@cjhyy/code-shell-core 0.6.0-rc.16 → 0.6.0-rc.18

package/dist/tool-system/executor.js

@@ -14,22 +14,33 @@ import { parsePatch } from "./builtin/apply-patch/parser.js";
 import { BUILTIN_TOOL_GUARDS } from "./builtin/index.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "./builtin/complete-goal.js";
 import { CANCEL_GOAL_TOOL_NAME } from "./builtin/cancel-goal.js";
-// A1 hardening: hooks must never promote a non-`allow` classifier
-// decision to `allow`. They may otherwise adjust the decision freely
-// (e.g. tighten `allow` to `deny`/`ask`, or relax `deny` to `ask` to
-// request interactive confirmation — both legitimate audit patterns).
-// The user remains the only source of `allow` when the classifier
-// said `ask`/`deny`.
-//
-// See standard §S4 and spec docs/superpowers/specs/2026-05-26-a1-permission-hardening-design.md.
+import { toolResultDisplayText } from "./tool-result-redaction.js";
+const PERMISSION_DECISION_RANK = {
+    allow: 0,
+    ask: 1,
+    deny: 2,
+};
+// Permission hooks may only keep or tighten the current decision. The merge
+// order is deny > ask > allow, so classifier deny/rules stay hard-deny even if
+// a hook asks the user for confirmation.
 function clampHookDecision(classifier, hook) {
     if (!hook)
         return { decision: classifier, rejectedUpgrade: false };
-    if (hook === "allow" && classifier !== "allow") {
+    if (PERMISSION_DECISION_RANK[hook] < PERMISSION_DECISION_RANK[classifier]) {
         return { decision: classifier, rejectedUpgrade: true };
     }
     return { decision: hook, rejectedUpgrade: false };
 }
+function permissionAskReason(preHookMessages, permissionHookMessages) {
+    const parts = [];
+    if (preHookMessages?.length) {
+        parts.push(`pre_tool_use:\n${preHookMessages.join("\n")}`);
+    }
+    if (permissionHookMessages?.length) {
+        parts.push(`on_permission_check:\n${permissionHookMessages.join("\n")}`);
+    }
+    return parts.length > 0 ? parts.join("\n\n") : undefined;
+}
 export class ToolExecutor {
     registry;
     permission;
@@ -132,7 +143,9 @@ export class ToolExecutor {
             };
         }
         const visibilityGuard = BUILTIN_TOOL_GUARDS.get(call.toolName);
-        if (visibilityGuard && this.toolCtx?.toolVisibility && !visibilityGuard(this.toolCtx.toolVisibility)) {
+        if (visibilityGuard &&
+            this.toolCtx?.toolVisibility &&
+            !visibilityGuard(this.toolCtx.toolVisibility)) {
             return {
                 id: call.id,
                 toolName: call.toolName,
@@ -276,41 +289,16 @@ export class ToolExecutor {
                 isError: true,
             };
         }
-        // A1 hardening: pre_tool_use can no longer pre-approve a tool via
-        // `decision === "allow"`. Hooks may relax `allow` and may force
-        // `ask`/`deny`, but they cannot promote a `deny`/`ask` decision to
-        // `allow`. The only paths to `allow` are the classifier (rules,
-        // safe-read, allowlist) and the user (interactive approval).
-        if (hookResult.decision === "allow") {
-            this.log.info("permission.hook_upgrade_rejected", {
-                cat: "permission",
-                tool: call.toolName,
-                site: "pre_tool_use",
-            });
-        }
-        // pre_tool_use can request interactive confirmation via
-        // decision: "ask". We invoke the same handleAsk path the classifier
-        // uses, but feed the hook's messages so the user sees the handler's
-        // reasoning. If the user approves, we skip the classifier below —
-        // the hook and the user together have decided.
-        if (hookResult.decision === "ask") {
-            const reason = hookResult.messages?.join("\n") ?? undefined;
-            const approved = await this.permission.handleAsk(call.toolName, call.args, reason, { sessionId: this.toolCtx?.sessionId });
-            if (!approved) {
-                return {
-                    id: call.id,
-                    toolName: call.toolName,
-                    error: `Tool call denied by user (pre_tool_use ask).`,
-                    isError: true,
-                };
-            }
-        }
         // 0.7. Investigation guard — block redundant reads and tag soft reminders
         // onto results. See investigation-guard.ts for the rules; they enforce the
         // soft prompt guidance in coding.md ("never re-read", "3-call budget").
         const guardDecision = this.guard?.preToolCheck(call);
         if (guardDecision?.block) {
-            this.log.info("guard.block", { cat: "guard", tool: call.toolName, reason: guardDecision.block.slice(0, 200) });
+            this.log.info("guard.block", {
+                cat: "guard",
+                tool: call.toolName,
+                reason: guardDecision.block.slice(0, 200),
+            });
             return {
                 id: call.id,
                 toolName: call.toolName,
@@ -318,68 +306,77 @@ export class ToolExecutor {
                 isError: true,
             };
         }
-        // 1. Permission check — skipped only when pre_tool_use issued an
-        // `ask` that the user just approved (we don't double-prompt).
-        if (hookResult.decision !== "ask") {
-            const classifierDecision = this.permission.classify(call.toolName, call.args);
-            this.log.info("permission.classify", {
+        // 1. Permission check. `pre_tool_use: ask` only adds a stricter ask
+        // requirement; user approval for that ask cannot bypass classifier deny
+        // rules. Final merge order is deny > ask > allow, and at most one prompt
+        // is shown for the merged ask decision.
+        const classifierDecision = this.permission.classify(call.toolName, call.args);
+        this.log.info("permission.classify", {
+            cat: "permission",
+            tool: call.toolName,
+            decision: classifierDecision,
+            mode: this.permission.getMode(),
+        });
+        // on_permission_check hook: lets handlers audit and tighten the decision
+        // (e.g. `allow → ask/deny`). Attempts to relax classifier/pre-hook deny or
+        // ask are rejected by clampHookDecision.
+        const permHook = await this.hooks.emit("on_permission_check", {
+            toolName: call.toolName,
+            args: call.args,
+            toolCallId: call.id,
+            classifierDecision,
+        });
+        const preClamped = clampHookDecision(classifierDecision, hookResult.decision);
+        let decision = preClamped.decision;
+        if (preClamped.rejectedUpgrade) {
+            this.log.info("permission.hook_upgrade_rejected", {
+                cat: "permission",
+                tool: call.toolName,
+                site: "pre_tool_use",
+                attempted: hookResult.decision,
+                classifier: classifierDecision,
+            });
+        }
+        const permClamped = clampHookDecision(decision, permHook.decision);
+        decision = permClamped.decision;
+        if (permClamped.rejectedUpgrade) {
+            this.log.info("permission.hook_upgrade_rejected", {
+                cat: "permission",
+                tool: call.toolName,
+                site: "on_permission_check",
+                attempted: permHook.decision,
+                classifier: classifierDecision,
+            });
+        }
+        if (decision !== classifierDecision) {
+            this.log.info("permission.hook_override", {
                 cat: "permission",
                 tool: call.toolName,
-                decision: classifierDecision,
-                mode: this.permission.getMode(),
+                from: classifierDecision,
+                to: decision,
             });
-            // on_permission_check hook: lets handlers audit and *downgrade*
-            // the classifier decision (e.g. `allow → ask/deny`, `deny →
-            // ask`). Promotion to `allow` is rejected by clampHookDecision
-            // — only the classifier and the user can grant `allow`.
-            const permHook = await this.hooks.emit("on_permission_check", {
+        }
+        if (decision === "deny") {
+            return {
+                id: call.id,
                 toolName: call.toolName,
-                args: call.args,
-                toolCallId: call.id,
-                classifierDecision,
+                error: `Permission denied for tool: ${call.toolName}`,
+                isError: true,
+            };
+        }
+        if (decision === "ask") {
+            const reason = permissionAskReason(hookResult.decision === "ask" ? hookResult.messages : undefined, permHook.decision === "ask" ? permHook.messages : undefined);
+            const approved = await this.permission.handleAsk(call.toolName, call.args, reason, {
+                sessionId: this.toolCtx?.sessionId,
             });
-            // A1 hardening: clamp hook decision to downgrades only.
-            const clamped = clampHookDecision(classifierDecision, permHook.decision);
-            const decision = clamped.decision;
-            if (clamped.rejectedUpgrade) {
-                this.log.info("permission.hook_upgrade_rejected", {
-                    cat: "permission",
-                    tool: call.toolName,
-                    site: "on_permission_check",
-                    attempted: permHook.decision,
-                    classifier: classifierDecision,
-                });
-            }
-            if (decision !== classifierDecision) {
-                this.log.info("permission.hook_override", {
-                    cat: "permission",
-                    tool: call.toolName,
-                    from: classifierDecision,
-                    to: decision,
-                });
-            }
-            if (decision === "deny") {
+            if (!approved) {
                 return {
                     id: call.id,
                     toolName: call.toolName,
-                    error: `Permission denied for tool: ${call.toolName}`,
+                    error: `Permission denied by user for tool: ${call.toolName}`,
                     isError: true,
                 };
             }
-            if (decision === "ask") {
-                const reason = permHook.messages?.join("\n");
-                const approved = await this.permission.handleAsk(call.toolName, call.args, reason, {
-                    sessionId: this.toolCtx?.sessionId,
-                });
-                if (!approved) {
-                    return {
-                        id: call.id,
-                        toolName: call.toolName,
-                        error: `Permission denied by user for tool: ${call.toolName}`,
-                        isError: true,
-                    };
-                }
-            }
         }
         // 2. Pre-tool hook
         await this.hooks.emit("on_tool_start", {
@@ -415,7 +412,7 @@ export class ToolExecutor {
                 toolName: call.toolName,
                 ok: false,
                 durationMs: Date.now() - toolStartedAt,
-                error: err instanceof Error ? err.stack ?? err.message : String(err),
+                error: err instanceof Error ? (err.stack ?? err.message) : String(err),
             });
             // A model calling a tool that isn't in the registry (hallucinated name,
             // or a builtin missing from the active preset's whitelist) must not kill
@@ -437,7 +434,8 @@ export class ToolExecutor {
         if (guardDecision?.prepend && !result.error && result.result) {
             result.result = `${guardDecision.prepend}\n${result.result}`;
         }
-        const payload = result.result ?? result.error ?? "";
+        const observerResult = toolResultDisplayText(result);
+        const payload = observerResult ?? result.error ?? "";
         span.end({
             ok: !result.error,
             chars: payload.length,
@@ -451,21 +449,21 @@ export class ToolExecutor {
             toolName: call.toolName,
             ok: !result.error,
             durationMs: Date.now() - toolStartedAt,
-            output: result.error ? undefined : result.result,
+            output: result.error ? undefined : observerResult,
             error: result.error,
         });
         // 4. Post-tool hook
         await this.hooks.emit("on_tool_end", {
             toolName: call.toolName,
             toolCallId: call.id,
-            result: result.result,
+            result: observerResult,
             error: result.error,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)
         const postHook = await this.hooks.emit("post_tool_use", {
             toolName: call.toolName,
             toolCallId: call.id,
-            result: result.result,
+            result: observerResult,
             error: result.error,
         });
         // Append handler-supplied context (linter output, type-check result,
@@ -574,23 +572,4 @@ export class ToolExecutor {
             return `Error: ${err.message}`;
         }
     }
-    /**
-     * Convert tool results into Message entries for the transcript.
-     */
-    resultsToMessages(toolCalls, results) {
-        const blocks = [];
-        for (const result of results) {
-            blocks.push({
-                type: "tool_result",
-                tool_use_id: result.id,
-                content: result.error ? `Error: ${result.error}` : (result.result ?? "(no output)"),
-            });
-        }
-        return [
-            {
-                role: "user",
-                content: blocks,
-            },
-        ];
-    }
 }

package/dist/tool-system/mcp-manager.d.ts

@@ -6,6 +6,7 @@
 import type { Tool as McpTool } from "@modelcontextprotocol/sdk/types.js";
 import type { MCPServerConfig, RegisteredTool } from "../types.js";
 import { ToolRegistry } from "./registry.js";
+import { type CredentialAccess } from "../credentials/access.js";
 interface MCPResourceInfo {
     uri: string;
     name: string;
@@ -34,6 +35,7 @@ export declare function buildStdioEnv(serverName: string, config: MCPServerConfi
  * and win on conflict. Pure + exported for unit testing.
  */
 export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => string | undefined): Record<string, string>;
+export declare function buildHttpHeadersWithCredentialAccess(serverName: string, config: MCPServerConfig, access?: Pick<CredentialAccess, "resolveValue">): Promise<Record<string, string>>;
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —

package/dist/tool-system/mcp-manager.js

@@ -7,7 +7,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { logger } from "../logging/logger.js";
-import { CredentialStore } from "../credentials/index.js";
+import { getCredentialAccess } from "../credentials/access.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
 import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -90,6 +90,20 @@ export function buildHttpHeaders(serverName, config, resolveCredential) {
     }
     return headers;
 }
+export async function buildHttpHeadersWithCredentialAccess(serverName, config, access = getCredentialAccess()) {
+    if (!config.credentialRef)
+        return buildHttpHeaders(serverName, config);
+    if (!access.resolveValue) {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
+    }
+    const secret = await access.resolveValue({
+        cwd: undefined,
+        id: config.credentialRef,
+        scope: "full",
+        purpose: "mcp",
+    });
+    return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? secret : undefined);
+}
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
@@ -228,7 +242,10 @@ export function buildRegisteredTool(serverName, tool) {
     return {
         name: toOpenAIToolName(`mcp_${serverName}_${tool.name}`),
         description: `[${serverName}] ${tool.description ?? tool.name}`,
-        inputSchema: tool.inputSchema ?? { type: "object", properties: {} },
+        inputSchema: tool.inputSchema ?? {
+            type: "object",
+            properties: {},
+        },
         source: "mcp",
         serverName,
         permissionDefault: "ask",
@@ -403,12 +420,10 @@ export class MCPManager {
             if (!config.url) {
                 throw new Error(`MCP server "${name}": url is required for ${transportType} transport`);
             }
-            // credentialRef resolves against the user-scope CredentialStore. The
-            // shared MCPManager pool has no per-session cwd (see desiredByOwner note),
-            // and MCP-referenced credentials (e.g. a Figma token) are user-global by
-            // nature, so user scope is the right resolution surface here.
-            const credStore = new CredentialStore(undefined);
-            const headers = buildHttpHeaders(name, config, (id) => credStore.resolve(id)?.secret);
+            // credentialRef resolves against user-scope credential access. The shared
+            // MCPManager pool has no per-session cwd, and MCP-referenced credentials
+            // (e.g. a Figma token) remain user-global by design.
+            const headers = await buildHttpHeadersWithCredentialAccess(name, config);
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
                 requestInit: Object.keys(headers).length ? { headers } : undefined,
             });

package/dist/tool-system/path-policy.js

@@ -372,6 +372,12 @@ function isSafeCodeShellDiagnosticRead(resolved) {
     }
     return false;
 }
+function isNoRepoAttachmentRead(resolved, operation) {
+    if (operation !== "read")
+        return false;
+    const root = join(homedir(), ".code-shell", "no-repo", ".code-shell", "attachments");
+    return isInsideDir(resolved, root);
+}
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *
@@ -412,6 +418,13 @@ export function classifyPath(rawPath, opts) {
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {
+        if (isNoRepoAttachmentRead(resolved, opts.operation)) {
+            return {
+                decision: "allow",
+                reason: "no-repo attachment read",
+                resolvedPath: resolved,
+            };
+        }
         if (opts.operation === "read" && isSafeCodeShellDiagnosticRead(resolved)) {
             return {
                 decision: "allow",

package/dist/tool-system/permission.d.ts

@@ -21,6 +21,17 @@ export declare class AutoApprovalBackend implements ApprovalBackend {
     requestApproval(req: ApprovalRequest): Promise<ApprovalResult>;
     private isSafeOperation;
 }
+/**
+ * Closed-session tombstones are a bounded replay guard. A prompt that started
+ * before close is still protected by the state-object identity check in
+ * isActiveSessionState(): clearSession deletes the captured state, so the late
+ * result cannot write into a new bucket even if an old tombstone has aged out.
+ * The tombstone only blocks fresh post-close calls carrying a recently closed
+ * sessionId from creating an empty bucket. 4096 is 256x the default
+ * ChatSessionManager.maxSessions (16), which covers normal late-result bursts
+ * while keeping long-lived processes from retaining every historical id.
+ */
+export declare const CLOSED_SESSION_TOMBSTONE_LIMIT = 4096;
 /**
  * Interactive approval backend — prompts the user via a callback.
  *
@@ -34,13 +45,11 @@ export declare class AutoApprovalBackend implements ApprovalBackend {
  * the next time the user opens the project.
  */
 export declare class InteractiveApprovalBackend implements ApprovalBackend {
-    private sessionAllowRules;
-    private sessionDenyRules;
+    private sessionStateById;
+    private closedSessionIds;
     private promptFn;
-    private cwd;
-    private savedProjectRules;
-    private onProjectRules;
-    private promptTurn;
+    private legacyPromptTurn;
+    private legacyContext;
     setPromptFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
     /**
      * Has someone installed a real prompt callback? Engine consults this
@@ -59,8 +68,18 @@ export declare class InteractiveApprovalBackend implements ApprovalBackend {
      * earlier approvals.
      */
     setOnProjectRules(fn: (rules: PermissionRule[]) => void): void;
+    setSessionContext(sessionId: string, context: {
+        cwd: string;
+        onProjectRules: (rules: PermissionRule[]) => void;
+    }): void;
+    openSession(sessionId: string): void;
+    clearSession(sessionId: string): void;
+    private rememberClosedSession;
+    private makeSessionState;
+    private getSessionState;
+    private isActiveSessionState;
     requestApproval(req: ApprovalRequest): Promise<ApprovalResult>;
-    /** Session-rule lookup — operation-scoped (see sessionAllowRules doc). Deny
+    /** Session-rule lookup — operation-scoped (see sessionStateById doc). Deny
      *  wins over allow if both somehow match (conservative). Null = no rule. */
     private checkSessionRules;
     /** The actual interactive ask + rule recording (runs inside the prompt turn). */
@@ -89,6 +108,8 @@ export declare function pathRuleArgsPattern(absPath: string, scope: "file" | "di
  */
 export declare function ruleMatches(rule: PermissionRule, toolName: string, args: Record<string, unknown>): boolean;
 export declare function getInteractiveApprovalBackend(): InteractiveApprovalBackend;
+export declare function openInteractiveApprovalSession(sessionId: string): void;
+export declare function clearInteractiveApprovalSession(sessionId: string): void;
 export declare function setInteractiveApprovalFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
 type BashSafetyLevel = "safe-read" | "safe-write" | "unsafe" | "dangerous";
 /**