@cjhyy/code-shell-core 0.6.0-rc.8 → 0.7.0-beta.1

package/dist/tool-system/mcp-manager.js

@@ -7,10 +7,12 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { logger } from "../logging/logger.js";
-import { CredentialStore } from "../credentials/index.js";
+import { getCredentialAccess } from "../credentials/access.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
+import { codeShellHome } from "../session/session-manager.js";
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -88,6 +90,20 @@ export function buildHttpHeaders(serverName, config, resolveCredential) {
     }
     return headers;
 }
+export async function buildHttpHeadersWithCredentialAccess(serverName, config, access = getCredentialAccess()) {
+    if (!config.credentialRef)
+        return buildHttpHeaders(serverName, config);
+    if (!access.resolveValue) {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
+    }
+    const secret = await access.resolveValue({
+        cwd: undefined,
+        id: config.credentialRef,
+        scope: "full",
+        purpose: "mcp",
+    });
+    return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? secret : undefined);
+}
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
@@ -117,7 +133,29 @@ export function inferTransportType(config) {
  * spill itself is bounded by the byte budget below; this cap is just
  * to keep ls(~/.code-shell/mcp_images) tractable.
  */
+const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
+function spillTimestamp(filename, prefix) {
+    const suffix = filename.slice(prefix.length);
+    const dot = suffix.lastIndexOf(".");
+    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
+    const timestamp = Number(raw);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+async function pruneMcpImageSpills(baseDir, prefix) {
+    const entries = await readdir(baseDir, { withFileTypes: true });
+    const spills = entries
+        .filter((entry) => entry.isFile() && entry.name.startsWith(prefix))
+        .map((entry) => ({
+        name: entry.name,
+        timestamp: spillTimestamp(entry.name, prefix),
+    }))
+        .sort((a, b) => a.timestamp - b.timestamp || a.name.localeCompare(b.name));
+    const excess = spills.length - MAX_MCP_IMAGE_SPILLS_PER_TOOL;
+    if (excess <= 0)
+        return;
+    await Promise.all(spills.slice(0, excess).map((entry) => unlink(join(baseDir, entry.name)).catch(() => { })));
+}
 /**
  * Persist an MCP-returned image to disk and return the textual
  * reference the LLM should see. Images larger than
@@ -129,9 +167,7 @@ const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
  *   [mcp-image] server=playwright tool=screenshot saved=/abs/path.png (123 KB)
  */
 export async function spillMcpImage(serverName, toolName, base64, mimeType, opts) {
-    const home = process.env.CODE_SHELL_HOME ?? process.env.HOME ?? "";
-    const baseDir = opts?.baseDir ??
-        (home ? join(home, ".code-shell", "mcp_images") : join("/tmp", "code-shell-mcp-images"));
+    const baseDir = opts?.baseDir ?? join(codeShellHome(), "mcp_images");
     const now = opts?.now ?? Date.now;
     const decodedBytes = Math.floor((base64.length * 3) / 4);
     if (decodedBytes > MAX_MCP_IMAGE_BYTES) {
@@ -146,11 +182,13 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
                 : "png";
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
-    const filename = `${safeServer}-${safeTool}-${now()}.${ext}`;
+    const prefix = `${safeServer}-${safeTool}-`;
+    const filename = `${prefix}${now()}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
         await writeFile(filePath, Buffer.from(base64, "base64"));
+        await pruneMcpImageSpills(baseDir, prefix);
     }
     catch (err) {
         logger.warn("mcp.image_spill_failed", {
@@ -204,7 +242,10 @@ export function buildRegisteredTool(serverName, tool) {
     return {
         name: toOpenAIToolName(`mcp_${serverName}_${tool.name}`),
         description: `[${serverName}] ${tool.description ?? tool.name}`,
-        inputSchema: tool.inputSchema ?? { type: "object", properties: {} },
+        inputSchema: tool.inputSchema ?? {
+            type: "object",
+            properties: {},
+        },
         source: "mcp",
         serverName,
         permissionDefault: "ask",
@@ -246,13 +287,16 @@ export class MCPManager {
      * Connect to all configured MCP servers and register their tools.
      */
     async connectAll(servers, owner) {
+        const enabledNames = this.enabledServerNames(servers);
         // Register this owner's desired set up front (see reconcile's shared-pool
         // note) so a later reconcile from ANOTHER session can't disconnect servers
         // this session connected at run start.
         if (owner !== undefined) {
-            this.desiredByOwner.set(owner, new Set(Object.entries(servers)
-                .filter(([, c]) => c.enabled !== false)
-                .map(([n]) => n)));
+            this.desiredByOwner.set(owner, enabledNames);
+            this.desiredServerNames = this.unionDesired() ?? new Set();
+        }
+        else if (this.desiredByOwner.size === 0) {
+            this.desiredServerNames = enabledNames;
         }
         // Codex-style toggle: skip servers explicitly disabled in settings.
         // Only the literal `false` disables — absent / true / any other value
@@ -278,26 +322,42 @@ export class MCPManager {
         }
     }
     async reconcile(servers, owner) {
-        const enabledNames = new Set(Object.entries(servers)
-            .filter(([, config]) => config.enabled !== false)
-            .map(([name]) => name));
-        this.desiredServerNames = enabledNames;
+        const enabledNames = this.enabledServerNames(servers);
         // Shared-pool semantics: this ONE pool serves every session in the worker,
         // and sessions in different projects legitimately want DIFFERENT server
         // sets (per-project capabilityOverrides). Disconnect only servers that NO
         // registered owner wants — otherwise the per-session hot-reload patches
         // would thrash each other's connections (last reconcile wins, killing a
-        // server another project's session is using). Owners are engines; a
-        // closed session's desires linger (no engine-teardown hook), which merely
-        // over-RETAINS idle connections — per-session tool visibility keeps
-        // correctness regardless.
+        // server another project's session is using). Owners are engines; closed
+        // sessions call unregisterOwner() so their desired sets stop retaining idle
+        // connections.
         if (owner !== undefined)
             this.desiredByOwner.set(owner, enabledNames);
         const union = this.unionDesired() ?? enabledNames;
+        this.desiredServerNames = union;
         const stale = this.listServers().filter((name) => !union.has(name));
         await Promise.all(stale.map((name) => this.disconnect(name)));
         await this.connectAll(servers, owner);
     }
+    /**
+     * Remove one owner from the shared desired-server pool and disconnect servers
+     * that no remaining owner wants. This is called when a session-owned Engine
+     * is closed; without it project-scoped MCP servers can stay connected until
+     * worker shutdown.
+     */
+    async unregisterOwner(owner) {
+        if (!this.desiredByOwner.delete(owner))
+            return;
+        const desired = this.unionDesired() ?? new Set();
+        this.desiredServerNames = desired;
+        const stale = this.listServers().filter((name) => !desired.has(name));
+        await Promise.all(stale.map((name) => this.disconnect(name)));
+    }
+    enabledServerNames(servers) {
+        return new Set(Object.entries(servers)
+            .filter(([, config]) => config.enabled !== false)
+            .map(([name]) => name));
+    }
     /** Union of every registered owner's desired set; null when none registered. */
     unionDesired() {
         if (this.desiredByOwner.size === 0)
@@ -360,12 +420,10 @@ export class MCPManager {
             if (!config.url) {
                 throw new Error(`MCP server "${name}": url is required for ${transportType} transport`);
             }
-            // credentialRef resolves against the user-scope CredentialStore. The
-            // shared MCPManager pool has no per-session cwd (see desiredByOwner note),
-            // and MCP-referenced credentials (e.g. a Figma token) are user-global by
-            // nature, so user scope is the right resolution surface here.
-            const credStore = new CredentialStore(undefined);
-            const headers = buildHttpHeaders(name, config, (id) => credStore.resolve(id)?.secret);
+            // credentialRef resolves against user-scope credential access. The shared
+            // MCPManager pool has no per-session cwd, and MCP-referenced credentials
+            // (e.g. a Figma token) remain user-global by design.
+            const headers = await buildHttpHeadersWithCredentialAccess(name, config);
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
                 requestInit: Object.keys(headers).length ? { headers } : undefined,
             });
@@ -393,6 +451,22 @@ export class MCPManager {
             catch {
                 // ignore cleanup errors
             }
+            if (transportType === "stdio" && config.command) {
+                const diagnostic = await diagnoseMcpStdioMissingCommand(config.command, err);
+                if (diagnostic) {
+                    logger.warn("mcp.stdio_command_missing", {
+                        server: name,
+                        command: config.command,
+                        foundPaths: diagnostic.foundPaths,
+                        path: previewPath(),
+                        message: diagnostic.message,
+                    });
+                    const original = err instanceof Error ? err.message : String(err);
+                    const enhanced = new Error(`${original}\n${diagnostic.message}`);
+                    enhanced.cause = err;
+                    throw enhanced;
+                }
+            }
             throw err;
         }
         finally {
@@ -412,59 +486,65 @@ export class MCPManager {
      * Discover tools from an MCP server and register them.
      */
     async discoverTools(serverName, client) {
-        const result = await client.listTools();
-        for (const tool of result.tools) {
-            const registered = buildRegisteredTool(serverName, tool);
-            // Register with an executor that calls the MCP server
-            this.toolRegistry.registerTool(registered, async (args) => {
-                const callResult = await client.callTool({
-                    name: tool.name,
-                    arguments: stripInternalToolArgs(args),
-                });
-                // Extract text + image content from the result. Image blobs
-                // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
-                // the LLM message tree — same pattern as the GenerateImage
-                // tool — and the model sees a textual reference it can Read
-                // on a later turn if it needs the pixels. This sidesteps the
-                // "MCP returned a 5MB screenshot → token budget exploded"
-                // failure mode that bit Codex (issue #11845); we never put
-                // raw base64 image data in the result text. See
-                // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
-                const parts = [];
-                if (Array.isArray(callResult.content)) {
-                    for (const item of callResult.content) {
-                        if (typeof item === "string") {
-                            parts.push(item);
-                            continue;
-                        }
-                        if (typeof item !== "object" || item === null)
-                            continue;
-                        if ("text" in item) {
-                            parts.push(String(item.text));
-                            continue;
-                        }
-                        if (item.type === "image") {
-                            const block = item;
-                            if (typeof block.data === "string" && block.data.length > 0) {
-                                const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
-                                parts.push(note);
+        try {
+            const result = await client.listTools();
+            for (const tool of result.tools) {
+                const registered = buildRegisteredTool(serverName, tool);
+                // Register with an executor that calls the MCP server
+                this.toolRegistry.registerTool(registered, async (args, ctx) => {
+                    const callResult = await client.callTool({
+                        name: tool.name,
+                        arguments: stripInternalToolArgs(args),
+                    }, undefined, ctx?.signal ? { signal: ctx.signal } : undefined);
+                    // Extract text + image content from the result. Image blobs
+                    // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
+                    // the LLM message tree — same pattern as the GenerateImage
+                    // tool — and the model sees a textual reference it can Read
+                    // on a later turn if it needs the pixels. This sidesteps the
+                    // "MCP returned a 5MB screenshot → token budget exploded"
+                    // failure mode that bit Codex (issue #11845); we never put
+                    // raw base64 image data in the result text. See
+                    // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
+                    const parts = [];
+                    if (Array.isArray(callResult.content)) {
+                        for (const item of callResult.content) {
+                            if (typeof item === "string") {
+                                parts.push(item);
+                                continue;
+                            }
+                            if (typeof item !== "object" || item === null)
+                                continue;
+                            if ("text" in item) {
+                                parts.push(String(item.text));
+                                continue;
+                            }
+                            if (item.type === "image") {
+                                const block = item;
+                                if (typeof block.data === "string" && block.data.length > 0) {
+                                    const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
+                                    parts.push(note);
+                                }
                             }
                         }
                     }
-                }
-                const body = parts.join("\n") || "(no output)";
-                // Trust boundary: MCP output is external content. Wrap it so the
-                // model sees an explicit reminder that the body comes from an
-                // untrusted server and any instructions inside are content, not
-                // commands. The marker is intentionally short so it doesn't bloat
-                // every tool result, but distinct enough that prompt-injected
-                // strings can't fake their way out.
-                return wrapMcpOutput(serverName, tool.name, body);
-            });
-            const set = this.registeredToolsByServer.get(serverName) ?? new Set();
-            set.add(registered.name);
-            this.registeredToolsByServer.set(serverName, set);
-            logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+                    const body = parts.join("\n") || "(no output)";
+                    // Trust boundary: MCP output is external content. Wrap it so the
+                    // model sees an explicit reminder that the body comes from an
+                    // untrusted server and any instructions inside are content, not
+                    // commands. The marker is intentionally short so it doesn't bloat
+                    // every tool result, but distinct enough that prompt-injected
+                    // strings can't fake their way out.
+                    return wrapMcpOutput(serverName, tool.name, body);
+                });
+                const set = this.registeredToolsByServer.get(serverName) ?? new Set();
+                set.add(registered.name);
+                this.registeredToolsByServer.set(serverName, set);
+                logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+            }
+        }
+        catch (err) {
+            await this.disconnect(serverName);
+            throw err;
         }
     }
     /**
@@ -472,6 +552,8 @@ export class MCPManager {
      */
     async disconnectAll() {
         await Promise.all([...this.connections.keys()].map((name) => this.disconnect(name)));
+        this.desiredByOwner.clear();
+        this.desiredServerNames = null;
     }
     async disconnect(name) {
         const conn = this.connections.get(name);
@@ -545,6 +627,7 @@ export class MCPManager {
                         uri: r.uri,
                         name: r.name ?? r.uri,
                         description: r.description,
+                        serverName: name,
                     });
                 }
             }

package/dist/tool-system/mcp-stdio-diagnostics.d.ts

@@ -0,0 +1,9 @@
+export declare function isBareCommand(command: string): boolean;
+export declare function isMissingCommandError(error: unknown): boolean;
+export declare function probeCommonExecutableLocations(command: string, env?: NodeJS.ProcessEnv): Promise<string[]>;
+export declare function classifyMcpStdioMissingCommand(command: string, foundPaths: readonly string[]): string;
+export declare function diagnoseMcpStdioMissingCommand(command: string, error: unknown, env?: NodeJS.ProcessEnv): Promise<{
+    message: string;
+    foundPaths: string[];
+} | null>;
+export declare function previewPath(env?: NodeJS.ProcessEnv): string;

package/dist/tool-system/mcp-stdio-diagnostics.js

@@ -0,0 +1,93 @@
+import { constants } from "node:fs";
+import { access } from "node:fs/promises";
+import { delimiter, isAbsolute, join } from "node:path";
+const COMMON_POSIX_BIN_DIRS = [
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/home/linuxbrew/.linuxbrew/bin",
+    "/usr/bin",
+    "/bin",
+];
+function unique(entries) {
+    const seen = new Set();
+    const out = [];
+    for (const entry of entries) {
+        const trimmed = entry.trim();
+        if (!trimmed || seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        out.push(trimmed);
+    }
+    return out;
+}
+function commonExecutableDirs(env = process.env) {
+    const home = env.HOME?.trim();
+    return unique([
+        ...COMMON_POSIX_BIN_DIRS,
+        ...(home
+            ? [join(home, ".bun", "bin"), join(home, ".local", "bin"), join(home, ".npm-global", "bin")]
+            : []),
+    ]);
+}
+export function isBareCommand(command) {
+    const trimmed = command.trim();
+    return !!trimmed && !trimmed.includes("/") && !trimmed.includes("\\") && !isAbsolute(trimmed);
+}
+export function isMissingCommandError(error) {
+    const err = error;
+    const message = typeof err.message === "string" ? err.message : String(error);
+    return err.code === "ENOENT" || /\bENOENT\b/i.test(message) || /command not found/i.test(message);
+}
+async function isExecutable(filePath) {
+    try {
+        await access(filePath, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function probeCommonExecutableLocations(command, env = process.env) {
+    if (!isBareCommand(command) || process.platform === "win32")
+        return [];
+    const found = [];
+    for (const dir of commonExecutableDirs(env)) {
+        const candidate = join(dir, command);
+        if (await isExecutable(candidate))
+            found.push(candidate);
+    }
+    return found;
+}
+function installGuidance(command) {
+    if (command === "node" || command === "npx")
+        return "Please install Node.js and restart CodeShell.";
+    if (command === "bun" || command === "bunx")
+        return "Please install Bun and restart CodeShell.";
+    return `Please install "${command}" and restart CodeShell.`;
+}
+export function classifyMcpStdioMissingCommand(command, foundPaths) {
+    const trimmed = command.trim();
+    if (foundPaths.length > 0) {
+        return [
+            `MCP stdio command "${trimmed}" failed to start: detected ${trimmed} at ${foundPaths[0]},`,
+            "but that directory was not available on PATH.",
+            "Login-shell PATH injection may have failed; restart CodeShell or configure this MCP command as an absolute path.",
+        ].join(" ");
+    }
+    return [
+        `MCP stdio command "${trimmed}" failed to start: ${trimmed} was not found on PATH or in common install locations.`,
+        installGuidance(trimmed),
+    ].join(" ");
+}
+export async function diagnoseMcpStdioMissingCommand(command, error, env = process.env) {
+    if (!isBareCommand(command) || !isMissingCommandError(error))
+        return null;
+    const foundPaths = await probeCommonExecutableLocations(command, env);
+    return {
+        message: classifyMcpStdioMissingCommand(command, foundPaths),
+        foundPaths,
+    };
+}
+export function previewPath(env = process.env) {
+    return (env.PATH ?? "").split(delimiter).filter(Boolean).join(delimiter);
+}

package/dist/tool-system/path-policy.d.ts

@@ -52,6 +52,8 @@ export interface ClassifyOptions {
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
+export declare function openSessionPathApprovals(sessionId: string): void;
+export declare function clearSessionPathApprovals(sessionId: string): void;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -105,6 +105,10 @@ function expandTilde(p) {
 }
 /** sessionId → set of approved directory grants (prefix + operation). */
 const sessionPathGrants = new Map();
+/** Session ids explicitly closed by ChatSessionManager; late approvals must not recreate grants. */
+const closedPathApprovalSessions = new Set();
+/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
+const askChains = new Map();
 /** True if a grant for `grantOp` authorizes an operation of `wantOp`. */
 function grantCoversOp(grantOp, wantOp) {
     // write ⊇ {read, write}; read ⊇ {read}.
@@ -198,6 +202,8 @@ function storedOp(g) {
 function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
     if (scope === "once")
         return;
+    if (sessionId && closedPathApprovalSessions.has(sessionId))
+        return;
     const prefix = dirPrefix(dirname(resolved));
     if (scope === "session") {
         if (!sessionId)
@@ -271,6 +277,16 @@ function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
 /** Test seam: clear the in-memory session grants. */
 export function _resetSessionPathGrants() {
     sessionPathGrants.clear();
+    closedPathApprovalSessions.clear();
+    askChains.clear();
+}
+export function openSessionPathApprovals(sessionId) {
+    closedPathApprovalSessions.delete(sessionId);
+}
+export function clearSessionPathApprovals(sessionId) {
+    sessionPathGrants.delete(sessionId);
+    closedPathApprovalSessions.add(sessionId);
+    askChains.delete(sessionId);
 }
 /**
  * Best-effort resolution. realpath fails when the path doesn't exist yet —
@@ -356,6 +372,12 @@ function isSafeCodeShellDiagnosticRead(resolved) {
     }
     return false;
 }
+function isNoRepoAttachmentRead(resolved, operation) {
+    if (operation !== "read")
+        return false;
+    const root = join(homedir(), ".code-shell", "no-repo", ".code-shell", "attachments");
+    return isInsideDir(resolved, root);
+}
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *
@@ -396,6 +418,13 @@ export function classifyPath(rawPath, opts) {
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {
+        if (isNoRepoAttachmentRead(resolved, opts.operation)) {
+            return {
+                decision: "allow",
+                reason: "no-repo attachment read",
+                resolvedPath: resolved,
+            };
+        }
         if (opts.operation === "read" && isSafeCodeShellDiagnosticRead(resolved)) {
             return {
                 decision: "allow",
@@ -461,8 +490,8 @@ export function enforcePathPolicy(filePath, operation, workspaceRoot) {
     }
     // ask — MVP refuses with explanatory message until askUser plumbing
     // lands. The conservative bias matches the plan's leaning answer for Q1.
-    return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`;
+    return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`);
 }
 export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (ctx?.cwd === undefined)
@@ -481,8 +510,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
         return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}`;
     }
     if (operation === "write" && ctx.planMode) {
-        return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `Plan mode does not allow file writes.`;
+        return (`Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `Plan mode does not allow file writes.`);
     }
     // Already approved this directory for this OPERATION (this session or
     // persisted for the project)? Proceed without re-prompting — this is the fix
@@ -491,8 +520,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
         return null;
     if (!ctx.askUser) {
-        return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `No interactive approval UI is available in this run.`;
+        return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `No interactive approval UI is available in this run.`);
     }
     // Serialize concurrent asks (per session) and RE-CHECK grants when our turn
     // comes. Parallel tools hitting the same not-yet-approved directory all pass
@@ -502,7 +531,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     const chainKey = ctx.sessionId ?? "__global__";
     const prevTurn = askChains.get(chainKey) ?? Promise.resolve();
     let release;
-    askChains.set(chainKey, new Promise((r) => (release = r)));
+    const currentTurn = new Promise((r) => (release = r));
+    askChains.set(chainKey, currentTurn);
     try {
         await prevTurn;
         if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
@@ -511,6 +541,9 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     }
     finally {
         release();
+        if (askChains.get(chainKey) === currentTurn) {
+            askChains.delete(chainKey);
+        }
     }
 }
 /** The actual interactive ask — split out so the serialized section reads flat.
@@ -521,9 +554,7 @@ async function promptForPathApproval(c, operation, ctx) {
     // "工作区外路径" header was misleading for sensitive-path asks.
     const isSensitive = c.reason.startsWith("sensitive");
     const what = operation === "read" ? "读取" : "写入";
-    const title = isSensitive
-        ? `工具想${what}敏感文件`
-        : `工具想${what}工作区外路径`;
+    const title = isSensitive ? `工具想${what}敏感文件` : `工具想${what}工作区外路径`;
     const header = isSensitive ? "敏感文件权限" : "路径权限";
     // Scope options carry remembered grants for the directory of this path, so
     // the same folder isn't re-prompted. Labels are matched by exact string
@@ -566,8 +597,6 @@ async function promptForPathApproval(c, operation, ctx) {
     }
     return `Error: path approval denied by user — ${c.reason}. Path: ${c.resolvedPath}`;
 }
-/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
-const askChains = new Map();
 /**
  * Internal: reset the "disabled warning" latch. Tests flip the env var
  * between cases and need each one to be able to re-trigger the warning.