@cjhyy/code-shell-core 0.6.0-rc.11 → 0.6.0-rc.13

package/dist/git/worktree.js

@@ -30,6 +30,8 @@ export function selectPlatformScript(scripts, platform = process.platform) {
  * Validate worktree slug to prevent path traversal attacks.
  */
 export function validateWorktreeSlug(slug) {
+    if (slug.trim().length === 0)
+        throw new Error("Worktree slug cannot be empty");
     if (slug.length > 64)
         throw new Error("Worktree slug too long (max 64 chars)");
     if (/[^a-zA-Z0-9._-]/.test(slug))
@@ -41,7 +43,72 @@ export function validateWorktreeSlug(slug) {
  * Find the canonical git root (resolves worktree → main repo).
  */
 export function findGitRoot(cwd) {
-    return execFileSync(GIT_BIN, ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf-8", timeout: 5000 }).trim();
+    return findMainWorktreeRoot(cwd);
+}
+export function findMainWorktreeRoot(cwd) {
+    const commonDir = execFileSync(GIT_BIN, ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+        cwd,
+        encoding: "utf-8",
+        timeout: 5000,
+    }).trim();
+    return dirname(commonDir);
+}
+export function findWorktreeForBranch(cwd, branch) {
+    const normalized = normalizeBranchName(branch);
+    return listWorktrees(cwd).find((entry) => entry.branch === normalized)?.path;
+}
+export function assertBranchNotCheckedOut(cwd, branch) {
+    const existingPath = findWorktreeForBranch(cwd, branch);
+    if (existingPath) {
+        throw new Error(`branch ${normalizeBranchName(branch)} already checked out at ${existingPath}`);
+    }
+}
+export function branchExists(cwd, branch) {
+    try {
+        return (execFileSync(GIT_BIN, ["branch", "--list", normalizeBranchName(branch)], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 10000,
+        }).trim().length > 0);
+    }
+    catch {
+        return false;
+    }
+}
+export function isGitWorktreeRoot(cwd) {
+    if (!existsSync(join(cwd, ".git")))
+        return false;
+    try {
+        const inside = execFileSync(GIT_BIN, ["rev-parse", "--is-inside-work-tree"], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 5000,
+        }).trim();
+        if (inside !== "true")
+            return false;
+        const topLevel = execFileSync(GIT_BIN, ["rev-parse", "--path-format=absolute", "--show-toplevel"], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 5000,
+        }).trim();
+        return resolve(topLevel) === resolve(cwd);
+    }
+    catch {
+        return false;
+    }
+}
+export function currentBranch(cwd) {
+    try {
+        const branch = execFileSync(GIT_BIN, ["branch", "--show-current"], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 5000,
+        }).trim();
+        return branch || undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 /**
  * Create an isolated git worktree for an agent session.
@@ -51,6 +118,7 @@ export function createWorktree(cwd, slug, sessionId) {
     const gitRoot = findGitRoot(cwd);
     const branchName = `worktree/${slug}-${sessionId.slice(0, 8)}`;
     const worktreePath = resolve(gitRoot, "..", `.worktrees/${slug}-${sessionId.slice(0, 8)}`);
+    assertBranchNotCheckedOut(gitRoot, branchName);
     // Get current branch for later reference
     let originalBranch;
     try {
@@ -134,50 +202,87 @@ export async function runWorktreeSetup(worktreePath, script, opts = {}) {
  * Remove a worktree and optionally its branch.
  */
 export function removeWorktree(worktreePath, removeBranch = false) {
+    // The MAIN repo root, not the worktree's own toplevel. `git rev-parse
+    // --show-toplevel` from inside a worktree returns the worktree path, which
+    // is about to be deleted; the branch-delete must run from the main repo,
+    // which outlives the worktree. Derive it from the common git dir.
+    let mainRoot;
     try {
-        // The MAIN repo root, not the worktree's own toplevel. `git rev-parse
-        // --show-toplevel` from inside a worktree returns the worktree path, which
-        // is about to be deleted; the branch-delete must run from the main repo,
-        // which outlives the worktree. Derive it from the common git dir.
         const commonDir = execFileSync(GIT_BIN, ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: worktreePath, encoding: "utf-8", timeout: 5000 }).trim();
-        const mainRoot = dirname(commonDir); // <main>/.git → <main>
-        // Capture the worktree's branch BEFORE removing the worktree — afterwards
-        // the directory is gone and `git branch --show-current` in it would fail
-        // (silently, leaving removeBranch a no-op).
-        let branch = "";
-        if (removeBranch) {
-            try {
-                branch = execFileSync(GIT_BIN, ["branch", "--show-current"], {
-                    cwd: worktreePath,
-                    encoding: "utf-8",
-                    timeout: 5000,
-                }).trim();
-            }
-            catch {
-                // Detached HEAD or unreadable — nothing to delete.
-            }
+        mainRoot = dirname(commonDir); // <main>/.git → <main>
+    }
+    catch (err) {
+        throw new Error(`failed to inspect worktree ${worktreePath}: ${gitErrorMessage(err)}`);
+    }
+    // Capture the worktree's branch BEFORE removing the worktree — afterwards
+    // the directory is gone and `git branch --show-current` in it would fail.
+    let branch = "";
+    if (removeBranch) {
+        try {
+            branch = execFileSync(GIT_BIN, ["branch", "--show-current"], {
+                cwd: worktreePath,
+                encoding: "utf-8",
+                timeout: 5000,
+            }).trim();
+        }
+        catch (err) {
+            throw new Error(`failed to determine branch for worktree ${worktreePath}: ${gitErrorMessage(err)}`);
+        }
+        if (!branch) {
+            throw new Error(`failed to determine branch for worktree ${worktreePath}`);
+        }
+        if (!branch.startsWith("worktree/")) {
+            throw new Error(`refusing to delete non-CodeShell worktree branch ${branch}`);
         }
+    }
+    try {
         execFileSync(GIT_BIN, ["worktree", "remove", worktreePath, "--force"], {
             cwd: mainRoot,
             timeout: 30000,
         });
-        if (removeBranch && branch.startsWith("worktree/")) {
-            try {
-                execFileSync(GIT_BIN, ["branch", "-D", branch], { cwd: mainRoot, timeout: 10000 });
-            }
-            catch {
-                // Branch might already be removed.
-            }
+    }
+    catch (err) {
+        throw new Error(`failed to remove worktree ${worktreePath}: ${gitErrorMessage(err)}`);
+    }
+    if (removeBranch) {
+        try {
+            execFileSync(GIT_BIN, ["branch", "-D", branch], { cwd: mainRoot, timeout: 10000 });
+        }
+        catch (err) {
+            return {
+                dirRemoved: true,
+                branch,
+                branchDeleted: false,
+                branchError: gitErrorMessage(err),
+            };
         }
     }
+    return removeBranch ? { dirRemoved: true, branch, branchDeleted: true } : { dirRemoved: true };
+}
+export function worktreeHasUncommittedChanges(worktreePath) {
+    try {
+        return (execFileSync(GIT_BIN, ["status", "--porcelain"], {
+            cwd: worktreePath,
+            encoding: "utf-8",
+            timeout: 10000,
+        }).trim().length > 0);
+    }
     catch {
-        // Worktree might already be removed
+        return false;
     }
 }
+export function worktreeHasUncommittedOrAheadChanges(worktreePath, baseRef) {
+    if (worktreeHasUncommittedChanges(worktreePath))
+        return true;
+    const comparisonBase = baseRef && commitRefExists(worktreePath, baseRef)
+        ? baseRef
+        : findComparisonBaseRef(worktreePath);
+    return comparisonBase ? aheadCommitCount(worktreePath, comparisonBase) > 0 : false;
+}
 /**
  * List active worktrees.
  */
-export function listWorktrees(cwd) {
+export function listWorktrees(cwd, opts = {}) {
     const raw = execFileSync(GIT_BIN, ["worktree", "list", "--porcelain"], {
         cwd,
         encoding: "utf-8",
@@ -202,7 +307,136 @@ export function listWorktrees(cwd) {
     }
     if (current.path)
         entries.push(current);
-    return entries;
+    if (!opts.includeDiffSummary && !opts.workspaceOwners?.length)
+        return entries;
+    let mainRoot = "";
+    try {
+        mainRoot = findMainWorktreeRoot(cwd);
+    }
+    catch {
+        mainRoot = entries[0]?.path ?? "";
+    }
+    const baseRef = opts.includeDiffSummary ? findComparisonBaseRef(mainRoot || cwd) : undefined;
+    return entries.map((entry) => {
+        const owners = ownersForWorktree(entry.path, opts.workspaceOwners ?? []);
+        return {
+            ...entry,
+            ...(mainRoot ? { isMain: resolve(entry.path) === resolve(mainRoot) } : {}),
+            ...(opts.includeDiffSummary ? { diff: diffSummary(entry.path, baseRef) } : {}),
+            ...(owners.length > 0
+                ? {
+                    occupiedBySessionIds: owners,
+                    occupiedByOtherSession: owners.some((id) => id !== opts.currentSessionId),
+                }
+                : {}),
+        };
+    });
+}
+function ownersForWorktree(path, owners) {
+    const target = resolve(path);
+    return owners
+        .filter((owner) => {
+        const workspace = owner.workspace;
+        if (!workspace)
+            return false;
+        return resolve(workspace.root) === target;
+    })
+        .map((owner) => owner.sessionId);
+}
+function findComparisonBaseRef(cwd) {
+    for (const ref of ["main", "master", "origin/main", "origin/master"]) {
+        if (commitRefExists(cwd, ref))
+            return ref;
+    }
+    return undefined;
+}
+function commitRefExists(cwd, ref) {
+    try {
+        execFileSync(GIT_BIN, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
+            cwd,
+            encoding: "utf-8",
+            timeout: 5000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function diffSummary(cwd, baseRef) {
+    const dirtyFiles = statusFileSet(cwd);
+    const committedFiles = baseRef ? changedFilesSinceBase(cwd, baseRef) : new Set();
+    const changedFiles = new Set([...dirtyFiles, ...committedFiles]);
+    return {
+        ...(baseRef ? { baseRef } : {}),
+        changedFiles: changedFiles.size,
+        aheadCommits: baseRef ? aheadCommitCount(cwd, baseRef) : 0,
+        hasUncommittedChanges: dirtyFiles.size > 0,
+    };
+}
+function changedFilesSinceBase(cwd, baseRef) {
+    const out = gitOutput(cwd, ["diff", "--name-only", `${baseRef}...HEAD`]);
+    const raw = out ?? gitOutput(cwd, ["diff", "--name-only", `${baseRef}..HEAD`]) ?? "";
+    return new Set(raw
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean));
+}
+function aheadCommitCount(cwd, baseRef) {
+    const out = gitOutput(cwd, ["rev-list", "--count", `${baseRef}..HEAD`]);
+    const n = Number.parseInt(out?.trim() ?? "0", 10);
+    return Number.isFinite(n) ? n : 0;
+}
+function statusFileSet(cwd) {
+    const raw = gitOutput(cwd, ["status", "--porcelain=v1"]) ?? "";
+    const files = new Set();
+    for (const line of raw.split("\n")) {
+        if (!line.trim())
+            continue;
+        const path = line.slice(3).trim();
+        if (!path)
+            continue;
+        const renameTarget = path.includes(" -> ") ? path.split(" -> ").at(-1) : path;
+        if (renameTarget)
+            files.add(unquoteGitPath(renameTarget));
+    }
+    return files;
+}
+function unquoteGitPath(path) {
+    if (!path.startsWith('"') || !path.endsWith('"'))
+        return path;
+    try {
+        return JSON.parse(path);
+    }
+    catch {
+        return path.slice(1, -1);
+    }
+}
+function gitOutput(cwd, args) {
+    try {
+        return execFileSync(GIT_BIN, args, {
+            cwd,
+            encoding: "utf-8",
+            timeout: 10000,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+function gitErrorMessage(err) {
+    const stderr = err.stderr;
+    if (Buffer.isBuffer(stderr)) {
+        const msg = stderr.toString("utf-8").trim();
+        if (msg)
+            return msg;
+    }
+    if (typeof stderr === "string" && stderr.trim())
+        return stderr.trim();
+    return err instanceof Error ? err.message : String(err);
+}
+function normalizeBranchName(branch) {
+    return branch.replace(/^refs\/heads\//, "");
 }
 /**
  * Symlink large directories (node_modules, .venv, etc.) from main repo to worktree.

package/dist/index.d.ts

@@ -3,8 +3,8 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.6.0-rc.8";
-export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
+export declare const VERSION = "0.6.0-rc.13";
+export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionWorkspace, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 export { Engine, loadAgentDefinitionsForCwd } from "./engine/engine.js";
 export type { EngineConfig, EngineHookConfig, EngineResult } from "./engine/types.js";
@@ -45,6 +45,7 @@ export { Methods, ErrorCodes, type RpcMessage, type RunResult, } from "./protoco
 export { Transcript } from "./session/transcript.js";
 export { SessionManager } from "./session/session-manager.js";
 export { FileHistory } from "./session/file-history.js";
+export { createWorktree, currentBranch, findMainWorktreeRoot, listWorktrees, removeWorktree, validateWorktreeSlug, worktreeHasUncommittedOrAheadChanges, worktreeHasUncommittedChanges, type ListWorktreesOptions, type RemoveWorktreeResult, type WorktreeDiffSummary, type WorktreeInfo, type WorktreeWorkspaceOwner, } from "./git/worktree.js";
 export { latestUndoTarget, earliestSnapshotsPerFile, latestTurnUndoTargets, latestRedoTargets, } from "./session/undo-target.js";
 export { diffLines, renderDiffPreview, type DiffLine } from "./session/simple-diff.js";
 export { MemoryManager } from "./session/memory.js";
@@ -103,7 +104,7 @@ export type { IterateConfig, IterateResult, IterateSubject, IterateFormat, Itera
 export { RunManager, type RunManagerConfig, type RunStore, FileRunStore, RunQueue, EngineRunner, AUTOMATION_PROMPT_NOTE, AUTOMATION_RUN_SOURCE, type EngineRunnerConfig, type RunExecutionHandle, type RunExecutor, type CustomToolEntry, RunApprovalBackend, createRunAskUserFn, type RunLifecycleHooks, CheckpointWriter, ArtifactTracker, RunLock, type RunLockConfig, type RunLockAcquireResult, Heartbeat, NoopEvaluator, CompositeEvaluator, type Evaluator, type EvaluatorResult, type EvaluatorContext, type RunStatus, type RunSnapshot, type RunEvent, type RunCheckpoint, type RunApproval, type RunArtifactRef, type SubmitRunInput, type ResumeRunInput, type ListRunsQuery, type RunStreamEvent, type RunStreamCallback, type DetachFn, VALID_TRANSITIONS, createRunManager, type CreateRunManagerOptions, } from "./run/index.js";
 export { defineProduct, type ProductDefinition, type ProductPreset, type ProductAdapter, type ProductContract, type CustomTool, type ProductRuntimeOptions, type ProductInstance, } from "./product/index.js";
 export { logger } from "./logging/logger.js";
-export { SettingsManager, type SettingsScope } from "./settings/manager.js";
+export { SettingsManager, userHome, type SettingsScope } from "./settings/manager.js";
 export { migrateConfig, configVersionOf, CURRENT_CONFIG_VERSION, type MigrationStep, } from "./settings/migrate-config.js";
 export { SettingsSchema, validateSettings } from "./settings/schema.js";
 export { settingsJsonSchema, writeSettingsSchemaFile } from "./settings/schema-export.js";

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.6.0-rc.8";
+export const VERSION = "0.6.0-rc.13";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────
@@ -44,6 +44,7 @@ export { Methods, ErrorCodes, } from "./protocol/types.js";
 export { Transcript } from "./session/transcript.js";
 export { SessionManager } from "./session/session-manager.js";
 export { FileHistory } from "./session/file-history.js";
+export { createWorktree, currentBranch, findMainWorktreeRoot, listWorktrees, removeWorktree, validateWorktreeSlug, worktreeHasUncommittedOrAheadChanges, worktreeHasUncommittedChanges, } from "./git/worktree.js";
 export { latestUndoTarget, earliestSnapshotsPerFile, latestTurnUndoTargets, latestRedoTargets, } from "./session/undo-target.js";
 export { diffLines, renderDiffPreview } from "./session/simple-diff.js";
 export { MemoryManager } from "./session/memory.js";
@@ -121,7 +122,7 @@ export { defineProduct, } from "./product/index.js";
 // ─── Logging ─────────────────────────────────────────────────────
 export { logger } from "./logging/logger.js";
 // ─── Settings ────────────────────────────────────────────────────
-export { SettingsManager } from "./settings/manager.js";
+export { SettingsManager, userHome } from "./settings/manager.js";
 export { migrateConfig, configVersionOf, CURRENT_CONFIG_VERSION, } from "./settings/migrate-config.js";
 export { SettingsSchema, validateSettings } from "./settings/schema.js";
 export { settingsJsonSchema, writeSettingsSchemaFile } from "./settings/schema-export.js";

package/dist/logging/logger.js

@@ -121,12 +121,12 @@ function resolveCategoryFilter() {
 //
 // Two mechanisms, layered:
 //
-// 1. `runWithSid(sid, fn)` — preferred. Engine.run wraps its entire body
-//    in this AsyncLocalStorage scope, so every log line emitted inside the
-//    (possibly deeply async) call tree picks up the right sid. Concurrent
-//    parent + child Engines coexist because each `await` boundary preserves
-//    the ALS context — they don't trample each other like a single module
-//    global would.
+// 1. `runWithSid(sid, fn)` — preferred. Once Engine.run has resolved the
+//    authoritative sid, its session-bound execution body runs in this
+//    AsyncLocalStorage scope, so every log line emitted inside the (possibly
+//    deeply async) call tree picks up the right sid. Concurrent parent + child
+//    Engines coexist because each `await` boundary preserves the ALS context —
+//    they don't trample each other like a single module global would.
 //
 // 2. `_currentSidFallback` — module-level mutable, written by `setCurrentSid`.
 //    Used only as a fallback when a code path runs outside any ALS scope

package/dist/plugins/installer/installFromSource.js

@@ -5,6 +5,7 @@ import { gitClone, gitRevParseHead } from "../gitOps.js";
 import { installPluginFromPath } from "./install.js";
 import { pluginMetaPath } from "./paths.js";
 import { PluginInstallError } from "./types.js";
+import { resolveContainedPluginSubpath } from "./sourcePath.js";
 /**
  * Remote install orchestrator: a thin bridge over the existing pieces. Clone
  * the git source to a private temp dir, hand the (sub)directory to the local
@@ -26,7 +27,14 @@ export async function installPluginFromSource(parsed, name, installedAt) {
         if (!clone.ok) {
             throw new PluginInstallError(`clone failed: ${clone.error}`);
         }
-        const realSrc = parsed.subdir ? join(tmp, parsed.subdir) : tmp;
+        const realSrc = parsed.subdir
+            ? (() => {
+                const resolved = resolveContainedPluginSubpath(tmp, parsed.subdir, "subdir");
+                if (!resolved.ok)
+                    throw new PluginInstallError(resolved.error);
+                return resolved.path;
+            })()
+            : tmp;
         if (!existsSync(realSrc) || !statSync(realSrc).isDirectory()) {
             throw new PluginInstallError(`subdir not found in repo: ${parsed.subdir}`);
         }

package/dist/plugins/installer/sourcePath.d.ts

@@ -0,0 +1,9 @@
+export type ContainedPluginSubpathResult = {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function validateRelativePluginSubpath(subpath: string, label: string): string | null;
+export declare function resolveContainedPluginSubpath(root: string, subpath: string, label: string): ContainedPluginSubpathResult;

package/dist/plugins/installer/sourcePath.js

@@ -0,0 +1,50 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, resolve, sep } from "node:path";
+function normPath(path) {
+    return process.platform === "win32" ? path.toLowerCase() : path;
+}
+function isContainedOrRoot(child, parent) {
+    const c = normPath(child);
+    const parentPath = normPath(parent);
+    const parentPrefix = normPath(parent.endsWith(sep) ? parent : parent + sep);
+    return c === parentPath || c.startsWith(parentPrefix);
+}
+export function validateRelativePluginSubpath(subpath, label) {
+    if (typeof subpath !== "string" || subpath.length === 0) {
+        return `${label} must be a non-empty relative path`;
+    }
+    if (subpath.includes("\0")) {
+        return `${label} must not contain NUL bytes: ${subpath}`;
+    }
+    if (isAbsolute(subpath)) {
+        return `${label} must be relative and inside the source tree: ${subpath}`;
+    }
+    if (subpath.split(/[\\/]+/).includes("..")) {
+        return `${label} must not contain parent-directory segments: ${subpath}`;
+    }
+    return null;
+}
+export function resolveContainedPluginSubpath(root, subpath, label) {
+    const invalid = validateRelativePluginSubpath(subpath, label);
+    if (invalid)
+        return { ok: false, error: invalid };
+    let realRoot;
+    try {
+        realRoot = realpathSync(root);
+    }
+    catch (err) {
+        return { ok: false, error: `${label} root could not be resolved: ${err.message}` };
+    }
+    const candidate = resolve(root, subpath);
+    let realCandidate;
+    try {
+        realCandidate = realpathSync(candidate);
+    }
+    catch {
+        return { ok: false, error: `${label} not found in source tree: ${subpath}` };
+    }
+    if (!isContainedOrRoot(realCandidate, realRoot)) {
+        return { ok: false, error: `${label} escapes the source tree: ${subpath}` };
+    }
+    return { ok: true, path: realCandidate };
+}

package/dist/plugins/pluginInstaller.js

@@ -6,7 +6,7 @@
  */
 import { existsSync, realpathSync, rmSync, rmdirSync } from "node:fs";
 import { cp, mkdir, mkdtemp, rm } from "node:fs/promises";
-import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { gitClone, gitRevParseHead, gitSparseCheckoutAdd, githubRepoToCloneUrl, } from "./gitOps.js";
 import { loadMarketplace } from "./marketplaceManager.js";
@@ -15,6 +15,7 @@ import { appendInstallEntry, pluginInstallKey, readInstalledPlugins, removeInsta
 import { rewritePluginVars } from "./varRewrite.js";
 import { assertSafePluginName } from "./installer/paths.js";
 import { pruneDisabledSettingsForPlugin } from "./installer/pruneDisabled.js";
+import { resolveContainedPluginSubpath, validateRelativePluginSubpath, } from "./installer/sourcePath.js";
 function userHome() {
     return process.env.HOME ?? homedir();
 }
@@ -81,12 +82,11 @@ export function resolveSafePluginPath(installPath, cacheRoot) {
     return resolvedTarget;
 }
 async function materializePath(marketplaceInstallLocation, relativePath, cacheTarget) {
-    const src = isAbsolute(relativePath)
-        ? relativePath
-        : resolve(marketplaceInstallLocation, relativePath);
-    if (!existsSync(src)) {
-        return { ok: false, error: `plugin source path "${relativePath}" not found in marketplace` };
+    const contained = resolveContainedPluginSubpath(marketplaceInstallLocation, relativePath, "plugin source path");
+    if (!contained.ok) {
+        return { ok: false, error: contained.error };
     }
+    const src = contained.path;
     await mkdir(dirname(cacheTarget), { recursive: true });
     if (existsSync(cacheTarget))
         await rm(cacheTarget, { recursive: true, force: true });
@@ -106,22 +106,23 @@ async function materializeGit(url, ref, cacheTarget) {
     return { ok: true, sha: head.stdout };
 }
 async function materializeGitSubdir(url, subPath, ref, cacheTarget) {
+    const invalid = validateRelativePluginSubpath(subPath, "git-subdir path");
+    if (invalid)
+        return { ok: false, error: invalid };
     // Clone to a tempdir, then copy the subdir over.
     const tmp = await mkdtemp(join(tmpdir(), "plugin-clone-"));
     try {
-        const clone = await gitClone(url, tmp + "/repo", { full: true, ...(ref ? { ref } : {}) });
+        const repoDir = join(tmp, "repo");
+        const clone = await gitClone(url, repoDir, { full: true, ...(ref ? { ref } : {}) });
         if (!clone.ok)
             return { ok: false, error: clone.error };
-        const head = await gitRevParseHead(tmp + "/repo");
+        const head = await gitRevParseHead(repoDir);
         if (!head.ok)
             return { ok: false, error: head.error };
-        const src = join(tmp, "repo", subPath);
-        if (!existsSync(src)) {
-            return {
-                ok: false,
-                error: `git-subdir path "${subPath}" not found in cloned repository`,
-            };
-        }
+        const contained = resolveContainedPluginSubpath(repoDir, subPath, "git-subdir path");
+        if (!contained.ok)
+            return { ok: false, error: contained.error };
+        const src = contained.path;
         await mkdir(dirname(cacheTarget), { recursive: true });
         if (existsSync(cacheTarget))
             await rm(cacheTarget, { recursive: true, force: true });
@@ -162,19 +163,20 @@ async function materialize(source, marketplaceInstallLocation, marketplace, plug
     // once we know it. For path sources there's no SHA — use "local".
     const placeholder = pluginCacheDir(marketplace, plugin, "_pending_");
     if (typeof source === "string") {
+        const invalid = validateRelativePluginSubpath(source, "plugin source path");
+        if (invalid)
+            return { ok: false, error: invalid };
         // The marketplace was cloned sparse (only the manifest dirs are on disk),
         // so a local-path plugin's tree may not be checked out yet. Expand the
         // sparse-checkout to include it before reading. Best-effort: on a
         // non-sparse (full) clone this errors harmlessly and the files are already
         // present, so we ignore the result and let materializePath report a real
         // missing-path error if the subdir truly isn't there.
-        if (!isAbsolute(source)) {
-            // Strip a leading "./" — in non-cone sparse mode the literal "./" prefix
-            // doesn't match repo paths (which are stored without it), so the
-            // expand would silently no-op and the tree would stay un-materialized.
-            const sparseRel = source.replace(/^\.\//, "");
-            await gitSparseCheckoutAdd(marketplaceInstallLocation, sparseRel);
-        }
+        // Strip a leading "./" — in non-cone sparse mode the literal "./" prefix
+        // doesn't match repo paths (which are stored without it), so the
+        // expand would silently no-op and the tree would stay un-materialized.
+        const sparseRel = source.replace(/^\.\//, "");
+        await gitSparseCheckoutAdd(marketplaceInstallLocation, sparseRel);
         const r = await materializePath(marketplaceInstallLocation, source, placeholder);
         if (!r.ok)
             return r;

package/dist/protocol/chat-session-manager.d.ts

@@ -44,4 +44,5 @@ export declare class ChatSessionManager {
     sweepIdle(): void;
     startIdleSweeper(intervalMs?: number): void;
     stopIdleSweeper(): void;
+    private unregisterMcpOwner;
 }

package/dist/protocol/chat-session-manager.js

@@ -1,6 +1,7 @@
 import { ChatSession } from "./chat-session.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { clearAgentOutputFiles } from "../tool-system/builtin/agent-output-file.js";
+import { logger } from "../logging/logger.js";
 export class ChatSessionManager {
     sessions = new Map();
     runtime;
@@ -59,6 +60,7 @@ export class ChatSessionManager {
         if (!s)
             return;
         s.cancel();
+        this.unregisterMcpOwner(s);
         this.sessions.delete(sessionId);
     }
     closeAll() {
@@ -110,4 +112,15 @@ export class ChatSessionManager {
             clearInterval(this.sweeper);
         this.sweeper = null;
     }
+    unregisterMcpOwner(session) {
+        const mcpPool = this.runtime.mcpPool;
+        if (typeof mcpPool?.unregisterOwner !== "function")
+            return;
+        void mcpPool.unregisterOwner(session.engine).catch((err) => {
+            logger.warn("chat_session.mcp_owner_unregister_failed", {
+                sessionId: session.id,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        });
+    }
 }

package/dist/protocol/server.d.ts

@@ -84,6 +84,14 @@ export declare class AgentServer {
     private approvalTimers;
     /** Default approval timeout: 5 minutes */
     private static readonly APPROVAL_TIMEOUT_MS;
+    /**
+     * Wall-clock timeout for AskUserQuestion during a GOAL run (10 minutes).
+     * Plain interactive asks stay untimed; only a self-driving goal run arms this
+     * so a mid-goal question can't suspend the loop forever with nobody watching.
+     * Longer than the tool-approval timeout — a user who IS present deserves more
+     * time to compose a real answer before we assume-and-continue.
+     */
+    private static readonly GOAL_ASKUSER_TIMEOUT_MS;
     /**
      * Unsubscribe handle for the process-local `agentNotificationBus`
      * subscription set up in the constructor. Called from `close()` so a