────────────────────────────────────────────────
 export const memoryListToolDef = {
     name: "MemoryList",
@@ -43,6 +57,7 @@ export const memoryListToolDef = {
                 enum: ["user", "dream"],
                 description: "Which scope to list",
             },
+            location: LOCATION_SCHEMA,
         },
         required: ["scope"],
     },
@@ -53,7 +68,7 @@ export async function memoryListTool(args, ctx) {
         return scope;
     }
     try {
-        const mm = mmFor(ctx, scope);
+        const mm = mmFor(ctx, scope, parseLocation(args.location));
         const entries = mm.loadAll();
         if (entries.length === 0)
             return `(no memories in scope "${scope}")`;
@@ -78,6 +93,7 @@ export const memoryReadToolDef = {
                 enum: ["user", "dream"],
                 description: "Which scope to read from",
             },
+            location: LOCATION_SCHEMA,
             name: {
                 type: "string",
                 description: "The memory entry's name (from MemoryList output)",
@@ -91,15 +107,32 @@ export async function memoryReadTool(args, ctx) {
     if (typeof scope !== "string" || !VALID_SCOPES.includes(scope)) {
         return scope;
     }
+    const location = parseLocation(args.location);
     const name = args.name;
     if (typeof name !== "string" || !name)
         return "Error: name is required";
     try {
-        const mm = mmFor(ctx, scope);
+        const mm = mmFor(ctx, scope, location);
         const entries = mm.loadAll();
         const entry = entries.find((e) => e.name === name || e.fileName === name);
         if (!entry)
             return `Error: no memory named "${name}" in scope "${scope}"`;
+        // Recall signal (用户拍板 C + 可见性): reading a memory bumps its usage so
+        // the recall-TTL sweep keeps frequently-read memories alive, and emits a
+        // stream event so the UI can show the user this memory was actually used.
+        // Best-effort — never let accounting failure break the read.
+        try {
+            mm.recordRecall(entry.name);
+            const cb = ctx?.streamCallback;
+            if (cb) {
+                // scope here is always "user"|"dream" (validated above); pending is
+                // never tool-readable, so the narrower event type is correct.
+                void cb({ type: "memory_recalled", name: entry.name, scope: scope, location });
+            }
+        }
+        catch {
+            // ignore — the read result below is what matters
+        }
         return (`name: ${entry.name}\n` +
             `description: ${entry.description}\n` +
             `type: ${entry.type}\n` +
@@ -120,6 +153,8 @@ export const memorySaveToolDef = {
         "feedback (how to approach work), " +
         "project (non-obvious facts about ongoing work), " +
         "reference (pointers to external resources). " +
+        "Pick `location`: global (a lesson/preference true in ANY project) vs project (this repo only). " +
+        "If a memory in the injected index is now stale or wrong, overwrite it (same name) or MemoryDelete it — keep the store correct rather than letting contradictions pile up. " +
         "The `description` is a one-line summary shown in the index; the `content` is the full body.",
     inputSchema: {
         type: "object",
@@ -129,6 +164,7 @@ export const memorySaveToolDef = {
                 enum: ["user", "dream"],
                 description: "Which scope to save to",
             },
+            location: LOCATION_SCHEMA,
             name: {
                 type: "string",
                 description: "Short kebab-case identifier (also becomes the filename slug)",
@@ -169,14 +205,15 @@ export async function memorySaveTool(args, ctx) {
         return `Error: type must be one of ${VALID_TYPES.join(", ")}`;
     }
     try {
-        const mm = mmFor(ctx, scope);
+        const location = parseLocation(args.location);
+        const mm = mmFor(ctx, scope, location);
         const fileName = mm.save({
             name,
             description,
             type: type,
             content,
         });
-        return `Saved memory "${name}" → ${scope}/${fileName}`;
+        return `Saved memory "${name}" → ${location}/${scope}/${fileName}`;
     }
     catch (err) {
         return `Error saving memory: ${err.message}`;
@@ -197,6 +234,7 @@ export const memoryDeleteToolDef = {
                 enum: ["user", "dream"],
                 description: "Which scope to delete from",
             },
+            location: LOCATION_SCHEMA,
             name: {
                 type: "string",
                 description: "The memory entry's name (from MemoryList output)",
@@ -214,7 +252,7 @@ export async function memoryDeleteTool(args, ctx) {
     if (typeof name !== "string" || !name)
         return "Error: name is required";
     try {
-        const mm = mmFor(ctx, scope);
+        const mm = mmFor(ctx, scope, parseLocation(args.location));
         const ok = mm.delete(name);
         return ok
             ? `Deleted memory "${name}" from scope "${scope}" (moved to memory-trash/)`

package/dist/tool-system/builtin/notebook-edit.js

@@ -2,7 +2,6 @@
  * NotebookEditTool — read and edit Jupyter notebook (.ipynb) cells.
  */
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
-import { enforcePathPolicy } from "../path-policy.js";
 export const notebookEditToolDef = {
     name: "NotebookEdit",
     description: "Edit a Jupyter notebook (.ipynb) file. Supports actions: " +
@@ -44,12 +43,6 @@ export async function notebookEditTool(args, ctx) {
         return "Error: file_path is required";
     if (!filePath.endsWith(".ipynb"))
         return "Error: file must be a .ipynb file";
-    // Path policy: 'read' goes through the read-side rules (sensitive paths
-    // still ask), all other actions are writes and use the stricter rules.
-    const op = action === "read" ? "read" : "write";
-    const blocked = enforcePathPolicy(filePath, op, ctx?.cwd);
-    if (blocked)
-        return blocked;
     if (action === "read") {
         if (!existsSync(filePath))
             return `Error: File not found: ${filePath}`;

package/dist/tool-system/builtin/powershell.js

@@ -27,7 +27,10 @@ export const powershellToolDef = {
 const PS_MAX_BUFFER = 5 * 1024 * 1024;
 export async function powershellTool(args, ctx) {
     const command = args.command;
-    const timeout = args.timeout ?? 120_000;
+    // `??` only catches null/undefined — a non-positive timeout (0/-5) would slip
+    // through to setTimeout (clamped to 0 → near-instant kill). Floor to default.
+    const rawTimeout = args.timeout;
+    const timeout = typeof rawTimeout === "number" && rawTimeout > 0 ? rawTimeout : 120_000;
     if (!command.trim()) {
         return "Error: command is required.";
     }