@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.2

package/dist/credentials/index.d.ts

@@ -0,0 +1,7 @@
+export { CredentialStore } from "./store.js";
+export type { CredentialScope, MaskedCredential } from "./store.js";
+export { type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export type { Credential, CredentialType, CredentialStoreFile } from "./types.js";
+export { formatNetscapeCookies, parseCookieJar, type CookieLike } from "./cookie-jar.js";
+export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
+export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/index.js

@@ -0,0 +1,5 @@
+export { CredentialStore } from "./store.js";
+export { PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
+export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/inject-credential-tool.d.ts

@@ -0,0 +1,20 @@
+/**
+ * InjectCredential 工具:把一条 cookie 凭证「注入内置浏览器」(恢复登录态),
+ * 让 AI 能以该账号身份在内置浏览器面板做 UI 操作(配 browser_* 工具)。
+ *
+ * 与 UseCredential 的区别:
+ *  - UseCredential 取 cookie 文件路径走 HTTP 请求(curl/yt-dlp),只读、不改浏览器。
+ *  - InjectCredential 改的是内置浏览器的登录态(先清再灌),副作用更大 →
+ *    独立的逐条门 `autoInjectByAI`(不复用 autoUseByAI)。
+ *
+ * 跨进程:实际的 restoreCookiesToBrowser 在 desktop main(core 够不到 Electron
+ * session),经 `ctx.injectCredentialToBrowser` 回调(宿主注入,镜像 askUser)触发。
+ */
+import type { ToolDefinition } from "../types.js";
+import type { ToolContext } from "../tool-system/context.js";
+export declare const injectCredentialToolDef: ToolDefinition;
+/** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
+export declare function isInjectCredentialAvailable(cwd: string): boolean;
+export declare function injectCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+/** 测试钩子:清空会话 allow 集。 */
+export declare function __resetInjectCredentialSessionAllowForTests(): void;

package/dist/credentials/inject-credential-tool.js

@@ -0,0 +1,130 @@
+/**
+ * InjectCredential 工具:把一条 cookie 凭证「注入内置浏览器」(恢复登录态),
+ * 让 AI 能以该账号身份在内置浏览器面板做 UI 操作(配 browser_* 工具)。
+ *
+ * 与 UseCredential 的区别:
+ *  - UseCredential 取 cookie 文件路径走 HTTP 请求(curl/yt-dlp),只读、不改浏览器。
+ *  - InjectCredential 改的是内置浏览器的登录态(先清再灌),副作用更大 →
+ *    独立的逐条门 `autoInjectByAI`(不复用 autoUseByAI)。
+ *
+ * 跨进程:实际的 restoreCookiesToBrowser 在 desktop main(core 够不到 Electron
+ * session),经 `ctx.injectCredentialToBrowser` 回调(宿主注入,镜像 askUser)触发。
+ */
+import { CredentialStore } from "./store.js";
+import { credentialUseGate, } from "./use-gate.js";
+import { SettingsManager } from "../settings/manager.js";
+const TOOL_NAME = "InjectCredential";
+const BASE_DESCRIPTION = "Inject a stored COOKIE credential into the built-in browser to restore its " +
+    "login state, so you can then drive the page as that logged-in account with the " +
+    "browser_* tools (snapshot/click/type/navigate). This replaces the browser's " +
+    "current cookies.\n\n" +
+    "ONLY call this when the user EXPLICITLY asks to log in / act as a specific " +
+    "account / do something that requires being signed in. Do NOT call it just to " +
+    "open, navigate to, or browse a site — 'open 小红书 / go to <url> / take a look' " +
+    "is plain navigation: use browser_navigate WITHOUT injecting any cookies. " +
+    "Injecting overwrites the browser's current session, so an unrequested inject is " +
+    "a surprising, destructive side effect. When unsure whether login is wanted, " +
+    "navigate first and ask the user rather than injecting.\n\n" +
+    "When it IS wanted: call UseCredential with no args first to see available " +
+    "credentials, then call this with `id` of a cookie credential. For HTTP " +
+    "scraping/downloads (curl/yt-dlp) use UseCredential instead — this is only for " +
+    "driving the built-in browser UI. Gated by a quick user approval unless the " +
+    "credential has auto-inject enabled.";
+export const injectCredentialToolDef = {
+    name: TOOL_NAME,
+    description: BASE_DESCRIPTION,
+    inputSchema: {
+        type: "object",
+        properties: {
+            id: {
+                type: "string",
+                description: "Cookie credential id to inject into the built-in browser.",
+            },
+            purpose: {
+                type: "string",
+                description: "Short reason you need it (shown in the approval prompt).",
+            },
+        },
+        required: ["id"],
+    },
+};
+/** 内存会话 allow 集(每 Engine 一份,与 UseCredential 分开:注入是独立动作)。 */
+const injectSessionAllowByEngine = new Map();
+function sessionAllowFor(ctx) {
+    // 同 UseCredential:无 sessionId 时绝不共享全局桶,返回一次性 Set,避免跨上下文串台。
+    if (!ctx?.sessionId)
+        return new Set();
+    const key = ctx.sessionId;
+    let set = injectSessionAllowByEngine.get(key);
+    if (!set) {
+        set = new Set();
+        injectSessionAllowByEngine.set(key, set);
+    }
+    return set;
+}
+function readAutoApprove(cwd) {
+    try {
+        const s = new SettingsManager(cwd, "full").get();
+        return s.credentialUse?.autoApprove === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
+export function isInjectCredentialAvailable(cwd) {
+    try {
+        return new CredentialStore(cwd).listMasked().some((c) => c.type === "cookie");
+    }
+    catch {
+        return false;
+    }
+}
+export async function injectCredentialTool(args, ctx) {
+    const cwd = ctx?.cwd ?? process.cwd();
+    const id = typeof args.id === "string" ? args.id.trim() : "";
+    const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
+    if (!id) {
+        return json({ kind: "error", error: "缺少 id。先用 UseCredential(无参)列出凭证,再用 cookie 凭证的 id 调本工具。" });
+    }
+    if (!ctx?.injectCredentialToBrowser) {
+        return json({
+            kind: "error",
+            error: "当前环境无内置浏览器(headless/无面板),无法注入。请改用 UseCredential 取 cookie 走 HTTP 请求。",
+        });
+    }
+    const cred = new CredentialStore(cwd).resolve(id);
+    if (!cred) {
+        return json({ kind: "error", error: `凭证不存在: "${id}"。调用 UseCredential(无参)可列出可用凭证。` });
+    }
+    if (cred.type !== "cookie") {
+        return json({ kind: "error", error: `凭证「${cred.label}」不是 cookie 类型,不能注入浏览器。` });
+    }
+    // 过门:复用三档,但用该凭证的 autoInjectByAI(不是 autoUseByAI)。
+    const ask = ctx.askUser ? (q, opts) => ctx.askUser(q, opts) : undefined;
+    const decision = await credentialUseGate({ id: cred.id, label: cred.label, purpose }, {
+        autoApprove: readAutoApprove(cwd),
+        credentialAutoUse: cred.autoInjectByAI === true,
+        sessionAllow: sessionAllowFor(ctx),
+        ask,
+    });
+    if (!decision.allowed) {
+        const msg = decision.reason === "no-ui"
+            ? "无法注入:当前无审批 UI(headless),且该凭证未开启自动注入。"
+            : `用户拒绝把「${cred.label}」注入浏览器。`;
+        return json({ kind: "error", error: msg });
+    }
+    // 跨进程触发宿主注入。
+    const res = await ctx.injectCredentialToBrowser(cred.id);
+    if (!res.ok) {
+        return json({ kind: "error", error: res.error ?? "注入浏览器失败(宿主未返回成功)。" });
+    }
+    return json({ kind: "injected", count: res.count ?? 0 });
+}
+function json(r) {
+    return JSON.stringify(r);
+}
+/** 测试钩子:清空会话 allow 集。 */
+export function __resetInjectCredentialSessionAllowForTests() {
+    injectSessionAllowByEngine.clear();
+}

package/dist/credentials/store.d.ts

@@ -0,0 +1,72 @@
+import type { Credential } from "./types.js";
+import { type EncryptionCipher } from "./cipher.js";
+export type CredentialScope = "user" | "project";
+export interface MaskedCredential extends Omit<Credential, "secret"> {
+    hasSecret: boolean;
+    /** 形如 `****abcd`,绝不含完整明文。 */
+    secretHint?: string;
+}
+/**
+ * 两层凭证库,镜像 SettingsManager 的 user(~/.code-shell)/ project(<cwd>/.code-shell)
+ * 双层模型。只存 token / link;cookie 不进库(见 credentials-module 设计稿)。
+ */
+export declare class CredentialStore {
+    private readonly cwd?;
+    private readonly cipher;
+    /**
+     * @param cwd     project root for the project-scope store (undefined → user only).
+     * @param cipher  secret encryption strategy. Defaults to the process-wide
+     *                cipher (see setDefaultCredentialCipher) — PlaintextCipher
+     *                unless the host installed one. The store always sees and
+     *                returns PLAINTEXT secrets; encryption is applied only at the
+     *                disk boundary (read decrypts, write encrypts).
+     */
+    constructor(cwd?: string | undefined, cipher?: EncryptionCipher);
+    private pathFor;
+    /**
+     * Decrypt a stored secret to plaintext. A value this cipher can't decrypt
+     * (foreign ciphertext, or legacy plaintext under an encrypting cipher that
+     * rejects it) is left as-is rather than crashing the whole store — the worst
+     * case is one unusable credential, not an empty list. Re-encryption happens
+     * lazily on the next save() of that credential.
+     */
+    private decryptSecret;
+    private read;
+    private write;
+    /** Upsert by id within a scope. */
+    save(scope: CredentialScope, cred: Credential): void;
+    /**
+     * 只改元数据(label / exposeAsEnv / autoUseByAI / meta),保留 secret 原样。
+     * 给 UI「编辑/开关」用 —— 渲染层拿不到明文 secret,故不能走 save(会清空)。
+     * id 不存在则 no-op。
+     */
+    patch(scope: CredentialScope, id: string, fields: Partial<Pick<Credential, "label" | "exposeAsEnv" | "autoUseByAI" | "autoInjectByAI" | "meta">>): void;
+    remove(scope: CredentialScope, id: string): void;
+    /**
+     * List credentials visible to an engine of the given settings scope.
+     *   - "full" (default): merge user(~/.code-shell) then project, project wins —
+     *     the host-application behavior.
+     *   - "project": ONLY the project store. A project/isolated-scope engine
+     *     (e.g. SDK-embedded) must never surface the host user's credentials —
+     *     same host-isolation contract as {@link envExposures} and top-level env.
+     */
+    list(scope?: "full" | "project"): Credential[];
+    resolve(id: string, scope?: "full" | "project"): Credential | undefined;
+    /**
+     * Credentials flagged "expose as env var" → a `{ ENV_NAME: secret }` map for
+     * layering into the shell env (Engine.readShellEnv). This is the missing
+     * consumer of `Credential.exposeAsEnv` — the UI/store recorded the flag but
+     * nothing injected the secret, so `$FIGMA_TOKEN` was always empty.
+     *
+     * `scope` mirrors the engine's settings scope to keep the host-isolation
+     * contract identical to top-level `env`:
+     *   - "full": merge user(~/.code-shell) then project (project wins), matching
+     *     `list()` precedence.
+     *   - "project": ONLY the project store — a project-scoped engine must never
+     *     surface the host user's credentials (SDK-embedding safety).
+     * Only credentials with BOTH a non-empty exposeAsEnv and a non-empty secret
+     * contribute; a later layer (project) overrides an earlier env name.
+     */
+    envExposures(scope: "full" | "project"): Record<string, string>;
+    listMasked(scope?: "full" | "project"): MaskedCredential[];
+}

package/dist/credentials/store.js

@@ -0,0 +1,184 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { getDefaultCredentialCipher } from "./cipher.js";
+import { logger } from "../logging/logger.js";
+/** 测试可经 process.env.HOME 覆盖(镜像 settings/manager.ts userHome)。 */
+function userHome() {
+    return process.env.HOME ?? homedir();
+}
+const EMPTY = { version: 1, credentials: [] };
+/**
+ * 两层凭证库,镜像 SettingsManager 的 user(~/.code-shell)/ project(<cwd>/.code-shell)
+ * 双层模型。只存 token / link;cookie 不进库(见 credentials-module 设计稿)。
+ */
+export class CredentialStore {
+    cwd;
+    cipher;
+    /**
+     * @param cwd     project root for the project-scope store (undefined → user only).
+     * @param cipher  secret encryption strategy. Defaults to the process-wide
+     *                cipher (see setDefaultCredentialCipher) — PlaintextCipher
+     *                unless the host installed one. The store always sees and
+     *                returns PLAINTEXT secrets; encryption is applied only at the
+     *                disk boundary (read decrypts, write encrypts).
+     */
+    constructor(cwd, cipher) {
+        this.cwd = cwd;
+        this.cipher = cipher ?? getDefaultCredentialCipher();
+    }
+    pathFor(scope) {
+        if (scope === "user")
+            return join(userHome(), ".code-shell", "credentials.json");
+        if (!this.cwd)
+            return undefined;
+        return join(this.cwd, ".code-shell", "credentials.json");
+    }
+    /**
+     * Decrypt a stored secret to plaintext. A value this cipher can't decrypt
+     * (foreign ciphertext, or legacy plaintext under an encrypting cipher that
+     * rejects it) is left as-is rather than crashing the whole store — the worst
+     * case is one unusable credential, not an empty list. Re-encryption happens
+     * lazily on the next save() of that credential.
+     */
+    decryptSecret(stored) {
+        try {
+            if (this.cipher.canDecrypt && !this.cipher.canDecrypt(stored))
+                return stored;
+            return this.cipher.decrypt(stored);
+        }
+        catch (err) {
+            logger.warn("credentials.decrypt_fail", { error: err.message });
+            return stored;
+        }
+    }
+    read(scope) {
+        const p = this.pathFor(scope);
+        if (!p || !existsSync(p))
+            return { ...EMPTY, credentials: [] };
+        try {
+            const raw = JSON.parse(readFileSync(p, "utf8"));
+            const creds = Array.isArray(raw.credentials) ? raw.credentials : [];
+            // Decrypt secrets at the disk boundary so all callers see plaintext.
+            for (const c of creds) {
+                if (typeof c.secret === "string" && c.secret.length > 0) {
+                    c.secret = this.decryptSecret(c.secret);
+                }
+            }
+            return { version: 1, credentials: creds };
+        }
+        catch {
+            return { ...EMPTY, credentials: [] };
+        }
+    }
+    write(scope, file) {
+        const p = this.pathFor(scope);
+        if (!p)
+            return;
+        mkdirSync(dirname(p), { recursive: true });
+        // Encrypt secrets at the disk boundary. `file` carries plaintext secrets
+        // (read() decrypted them); serialize a copy with each secret encrypted so
+        // we never persist plaintext under an encrypting cipher.
+        const onDisk = {
+            version: file.version,
+            credentials: file.credentials.map((c) => typeof c.secret === "string" && c.secret.length > 0
+                ? { ...c, secret: this.cipher.encrypt(c.secret) }
+                : c),
+        };
+        const tmp = `${p}.${process.pid}.${String(performance.now()).replace(".", "")}.tmp`;
+        writeFileSync(tmp, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
+        renameSync(tmp, p);
+    }
+    /** Upsert by id within a scope. */
+    save(scope, cred) {
+        const file = this.read(scope);
+        const idx = file.credentials.findIndex((c) => c.id === cred.id);
+        if (idx >= 0)
+            file.credentials[idx] = cred;
+        else
+            file.credentials.push(cred);
+        this.write(scope, file);
+    }
+    /**
+     * 只改元数据(label / exposeAsEnv / autoUseByAI / meta),保留 secret 原样。
+     * 给 UI「编辑/开关」用 —— 渲染层拿不到明文 secret,故不能走 save(会清空)。
+     * id 不存在则 no-op。
+     */
+    patch(scope, id, fields) {
+        const file = this.read(scope);
+        const idx = file.credentials.findIndex((c) => c.id === id);
+        if (idx < 0)
+            return;
+        file.credentials[idx] = { ...file.credentials[idx], ...fields };
+        this.write(scope, file);
+    }
+    remove(scope, id) {
+        const file = this.read(scope);
+        file.credentials = file.credentials.filter((c) => c.id !== id);
+        this.write(scope, file);
+    }
+    /**
+     * List credentials visible to an engine of the given settings scope.
+     *   - "full" (default): merge user(~/.code-shell) then project, project wins —
+     *     the host-application behavior.
+     *   - "project": ONLY the project store. A project/isolated-scope engine
+     *     (e.g. SDK-embedded) must never surface the host user's credentials —
+     *     same host-isolation contract as {@link envExposures} and top-level env.
+     */
+    list(scope = "full") {
+        const byId = new Map();
+        if (scope === "full") {
+            for (const c of this.read("user").credentials)
+                byId.set(c.id, c);
+        }
+        for (const c of this.read("project").credentials)
+            byId.set(c.id, c); // project wins
+        return [...byId.values()];
+    }
+    resolve(id, scope = "full") {
+        return this.list(scope).find((c) => c.id === id);
+    }
+    /**
+     * Credentials flagged "expose as env var" → a `{ ENV_NAME: secret }` map for
+     * layering into the shell env (Engine.readShellEnv). This is the missing
+     * consumer of `Credential.exposeAsEnv` — the UI/store recorded the flag but
+     * nothing injected the secret, so `$FIGMA_TOKEN` was always empty.
+     *
+     * `scope` mirrors the engine's settings scope to keep the host-isolation
+     * contract identical to top-level `env`:
+     *   - "full": merge user(~/.code-shell) then project (project wins), matching
+     *     `list()` precedence.
+     *   - "project": ONLY the project store — a project-scoped engine must never
+     *     surface the host user's credentials (SDK-embedding safety).
+     * Only credentials with BOTH a non-empty exposeAsEnv and a non-empty secret
+     * contribute; a later layer (project) overrides an earlier env name.
+     */
+    envExposures(scope) {
+        const out = {};
+        const layers = scope === "project"
+            ? [this.read("project").credentials]
+            : [this.read("user").credentials, this.read("project").credentials];
+        for (const layer of layers) {
+            for (const c of layer) {
+                const name = c.exposeAsEnv?.trim();
+                if (name && typeof c.secret === "string" && c.secret.length > 0) {
+                    out[name] = c.secret;
+                }
+            }
+        }
+        return out;
+    }
+    listMasked(scope = "full") {
+        return this.list(scope).map((c) => {
+            const { secret, ...rest } = c;
+            return {
+                ...rest,
+                hasSecret: typeof secret === "string" && secret.length > 0,
+                // Reveal at most the last 4 chars — and ONLY when the secret is longer
+                // than 4, so those chars aren't the whole secret. `"ab".slice(-4)` is
+                // "ab", so a short secret would otherwise leak in full through the hint.
+                secretHint: secret ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
+            };
+        });
+    }
+}

package/dist/credentials/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 常驻凭证:token / link / cookie。
+ * - token/link 第一期已有;cookie 第二期改为「具名 cookie 凭证」进库
+ *   (用户主动按域拓取存,支持同域多账号),见 credential-use-gate 设计稿。
+ */
+export type CredentialType = "token" | "link" | "cookie";
+export interface Credential {
+    /**
+     * 引用键,kebab-case,全局/项目两层内唯一。
+     * - token/link 如 "my-figma-token"。
+     * - cookie 为 `${platform}__${slug(label)}`,如 "xiaohongshu__accountA"
+     *   (同一域可有多条不同账号,故 id 不等于域名)。
+     */
+    id: string;
+    type: CredentialType;
+    /** 展示名。 */
+    label: string;
+    /**
+     * 密文(UI 只显示掩码):
+     * - token: token 值;
+     * - link: client id/secret 等的 JSON 字符串;
+     * - cookie: 序列化的 cookie jar(JSON.stringify 的 ElectronCookieLike[])。
+     */
+    secret?: string;
+    /** 可选:静态暴露为该 shell env 变量名(进 readShellEnv)。 */
+    exposeAsEnv?: string;
+    /**
+     * 逐条「AI 可自动取用」开关:为 true 时该凭证免过审批门(等价于对它单独开了
+     * 全局 credentialUse.autoApprove)。默认 false / 缺省 = 走全局开关 + 审批门。
+     * 管的是「AI 取 cookie 文件走 HTTP 请求」(UseCredential)。
+     */
+    autoUseByAI?: boolean;
+    /**
+     * 逐条「AI 可自动注入浏览器」开关(仅 cookie):为 true 时 AI 调「注入浏览器」工具
+     * (把该 cookie 灌进内置浏览器以登录态打开页面)免审批。默认 false = 弹审批。
+     * 与 autoUseByAI 分开 —— 注入浏览器改的是浏览器登录态,比只读取用风险更高。
+     */
+    autoInjectByAI?: boolean;
+    /**
+     * link: 业务方 app 注册地址;cookie: 拓取所用平台与主域 + 抓取范围 + 切换策略。
+     * - scope="all" 表示该 jar 是整分区全量抓的(切换时整包导回);缺省/"domain" = 仅该域。
+     * - switchMode 决定「切换」时怎么写回浏览器:"clear"(默认)先清空整分区再注入(干净换号);
+     *   "merge" 只覆盖同名 cookie、保留分区里其他站(不踢掉别的登录态)。
+     */
+    meta?: {
+        appUrl?: string;
+        platform?: string;
+        domain?: string;
+        scope?: "domain" | "all";
+        switchMode?: "clear" | "merge";
+    };
+}
+export interface CredentialStoreFile {
+    version: 1;
+    credentials: Credential[];
+}

package/dist/credentials/use-credential-tool.d.ts

@@ -0,0 +1,29 @@
+/**
+ * UseCredential 工具(凭证模块第二期 §3-§5)。
+ *
+ * 对 AI 暴露**一个统一工具**取用已存凭证(token / link / cookie 同构,描述只说「凭证」)。
+ * - 无 `id` → 返回脱敏清单(权威实时源,兜底动态描述的滞后)。
+ * - 有 `id` → 过 CredentialUseGate(默认问 / 本会话记住 / 全自动)后:
+ *     - token/link → `{ kind: "value", value }`
+ *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
+ *
+ * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
+ * 满足设计稿 §1「可整块外移」约束。
+ */
+import type { ToolDefinition } from "../types.js";
+import type { ToolContext } from "../tool-system/context.js";
+export declare const useCredentialToolDef: ToolDefinition;
+/**
+ * 动态描述:在基础描述末尾附当前可用凭证清单(镜像 generateVideoToolDefFor)。
+ * 空时回退基础描述。AI 一搜出/一看到就知道有哪些可用,减少无谓的无参列举调用。
+ */
+export declare function useCredentialToolDefFor(cwd: string): ToolDefinition;
+/**
+ * 启动期清理上次遗留的临时 cookies.txt(沿用 sweepStaleLeases 思路:扫同目录、按 mtime)。
+ * 不引入 lease 对象/定时器 —— 文件用完靠进程退出 + 这个轻量 sweep。
+ */
+export declare function sweepStaleCredentialCookies(now?: number): void;
+export declare function useCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+/** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
+export declare function __resetCredentialSessionAllowForTests(): void;