@cjhyy/code-shell-core 0.6.0-rc.14 → 0.6.0-rc.15

package/dist/tool-system/mcp-manager.js

@@ -9,9 +9,10 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { logger } from "../logging/logger.js";
 import { CredentialStore } from "../credentials/index.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
+import { codeShellHome } from "../session/session-manager.js";
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -118,7 +119,29 @@ export function inferTransportType(config) {
  * spill itself is bounded by the byte budget below; this cap is just
  * to keep ls(~/.code-shell/mcp_images) tractable.
  */
+const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
+function spillTimestamp(filename, prefix) {
+    const suffix = filename.slice(prefix.length);
+    const dot = suffix.lastIndexOf(".");
+    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
+    const timestamp = Number(raw);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+async function pruneMcpImageSpills(baseDir, prefix) {
+    const entries = await readdir(baseDir, { withFileTypes: true });
+    const spills = entries
+        .filter((entry) => entry.isFile() && entry.name.startsWith(prefix))
+        .map((entry) => ({
+        name: entry.name,
+        timestamp: spillTimestamp(entry.name, prefix),
+    }))
+        .sort((a, b) => a.timestamp - b.timestamp || a.name.localeCompare(b.name));
+    const excess = spills.length - MAX_MCP_IMAGE_SPILLS_PER_TOOL;
+    if (excess <= 0)
+        return;
+    await Promise.all(spills.slice(0, excess).map((entry) => unlink(join(baseDir, entry.name)).catch(() => { })));
+}
 /**
  * Persist an MCP-returned image to disk and return the textual
  * reference the LLM should see. Images larger than
@@ -130,9 +153,7 @@ const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
  *   [mcp-image] server=playwright tool=screenshot saved=/abs/path.png (123 KB)
  */
 export async function spillMcpImage(serverName, toolName, base64, mimeType, opts) {
-    const home = process.env.CODE_SHELL_HOME ?? process.env.HOME ?? "";
-    const baseDir = opts?.baseDir ??
-        (home ? join(home, ".code-shell", "mcp_images") : join("/tmp", "code-shell-mcp-images"));
+    const baseDir = opts?.baseDir ?? join(codeShellHome(), "mcp_images");
     const now = opts?.now ?? Date.now;
     const decodedBytes = Math.floor((base64.length * 3) / 4);
     if (decodedBytes > MAX_MCP_IMAGE_BYTES) {
@@ -147,11 +168,13 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
                 : "png";
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
-    const filename = `${safeServer}-${safeTool}-${now()}.${ext}`;
+    const prefix = `${safeServer}-${safeTool}-`;
+    const filename = `${prefix}${now()}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
         await writeFile(filePath, Buffer.from(base64, "base64"));
+        await pruneMcpImageSpills(baseDir, prefix);
     }
     catch (err) {
         logger.warn("mcp.image_spill_failed", {
@@ -448,59 +471,65 @@ export class MCPManager {
      * Discover tools from an MCP server and register them.
      */
     async discoverTools(serverName, client) {
-        const result = await client.listTools();
-        for (const tool of result.tools) {
-            const registered = buildRegisteredTool(serverName, tool);
-            // Register with an executor that calls the MCP server
-            this.toolRegistry.registerTool(registered, async (args) => {
-                const callResult = await client.callTool({
-                    name: tool.name,
-                    arguments: stripInternalToolArgs(args),
-                });
-                // Extract text + image content from the result. Image blobs
-                // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
-                // the LLM message tree — same pattern as the GenerateImage
-                // tool — and the model sees a textual reference it can Read
-                // on a later turn if it needs the pixels. This sidesteps the
-                // "MCP returned a 5MB screenshot → token budget exploded"
-                // failure mode that bit Codex (issue #11845); we never put
-                // raw base64 image data in the result text. See
-                // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
-                const parts = [];
-                if (Array.isArray(callResult.content)) {
-                    for (const item of callResult.content) {
-                        if (typeof item === "string") {
-                            parts.push(item);
-                            continue;
-                        }
-                        if (typeof item !== "object" || item === null)
-                            continue;
-                        if ("text" in item) {
-                            parts.push(String(item.text));
-                            continue;
-                        }
-                        if (item.type === "image") {
-                            const block = item;
-                            if (typeof block.data === "string" && block.data.length > 0) {
-                                const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
-                                parts.push(note);
+        try {
+            const result = await client.listTools();
+            for (const tool of result.tools) {
+                const registered = buildRegisteredTool(serverName, tool);
+                // Register with an executor that calls the MCP server
+                this.toolRegistry.registerTool(registered, async (args, ctx) => {
+                    const callResult = await client.callTool({
+                        name: tool.name,
+                        arguments: stripInternalToolArgs(args),
+                    }, undefined, ctx?.signal ? { signal: ctx.signal } : undefined);
+                    // Extract text + image content from the result. Image blobs
+                    // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
+                    // the LLM message tree — same pattern as the GenerateImage
+                    // tool — and the model sees a textual reference it can Read
+                    // on a later turn if it needs the pixels. This sidesteps the
+                    // "MCP returned a 5MB screenshot → token budget exploded"
+                    // failure mode that bit Codex (issue #11845); we never put
+                    // raw base64 image data in the result text. See
+                    // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
+                    const parts = [];
+                    if (Array.isArray(callResult.content)) {
+                        for (const item of callResult.content) {
+                            if (typeof item === "string") {
+                                parts.push(item);
+                                continue;
+                            }
+                            if (typeof item !== "object" || item === null)
+                                continue;
+                            if ("text" in item) {
+                                parts.push(String(item.text));
+                                continue;
+                            }
+                            if (item.type === "image") {
+                                const block = item;
+                                if (typeof block.data === "string" && block.data.length > 0) {
+                                    const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
+                                    parts.push(note);
+                                }
                             }
                         }
                     }
-                }
-                const body = parts.join("\n") || "(no output)";
-                // Trust boundary: MCP output is external content. Wrap it so the
-                // model sees an explicit reminder that the body comes from an
-                // untrusted server and any instructions inside are content, not
-                // commands. The marker is intentionally short so it doesn't bloat
-                // every tool result, but distinct enough that prompt-injected
-                // strings can't fake their way out.
-                return wrapMcpOutput(serverName, tool.name, body);
-            });
-            const set = this.registeredToolsByServer.get(serverName) ?? new Set();
-            set.add(registered.name);
-            this.registeredToolsByServer.set(serverName, set);
-            logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+                    const body = parts.join("\n") || "(no output)";
+                    // Trust boundary: MCP output is external content. Wrap it so the
+                    // model sees an explicit reminder that the body comes from an
+                    // untrusted server and any instructions inside are content, not
+                    // commands. The marker is intentionally short so it doesn't bloat
+                    // every tool result, but distinct enough that prompt-injected
+                    // strings can't fake their way out.
+                    return wrapMcpOutput(serverName, tool.name, body);
+                });
+                const set = this.registeredToolsByServer.get(serverName) ?? new Set();
+                set.add(registered.name);
+                this.registeredToolsByServer.set(serverName, set);
+                logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+            }
+        }
+        catch (err) {
+            await this.disconnect(serverName);
+            throw err;
         }
     }
     /**
@@ -583,6 +612,7 @@ export class MCPManager {
                         uri: r.uri,
                         name: r.name ?? r.uri,
                         description: r.description,
+                        serverName: name,
                     });
                 }
             }

package/dist/tool-system/path-policy.d.ts

@@ -52,6 +52,8 @@ export interface ClassifyOptions {
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
+export declare function openSessionPathApprovals(sessionId: string): void;
+export declare function clearSessionPathApprovals(sessionId: string): void;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -105,6 +105,10 @@ function expandTilde(p) {
 }
 /** sessionId → set of approved directory grants (prefix + operation). */
 const sessionPathGrants = new Map();
+/** Session ids explicitly closed by ChatSessionManager; late approvals must not recreate grants. */
+const closedPathApprovalSessions = new Set();
+/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
+const askChains = new Map();
 /** True if a grant for `grantOp` authorizes an operation of `wantOp`. */
 function grantCoversOp(grantOp, wantOp) {
     // write ⊇ {read, write}; read ⊇ {read}.
@@ -198,6 +202,8 @@ function storedOp(g) {
 function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
     if (scope === "once")
         return;
+    if (sessionId && closedPathApprovalSessions.has(sessionId))
+        return;
     const prefix = dirPrefix(dirname(resolved));
     if (scope === "session") {
         if (!sessionId)
@@ -271,6 +277,16 @@ function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
 /** Test seam: clear the in-memory session grants. */
 export function _resetSessionPathGrants() {
     sessionPathGrants.clear();
+    closedPathApprovalSessions.clear();
+    askChains.clear();
+}
+export function openSessionPathApprovals(sessionId) {
+    closedPathApprovalSessions.delete(sessionId);
+}
+export function clearSessionPathApprovals(sessionId) {
+    sessionPathGrants.delete(sessionId);
+    closedPathApprovalSessions.add(sessionId);
+    askChains.delete(sessionId);
 }
 /**
  * Best-effort resolution. realpath fails when the path doesn't exist yet —
@@ -461,8 +477,8 @@ export function enforcePathPolicy(filePath, operation, workspaceRoot) {
     }
     // ask — MVP refuses with explanatory message until askUser plumbing
     // lands. The conservative bias matches the plan's leaning answer for Q1.
-    return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`;
+    return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`);
 }
 export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (ctx?.cwd === undefined)
@@ -481,8 +497,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
         return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}`;
     }
     if (operation === "write" && ctx.planMode) {
-        return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `Plan mode does not allow file writes.`;
+        return (`Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `Plan mode does not allow file writes.`);
     }
     // Already approved this directory for this OPERATION (this session or
     // persisted for the project)? Proceed without re-prompting — this is the fix
@@ -491,8 +507,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
         return null;
     if (!ctx.askUser) {
-        return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `No interactive approval UI is available in this run.`;
+        return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `No interactive approval UI is available in this run.`);
     }
     // Serialize concurrent asks (per session) and RE-CHECK grants when our turn
     // comes. Parallel tools hitting the same not-yet-approved directory all pass
@@ -502,7 +518,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     const chainKey = ctx.sessionId ?? "__global__";
     const prevTurn = askChains.get(chainKey) ?? Promise.resolve();
     let release;
-    askChains.set(chainKey, new Promise((r) => (release = r)));
+    const currentTurn = new Promise((r) => (release = r));
+    askChains.set(chainKey, currentTurn);
     try {
         await prevTurn;
         if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
@@ -511,6 +528,9 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     }
     finally {
         release();
+        if (askChains.get(chainKey) === currentTurn) {
+            askChains.delete(chainKey);
+        }
     }
 }
 /** The actual interactive ask — split out so the serialized section reads flat.
@@ -521,9 +541,7 @@ async function promptForPathApproval(c, operation, ctx) {
     // "工作区外路径" header was misleading for sensitive-path asks.
     const isSensitive = c.reason.startsWith("sensitive");
     const what = operation === "read" ? "读取" : "写入";
-    const title = isSensitive
-        ? `工具想${what}敏感文件`
-        : `工具想${what}工作区外路径`;
+    const title = isSensitive ? `工具想${what}敏感文件` : `工具想${what}工作区外路径`;
     const header = isSensitive ? "敏感文件权限" : "路径权限";
     // Scope options carry remembered grants for the directory of this path, so
     // the same folder isn't re-prompted. Labels are matched by exact string
@@ -566,8 +584,6 @@ async function promptForPathApproval(c, operation, ctx) {
     }
     return `Error: path approval denied by user — ${c.reason}. Path: ${c.resolvedPath}`;
 }
-/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
-const askChains = new Map();
 /**
  * Internal: reset the "disabled warning" latch. Tests flip the env var
  * between cases and need each one to be able to re-trigger the warning.

package/dist/tool-system/workspace-bridge.d.ts

@@ -0,0 +1,11 @@
+import type { SessionWorkspace } from "../types.js";
+/**
+ * WorkspaceBridge — host-backed session workspace switching.
+ *
+ * Desktop implements this through Electron main so model-initiated switches use
+ * the same service path as the UI workspace switcher. Undefined in headless or
+ * non-desktop contexts.
+ */
+export interface WorkspaceBridge {
+    switch(target: string): Promise<SessionWorkspace>;
+}

package/dist/tool-system/workspace-bridge.js

@@ -0,0 +1 @@
+export {};

package/dist/types.d.ts

@@ -149,6 +149,14 @@ export interface SessionWorkspace {
         createdBy: "codeshell";
     };
 }
+export interface ContextUsageAnchor {
+    promptTokens: number;
+    messageCount: number;
+    estimateAtAnchor?: number;
+    recordedAt: number;
+    provider?: string;
+    model?: string;
+}
 export interface SessionState {
     sessionId: string;
     cwd: string;
@@ -162,6 +170,12 @@ export interface SessionState {
      * (for example model switches), so it must not drive whole-session metrics.
      */
     tokenUsage: TokenUsage;
+    /**
+     * Last provider-reported prompt-token count for the current context window.
+     * Separate from cumulative tokenUsage; used only to seed context-size estimates
+     * before the next provider response.
+     */
+    contextUsageAnchor?: ContextUsageAnchor;
     /**
      * Monotonic prompt-cache counters for the whole session. These only increase
      * from session start and are separate from the resettable tokenUsage window.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.6.0-rc.14",
+  "version": "0.6.0-rc.15",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",