@cjhyy/code-shell-core 0.6.0-rc.13 → 0.6.0-rc.15

package/dist/tool-system/builtin/worktree.js

@@ -4,6 +4,49 @@
 import { existsSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { createWorktree, removeWorktree, listWorktrees, validateWorktreeSlug, selectPlatformScript, runWorktreeSetup, worktreeHasUncommittedOrAheadChanges, currentBranch, } from "../../git/worktree.js";
+export const switchSessionWorkspaceToolDef = {
+    name: "SwitchSessionWorkspace",
+    description: "Switch this current conversation session into or out of a workspace through the host UI path. " +
+        "Use this when you need isolated or parallel work in a git worktree, when you need to move " +
+        "this conversation to an existing worktree path/branch, or when you are done and should return " +
+        "this current conversation to main. This is the correct way to move THIS conversation's session " +
+        "into or out of a worktree on desktop.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            target: {
+                type: "string",
+                description: "Workspace target: 'main', a new slug, an existing worktree path, or an existing branch name.",
+            },
+        },
+        required: ["target"],
+    },
+};
+export async function switchSessionWorkspaceTool(args, ctx) {
+    const target = stringArg(args.target);
+    if (!target)
+        return "Error: target is required";
+    const bridge = ctx?.workspace;
+    if (!bridge) {
+        return ("SwitchSessionWorkspace is not available in this host. " +
+            "Use the host's supported workspace controls instead.");
+    }
+    try {
+        const workspace = await bridge.switch(target);
+        ctx?.setSessionWorkspace?.(workspace);
+        const details = workspace.kind === "worktree" && workspace.worktree
+            ? `\n  Branch: ${workspace.worktree.branch}`
+            : "";
+        return (`Switched session workspace:\n` +
+            `  Path: ${workspace.root}` +
+            details +
+            `\n\n` +
+            nextTurnNotice(workspace.root, ctx?.cwd ?? workspace.root));
+    }
+    catch (err) {
+        return `Error switching workspace: ${err.message}`;
+    }
+}
 export const enterWorktreeToolDef = {
     name: "EnterWorktree",
     description: "Switch the current session workspace. Target can be a new worktree slug, " +
@@ -40,6 +83,7 @@ export async function enterWorktreeTool(args, ctx) {
     };
     const fromRoot = fromWorkspace.root;
     const currentTurnRoot = ctx?.cwd ?? fromRoot;
+    const branchPrefix = ctx?.engine?.readWorktreeBranchPrefix?.(mainRoot);
     try {
         if (target === "main") {
             const workspace = { root: mainRoot, kind: "main" };
@@ -50,12 +94,13 @@ export async function enterWorktreeTool(args, ctx) {
                 `  From: ${fromRoot}\n\n` +
                 nextTurnNotice(mainRoot, currentTurnRoot));
         }
-        const selected = resolveWorktreeTarget({
+        const selected = await resolveWorktreeTarget({
             target,
             cwd: ctx?.cwd ?? mainRoot,
             mainRoot,
             sessionId,
             currentWorkspace: fromWorkspace,
+            branchPrefix,
         });
         const workspace = toSessionWorkspace(selected, fromWorkspace);
         persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
@@ -125,7 +170,7 @@ export async function exitWorktreeTool(args, ctx) {
         return `Error: unknown action "${requested}" (expected keep, detach, or discard).`;
     }
     const hasPendingChanges = existsSync(workspace.worktree.path) &&
-        worktreeHasUncommittedOrAheadChanges(workspace.worktree.path, workspace.worktree.baseRef);
+        (await worktreeHasUncommittedOrAheadChanges(workspace.worktree.path, workspace.worktree.baseRef));
     const action = requested ?? (hasPendingChanges ? undefined : "detach");
     if (!action) {
         return (`Error: worktree has uncommitted changes or new commits. Choose action "keep" to preserve ` +
@@ -137,10 +182,11 @@ export async function exitWorktreeTool(args, ctx) {
     }
     const mainRoot = sessionManager.readCwd(sessionId) ?? workspace.root;
     const currentTurnRoot = ctx?.cwd ?? workspace.root;
+    const branchPrefix = ctx?.engine?.readWorktreeBranchPrefix?.(mainRoot);
     try {
         let removal;
         if (action === "discard" || action === "detach") {
-            const otherOwners = otherSessionOwnersForWorktree(sessionManager, sessionId, mainRoot, workspace.worktree.path);
+            const otherOwners = await otherSessionOwnersForWorktree(sessionManager, sessionId, mainRoot, workspace.worktree.path);
             if (otherOwners.length > 0) {
                 const mainWorkspace = { root: mainRoot, kind: "main" };
                 persistSessionWorkspace(sessionManager, sessionId, mainWorkspace, ctx);
@@ -149,7 +195,7 @@ export async function exitWorktreeTool(args, ctx) {
             }
         }
         if (action === "discard") {
-            removal = removeWorktree(workspace.worktree.path, true);
+            removal = removeWorktree(workspace.worktree.path, true, { prefix: branchPrefix });
         }
         else if (action === "detach") {
             removal = removeWorktree(workspace.worktree.path, false);
@@ -196,15 +242,15 @@ function sessionServices(ctx) {
     }
     return { ok: true, sessionId, sessionManager };
 }
-function otherSessionOwnersForWorktree(sessionManager, sessionId, mainRoot, worktreePath) {
+async function otherSessionOwnersForWorktree(sessionManager, sessionId, mainRoot, worktreePath) {
     const workspaceOwners = sessionManager
         .list(Number.MAX_SAFE_INTEGER)
         .map((session) => ({ sessionId: session.sessionId, workspace: session.workspace }))
         .filter((owner) => owner.workspace !== undefined);
-    const entry = listWorktrees(mainRoot, {
+    const entry = (await listWorktrees(mainRoot, {
         currentSessionId: sessionId,
         workspaceOwners,
-    }).find((worktree) => resolve(worktree.path) === resolve(worktreePath));
+    })).find((worktree) => resolve(worktree.path) === resolve(worktreePath));
     return (entry?.occupiedBySessionIds ?? []).filter((owner) => owner !== sessionId);
 }
 function sharedWorktreeRemovalSkippedMessage(otherOwners, mainRoot, currentTurnRoot) {
@@ -213,8 +259,8 @@ function sharedWorktreeRemovalSkippedMessage(otherOwners, mainRoot, currentTurnR
         `Back to ${mainRoot} starting next turn.\n` +
         nextTurnNotice(mainRoot, currentTurnRoot));
 }
-function resolveWorktreeTarget(opts) {
-    const entries = listWorktrees(opts.mainRoot);
+async function resolveWorktreeTarget(opts) {
+    const entries = await listWorktrees(opts.mainRoot);
     const pathTarget = pathLike(opts.target) ? resolvePathTarget(opts.target, opts.cwd) : undefined;
     const branchTarget = normalizeBranchName(opts.target);
     const match = entries.find((entry) => {
@@ -230,7 +276,7 @@ function resolveWorktreeTarget(opts) {
                 worktreePath: match.path,
                 worktreeName: match.path.split(/[\\/]/).pop() ?? match.branch,
                 worktreeBranch: match.branch,
-                originalBranch: currentBranch(opts.mainRoot),
+                originalBranch: await currentBranch(opts.mainRoot),
                 sessionId: opts.sessionId,
                 createdAt: Date.now(),
             },
@@ -241,7 +287,9 @@ function resolveWorktreeTarget(opts) {
         throw new Error(`no existing worktree found at ${opts.target}`);
     }
     validateWorktreeSlug(opts.target);
-    const created = createWorktree(opts.mainRoot, opts.target, opts.sessionId);
+    const created = await createWorktree(opts.mainRoot, opts.target, opts.sessionId, {
+        prefix: opts.branchPrefix,
+    });
     return { created: true, session: created, from: created.originalBranch ?? "HEAD" };
 }
 function toSessionWorkspace(selected, currentWorkspace) {

package/dist/tool-system/context.d.ts

@@ -40,6 +40,8 @@ export interface ToolRuntimeHost {
         linux?: string;
         windows?: string;
     } | undefined;
+    /** Branch prefix used for CodeShell-managed worktree branches. */
+    readWorktreeBranchPrefix?(cwd?: string): string | undefined;
     /** Resolve a setup-only sandbox for a newly-created worktree root. */
     resolveWorktreeSetupSandbox?(cwd: string): Promise<SandboxBackend | undefined>;
     /** Resolve setup-only shell env for a newly-created worktree root. */
@@ -180,6 +182,7 @@ export interface SubAgentSpawner {
 export interface ToolVisibilityContext {
     cwd: string;
     hasGoal: boolean;
+    settingsScope?: import("../settings/manager.js").SettingsScope;
 }
 export interface ToolContext {
     /** Active working directory for this Engine. */
@@ -348,6 +351,13 @@ export interface ToolContext {
      * docs/superpowers/specs/2026-06-16-browser-automation-mvp.md.
      */
     browser?: import("./browser-bridge.js").BrowserBridge;
+    /**
+     * Host-backed workspace switch bridge. Desktop wires this to Electron main so
+     * the model's SwitchSessionWorkspace tool goes through the same path as the UI
+     * switcher. Undefined outside hosts that can switch this conversation's
+     * session workspace.
+     */
+    workspace?: import("./workspace-bridge.js").WorkspaceBridge;
     /**
      * Inject a stored cookie credential into the built-in browser (restore its
      * login state so the AI can drive the page as that account). The host
@@ -359,7 +369,7 @@ export interface ToolContext {
     injectCredentialToBrowser?: InjectCredentialFn;
 }
 /** Inject a cookie credential into the built-in browser (host-implemented). */
-export type InjectCredentialFn = (credentialId: string) => Promise<{
+export type InjectCredentialFn = (credentialId: string, credentialScope?: "full" | "project") => Promise<{
     ok: boolean;
     count?: number;
     error?: string;

package/dist/tool-system/mcp-manager.d.ts

@@ -6,6 +6,12 @@
 import type { Tool as McpTool } from "@modelcontextprotocol/sdk/types.js";
 import type { MCPServerConfig, RegisteredTool } from "../types.js";
 import { ToolRegistry } from "./registry.js";
+interface MCPResourceInfo {
+    uri: string;
+    name: string;
+    description?: string;
+    serverName: string;
+}
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -125,13 +131,10 @@ export declare class MCPManager {
     /**
      * List resources from MCP servers.
      */
-    listResources(serverName?: string, signal?: AbortSignal): Promise<Array<{
-        uri: string;
-        name: string;
-        description?: string;
-    }>>;
+    listResources(serverName?: string, signal?: AbortSignal): Promise<MCPResourceInfo[]>;
     /**
      * Read a resource from an MCP server.
      */
     readResource(serverName: string, uri: string, signal?: AbortSignal): Promise<string>;
 }
+export {};

package/dist/tool-system/mcp-manager.js

@@ -9,9 +9,10 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { logger } from "../logging/logger.js";
 import { CredentialStore } from "../credentials/index.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
+import { codeShellHome } from "../session/session-manager.js";
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -118,7 +119,29 @@ export function inferTransportType(config) {
  * spill itself is bounded by the byte budget below; this cap is just
  * to keep ls(~/.code-shell/mcp_images) tractable.
  */
+const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
+function spillTimestamp(filename, prefix) {
+    const suffix = filename.slice(prefix.length);
+    const dot = suffix.lastIndexOf(".");
+    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
+    const timestamp = Number(raw);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+async function pruneMcpImageSpills(baseDir, prefix) {
+    const entries = await readdir(baseDir, { withFileTypes: true });
+    const spills = entries
+        .filter((entry) => entry.isFile() && entry.name.startsWith(prefix))
+        .map((entry) => ({
+        name: entry.name,
+        timestamp: spillTimestamp(entry.name, prefix),
+    }))
+        .sort((a, b) => a.timestamp - b.timestamp || a.name.localeCompare(b.name));
+    const excess = spills.length - MAX_MCP_IMAGE_SPILLS_PER_TOOL;
+    if (excess <= 0)
+        return;
+    await Promise.all(spills.slice(0, excess).map((entry) => unlink(join(baseDir, entry.name)).catch(() => { })));
+}
 /**
  * Persist an MCP-returned image to disk and return the textual
  * reference the LLM should see. Images larger than
@@ -130,9 +153,7 @@ const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
  *   [mcp-image] server=playwright tool=screenshot saved=/abs/path.png (123 KB)
  */
 export async function spillMcpImage(serverName, toolName, base64, mimeType, opts) {
-    const home = process.env.CODE_SHELL_HOME ?? process.env.HOME ?? "";
-    const baseDir = opts?.baseDir ??
-        (home ? join(home, ".code-shell", "mcp_images") : join("/tmp", "code-shell-mcp-images"));
+    const baseDir = opts?.baseDir ?? join(codeShellHome(), "mcp_images");
     const now = opts?.now ?? Date.now;
     const decodedBytes = Math.floor((base64.length * 3) / 4);
     if (decodedBytes > MAX_MCP_IMAGE_BYTES) {
@@ -147,11 +168,13 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
                 : "png";
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
-    const filename = `${safeServer}-${safeTool}-${now()}.${ext}`;
+    const prefix = `${safeServer}-${safeTool}-`;
+    const filename = `${prefix}${now()}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
         await writeFile(filePath, Buffer.from(base64, "base64"));
+        await pruneMcpImageSpills(baseDir, prefix);
     }
     catch (err) {
         logger.warn("mcp.image_spill_failed", {
@@ -448,59 +471,65 @@ export class MCPManager {
      * Discover tools from an MCP server and register them.
      */
     async discoverTools(serverName, client) {
-        const result = await client.listTools();
-        for (const tool of result.tools) {
-            const registered = buildRegisteredTool(serverName, tool);
-            // Register with an executor that calls the MCP server
-            this.toolRegistry.registerTool(registered, async (args) => {
-                const callResult = await client.callTool({
-                    name: tool.name,
-                    arguments: stripInternalToolArgs(args),
-                });
-                // Extract text + image content from the result. Image blobs
-                // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
-                // the LLM message tree — same pattern as the GenerateImage
-                // tool — and the model sees a textual reference it can Read
-                // on a later turn if it needs the pixels. This sidesteps the
-                // "MCP returned a 5MB screenshot → token budget exploded"
-                // failure mode that bit Codex (issue #11845); we never put
-                // raw base64 image data in the result text. See
-                // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
-                const parts = [];
-                if (Array.isArray(callResult.content)) {
-                    for (const item of callResult.content) {
-                        if (typeof item === "string") {
-                            parts.push(item);
-                            continue;
-                        }
-                        if (typeof item !== "object" || item === null)
-                            continue;
-                        if ("text" in item) {
-                            parts.push(String(item.text));
-                            continue;
-                        }
-                        if (item.type === "image") {
-                            const block = item;
-                            if (typeof block.data === "string" && block.data.length > 0) {
-                                const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
-                                parts.push(note);
+        try {
+            const result = await client.listTools();
+            for (const tool of result.tools) {
+                const registered = buildRegisteredTool(serverName, tool);
+                // Register with an executor that calls the MCP server
+                this.toolRegistry.registerTool(registered, async (args, ctx) => {
+                    const callResult = await client.callTool({
+                        name: tool.name,
+                        arguments: stripInternalToolArgs(args),
+                    }, undefined, ctx?.signal ? { signal: ctx.signal } : undefined);
+                    // Extract text + image content from the result. Image blobs
+                    // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
+                    // the LLM message tree — same pattern as the GenerateImage
+                    // tool — and the model sees a textual reference it can Read
+                    // on a later turn if it needs the pixels. This sidesteps the
+                    // "MCP returned a 5MB screenshot → token budget exploded"
+                    // failure mode that bit Codex (issue #11845); we never put
+                    // raw base64 image data in the result text. See
+                    // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
+                    const parts = [];
+                    if (Array.isArray(callResult.content)) {
+                        for (const item of callResult.content) {
+                            if (typeof item === "string") {
+                                parts.push(item);
+                                continue;
+                            }
+                            if (typeof item !== "object" || item === null)
+                                continue;
+                            if ("text" in item) {
+                                parts.push(String(item.text));
+                                continue;
+                            }
+                            if (item.type === "image") {
+                                const block = item;
+                                if (typeof block.data === "string" && block.data.length > 0) {
+                                    const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
+                                    parts.push(note);
+                                }
                             }
                         }
                     }
-                }
-                const body = parts.join("\n") || "(no output)";
-                // Trust boundary: MCP output is external content. Wrap it so the
-                // model sees an explicit reminder that the body comes from an
-                // untrusted server and any instructions inside are content, not
-                // commands. The marker is intentionally short so it doesn't bloat
-                // every tool result, but distinct enough that prompt-injected
-                // strings can't fake their way out.
-                return wrapMcpOutput(serverName, tool.name, body);
-            });
-            const set = this.registeredToolsByServer.get(serverName) ?? new Set();
-            set.add(registered.name);
-            this.registeredToolsByServer.set(serverName, set);
-            logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+                    const body = parts.join("\n") || "(no output)";
+                    // Trust boundary: MCP output is external content. Wrap it so the
+                    // model sees an explicit reminder that the body comes from an
+                    // untrusted server and any instructions inside are content, not
+                    // commands. The marker is intentionally short so it doesn't bloat
+                    // every tool result, but distinct enough that prompt-injected
+                    // strings can't fake their way out.
+                    return wrapMcpOutput(serverName, tool.name, body);
+                });
+                const set = this.registeredToolsByServer.get(serverName) ?? new Set();
+                set.add(registered.name);
+                this.registeredToolsByServer.set(serverName, set);
+                logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+            }
+        }
+        catch (err) {
+            await this.disconnect(serverName);
+            throw err;
         }
     }
     /**
@@ -583,6 +612,7 @@ export class MCPManager {
                         uri: r.uri,
                         name: r.name ?? r.uri,
                         description: r.description,
+                        serverName: name,
                     });
                 }
             }

package/dist/tool-system/path-policy.d.ts

@@ -52,6 +52,8 @@ export interface ClassifyOptions {
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
+export declare function openSessionPathApprovals(sessionId: string): void;
+export declare function clearSessionPathApprovals(sessionId: string): void;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -105,6 +105,10 @@ function expandTilde(p) {
 }
 /** sessionId → set of approved directory grants (prefix + operation). */
 const sessionPathGrants = new Map();
+/** Session ids explicitly closed by ChatSessionManager; late approvals must not recreate grants. */
+const closedPathApprovalSessions = new Set();
+/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
+const askChains = new Map();
 /** True if a grant for `grantOp` authorizes an operation of `wantOp`. */
 function grantCoversOp(grantOp, wantOp) {
     // write ⊇ {read, write}; read ⊇ {read}.
@@ -198,6 +202,8 @@ function storedOp(g) {
 function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
     if (scope === "once")
         return;
+    if (sessionId && closedPathApprovalSessions.has(sessionId))
+        return;
     const prefix = dirPrefix(dirname(resolved));
     if (scope === "session") {
         if (!sessionId)
@@ -271,6 +277,16 @@ function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
 /** Test seam: clear the in-memory session grants. */
 export function _resetSessionPathGrants() {
     sessionPathGrants.clear();
+    closedPathApprovalSessions.clear();
+    askChains.clear();
+}
+export function openSessionPathApprovals(sessionId) {
+    closedPathApprovalSessions.delete(sessionId);
+}
+export function clearSessionPathApprovals(sessionId) {
+    sessionPathGrants.delete(sessionId);
+    closedPathApprovalSessions.add(sessionId);
+    askChains.delete(sessionId);
 }
 /**
  * Best-effort resolution. realpath fails when the path doesn't exist yet —
@@ -461,8 +477,8 @@ export function enforcePathPolicy(filePath, operation, workspaceRoot) {
     }
     // ask — MVP refuses with explanatory message until askUser plumbing
     // lands. The conservative bias matches the plan's leaning answer for Q1.
-    return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`;
+    return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`);
 }
 export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (ctx?.cwd === undefined)
@@ -481,8 +497,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
         return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}`;
     }
     if (operation === "write" && ctx.planMode) {
-        return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `Plan mode does not allow file writes.`;
+        return (`Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `Plan mode does not allow file writes.`);
     }
     // Already approved this directory for this OPERATION (this session or
     // persisted for the project)? Proceed without re-prompting — this is the fix
@@ -491,8 +507,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
         return null;
     if (!ctx.askUser) {
-        return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `No interactive approval UI is available in this run.`;
+        return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `No interactive approval UI is available in this run.`);
     }
     // Serialize concurrent asks (per session) and RE-CHECK grants when our turn
     // comes. Parallel tools hitting the same not-yet-approved directory all pass
@@ -502,7 +518,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     const chainKey = ctx.sessionId ?? "__global__";
     const prevTurn = askChains.get(chainKey) ?? Promise.resolve();
     let release;
-    askChains.set(chainKey, new Promise((r) => (release = r)));
+    const currentTurn = new Promise((r) => (release = r));
+    askChains.set(chainKey, currentTurn);
     try {
         await prevTurn;
         if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
@@ -511,6 +528,9 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     }
     finally {
         release();
+        if (askChains.get(chainKey) === currentTurn) {
+            askChains.delete(chainKey);
+        }
     }
 }
 /** The actual interactive ask — split out so the serialized section reads flat.
@@ -521,9 +541,7 @@ async function promptForPathApproval(c, operation, ctx) {
     // "工作区外路径" header was misleading for sensitive-path asks.
     const isSensitive = c.reason.startsWith("sensitive");
     const what = operation === "read" ? "读取" : "写入";
-    const title = isSensitive
-        ? `工具想${what}敏感文件`
-        : `工具想${what}工作区外路径`;
+    const title = isSensitive ? `工具想${what}敏感文件` : `工具想${what}工作区外路径`;
     const header = isSensitive ? "敏感文件权限" : "路径权限";
     // Scope options carry remembered grants for the directory of this path, so
     // the same folder isn't re-prompted. Labels are matched by exact string
@@ -566,8 +584,6 @@ async function promptForPathApproval(c, operation, ctx) {
     }
     return `Error: path approval denied by user — ${c.reason}. Path: ${c.resolvedPath}`;
 }
-/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
-const askChains = new Map();
 /**
  * Internal: reset the "disabled warning" latch. Tests flip the env var
  * between cases and need each one to be able to re-trigger the warning.

package/dist/tool-system/workspace-bridge.d.ts

@@ -0,0 +1,11 @@
+import type { SessionWorkspace } from "../types.js";
+/**
+ * WorkspaceBridge — host-backed session workspace switching.
+ *
+ * Desktop implements this through Electron main so model-initiated switches use
+ * the same service path as the UI workspace switcher. Undefined in headless or
+ * non-desktop contexts.
+ */
+export interface WorkspaceBridge {
+    switch(target: string): Promise<SessionWorkspace>;
+}

package/dist/tool-system/workspace-bridge.js

@@ -0,0 +1 @@
+export {};

package/dist/types.d.ts

@@ -149,6 +149,14 @@ export interface SessionWorkspace {
         createdBy: "codeshell";
     };
 }
+export interface ContextUsageAnchor {
+    promptTokens: number;
+    messageCount: number;
+    estimateAtAnchor?: number;
+    recordedAt: number;
+    provider?: string;
+    model?: string;
+}
 export interface SessionState {
     sessionId: string;
     cwd: string;
@@ -162,6 +170,12 @@ export interface SessionState {
      * (for example model switches), so it must not drive whole-session metrics.
      */
     tokenUsage: TokenUsage;
+    /**
+     * Last provider-reported prompt-token count for the current context window.
+     * Separate from cumulative tokenUsage; used only to seed context-size estimates
+     * before the next provider response.
+     */
+    contextUsageAnchor?: ContextUsageAnchor;
     /**
      * Monotonic prompt-cache counters for the whole session. These only increase
      * from session start and are separate from the resettable tokenUsage window.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.6.0-rc.13",
+  "version": "0.6.0-rc.15",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",