@cjhyy/code-shell-core 0.6.0-rc.16 → 0.6.0-rc.18

package/dist/preset/index.js

@@ -75,9 +75,9 @@ const GENERAL_BUILTIN_TOOLS = [
     // what lets the LLM list/read/save/delete memories during a normal session,
     // AND what makes the end-of-session auto-dream consolidation work — its
     // tool-call loop pulls these from the registry, so without them every dream
-    // run bailed with "missing memory tools". Save/Delete in the user scope stay
-    // permission-gated (the tools declare permissionDefault: "ask"); dream-scope
-    // writes go through freely.
+    // run bailed with "missing memory tools". Save/Delete in the user scope have
+    // no explicit allow rule, so the default-mode classifier fallback asks;
+    // dream-scope writes go through freely.
     "MemoryList",
     "MemoryRead",
     "MemorySave",
@@ -93,7 +93,7 @@ const GENERAL_BUILTIN_TOOLS = [
     // AI 增/改模型 catalog(写 ~/.code-shell/model-catalog.user.json)。同 BashOutput/
     // UseCredential 一样的 whitelist 要求:registerBuiltins 按 preset 集过滤 BUILTIN_TOOLS,
     // 名单里没有它 → 即使工具已注册,AI 列表里也没有 → 用户实测「找不到这个工具」。
-    // permissionDefault: "ask",列入只是让 AI 看得到,调用仍走审批,无条件列入安全。
+    // 列入只是让 AI 看得到；执行期没有显式 allow rule，默认 classifier fallback 会审批。
     "EditModelCatalog",
     // Goal-mode control tools. Same whitelist requirement as the rest:
     // registerBuiltins filters BUILTIN_TOOLS by the preset set, so a goal tool
@@ -134,18 +134,19 @@ const GENERAL_PERMISSION_RULES = [
     { tool: "Skill", decision: "allow" },
     // ListMcpResources only enumerates resource names (and the executor filters
     // the list to this session's enabled servers). ReadMcpResource pulls actual
-    // content and is intentionally NOT auto-allowed here — it falls back to its
-    // tool-level "ask" default so a default-mode session confirms the read.
+    // content and is intentionally NOT auto-allowed here — with no explicit rule,
+    // default-mode classifier fallback asks the user. The tool's
+    // permissionDefault is only UI/metadata, not classifier input.
     { tool: "ListMcpResources", decision: "allow" },
     // Reading memory is always safe; writes (MemorySave/MemoryDelete) stay gated
-    // by the tools' own permissionDefault so the user confirms each change.
+    // by explicit rules below plus default-mode ask fallback.
     { tool: "MemoryList", decision: "allow" },
     { tool: "MemoryRead", decision: "allow" },
     // Browser automation (3 semantic tools). Rules are first-match-wins, ordered
     // by specificity — so the action-gating rule for browser_act MUST come first:
     // click/type/select mutate the page/form → "ask"; all other actions (hover/
-    // scroll/wait/press_key/list_tabs/switch_tab) fall through to browser_act's
-    // tool-level "allow". observe (read-only) and navigate auto-allow.
+    // scroll/wait/press_key/list_tabs/switch_tab) fall through to the default
+    // allow rule below. observe (read-only) and navigate auto-allow.
     // (Main-side sensitive-action + domain-whitelist enforcement also applies.)
     {
         tool: "browser_act",

package/dist/protocol/chat-session-manager.d.ts

@@ -25,6 +25,7 @@ export declare class ChatSessionManager {
     constructor(opts: ChatSessionManagerOptions);
     getOrCreate(sessionId: string, slice: EngineConfigSlice): ChatSession;
     get(sessionId: string): ChatSession | undefined;
+    sessionExistsOnDisk(sessionId: string, slice: EngineConfigSlice): boolean;
     /**
      * Iterate every live session once. Public iterator so callers (e.g. the
      * protocol server's config hot-reload / sessions query) don't reach into

package/dist/protocol/chat-session-manager.js

@@ -1,10 +1,12 @@
 import { ChatSession } from "./chat-session.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { clearAgentOutputFiles } from "../tool-system/builtin/agent-output-file.js";
+import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js";
 import { clearCredentialSessionAllow } from "../credentials/use-credential-tool.js";
 import { clearInjectCredentialSessionAllow } from "../credentials/inject-credential-tool.js";
 import { logger } from "../logging/logger.js";
 import { clearSessionPathApprovals, openSessionPathApprovals } from "../tool-system/path-policy.js";
+import { clearInteractiveApprovalSession, openInteractiveApprovalSession, } from "../tool-system/permission.js";
 export class ChatSessionManager {
     sessions = new Map();
     runtime;
@@ -20,6 +22,7 @@ export class ChatSessionManager {
     }
     getOrCreate(sessionId, slice) {
         openSessionPathApprovals(sessionId);
+        openInteractiveApprovalSession(sessionId);
         const existing = this.sessions.get(sessionId);
         if (existing) {
             existing.lastActivityAt = Date.now();
@@ -49,6 +52,13 @@ export class ChatSessionManager {
     get(sessionId) {
         return this.sessions.get(sessionId);
     }
+    sessionExistsOnDisk(sessionId, slice) {
+        const existing = this.sessions.get(sessionId);
+        if (existing)
+            return true;
+        const probeEngine = this.factory(slice);
+        return probeEngine.sessionExistsOnDisk(sessionId);
+    }
     /**
      * Iterate every live session once. Public iterator so callers (e.g. the
      * protocol server's config hot-reload / sessions query) don't reach into
@@ -65,6 +75,7 @@ export class ChatSessionManager {
             return;
         s.cancel();
         clearSessionPathApprovals(sessionId);
+        clearInteractiveApprovalSession(sessionId);
         clearCredentialSessionAllow(sessionId);
         clearInjectCredentialSessionAllow(sessionId);
         this.unregisterMcpOwner(s);
@@ -103,8 +114,13 @@ export class ChatSessionManager {
     sweepIdle() {
         const cutoff = Date.now() - this.idleTtlMs;
         for (const [id, s] of [...this.sessions]) {
-            if (s.lastActivityAt < cutoff && !s.isBusy())
-                this.close(id);
+            if (s.lastActivityAt >= cutoff)
+                continue;
+            if (s.isBusy())
+                continue;
+            if (backgroundJobRegistry.hasRunningForSession(id))
+                continue;
+            this.close(id);
         }
     }
     startIdleSweeper(intervalMs = 60_000) {

package/dist/protocol/chat-session.d.ts

@@ -1,6 +1,7 @@
 import type { Engine, EngineResult } from "../engine/engine.js";
 import type { ModelEntry } from "../llm/model-pool.js";
 import type { StreamEvent } from "../types.js";
+import type { InputAttachmentMeta } from "./types.js";
 export interface ChatSessionOptions {
     id: string;
     engine: Engine;
@@ -20,6 +21,8 @@ export interface TurnOpts {
     injected?: boolean;
     /** Stable id for this user-intent; forwarded to Engine.run for idempotency. */
     clientMessageId?: string;
+    /** Structured input attachments for this turn. */
+    attachments?: InputAttachmentMeta[];
 }
 /**
  * One ChatSession per UI chat tab. Owns a single Engine, an AbortController

package/dist/protocol/chat-session.js

@@ -170,6 +170,7 @@ export class ChatSession {
                 goal: next.opts.goal,
                 injected: next.opts.injected,
                 clientMessageId: next.opts.clientMessageId,
+                attachments: next.opts.attachments,
             });
             this.lastActivityAt = Date.now();
             next.resolve(result);

package/dist/protocol/client.d.ts

@@ -11,12 +11,15 @@
  *   const result = await client.run("fix the bug");
  */
 import type { Transport } from "./transport.js";
-import { type RunParams, type RunResult, type AgentStreamEventNotification, type ConfigureParams, type QueryParams, type QueryResult } from "./types.js";
+import { type RunParams, type RunResult, type AgentStreamEventNotification, type ConfigureParams, type QueryParams, type QueryResult, type ApprovalRequestNotification, type ApprovalResolvedNotification } from "./types.js";
 import type { ApprovalRequest, ApprovalResult, PermissionMode, BackgroundAgentCompletedEvent } from "../types.js";
+export type ApprovalRequestMeta = Pick<ApprovalRequestNotification, "sessionId">;
+export type ApprovalResolvedEvent = ApprovalResolvedNotification;
 export interface AgentClientEvents {
     /** Multi-session envelope: carries sessionId + event. */
     stream: (envelope: AgentStreamEventNotification) => void;
-    approvalRequest: (requestId: string, request: ApprovalRequest) => void;
+    approvalRequest: (requestId: string, request: ApprovalRequest, meta?: ApprovalRequestMeta) => void;
+    approvalResolved: (event: ApprovalResolvedEvent) => void;
     status: (status: string, message?: string) => void;
 }
 export interface AgentRunOptions {
@@ -115,8 +118,10 @@ export declare class AgentClient {
      */
     onStreamEvent(handler: (envelope: AgentStreamEventNotification) => void): void;
     offStreamEvent(handler: (envelope: AgentStreamEventNotification) => void): void;
-    onApprovalRequest(handler: (requestId: string, request: ApprovalRequest) => void): void;
-    offApprovalRequest(handler: (requestId: string, request: ApprovalRequest) => void): void;
+    onApprovalRequest(handler: (requestId: string, request: ApprovalRequest, meta?: ApprovalRequestMeta) => void): void;
+    offApprovalRequest(handler: (requestId: string, request: ApprovalRequest, meta?: ApprovalRequestMeta) => void): void;
+    onApprovalResolved(handler: (event: ApprovalResolvedEvent) => void): void;
+    offApprovalResolved(handler: (event: ApprovalResolvedEvent) => void): void;
     onStatus(handler: (status: string, message?: string) => void): void;
     offStatus(handler: (status: string, message?: string) => void): void;
     /**

package/dist/protocol/client.js

@@ -211,6 +211,12 @@ export class AgentClient {
     offApprovalRequest(handler) {
         this.emitter.off("approvalRequest", handler);
     }
+    onApprovalResolved(handler) {
+        this.emitter.on("approvalResolved", handler);
+    }
+    offApprovalResolved(handler) {
+        this.emitter.off("approvalResolved", handler);
+    }
     onStatus(handler) {
         this.emitter.on("status", handler);
     }
@@ -279,7 +285,18 @@ export class AgentClient {
                 const requestId = params.requestId;
                 const request = params.request;
                 if (requestId && request) {
-                    this.emitter.emit("approvalRequest", requestId, request);
+                    const sessionId = typeof params.sessionId === "string" ? params.sessionId : undefined;
+                    const meta = sessionId === undefined ? {} : { sessionId };
+                    this.emitter.emit("approvalRequest", requestId, request, meta);
+                }
+                break;
+            }
+            case Methods.ApprovalResolved: {
+                const requestId = params.requestId;
+                if (requestId) {
+                    const sessionId = typeof params.sessionId === "string" ? params.sessionId : undefined;
+                    const event = sessionId === undefined ? { requestId } : { sessionId, requestId };
+                    this.emitter.emit("approvalResolved", event);
                 }
                 break;
             }

package/dist/protocol/server.d.ts

@@ -67,6 +67,14 @@ export declare class AgentServer {
     /** Disk-only active-goal reader for agent/goalGet on a non-live session. */
     private readonly readActiveGoalFromDisk;
     private readonly workspaceBridgeEnabled;
+    /**
+     * Last per-session EngineConfigSlice supplied by agent/run. Kept even after
+     * idle eviction so background-completion wakeups can rebuild the ChatSession
+     * with the same cwd/permission/trust inputs before draining the queue.
+     */
+    private readonly lastSliceBySession;
+    /** Lazy disk reader for cold wakeup rehydrate when this process lacks a slice. */
+    private diskSessionReader;
     /**
      * Monotonic config-reload version, bumped per reloadSettings request so each
      * Engine.refreshRuntimeConfig can drop out-of-order (stale) deliveries (Q5).
@@ -137,6 +145,10 @@ export declare class AgentServer {
      * "wakeup in flight" guard flag.
      */
     private maybeWakeIdleSession;
+    private rehydrateSessionForWake;
+    private sliceForWakeRehydrate;
+    private rememberSessionSlice;
+    private wireInteractiveSession;
     private handleRequest;
     private handleRun;
     private handleRunMulti;

package/dist/protocol/server.js

@@ -24,6 +24,7 @@ import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js
 import { listBackgroundWorkForUI } from "../tool-system/builtin/background-work.js";
 import { logger } from "../logging/logger.js";
 import { nanoid } from "nanoid";
+import { SessionManager } from "../session/session-manager.js";
 import { redactLlmConfig, maskSecretValue } from "./redact.js";
 import { redactSecrets } from "../logging/sanitize-messages.js";
 const COMPACT_STREAM_STRATEGIES = new Set([
@@ -49,6 +50,14 @@ export class AgentServer {
     /** Disk-only active-goal reader for agent/goalGet on a non-live session. */
     readActiveGoalFromDisk;
     workspaceBridgeEnabled;
+    /**
+     * Last per-session EngineConfigSlice supplied by agent/run. Kept even after
+     * idle eviction so background-completion wakeups can rebuild the ChatSession
+     * with the same cwd/permission/trust inputs before draining the queue.
+     */
+    lastSliceBySession = new Map();
+    /** Lazy disk reader for cold wakeup rehydrate when this process lacks a slice. */
+    diskSessionReader = null;
     /**
      * Monotonic config-reload version, bumped per reloadSettings request so each
      * Engine.refreshRuntimeConfig can drop out-of-order (stale) deliveries (Q5).
@@ -179,7 +188,7 @@ export class AgentServer {
     maybeWakeIdleSession(sessionId) {
         if (!this.chatManager)
             return;
-        const session = this.chatManager.get(sessionId);
+        const session = this.chatManager.get(sessionId) ?? this.rehydrateSessionForWake(sessionId);
         if (!session || session.isBusy())
             return;
         // Headless / automation runs are one-shot: the caller takes result.text and
@@ -239,6 +248,76 @@ export class AgentServer {
             this.maybeWakeIdleSession(sessionId);
         });
     }
+    rehydrateSessionForWake(sessionId) {
+        if (!this.chatManager)
+            return null;
+        try {
+            const pending = notificationQueue.getSnapshot(sessionId);
+            if (pending.length === 0) {
+                logger.debug("bg_wakeup.rehydrate_skipped_no_pending", { sessionId });
+                return null;
+            }
+            const slice = this.sliceForWakeRehydrate(sessionId);
+            if (!slice) {
+                logger.warn("bg_wakeup.rehydrate_skipped_missing_disk_session", {
+                    sessionId,
+                    pendingCount: pending.length,
+                    reason: "state_json_cwd_missing",
+                });
+                return null;
+            }
+            if (!this.chatManager.sessionExistsOnDisk(sessionId, slice)) {
+                logger.warn("bg_wakeup.rehydrate_skipped_missing_disk_session", {
+                    sessionId,
+                    pendingCount: pending.length,
+                });
+                return null;
+            }
+            const session = this.chatManager.getOrCreate(sessionId, slice);
+            this.wireInteractiveSession(session, sessionId);
+            logger.debug("bg_wakeup.rehydrated_session", {
+                sessionId,
+                pendingCount: pending.length,
+                source: this.lastSliceBySession.has(sessionId) ? "last_slice" : "state_json",
+            });
+            return session;
+        }
+        catch (err) {
+            logger.warn("bg_wakeup.rehydrate_failed", {
+                sessionId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return null;
+        }
+    }
+    sliceForWakeRehydrate(sessionId) {
+        const cached = this.lastSliceBySession.get(sessionId);
+        if (cached)
+            return { ...cached };
+        if (!this.diskSessionReader)
+            this.diskSessionReader = new SessionManager();
+        const cwd = this.diskSessionReader.readCwd(sessionId);
+        if (!cwd)
+            return null;
+        return {
+            permissionMode: "default",
+            projectTrusted: false,
+            cwd,
+        };
+    }
+    rememberSessionSlice(sessionId, slice) {
+        this.lastSliceBySession.set(sessionId, { ...slice });
+    }
+    wireInteractiveSession(session, sid) {
+        if (session.engine.isHeadless())
+            return;
+        session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
+        session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
+        session.engine.setInjectCredential((credentialId, credentialScope) => this.requestCredentialInjectForSession(session, sid, credentialId, credentialScope));
+        if (this.workspaceBridgeEnabled && typeof session.engine.setWorkspaceBridge === "function") {
+            session.engine.setWorkspaceBridge(this.makeWorkspaceBridge(session, sid));
+        }
+    }
     // ─── Request Dispatch ───────────────────────────────────────────
     async handleRequest(req) {
         switch (req.method) {
@@ -311,28 +390,39 @@ export class AgentServer {
             this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "task is required"));
             return;
         }
+        const sessionConfig = {
+            permissionMode: params.permissionMode,
+            cwd: params.cwd,
+            projectTrusted: params.projectTrusted,
+            goal: typeof params.goal === "string" || (params.goal != null && typeof params.goal === "object")
+                ? params.goal
+                : undefined,
+        };
+        if (params.requireExisting === true && !cm.get(params.sessionId)) {
+            let existsOnDisk = false;
+            try {
+                existsOnDisk = cm.sessionExistsOnDisk(params.sessionId, sessionConfig);
+            }
+            catch (err) {
+                const code = err.code ?? ErrorCodes.InternalError;
+                this.transport.send(createErrorResponse(req.id, code, err.message));
+                return;
+            }
+            if (!existsOnDisk) {
+                this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionNotFound, `session ${params.sessionId} does not exist`));
+                return;
+            }
+        }
         let session;
         try {
-            session = cm.getOrCreate(params.sessionId, {
-                permissionMode: params.permissionMode,
-                cwd: params.cwd,
-                projectTrusted: params.projectTrusted,
-            });
+            session = cm.getOrCreate(params.sessionId, sessionConfig);
         }
         catch (err) {
             const code = err.code ?? ErrorCodes.InternalError;
             this.transport.send(createErrorResponse(req.id, code, err.message));
             return;
         }
-        // `requireExisting`: reject if the target session isn't on disk rather than
-        // running the prompt against a freshly-created blank session. A cron
-        // "continue this conversation" job whose session the user deleted must fail
-        // loudly here (SessionNotFound) so the scheduler can auto-disable it,
-        // instead of silently executing with no transcript/goal/context.
-        if (params.requireExisting === true && !session.engine.sessionExistsOnDisk(params.sessionId)) {
-            this.transport.send(createErrorResponse(req.id, ErrorCodes.SessionNotFound, `session ${params.sessionId} does not exist`));
-            return;
-        }
+        this.rememberSessionSlice(params.sessionId, sessionConfig);
         if (params.model !== undefined) {
             if (typeof params.model !== "string" || params.model.length === 0) {
                 this.transport.send(createErrorResponse(req.id, ErrorCodes.InvalidParams, "model must be a non-empty string"));
@@ -350,32 +440,14 @@ export class AgentServer {
             session.engine.setPlanMode(params.planMode);
         }
         const sid = params.sessionId;
-        // Wire AskUserQuestion for this interactive session. The chatManager path
-        // builds a fresh per-session Engine via engineFactory, which (unlike the
-        // legacy single-engine path) never had askUser wired — so AskUserQuestion
-        // always fell into its "not available in headless mode" branch in normal
-        // chat (and in a resumed automation session). Route it to the client with
-        // this session's id so the renderer attributes the question to the right
-        // tab, resolving via the session's own pendingApprovals. Skip genuinely
-        // headless engines (no human to answer).
-        if (!session.engine.isHeadless()) {
-            session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
-            // Browser automation bridge: each method routes a browser action to the
-            // client (Electron main drives the webview via CDP) over the SAME
-            // request/response channel as askUser (pendingApprovals + requestId).
-            // Browser actions still keep their own bounded timeout; AskUserQuestion
-            // waits for a real answer or Stop/cancel.
-            session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
-            // Cookie→browser injection (InjectCredential tool): same cross-process
-            // channel; main restores the cookie jar into the built-in browser.
-            session.engine.setInjectCredential((credentialId, credentialScope) => this.requestCredentialInjectForSession(session, sid, credentialId, credentialScope));
-            if (this.workspaceBridgeEnabled && typeof session.engine.setWorkspaceBridge === "function") {
-                session.engine.setWorkspaceBridge(this.makeWorkspaceBridge(session, sid));
-            }
-        }
+        // Wire AskUserQuestion and host bridges for this interactive session. The
+        // chatManager path builds a fresh per-session Engine via engineFactory, so
+        // these host callbacks must be installed after every create/recreate.
+        this.wireInteractiveSession(session, sid);
         try {
             const result = await session.enqueueTurn(params.task, {
                 cwd: params.cwd,
+                attachments: Array.isArray(params.attachments) ? params.attachments : undefined,
                 goal: typeof params.goal === "string" ||
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
@@ -637,6 +709,12 @@ export class AgentServer {
             : params.sessionId
                 ? (this.legacyEngine.clearGoal(params.sessionId) ?? false)
                 : false;
+        if (cleared && typeof params.sessionId === "string" && params.sessionId.length > 0) {
+            this.notify(Methods.StreamEvent, {
+                sessionId: params.sessionId,
+                event: { type: "goal_cleared" },
+            });
+        }
         this.transport.send(createResponse(req.id, { ok: true, cleared }));
     }
     /**

package/dist/protocol/types.d.ts

@@ -47,10 +47,41 @@ export declare const ErrorCodes: {
      */
     readonly Cancelled: -32005;
 };
+export type InputAttachmentKind = "image" | "file" | "directory";
+export type InputAttachmentOrigin = "paste" | "os-drop" | "file-panel" | "picker" | "mention" | "generated" | "tool";
+export interface InputAttachmentMeta {
+    id: string;
+    sessionId: string;
+    kind: InputAttachmentKind;
+    origin: InputAttachmentOrigin;
+    path: string;
+    absPath: string;
+    relPath?: string;
+    mime?: string;
+    size: number;
+    sha256: string;
+    originalName?: string;
+    createdAt: number;
+    sourcePath?: string;
+    width?: number;
+    height?: number;
+    vision?: {
+        include: boolean;
+        mediaPath?: string;
+        detail?: "low" | "standard" | "high";
+    };
+    directory?: {
+        treePath?: string;
+        truncated?: boolean;
+        entryCount?: number;
+    };
+}
 /** Start an agent run with a user task. */
 export interface RunParams {
     sessionId: string;
     task: string;
+    /** Structured input attachments. Legacy `<codeshell-image>` task blocks remain supported. */
+    attachments?: InputAttachmentMeta[];
     /** Stable id for the user's submit intent; duplicate ids are idempotent. */
     clientMessageId?: string;
     /**
@@ -264,6 +295,12 @@ export interface ApprovalRequestNotification {
     requestId: string;
     request: ApprovalRequest;
 }
+/** Server tells clients a pending approval/ask has been resolved elsewhere. */
+export interface ApprovalResolvedNotification {
+    /** Originating engine session when known. */
+    sessionId?: string;
+    requestId: string;
+}
 /** Server status changed. */
 export interface StatusNotification {
     status: "ready" | "running" | "error" | "shutdown";

package/dist/runtime/spawn-common.js

@@ -159,6 +159,13 @@ export function resolveGitBash() {
     const override = process.env.CODE_SHELL_GIT_BASH_PATH;
     if (override && existsSync(override))
         return (gitBashCache = override);
+    // Test-only hermetic switch: skip auto-discovery entirely. Clearing PATH is
+    // NOT enough on Windows — CreateProcess always searches System32, so `where`
+    // still spawns and a CI runner's preinstalled Git for Windows would resolve a
+    // real bash.exe and defeat the fallback tests. This env flag makes the
+    // "Git Bash absent" scenario reproducible on a real Windows host.
+    if (process.env.CODE_SHELL_NO_SHELL_DISCOVERY)
+        return (gitBashCache = null) ?? undefined;
     const candidates = [];
     // (2) derive from `where git`. Git installs git.exe under either \cmd\ or
     // \bin\; bash.exe lives under the sibling \bin\. Walk up to the Git root.
@@ -194,6 +201,9 @@ export function resolvePowerShell() {
     const override = process.env.CODE_SHELL_POWERSHELL_PATH;
     if (override && existsSync(override))
         return (powerShellCache = override);
+    // Test-only hermetic switch (see resolveGitBash for why PATH-clearing fails).
+    if (process.env.CODE_SHELL_NO_SHELL_DISCOVERY)
+        return (powerShellCache = null) ?? undefined;
     const candidates = [];
     for (const exe of ["pwsh", "powershell"]) {
         try {

package/dist/tool-system/builtin/drive-claude-code.d.ts

@@ -14,6 +14,7 @@ type Runner = (opts: {
     cwd: string;
     permissionMode?: PermMode;
     signal?: AbortSignal;
+    imagePaths?: string[];
 }) => Promise<AgentRunResult>;
 type SessionStore = {
     get(cli: DriveCli, sessionId: string): ExternalAgentSessionBinding | undefined;