@cjhyy/code-shell-core 0.6.0-rc.16 → 0.6.0-rc.18

package/dist/cc-orchestrator/external-agent-driver.js

@@ -6,64 +6,115 @@ export function runWithLines(adapter, lines, exitCode) {
     const parsed = adapter.parseResult(lines);
     return { ...parsed, exitCode, lines };
 }
-/** Spawn ONE headless agent run, collect stream-json to exit, return result.
- *  No time concept — a single turn. Honors AbortSignal (kills the child). */
-export function runAgentOnce(adapter, opts, signal) {
-    return new Promise((resolve, reject) => {
-        const args = adapter.buildArgs({
-            prompt: opts.prompt,
-            resumeSessionId: opts.resumeSessionId,
-            permissionMode: opts.permissionMode ?? "default",
-            cwd: opts.cwd,
-        });
-        // claude takes the prompt in argv (`-p <prompt>`) and wants stdin closed
-        // (verified: avoids a 3s wait). codex `exec` reads the prompt from stdin
-        // (argv ends with `-`), so adapters that set promptViaStdin get a piped
-        // stdin we write the prompt to.
-        const viaStdin = adapter.promptViaStdin === true;
-        const child = spawn(opts.command, args, {
-            cwd: opts.cwd,
+const codexImageFlagCache = new Map();
+export function detectCodexImageInput(command, cwd) {
+    const cached = codexImageFlagCache.get(command);
+    if (cached)
+        return cached;
+    const probe = new Promise((resolve) => {
+        const child = spawn(command, ["exec", "--help"], {
+            cwd,
             env: { ...process.env, PATH: pathWithCommonBins() },
-            // NOT detached: this child is owned by the (long-lived) worker that reads
-            // its stdout. Detaching orphaned it across a worker/app restart — the
-            // reader promise then never resolved and the completion notification never
-            // fired (the "后台任务没返回" bug). Bound to the worker, it lives or dies
-            // with the process that's actually listening for its result.
-            detached: false,
-            stdio: [viaStdin ? "pipe" : "ignore", "pipe", "pipe"],
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "pipe"],
         });
-        if (viaStdin && child.stdin) {
-            child.stdin.end(opts.prompt);
-        }
-        const lines = [];
-        if (child.stdout) {
-            const rl = createInterface({ input: child.stdout });
-            rl.on("line", (line) => lines.push(line));
-        }
-        // Not detached → no own process group, so kill the child directly (a
-        // negative-pid group kill would target the worker's group). claude has no
-        // long-lived child tree of its own here, so a direct SIGTERM is sufficient.
-        const onAbort = () => {
+        let out = "";
+        let settled = false;
+        const done = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const timer = setTimeout(() => {
             try {
                 child.kill("SIGTERM");
             }
-            catch { /* already gone */ }
-        };
-        signal?.addEventListener("abort", onAbort, { once: true });
-        child.on("error", (err) => {
-            signal?.removeEventListener("abort", onAbort);
-            // A missing binary is the most common failure (user hasn't installed the
-            // CLI, or GUI-launched Electron's PATH misses it). Turn the cryptic
-            // "spawn codex ENOENT" into something actionable that names the command.
-            if (err.code === "ENOENT") {
-                reject(new Error(`未找到命令 "${opts.command}"。请先安装该 CLI 并确保它在 PATH 中（${adapter.kind === "codex" ? "Codex CLI" : "Claude Code CLI"}）。`));
-                return;
+            catch {
+                // already gone
             }
-            reject(err);
+            done(false);
+        }, 2_000);
+        child.stdout?.on("data", (chunk) => {
+            out += chunk.toString("utf8");
         });
-        child.on("exit", (code) => {
-            signal?.removeEventListener("abort", onAbort);
-            resolve(runWithLines(adapter, lines, code));
+        child.stderr?.on("data", (chunk) => {
+            out += chunk.toString("utf8");
         });
+        child.on("error", () => done(false));
+        child.on("exit", () => done(/(?:^|\s)-i(?:,|\s)|--image\b/.test(out)));
+    });
+    codexImageFlagCache.set(command, probe);
+    return probe;
+}
+/** Spawn ONE headless agent run, collect stream-json to exit, return result.
+ *  No time concept — a single turn. Honors AbortSignal (kills the child). */
+export function runAgentOnce(adapter, opts, signal) {
+    return new Promise((resolve, reject) => {
+        void (async () => {
+            const codexImageInputSupported = adapter.kind === "codex" && (opts.imagePaths?.length ?? 0) > 0
+                ? await detectCodexImageInput(opts.command, opts.cwd).catch(() => false)
+                : false;
+            const args = adapter.buildArgs({
+                prompt: opts.prompt,
+                resumeSessionId: opts.resumeSessionId,
+                permissionMode: opts.permissionMode ?? "default",
+                cwd: opts.cwd,
+                imagePaths: opts.imagePaths,
+                codexImageInputSupported,
+            });
+            // claude takes the prompt in argv (`-p <prompt>`) and wants stdin closed
+            // (verified: avoids a 3s wait). codex `exec` reads the prompt from stdin
+            // (argv ends with `-`), so adapters that set promptViaStdin get a piped
+            // stdin we write the prompt to.
+            const viaStdin = adapter.promptViaStdin === true;
+            const child = spawn(opts.command, args, {
+                cwd: opts.cwd,
+                env: { ...process.env, PATH: pathWithCommonBins() },
+                // NOT detached: this child is owned by the (long-lived) worker that reads
+                // its stdout. Detaching orphaned it across a worker/app restart — the
+                // reader promise then never resolved and the completion notification never
+                // fired (the "后台任务没返回" bug). Bound to the worker, it lives or dies
+                // with the process that's actually listening for its result.
+                detached: false,
+                stdio: [viaStdin ? "pipe" : "ignore", "pipe", "pipe"],
+            });
+            if (viaStdin && child.stdin) {
+                child.stdin.end(opts.prompt);
+            }
+            const lines = [];
+            if (child.stdout) {
+                const rl = createInterface({ input: child.stdout });
+                rl.on("line", (line) => lines.push(line));
+            }
+            // Not detached → no own process group, so kill the child directly (a
+            // negative-pid group kill would target the worker's group). claude has no
+            // long-lived child tree of its own here, so a direct SIGTERM is sufficient.
+            const onAbort = () => {
+                try {
+                    child.kill("SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+            };
+            signal?.addEventListener("abort", onAbort, { once: true });
+            child.on("error", (err) => {
+                signal?.removeEventListener("abort", onAbort);
+                // A missing binary is the most common failure (user hasn't installed the
+                // CLI, or GUI-launched Electron's PATH misses it). Turn the cryptic
+                // "spawn codex ENOENT" into something actionable that names the command.
+                if (err.code === "ENOENT") {
+                    reject(new Error(`未找到命令 "${opts.command}"。请先安装该 CLI 并确保它在 PATH 中（${adapter.kind === "codex" ? "Codex CLI" : "Claude Code CLI"}）。`));
+                    return;
+                }
+                reject(err);
+            });
+            child.on("exit", (code) => {
+                signal?.removeEventListener("abort", onAbort);
+                resolve(runWithLines(adapter, lines, code));
+            });
+        })().catch(reject);
     });
 }

package/dist/cli/agent-server-stdio.js

@@ -50,6 +50,7 @@ import { logger } from "../logging/logger.js";
 import { cronScheduler } from "../automation/scheduler.js";
 import { CronStore, defaultCronStorePath } from "../automation/store.js";
 import { resolveLLMConfigForTag } from "../engine/resolve-llm-config.js";
+import { createIpcCredentialAccess, setDefaultCredentialAccess } from "../credentials/access.js";
 /**
  * Resolve per-session agent config: protocol slice overrides win, else fall
  * back to disk settings.agent.*. Fixes the bug where settings.agent.* never
@@ -274,6 +275,7 @@ cronScheduler.setExecutionEnabled(false);
 cronScheduler.loadJobs();
 // ─── Step 5: AgentServer over stdio ──────────────────────────────
 const stdioTransport = new StdioTransport(process.stdin, process.stdout);
+setDefaultCredentialAccess(createIpcCredentialAccess(stdioTransport));
 // Cron jobs are persisted by this worker but only main arms/executes their
 // timers (this worker keeps setExecutionEnabled(false) above). When an AI tool
 // creates/deletes a cron job here, notify main over stdio so it reloads the

package/dist/credentials/access.d.ts

@@ -0,0 +1,56 @@
+import type { Credential, CredentialType } from "./types.js";
+import type { SettingsScope } from "../settings/manager.js";
+import type { Transport } from "../protocol/transport.js";
+export type CredentialAccessScope = "full" | "project";
+export interface CredentialMetadata {
+    id: string;
+    type: CredentialType;
+    label: string;
+    autoUseByAI?: boolean;
+    autoInjectByAI?: boolean;
+    exposeAsEnv?: string;
+    meta?: Credential["meta"];
+    hasSecret: boolean;
+    secretHint?: string;
+}
+export interface CredentialAccess {
+    listMasked(cwd: string | undefined, scope: CredentialAccessScope): CredentialMetadata[];
+    resolveMeta(cwd: string | undefined, id: string, scope: CredentialAccessScope): CredentialMetadata | undefined;
+    envExposures(cwd: string | undefined, scope: CredentialAccessScope): Record<string, string>;
+    resolveValue?(req: {
+        cwd?: string;
+        id: string;
+        scope: CredentialAccessScope;
+        purpose: "use" | "mcp";
+    }): Promise<string>;
+    materializeCookie?(req: {
+        cwd?: string;
+        id: string;
+        scope: CredentialAccessScope;
+    }): Promise<{
+        cookiesFile: string;
+        count: number;
+    }>;
+}
+export interface CredentialSnapshotEntry {
+    cwd?: string;
+    full: CredentialMetadata[];
+    project: CredentialMetadata[];
+    envFull: Record<string, string>;
+    envProject: Record<string, string>;
+}
+export interface CredentialSnapshot {
+    revision: number;
+    entries: CredentialSnapshotEntry[];
+}
+export declare function setDefaultCredentialAccess(access: CredentialAccess | null | undefined): void;
+export declare function getCredentialAccess(): CredentialAccess;
+export declare function createIpcCredentialAccess(transport: Pick<Transport, "send" | "onMessage">): CredentialAccess;
+export declare function credentialAccessScope(scope: SettingsScope | undefined): CredentialAccessScope;
+export declare function isCredentialSecretAvailable(secret: string | undefined): secret is string;
+export declare const localCredentialAccess: CredentialAccess;
+export declare function materializeCookieSecret(credentialId: string, secret: string): {
+    cookiesFile: string;
+    count: number;
+};
+export declare function sweepStaleCredentialCookieFiles(now?: number): void;

package/dist/credentials/access.js

@@ -0,0 +1,183 @@
+import { existsSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CredentialStore } from "./store.js";
+import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
+const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000;
+let defaultCredentialAccess = null;
+export function setDefaultCredentialAccess(access) {
+    defaultCredentialAccess = access ?? null;
+}
+export function getCredentialAccess() {
+    return defaultCredentialAccess ?? localCredentialAccess;
+}
+export function createIpcCredentialAccess(transport) {
+    let snapshot = { revision: 0, entries: [] };
+    let nextId = 1;
+    const pending = new Map();
+    transport.onMessage((msg) => {
+        if ("method" in msg && msg.method === "desktop/credentialSnapshot") {
+            const params = msg.params;
+            if (params && typeof params.revision === "number" && Array.isArray(params.entries)) {
+                snapshot = {
+                    revision: params.revision,
+                    entries: params.entries,
+                };
+            }
+            return;
+        }
+        if (!("id" in msg) || "method" in msg)
+            return;
+        const id = String(msg.id);
+        const waiter = pending.get(id);
+        if (!waiter)
+            return;
+        pending.delete(id);
+        clearTimeout(waiter.timer);
+        if ("error" in msg && msg.error) {
+            waiter.reject(new Error(msg.error.message));
+        }
+        else {
+            waiter.resolve(msg.result);
+        }
+    });
+    const request = (method, params) => {
+        const id = `cred-${nextId++}`;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                pending.delete(id);
+                reject(new Error(`${method} timed out`));
+            }, 30_000);
+            pending.set(id, { resolve, reject, timer });
+            transport.send({ jsonrpc: "2.0", id, method, params });
+        });
+    };
+    const entryFor = (cwd) => {
+        const key = cwd ?? "";
+        return snapshot.entries.find((entry) => (entry.cwd ?? "") === key);
+    };
+    return {
+        listMasked(cwd, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return [];
+            return scope === "project" ? cloneMetadata(entry.project) : cloneMetadata(entry.full);
+        },
+        resolveMeta(cwd, id, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return undefined;
+            const list = scope === "project" ? entry.project : entry.full;
+            return cloneMetadata(list).find((cred) => cred.id === id);
+        },
+        envExposures(cwd, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return {};
+            return { ...(scope === "project" ? entry.envProject : entry.envFull) };
+        },
+        async resolveValue(req) {
+            const result = (await request("desktop/credentialResolve", req));
+            if (typeof result?.value !== "string")
+                throw new Error(`credential "${req.id}" is unavailable`);
+            return result.value;
+        },
+        async materializeCookie(req) {
+            const result = (await request("desktop/credentialMaterializeCookie", req));
+            if (typeof result?.cookiesFile !== "string" || typeof result.count !== "number") {
+                throw new Error(`cookie credential "${req.id}" is unavailable`);
+            }
+            return { cookiesFile: result.cookiesFile, count: result.count };
+        },
+    };
+}
+export function credentialAccessScope(scope) {
+    return scope === "full" || scope === undefined ? "full" : "project";
+}
+export function isCredentialSecretAvailable(secret) {
+    return typeof secret === "string" && secret.length > 0 && !secret.startsWith("enc:");
+}
+function toMetadata(cred) {
+    const secret = cred.secret;
+    const available = isCredentialSecretAvailable(secret);
+    const { secret: _secret, ...rest } = cred;
+    return {
+        ...rest,
+        hasSecret: available,
+        secretHint: available ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
+    };
+}
+function cloneMetadata(list) {
+    return list.map((cred) => ({ ...cred, meta: cred.meta ? { ...cred.meta } : undefined }));
+}
+function storeFor(cwd) {
+    return new CredentialStore(cwd);
+}
+export const localCredentialAccess = {
+    listMasked(cwd, scope) {
+        return storeFor(cwd).list(scope).map(toMetadata);
+    },
+    resolveMeta(cwd, id, scope) {
+        const cred = storeFor(cwd).resolve(id, scope);
+        return cred ? toMetadata(cred) : undefined;
+    },
+    envExposures(cwd, scope) {
+        const out = {};
+        const creds = storeFor(cwd).list(scope);
+        for (const cred of creds) {
+            const name = cred.exposeAsEnv?.trim();
+            if (name && isCredentialSecretAvailable(cred.secret))
+                out[name] = cred.secret;
+        }
+        return out;
+    },
+    async resolveValue(req) {
+        const cred = storeFor(req.cwd).resolve(req.id, req.scope);
+        if (!cred || !isCredentialSecretAvailable(cred.secret)) {
+            throw new Error(`credential "${req.id}" is unavailable`);
+        }
+        return cred.secret;
+    },
+    async materializeCookie(req) {
+        const cred = storeFor(req.cwd).resolve(req.id, req.scope);
+        if (!cred || cred.type !== "cookie" || !isCredentialSecretAvailable(cred.secret)) {
+            throw new Error(`cookie credential "${req.id}" is unavailable`);
+        }
+        return materializeCookieSecret(cred.id, cred.secret);
+    },
+};
+export function materializeCookieSecret(credentialId, secret) {
+    const jar = parseCookieJar(secret);
+    if (jar.length === 0)
+        throw new Error("cookie jar is empty or invalid");
+    const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safeFileName(credentialId)}-${process.pid}-${randomUUID()}.txt`);
+    writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+    return { cookiesFile: file, count: jar.length };
+}
+export function sweepStaleCredentialCookieFiles(now = Date.now()) {
+    const dir = tmpdir();
+    try {
+        if (!existsSync(dir))
+            return;
+        for (const f of readdirSync(dir)) {
+            if (!f.startsWith(COOKIE_FILE_PREFIX))
+                continue;
+            const p = join(dir, f);
+            try {
+                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
+                    rmSync(p, { force: true });
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+}
+function safeFileName(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+}

package/dist/credentials/index.d.ts

@@ -1,6 +1,7 @@
 export { CredentialStore } from "./store.js";
 export type { CredentialScope, MaskedCredential } from "./store.js";
 export { type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, type CredentialAccess, type CredentialAccessScope, type CredentialMetadata, type CredentialSnapshot, type CredentialSnapshotEntry, } from "./access.js";
 export type { Credential, CredentialType, CredentialStoreFile } from "./types.js";
 export { formatNetscapeCookies, parseCookieJar, type CookieLike } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";

package/dist/credentials/index.js

@@ -1,5 +1,6 @@
 export { CredentialStore } from "./store.js";
 export { PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, } from "./access.js";
 export { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
 export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/inject-credential-tool.js

@@ -10,9 +10,9 @@
  * 跨进程:实际的 restoreCookiesToBrowser 在 desktop main(core 够不到 Electron
  * session),经 `ctx.injectCredentialToBrowser` 回调(宿主注入,镜像 askUser)触发。
  */
-import { CredentialStore } from "./store.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
+import { credentialAccessScope, getCredentialAccess } from "./access.js";
 const TOOL_NAME = "InjectCredential";
 const BASE_DESCRIPTION = "Inject a stored COOKIE credential into the built-in browser to restore its " +
     "login state, so you can then drive the page as that logged-in account with the " +
@@ -65,7 +65,7 @@ function sessionAllowFor(ctx) {
 // CredentialStore only distinguishes full user+project from project-only.
 // Isolated engines must be at least as restrictive as project-scoped engines.
 function credentialScope(scope) {
-    return scope === "full" || scope === undefined ? "full" : "project";
+    return credentialAccessScope(scope);
 }
 function readAutoApprove(cwd, scope) {
     try {
@@ -79,8 +79,8 @@ function readAutoApprove(cwd, scope) {
 /** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
 export function isInjectCredentialAvailable(cwd, settingsScope) {
     try {
-        return new CredentialStore(cwd)
-            .listMasked(credentialScope(settingsScope))
+        return getCredentialAccess()
+            .listMasked(cwd, credentialScope(settingsScope))
             .some((c) => c.type === "cookie");
     }
     catch {
@@ -104,7 +104,7 @@ export async function injectCredentialTool(args, ctx) {
             error: "当前环境无内置浏览器(headless/无面板),无法注入。请改用 UseCredential 取 cookie 走 HTTP 请求。",
         });
     }
-    const cred = new CredentialStore(cwd).resolve(id, scope);
+    const cred = getCredentialAccess().resolveMeta(cwd, id, scope);
     if (!cred) {
         return json({
             kind: "error",

package/dist/credentials/use-credential-tool.d.ts

@@ -7,7 +7,8 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
@@ -25,6 +26,12 @@ export declare function useCredentialToolDefFor(cwd: string): ToolDefinition;
  */
 export declare function sweepStaleCredentialCookies(now?: number): void;
 export declare function useCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+export declare function useCredentialBuiltinTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string | {
+    result: string;
+    sensitive: true;
+    displayResult: string;
+    transcriptResult: string;
+}>;
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export declare function __resetCredentialSessionAllowForTests(): void;
 export declare function clearCredentialSessionAllow(sessionId: string): void;