@cjhyy/code-shell-core 0.6.0-rc.17 → 0.6.0-rc.18

package/dist/credentials/use-credential-tool.js

@@ -7,22 +7,17 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
-import { writeFileSync, existsSync, readdirSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
-import { CredentialStore } from "./store.js";
-import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+import { SENSITIVE_TOOL_RESULT_PLACEHOLDER } from "../tool-system/tool-result-redaction.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
 import { logger } from "../logging/logger.js";
+import { credentialAccessScope, getCredentialAccess, materializeCookieSecret, sweepStaleCredentialCookieFiles, } from "./access.js";
 const TOOL_NAME = "UseCredential";
-const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
-const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000; // 30min 启动 sweep 上限
 const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cookie) to run a command. " +
     "Call with NO arguments first to list available credentials (id + label + type); " +
     "then call again with `id` to fetch one. Token/link credentials return their secret " +
@@ -52,7 +47,7 @@ export const useCredentialToolDef = {
  */
 export function useCredentialToolDefFor(cwd) {
     try {
-        const list = new CredentialStore(cwd).listMasked();
+        const list = getCredentialAccess().listMasked(cwd, "full");
         if (list.length === 0)
             return useCredentialToolDef;
         const names = list.map((c) => `${c.id} (${c.type})`).join(", ");
@@ -70,26 +65,7 @@ export function useCredentialToolDefFor(cwd) {
  * 不引入 lease 对象/定时器 —— 文件用完靠进程退出 + 这个轻量 sweep。
  */
 export function sweepStaleCredentialCookies(now = Date.now()) {
-    const dir = tmpdir();
-    try {
-        if (!existsSync(dir))
-            return;
-        for (const f of readdirSync(dir)) {
-            if (!f.startsWith(COOKIE_FILE_PREFIX))
-                continue;
-            const p = join(dir, f);
-            try {
-                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
-                    rmSync(p, { force: true });
-            }
-            catch {
-                /* skip */
-            }
-        }
-    }
-    catch {
-        /* best-effort */
-    }
+    sweepStaleCredentialCookieFiles(now);
 }
 /** 内存会话 allow 集:每个 Engine 一份(从 ctx.sessionId 键)。纯内存,关进程即忘。 */
 const sessionAllowByEngine = new Map();
@@ -112,7 +88,7 @@ function sessionAllowFor(ctx) {
 // (project-only). An "isolated" engine is at least as restrictive as project,
 // so it maps to "project" — it must never read the host user's ~/.code-shell.
 function credentialScope(scope) {
-    return scope === "full" || scope === undefined ? "full" : "project";
+    return credentialAccessScope(scope);
 }
 function readAutoApprove(cwd, scope) {
     try {
@@ -128,19 +104,19 @@ function readAutoApprove(cwd, scope) {
 }
 export async function useCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
-    const store = new CredentialStore(cwd);
+    const access = getCredentialAccess();
     const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     // 无 id → 清单(脱敏,权威实时源)。按 engine scope 过滤:project/isolated
     // 引擎不得列出宿主 user 层凭证。
     if (!id) {
-        const credentials = store
-            .listMasked(scope)
+        const credentials = access
+            .listMasked(cwd, scope)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
         return json({ kind: "list", credentials });
     }
-    const cred = store.resolve(id, scope);
+    const cred = access.resolveMeta(cwd, id, scope);
     if (!cred) {
         return json({ kind: "error", error: `凭证不存在: "${id}"。调用本工具(无参)可列出可用凭证。` });
     }
@@ -162,14 +138,20 @@ export async function useCredentialTool(args, ctx) {
     }
     // token/link → 直接返回值
     if (cred.type === "token" || cred.type === "link") {
-        if (!cred.secret)
+        if (!cred.hasSecret || !access.resolveValue) {
+            return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
+        }
+        try {
+            const value = await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" });
+            return json({ kind: "value", value });
+        }
+        catch {
             return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
-        return json({ kind: "value", value: cred.secret });
+        }
     }
     // cookie → 就地写临时 cookies.txt
     if (cred.type === "cookie") {
-        const jar = parseCookieJar(cred.secret);
-        if (jar.length === 0) {
+        if (!cred.hasSecret) {
             return json({
                 kind: "error",
                 error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
@@ -180,25 +162,53 @@ export async function useCredentialTool(args, ctx) {
         // same process — the second write would clobber the first and a caller could
         // read another account's cookies. A random component makes each file distinct.
         // Prefix is unchanged so the 30-min startup sweep still matches & cleans them.
-        const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safe(cred.id)}-${process.pid}-${randomUUID()}.txt`);
         try {
-            writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+            const materialized = access.materializeCookie
+                ? await access.materializeCookie({ cwd, id: cred.id, scope })
+                : materializeCookieSecret(cred.id, await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" }));
+            return json({
+                kind: "cookie",
+                cookiesFile: materialized.cookiesFile,
+                count: materialized.count,
+            });
         }
         catch (e) {
+            if (String(e).includes("cookie jar is empty or invalid")) {
+                return json({
+                    kind: "error",
+                    error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
+                });
+            }
             logger.warn(`UseCredential: failed to write cookies.txt: ${String(e)}`);
             return json({ kind: "error", error: `写临时 cookie 文件失败: ${String(e)}` });
         }
-        return json({ kind: "cookie", cookiesFile: file, count: jar.length });
     }
     return json({ kind: "error", error: `未知凭证类型: ${cred.type}` });
 }
-/** 文件名安全化(凭证 id 用了 `__`,这里只挡路径分隔符/控制字符)。 */
-function safe(s) {
-    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+export async function useCredentialBuiltinTool(args, ctx) {
+    const result = await useCredentialTool(args, ctx);
+    if (!isValueResult(result))
+        return result;
+    const redacted = json({ kind: "value", value: SENSITIVE_TOOL_RESULT_PLACEHOLDER });
+    return {
+        result,
+        sensitive: true,
+        displayResult: redacted,
+        transcriptResult: redacted,
+    };
 }
 function json(r) {
     return JSON.stringify(r);
 }
+function isValueResult(result) {
+    try {
+        const parsed = JSON.parse(result);
+        return parsed.kind === "value" && typeof parsed.value === "string";
+    }
+    catch {
+        return false;
+    }
+}
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export function __resetCredentialSessionAllowForTests() {
     sessionAllowByEngine.clear();

package/dist/engine/engine.d.ts

@@ -16,6 +16,7 @@ import { type SandboxBackend } from "../tool-system/sandbox/index.js";
 import { ModelPool, type ModelEntry } from "../llm/model-pool.js";
 import { AgentDefinitionRegistry } from "../agent/agent-definition-registry.js";
 import { EngineRuntime } from "./runtime.js";
+import type { InputAttachmentMeta } from "../protocol/types.js";
 /**
  * Build ScanOptions.compatFileNames from the user's instruction compat toggles.
  * Primary file name stays hard-wired to CODESHELL.md (not exposed). Turning a
@@ -328,6 +329,8 @@ export declare class Engine {
         injected?: boolean;
         /** Stable id for this user-intent, used to make duplicate submits idempotent. */
         clientMessageId?: string;
+        /** Structured input attachments. Legacy `<codeshell-image>` blocks remain supported. */
+        attachments?: InputAttachmentMeta[];
     }): Promise<EngineResult>;
     /**
      * Run the end-of-session memory pipeline as a fire-and-forget background

package/dist/engine/engine.js

@@ -40,7 +40,7 @@ import { sanitizeContent, sanitizeTaskString } from "../logging/sanitize-message
 import { TurnLoop } from "./turn-loop.js";
 import { MCPManager } from "../tool-system/mcp-manager.js";
 import { SettingsManager, userHome } from "../settings/manager.js";
-import { CredentialStore } from "../credentials/store.js";
+import { getCredentialAccess } from "../credentials/access.js";
 import { isFeatureEnabled, resolveFeatureFlags, } from "../settings/feature-flags.js";
 import { effectiveDisabledList, effectiveBuiltinLists } from "../capability-control/overlay.js";
 import { computeEffectiveDisabledLists } from "../capability-control/disabled-lists.js";
@@ -54,6 +54,7 @@ import { defaultCacheDir } from "../llm/model-cache.js";
 import { detectProviderFromApiKey, buildModelPool } from "../onboarding.js";
 import { detectPastedNoise } from "../utils/task-sanitizer.js";
 import { parseTaskWithImages } from "./parse-task.js";
+import { buildInputAttachmentContext } from "./input-attachments.js";
 import { enforceImagePolicy, byteLengthFromBase64, dropOversizedImages, collectAttachedImagePaths, } from "./image-policy.js";
 import { tryCompressImages } from "./image-compression.js";
 import { buildSessionTitle } from "./session-title.js";
@@ -831,8 +832,32 @@ export class Engine {
                 usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
             };
         }
+        const cap = capabilitiesFor((this.config.llm.providerKind ?? this.config.llm.provider), this.config.llm.model);
+        const attachmentContext = await buildInputAttachmentContext(options?.attachments, cwd, {
+            includeImageBytes: cap.supportsVision,
+            expectedSessionId: options?.sessionId,
+        });
+        if (attachmentContext.errors.length > 0) {
+            const detail = attachmentContext.errors.join("; ");
+            logger.warn("engine.run.input_attachment_failed", { error: detail });
+            return {
+                text: `ERROR: input attachment could not be read (${detail}). Re-attach it or choose a path inside the workspace.`,
+                reason: "image_error",
+                sessionId: options?.sessionId ?? "input-attachment-failed",
+                turnCount: 0,
+                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+            };
+        }
+        if (attachmentContext.text || attachmentContext.hasStructuredImageAttachments) {
+            parsedTask = {
+                text: [parsedTask.text, attachmentContext.text].filter(Boolean).join("\n\n"),
+                images: [...parsedTask.images, ...attachmentContext.images],
+                hasImages: parsedTask.hasImages ||
+                    attachmentContext.images.length > 0 ||
+                    attachmentContext.hasStructuredImageAttachments,
+            };
+        }
         if (parsedTask.hasImages) {
-            const cap = capabilitiesFor((this.config.llm.providerKind ?? this.config.llm.provider), this.config.llm.model);
             if (!cap.supportsVision) {
                 logger.warn("engine.run.vision_not_supported", {
                     provider: this.config.llm.provider,
@@ -1397,12 +1422,14 @@ export class Engine {
             // in this same session don't re-prompt. Headless/auto backends skip
             // this — they don't prompt, so there are no project rules to persist.
             if (approvalBackend instanceof InteractiveApprovalBackend) {
-                approvalBackend.setCwd(cwd);
-                approvalBackend.setOnProjectRules((rules) => {
-                    // Prepend the *full* accumulated list of session-saved project rules
-                    // so user approvals win over defaults and earlier approvals aren't
-                    // dropped when later ones come in.
-                    permission.reconfigure(mode, approvalBackend, [...rules, ...defaultRules]);
+                approvalBackend.setSessionContext(session.state.sessionId, {
+                    cwd,
+                    onProjectRules: (rules) => {
+                        // Prepend the *full* accumulated list of session-saved project rules
+                        // so user approvals win over defaults and earlier approvals aren't
+                        // dropped when later ones come in.
+                        permission.reconfigure(mode, approvalBackend, [...rules, ...defaultRules]);
+                    },
                 });
             }
             const toolExecutor = new ToolExecutor(this.toolRegistry, permission, this.hooks);
@@ -2657,10 +2684,10 @@ export class Engine {
     buildPermissionConfig(mode, cwd) {
         const rules = [...this.preset.defaultPermissionRules];
         // Memory tools: dream scope is the LLM's own workspace, so save/delete
-        // there go through without prompting. user-scope save/delete fall through
-        // to the tool's permissionDefault ("ask"), forcing the user to confirm
-        // any modification of memories they own. Read tools are listed in the
-        // tool definition as permissionDefault: "allow" — no rule needed here.
+        // there go through without prompting. user-scope save/delete have no
+        // explicit allow rule here, so default-mode classifier fallback asks the
+        // user to confirm modifications. RegisteredTool.permissionDefault is only
+        // UI/metadata and is not read by the classifier.
         rules.push({
             tool: "MemorySave",
             argsPattern: { scope: "^dream$" },
@@ -2995,7 +3022,7 @@ export class Engine {
             // the host user's credentials (same isolation contract as top-level env).
             // Placed below settings.env so an explicit `env` entry can still override.
             const credScope = (this.config.settingsScope ?? "project") === "full" ? "full" : "project";
-            layer(new CredentialStore(cwd).envExposures(credScope));
+            layer(getCredentialAccess().envExposures(cwd, credScope));
             layer(settings.env); // top-level env (global ⊕ project) wins
         }
         catch {

package/dist/engine/image-policy.d.ts

@@ -149,6 +149,12 @@ export interface DropOversizedResult {
     droppedCount: number;
 }
 export declare function dropOversizedImages(images: readonly ParsedImage[]): DropOversizedResult;
+export interface ImagePolicyByteInput {
+    name: string;
+    mime: string;
+    bytes: number;
+}
+export declare function enforceImageBytePolicy(images: readonly ImagePolicyByteInput[]): ImagePolicyVerdict;
 export declare function enforceImagePolicy(images: readonly ParsedImage[]): ImagePolicyVerdict;
 /**
  * Collect the workspace file paths of any attached images that came from a

package/dist/engine/image-policy.js

@@ -107,15 +107,13 @@ export function dropOversizedImages(images) {
     if (dropped.length === 0) {
         return { kept, placeholder: "", droppedCount: 0 };
     }
-    const list = dropped
-        .map((d) => `「${d.name}」(~${fmtMB(d.bytes)})`)
-        .join("、");
+    const list = dropped.map((d) => `「${d.name}」(~${fmtMB(d.bytes)})`).join("、");
     const placeholder = `[已自动跳过 ${dropped.length} 张超大图片:${list};` +
         `单图上限 ${fmtMB(IMAGE_LIMITS.maxBytesPerImage)}。` +
         `图片未进入对话历史,本轮其余内容继续。]`;
     return { kept, placeholder, droppedCount: dropped.length };
 }
-export function enforceImagePolicy(images) {
+export function enforceImageBytePolicy(images) {
     if (images.length === 0)
         return { ok: true };
     if (images.length > IMAGE_LIMITS.maxImagesPerTurn) {
@@ -126,13 +124,13 @@ export function enforceImagePolicy(images) {
                 `本次有 ${images.length} 张。请删掉一些再发。`,
             totals: {
                 imageCount: images.length,
-                totalBytes: images.reduce((s, i) => s + byteLengthFromBase64(i.base64), 0),
+                totalBytes: images.reduce((s, i) => s + i.bytes, 0),
             },
         };
     }
     let totalBytes = 0;
     for (const img of images) {
-        const bytes = byteLengthFromBase64(img.base64);
+        const bytes = img.bytes;
         if (bytes > IMAGE_LIMITS.maxBytesPerImage) {
             return {
                 ok: false,
@@ -163,6 +161,13 @@ export function enforceImagePolicy(images) {
     }
     return { ok: true };
 }
+export function enforceImagePolicy(images) {
+    return enforceImageBytePolicy(images.map((img) => ({
+        name: img.name,
+        mime: img.mime,
+        bytes: byteLengthFromBase64(img.base64),
+    })));
+}
 /**
  * Collect the workspace file paths of any attached images that came from a
  * real file (the desktop composer's path-attach flow sets ParsedImage.name to
@@ -178,6 +183,12 @@ export function enforceImagePolicy(images) {
 export function collectAttachedImagePaths(images, resolve, exists) {
     const out = [];
     for (const img of images) {
+        const path = img.path?.trim();
+        if (path) {
+            if (exists(resolve(path)))
+                out.push(path);
+            continue;
+        }
         const name = img.name?.trim();
         if (!name)
             continue;

package/dist/engine/input-attachments.d.ts

@@ -0,0 +1,13 @@
+import type { InputAttachmentMeta } from "../protocol/types.js";
+import type { ParsedImage } from "./parse-task.js";
+export interface InputAttachmentContext {
+    text: string;
+    images: ParsedImage[];
+    errors: string[];
+    hasStructuredImageAttachments: boolean;
+}
+export interface BuildInputAttachmentContextOptions {
+    includeImageBytes?: boolean;
+    expectedSessionId?: string;
+}
+export declare function buildInputAttachmentContext(attachments: readonly InputAttachmentMeta[] | undefined, cwd: string, options?: BuildInputAttachmentContextOptions): Promise<InputAttachmentContext>;

package/dist/engine/input-attachments.js

@@ -0,0 +1,255 @@
+import { createHash } from "node:crypto";
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
+import { extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { classifyPath } from "../tool-system/path-policy.js";
+import { enforceImageBytePolicy } from "./image-policy.js";
+const IMAGE_MIME_BY_EXT = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+};
+const MAX_DIRECTORY_TREE_ENTRIES = 200;
+const MAX_DIRECTORY_TREE_DEPTH = 2;
+export async function buildInputAttachmentContext(attachments, cwd, options = {}) {
+    if (!attachments || attachments.length === 0) {
+        return { text: "", images: [], errors: [], hasStructuredImageAttachments: false };
+    }
+    const cwdReal = await realpath(cwd);
+    const includeImageBytes = options.includeImageBytes ?? true;
+    const expectedSessionId = options.expectedSessionId;
+    const textBlocks = [];
+    const images = [];
+    const errors = [];
+    const pendingImages = [];
+    let hasStructuredImageAttachments = false;
+    if (!expectedSessionId) {
+        return {
+            text: "",
+            images: [],
+            errors: ["input attachments require an expected sessionId"],
+            hasStructuredImageAttachments: false,
+        };
+    }
+    if (!isSafeSessionPathSegment(expectedSessionId)) {
+        return {
+            text: "",
+            images: [],
+            errors: [`expected sessionId "${expectedSessionId}" is not a safe path segment`],
+            hasStructuredImageAttachments: false,
+        };
+    }
+    for (const attachment of attachments) {
+        if (!attachment || typeof attachment !== "object")
+            continue;
+        const displayPath = attachment.path || attachment.relPath || attachment.absPath;
+        if (!displayPath) {
+            errors.push(`attachment ${attachment.id || "(unknown)"} has no path`);
+            continue;
+        }
+        if (attachment.sessionId !== expectedSessionId) {
+            errors.push(`attachment ${attachment.id || displayPath} session mismatch: expected ${expectedSessionId}, got ${attachment.sessionId}`);
+            continue;
+        }
+        const resolved = resolveAttachmentPath(attachment, cwd);
+        let info;
+        try {
+            info = await stat(resolved);
+        }
+        catch (err) {
+            errors.push(`attachment ${attachment.id || displayPath} stat failed: ${err.message}`);
+            continue;
+        }
+        const policy = classifyPath(resolved, { workspaceRoot: cwdReal, operation: "read" });
+        if (policy.decision !== "allow") {
+            errors.push(`attachment ${attachment.id || displayPath} blocked by path policy: ${policy.reason}`);
+            continue;
+        }
+        const realPath = policy.resolvedPath;
+        const stagedPathError = await validateStagedAttachmentPath(attachment, realPath, cwdReal, expectedSessionId, displayPath);
+        if (stagedPathError) {
+            errors.push(stagedPathError);
+            continue;
+        }
+        if (attachment.kind === "directory" || info.isDirectory()) {
+            const tree = await directoryTree(realPath, cwdReal).catch((err) => ({
+                lines: [`(directory tree unavailable: ${err.message})`],
+                truncated: true,
+                entryCount: 0,
+            }));
+            textBlocks.push([
+                `<attached-directory path="${escapeText(displayPath)}" entries="${tree.entryCount}" truncated="${tree.truncated}">`,
+                ...tree.lines,
+                `</attached-directory>`,
+            ].join("\n"));
+            continue;
+        }
+        if (!info.isFile()) {
+            errors.push(`attachment ${attachment.id || displayPath} is not a regular file or directory`);
+            continue;
+        }
+        const mime = attachment.mime || IMAGE_MIME_BY_EXT[extname(realPath).toLowerCase()];
+        if (attachment.kind === "image") {
+            hasStructuredImageAttachments = true;
+            if (!includeImageBytes || attachment.vision?.include === false) {
+                textBlocks.push(formatFileMetadata(attachment, displayPath, realPath, info.size, mime));
+                continue;
+            }
+            if (!mime ||
+                !mime.startsWith("image/") ||
+                !IMAGE_MIME_BY_EXT[extname(realPath).toLowerCase()]) {
+                errors.push(`image attachment ${attachment.id || displayPath} has unsupported image type`);
+                continue;
+            }
+            pendingImages.push({
+                attachment,
+                displayPath,
+                realPath,
+                mime,
+                size: info.size,
+            });
+            continue;
+        }
+        textBlocks.push(formatFileMetadata(attachment, displayPath, realPath, info.size, mime));
+    }
+    if (errors.length === 0 && includeImageBytes && pendingImages.length > 0) {
+        const verdict = enforceImageBytePolicy(pendingImages.map((image) => ({
+            name: image.attachment.originalName || image.displayPath,
+            mime: image.mime,
+            bytes: image.size,
+        })));
+        if (!verdict.ok) {
+            errors.push(`image attachment size policy failed: ${verdict.message}`);
+        }
+        else {
+            for (const image of pendingImages) {
+                let bytes;
+                try {
+                    bytes = await readFile(image.realPath);
+                }
+                catch (err) {
+                    errors.push(`image attachment ${image.attachment.id || image.displayPath} read failed: ${err.message}`);
+                    continue;
+                }
+                const sha256 = createHash("sha256").update(bytes).digest("hex");
+                const base64 = bytes.toString("base64");
+                images.push({
+                    mime: image.mime,
+                    name: image.attachment.originalName || image.displayPath,
+                    dataUrl: `data:${image.mime};base64,${base64}`,
+                    base64,
+                    path: image.displayPath,
+                    hash: `sha256:${sha256}`,
+                    size: image.size,
+                    origin: image.attachment.origin,
+                    sessionId: image.attachment.sessionId,
+                });
+            }
+        }
+    }
+    return { text: textBlocks.join("\n\n"), images, errors, hasStructuredImageAttachments };
+}
+function resolveAttachmentPath(attachment, cwd) {
+    const candidate = attachment.vision?.mediaPath || attachment.absPath || attachment.relPath || attachment.path;
+    if (isAbsolute(candidate))
+        return candidate;
+    return resolve(cwd, candidate);
+}
+async function validateStagedAttachmentPath(attachment, realPath, cwdReal, expectedSessionId, displayPath) {
+    if (!isStagedAttachmentReference(attachment, realPath, cwdReal))
+        return undefined;
+    const expectedDir = resolve(cwdReal, ".code-shell", "attachments", expectedSessionId);
+    let expectedDirReal;
+    try {
+        expectedDirReal = await realpath(expectedDir);
+    }
+    catch (err) {
+        return `attachment ${attachment.id || displayPath} staged session directory is unavailable: ${err.message}`;
+    }
+    if (isPathInside(realPath, expectedDirReal))
+        return undefined;
+    return `attachment ${attachment.id || displayPath} staged path is outside .code-shell/attachments/${expectedSessionId}`;
+}
+function isStagedAttachmentReference(attachment, realPath, cwdReal) {
+    const fields = [
+        attachment.path,
+        attachment.absPath,
+        attachment.relPath,
+        attachment.vision?.mediaPath,
+    ].filter((value) => typeof value === "string" && value.length > 0);
+    if (fields.some((value) => looksLikeStagedAttachmentPath(value)))
+        return true;
+    return isPathInside(realPath, resolve(cwdReal, ".code-shell", "attachments"));
+}
+function looksLikeStagedAttachmentPath(value) {
+    const normalized = normalizePath(value);
+    return (normalized === ".code-shell/attachments" ||
+        normalized.startsWith(".code-shell/attachments/") ||
+        normalized.includes("/.code-shell/attachments/"));
+}
+function isPathInside(child, parent) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+function isSafeSessionPathSegment(sessionId) {
+    if (!sessionId)
+        return false;
+    return (!sessionId.includes("/") && !sessionId.includes("\\") && sessionId !== "." && sessionId !== "..");
+}
+function normalizePath(value) {
+    return value.replace(/\\/g, "/");
+}
+function formatFileMetadata(attachment, displayPath, realPath, size, mime) {
+    const lines = [
+        `<attached-file path="${escapeText(displayPath)}">`,
+        `absolutePath: ${realPath}`,
+        ...(mime ? [`mime: ${mime}`] : []),
+        `size: ${size}`,
+        `sha256: ${attachment.sha256}`,
+        `origin: ${attachment.origin}`,
+        `</attached-file>`,
+    ];
+    return lines.join("\n");
+}
+async function directoryTree(dir, cwdReal) {
+    const lines = [];
+    let entryCount = 0;
+    let truncated = false;
+    async function walk(current, depth) {
+        if (entryCount >= MAX_DIRECTORY_TREE_ENTRIES) {
+            truncated = true;
+            return;
+        }
+        const entries = await readdir(current, { withFileTypes: true });
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (entryCount >= MAX_DIRECTORY_TREE_ENTRIES) {
+                truncated = true;
+                return;
+            }
+            if (entry.name === ".git" || entry.name === "node_modules")
+                continue;
+            const abs = join(current, entry.name);
+            const real = await realpath(abs).catch(() => null);
+            if (!real)
+                continue;
+            const rel = relative(cwdReal, real);
+            if (rel === ".." || rel.startsWith(`..${sep}`))
+                continue;
+            entryCount += 1;
+            lines.push(`${"  ".repeat(depth)}${entry.isDirectory() ? "dir " : "file "}${slash(rel)}`);
+            if (entry.isDirectory() && depth + 1 < MAX_DIRECTORY_TREE_DEPTH) {
+                await walk(real, depth + 1);
+            }
+        }
+    }
+    await walk(dir, 0);
+    return { lines, truncated, entryCount };
+}
+function escapeText(value) {
+    return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
+function slash(value) {
+    return sep === "\\" ? value.replace(/\\/g, "/") : value;
+}

package/dist/engine/model-facade.d.ts

@@ -4,6 +4,9 @@
 import type { LLMClientBase } from "../llm/client-base.js";
 import type { Message, ToolDefinition, LLMResponse, StreamCallback } from "../types.js";
 import { Transcript } from "../session/transcript.js";
+export interface ModelCallRecordingOptions {
+    sensitiveToolResultRedactions?: ReadonlyMap<string, string>;
+}
 /**
  * Prompt-cache hit rate for one request, as CC computes it:
  *   cacheRead / (cacheRead + cacheCreation + uncachedInput)
@@ -18,11 +21,11 @@ export declare class ModelFacade {
     private readonly client;
     private readonly transcript;
     constructor(client: LLMClientBase, transcript: Transcript);
-    call(systemPrompt: string, messages: Message[], tools: ToolDefinition[], onStream?: StreamCallback, signal?: AbortSignal): Promise<LLMResponse>;
+    call(systemPrompt: string, messages: Message[], tools: ToolDefinition[], onStream?: StreamCallback, signal?: AbortSignal, recordingOptions?: ModelCallRecordingOptions): Promise<LLMResponse>;
     /**
      * Call without streaming — used as fallback when streaming fails.
      */
-    callWithoutStreaming(systemPrompt: string, messages: Message[], tools: ToolDefinition[], signal?: AbortSignal): Promise<LLMResponse>;
+    callWithoutStreaming(systemPrompt: string, messages: Message[], tools: ToolDefinition[], signal?: AbortSignal, recordingOptions?: ModelCallRecordingOptions): Promise<LLMResponse>;
     /** Record API timing and token usage to bootstrap state. */
     private recordUsage;
     /** Optional summarize function for tool use summaries. */