@cjhyy/code-shell-core 0.6.0-rc.8 → 0.7.0-beta.1

package/dist/credentials/access.d.ts

@@ -0,0 +1,56 @@
+import type { Credential, CredentialType } from "./types.js";
+import type { SettingsScope } from "../settings/manager.js";
+import type { Transport } from "../protocol/transport.js";
+export type CredentialAccessScope = "full" | "project";
+export interface CredentialMetadata {
+    id: string;
+    type: CredentialType;
+    label: string;
+    autoUseByAI?: boolean;
+    autoInjectByAI?: boolean;
+    exposeAsEnv?: string;
+    meta?: Credential["meta"];
+    hasSecret: boolean;
+    secretHint?: string;
+}
+export interface CredentialAccess {
+    listMasked(cwd: string | undefined, scope: CredentialAccessScope): CredentialMetadata[];
+    resolveMeta(cwd: string | undefined, id: string, scope: CredentialAccessScope): CredentialMetadata | undefined;
+    envExposures(cwd: string | undefined, scope: CredentialAccessScope): Record<string, string>;
+    resolveValue?(req: {
+        cwd?: string;
+        id: string;
+        scope: CredentialAccessScope;
+        purpose: "use" | "mcp";
+    }): Promise<string>;
+    materializeCookie?(req: {
+        cwd?: string;
+        id: string;
+        scope: CredentialAccessScope;
+    }): Promise<{
+        cookiesFile: string;
+        count: number;
+    }>;
+}
+export interface CredentialSnapshotEntry {
+    cwd?: string;
+    full: CredentialMetadata[];
+    project: CredentialMetadata[];
+    envFull: Record<string, string>;
+    envProject: Record<string, string>;
+}
+export interface CredentialSnapshot {
+    revision: number;
+    entries: CredentialSnapshotEntry[];
+}
+export declare function setDefaultCredentialAccess(access: CredentialAccess | null | undefined): void;
+export declare function getCredentialAccess(): CredentialAccess;
+export declare function createIpcCredentialAccess(transport: Pick<Transport, "send" | "onMessage">): CredentialAccess;
+export declare function credentialAccessScope(scope: SettingsScope | undefined): CredentialAccessScope;
+export declare function isCredentialSecretAvailable(secret: string | undefined): secret is string;
+export declare const localCredentialAccess: CredentialAccess;
+export declare function materializeCookieSecret(credentialId: string, secret: string): {
+    cookiesFile: string;
+    count: number;
+};
+export declare function sweepStaleCredentialCookieFiles(now?: number): void;

package/dist/credentials/access.js

@@ -0,0 +1,183 @@
+import { existsSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CredentialStore } from "./store.js";
+import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
+const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000;
+let defaultCredentialAccess = null;
+export function setDefaultCredentialAccess(access) {
+    defaultCredentialAccess = access ?? null;
+}
+export function getCredentialAccess() {
+    return defaultCredentialAccess ?? localCredentialAccess;
+}
+export function createIpcCredentialAccess(transport) {
+    let snapshot = { revision: 0, entries: [] };
+    let nextId = 1;
+    const pending = new Map();
+    transport.onMessage((msg) => {
+        if ("method" in msg && msg.method === "desktop/credentialSnapshot") {
+            const params = msg.params;
+            if (params && typeof params.revision === "number" && Array.isArray(params.entries)) {
+                snapshot = {
+                    revision: params.revision,
+                    entries: params.entries,
+                };
+            }
+            return;
+        }
+        if (!("id" in msg) || "method" in msg)
+            return;
+        const id = String(msg.id);
+        const waiter = pending.get(id);
+        if (!waiter)
+            return;
+        pending.delete(id);
+        clearTimeout(waiter.timer);
+        if ("error" in msg && msg.error) {
+            waiter.reject(new Error(msg.error.message));
+        }
+        else {
+            waiter.resolve(msg.result);
+        }
+    });
+    const request = (method, params) => {
+        const id = `cred-${nextId++}`;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                pending.delete(id);
+                reject(new Error(`${method} timed out`));
+            }, 30_000);
+            pending.set(id, { resolve, reject, timer });
+            transport.send({ jsonrpc: "2.0", id, method, params });
+        });
+    };
+    const entryFor = (cwd) => {
+        const key = cwd ?? "";
+        return snapshot.entries.find((entry) => (entry.cwd ?? "") === key);
+    };
+    return {
+        listMasked(cwd, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return [];
+            return scope === "project" ? cloneMetadata(entry.project) : cloneMetadata(entry.full);
+        },
+        resolveMeta(cwd, id, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return undefined;
+            const list = scope === "project" ? entry.project : entry.full;
+            return cloneMetadata(list).find((cred) => cred.id === id);
+        },
+        envExposures(cwd, scope) {
+            const entry = entryFor(cwd);
+            if (!entry)
+                return {};
+            return { ...(scope === "project" ? entry.envProject : entry.envFull) };
+        },
+        async resolveValue(req) {
+            const result = (await request("desktop/credentialResolve", req));
+            if (typeof result?.value !== "string")
+                throw new Error(`credential "${req.id}" is unavailable`);
+            return result.value;
+        },
+        async materializeCookie(req) {
+            const result = (await request("desktop/credentialMaterializeCookie", req));
+            if (typeof result?.cookiesFile !== "string" || typeof result.count !== "number") {
+                throw new Error(`cookie credential "${req.id}" is unavailable`);
+            }
+            return { cookiesFile: result.cookiesFile, count: result.count };
+        },
+    };
+}
+export function credentialAccessScope(scope) {
+    return scope === "full" || scope === undefined ? "full" : "project";
+}
+export function isCredentialSecretAvailable(secret) {
+    return typeof secret === "string" && secret.length > 0 && !secret.startsWith("enc:");
+}
+function toMetadata(cred) {
+    const secret = cred.secret;
+    const available = isCredentialSecretAvailable(secret);
+    const { secret: _secret, ...rest } = cred;
+    return {
+        ...rest,
+        hasSecret: available,
+        secretHint: available ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
+    };
+}
+function cloneMetadata(list) {
+    return list.map((cred) => ({ ...cred, meta: cred.meta ? { ...cred.meta } : undefined }));
+}
+function storeFor(cwd) {
+    return new CredentialStore(cwd);
+}
+export const localCredentialAccess = {
+    listMasked(cwd, scope) {
+        return storeFor(cwd).list(scope).map(toMetadata);
+    },
+    resolveMeta(cwd, id, scope) {
+        const cred = storeFor(cwd).resolve(id, scope);
+        return cred ? toMetadata(cred) : undefined;
+    },
+    envExposures(cwd, scope) {
+        const out = {};
+        const creds = storeFor(cwd).list(scope);
+        for (const cred of creds) {
+            const name = cred.exposeAsEnv?.trim();
+            if (name && isCredentialSecretAvailable(cred.secret))
+                out[name] = cred.secret;
+        }
+        return out;
+    },
+    async resolveValue(req) {
+        const cred = storeFor(req.cwd).resolve(req.id, req.scope);
+        if (!cred || !isCredentialSecretAvailable(cred.secret)) {
+            throw new Error(`credential "${req.id}" is unavailable`);
+        }
+        return cred.secret;
+    },
+    async materializeCookie(req) {
+        const cred = storeFor(req.cwd).resolve(req.id, req.scope);
+        if (!cred || cred.type !== "cookie" || !isCredentialSecretAvailable(cred.secret)) {
+            throw new Error(`cookie credential "${req.id}" is unavailable`);
+        }
+        return materializeCookieSecret(cred.id, cred.secret);
+    },
+};
+export function materializeCookieSecret(credentialId, secret) {
+    const jar = parseCookieJar(secret);
+    if (jar.length === 0)
+        throw new Error("cookie jar is empty or invalid");
+    const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safeFileName(credentialId)}-${process.pid}-${randomUUID()}.txt`);
+    writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+    return { cookiesFile: file, count: jar.length };
+}
+export function sweepStaleCredentialCookieFiles(now = Date.now()) {
+    const dir = tmpdir();
+    try {
+        if (!existsSync(dir))
+            return;
+        for (const f of readdirSync(dir)) {
+            if (!f.startsWith(COOKIE_FILE_PREFIX))
+                continue;
+            const p = join(dir, f);
+            try {
+                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
+                    rmSync(p, { force: true });
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+}
+function safeFileName(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+}

package/dist/credentials/index.d.ts

@@ -1,6 +1,7 @@
 export { CredentialStore } from "./store.js";
 export type { CredentialScope, MaskedCredential } from "./store.js";
 export { type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, type CredentialAccess, type CredentialAccessScope, type CredentialMetadata, type CredentialSnapshot, type CredentialSnapshotEntry, } from "./access.js";
 export type { Credential, CredentialType, CredentialStoreFile } from "./types.js";
 export { formatNetscapeCookies, parseCookieJar, type CookieLike } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";

package/dist/credentials/index.js

@@ -1,5 +1,6 @@
 export { CredentialStore } from "./store.js";
 export { PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
+export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, } from "./access.js";
 export { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
 export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/inject-credential-tool.d.ts

@@ -12,9 +12,11 @@
  */
 import type { ToolDefinition } from "../types.js";
 import type { ToolContext } from "../tool-system/context.js";
+import { type SettingsScope } from "../settings/manager.js";
 export declare const injectCredentialToolDef: ToolDefinition;
 /** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
-export declare function isInjectCredentialAvailable(cwd: string): boolean;
+export declare function isInjectCredentialAvailable(cwd: string, settingsScope?: SettingsScope): boolean;
 export declare function injectCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
 /** 测试钩子:清空会话 allow 集。 */
 export declare function __resetInjectCredentialSessionAllowForTests(): void;
+export declare function clearInjectCredentialSessionAllow(sessionId: string): void;

package/dist/credentials/inject-credential-tool.js

@@ -10,9 +10,9 @@
  * 跨进程:实际的 restoreCookiesToBrowser 在 desktop main(core 够不到 Electron
  * session),经 `ctx.injectCredentialToBrowser` 回调(宿主注入,镜像 askUser)触发。
  */
-import { CredentialStore } from "./store.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
+import { credentialAccessScope, getCredentialAccess } from "./access.js";
 const TOOL_NAME = "InjectCredential";
 const BASE_DESCRIPTION = "Inject a stored COOKIE credential into the built-in browser to restore its " +
     "login state, so you can then drive the page as that logged-in account with the " +
@@ -62,9 +62,14 @@ function sessionAllowFor(ctx) {
     }
     return set;
 }
-function readAutoApprove(cwd) {
+// CredentialStore only distinguishes full user+project from project-only.
+// Isolated engines must be at least as restrictive as project-scoped engines.
+function credentialScope(scope) {
+    return credentialAccessScope(scope);
+}
+function readAutoApprove(cwd, scope) {
     try {
-        const s = new SettingsManager(cwd, "full").get();
+        const s = new SettingsManager(cwd, scope === "full" ? "full" : "project").get();
         return s.credentialUse?.autoApprove === true;
     }
     catch {
@@ -72,9 +77,11 @@ function readAutoApprove(cwd) {
     }
 }
 /** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
-export function isInjectCredentialAvailable(cwd) {
+export function isInjectCredentialAvailable(cwd, settingsScope) {
     try {
-        return new CredentialStore(cwd).listMasked().some((c) => c.type === "cookie");
+        return getCredentialAccess()
+            .listMasked(cwd, credentialScope(settingsScope))
+            .some((c) => c.type === "cookie");
     }
     catch {
         return false;
@@ -82,10 +89,14 @@ export function isInjectCredentialAvailable(cwd) {
 }
 export async function injectCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
+    const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     if (!id) {
-        return json({ kind: "error", error: "缺少 id。先用 UseCredential(无参)列出凭证,再用 cookie 凭证的 id 调本工具。" });
+        return json({
+            kind: "error",
+            error: "缺少 id。先用 UseCredential(无参)列出凭证,再用 cookie 凭证的 id 调本工具。",
+        });
     }
     if (!ctx?.injectCredentialToBrowser) {
         return json({
@@ -93,17 +104,22 @@ export async function injectCredentialTool(args, ctx) {
             error: "当前环境无内置浏览器(headless/无面板),无法注入。请改用 UseCredential 取 cookie 走 HTTP 请求。",
         });
     }
-    const cred = new CredentialStore(cwd).resolve(id);
+    const cred = getCredentialAccess().resolveMeta(cwd, id, scope);
     if (!cred) {
-        return json({ kind: "error", error: `凭证不存在: "${id}"。调用 UseCredential(无参)可列出可用凭证。` });
+        return json({
+            kind: "error",
+            error: `凭证不存在: "${id}"。调用 UseCredential(无参)可列出可用凭证。`,
+        });
     }
     if (cred.type !== "cookie") {
         return json({ kind: "error", error: `凭证「${cred.label}」不是 cookie 类型,不能注入浏览器。` });
     }
     // 过门:复用三档,但用该凭证的 autoInjectByAI(不是 autoUseByAI)。
-    const ask = ctx.askUser ? (q, opts) => ctx.askUser(q, opts) : undefined;
+    const ask = ctx.askUser
+        ? (q, opts) => ctx.askUser(q, opts)
+        : undefined;
     const decision = await credentialUseGate({ id: cred.id, label: cred.label, purpose }, {
-        autoApprove: readAutoApprove(cwd),
+        autoApprove: readAutoApprove(cwd, scope),
         credentialAutoUse: cred.autoInjectByAI === true,
         sessionAllow: sessionAllowFor(ctx),
         ask,
@@ -115,7 +131,7 @@ export async function injectCredentialTool(args, ctx) {
         return json({ kind: "error", error: msg });
     }
     // 跨进程触发宿主注入。
-    const res = await ctx.injectCredentialToBrowser(cred.id);
+    const res = await ctx.injectCredentialToBrowser(cred.id, scope);
     if (!res.ok) {
         return json({ kind: "error", error: res.error ?? "注入浏览器失败(宿主未返回成功)。" });
     }
@@ -128,3 +144,6 @@ function json(r) {
 export function __resetInjectCredentialSessionAllowForTests() {
     injectSessionAllowByEngine.clear();
 }
+export function clearInjectCredentialSessionAllow(sessionId) {
+    injectSessionAllowByEngine.delete(sessionId);
+}

package/dist/credentials/types.d.ts

@@ -39,8 +39,8 @@ export interface Credential {
     /**
      * link: 业务方 app 注册地址;cookie: 拓取所用平台与主域 + 抓取范围 + 切换策略。
      * - scope="all" 表示该 jar 是整分区全量抓的(切换时整包导回);缺省/"domain" = 仅该域。
-     * - switchMode 决定「切换」时怎么写回浏览器:"clear"(默认)先清空整分区再注入(干净换号);
-     *   "merge" 只覆盖同名 cookie、保留分区里其他站(不踢掉别的登录态)。
+     * - switchMode 决定「切换」时怎么写回浏览器:"merge"(默认)只覆盖同名 cookie、保留
+     *   分区里其他站(不踢掉别的登录态);"clear" 先清空整分区再注入(干净换号,需显式选)。
      */
     meta?: {
         appUrl?: string;

package/dist/credentials/use-credential-tool.d.ts

@@ -7,7 +7,8 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
@@ -25,5 +26,12 @@ export declare function useCredentialToolDefFor(cwd: string): ToolDefinition;
  */
 export declare function sweepStaleCredentialCookies(now?: number): void;
 export declare function useCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+export declare function useCredentialBuiltinTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string | {
+    result: string;
+    sensitive: true;
+    displayResult: string;
+    transcriptResult: string;
+}>;
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export declare function __resetCredentialSessionAllowForTests(): void;
+export declare function clearCredentialSessionAllow(sessionId: string): void;

package/dist/credentials/use-credential-tool.js

@@ -7,22 +7,17 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
-import { writeFileSync, existsSync, readdirSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
-import { CredentialStore } from "./store.js";
-import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+import { SENSITIVE_TOOL_RESULT_PLACEHOLDER } from "../tool-system/tool-result-redaction.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
 import { logger } from "../logging/logger.js";
+import { credentialAccessScope, getCredentialAccess, materializeCookieSecret, sweepStaleCredentialCookieFiles, } from "./access.js";
 const TOOL_NAME = "UseCredential";
-const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
-const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000; // 30min 启动 sweep 上限
 const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cookie) to run a command. " +
     "Call with NO arguments first to list available credentials (id + label + type); " +
     "then call again with `id` to fetch one. Token/link credentials return their secret " +
@@ -52,7 +47,7 @@ export const useCredentialToolDef = {
  */
 export function useCredentialToolDefFor(cwd) {
     try {
-        const list = new CredentialStore(cwd).listMasked();
+        const list = getCredentialAccess().listMasked(cwd, "full");
         if (list.length === 0)
             return useCredentialToolDef;
         const names = list.map((c) => `${c.id} (${c.type})`).join(", ");
@@ -70,26 +65,7 @@ export function useCredentialToolDefFor(cwd) {
  * 不引入 lease 对象/定时器 —— 文件用完靠进程退出 + 这个轻量 sweep。
  */
 export function sweepStaleCredentialCookies(now = Date.now()) {
-    const dir = tmpdir();
-    try {
-        if (!existsSync(dir))
-            return;
-        for (const f of readdirSync(dir)) {
-            if (!f.startsWith(COOKIE_FILE_PREFIX))
-                continue;
-            const p = join(dir, f);
-            try {
-                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
-                    rmSync(p, { force: true });
-            }
-            catch {
-                /* skip */
-            }
-        }
-    }
-    catch {
-        /* best-effort */
-    }
+    sweepStaleCredentialCookieFiles(now);
 }
 /** 内存会话 allow 集:每个 Engine 一份(从 ctx.sessionId 键)。纯内存,关进程即忘。 */
 const sessionAllowByEngine = new Map();
@@ -112,7 +88,7 @@ function sessionAllowFor(ctx) {
 // (project-only). An "isolated" engine is at least as restrictive as project,
 // so it maps to "project" — it must never read the host user's ~/.code-shell.
 function credentialScope(scope) {
-    return scope === "full" || scope === undefined ? "full" : "project";
+    return credentialAccessScope(scope);
 }
 function readAutoApprove(cwd, scope) {
     try {
@@ -128,19 +104,19 @@ function readAutoApprove(cwd, scope) {
 }
 export async function useCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
-    const store = new CredentialStore(cwd);
+    const access = getCredentialAccess();
     const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     // 无 id → 清单(脱敏,权威实时源)。按 engine scope 过滤:project/isolated
     // 引擎不得列出宿主 user 层凭证。
     if (!id) {
-        const credentials = store
-            .listMasked(scope)
+        const credentials = access
+            .listMasked(cwd, scope)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
         return json({ kind: "list", credentials });
     }
-    const cred = store.resolve(id, scope);
+    const cred = access.resolveMeta(cwd, id, scope);
     if (!cred) {
         return json({ kind: "error", error: `凭证不存在: "${id}"。调用本工具(无参)可列出可用凭证。` });
     }
@@ -162,14 +138,20 @@ export async function useCredentialTool(args, ctx) {
     }
     // token/link → 直接返回值
     if (cred.type === "token" || cred.type === "link") {
-        if (!cred.secret)
+        if (!cred.hasSecret || !access.resolveValue) {
+            return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
+        }
+        try {
+            const value = await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" });
+            return json({ kind: "value", value });
+        }
+        catch {
             return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
-        return json({ kind: "value", value: cred.secret });
+        }
     }
     // cookie → 就地写临时 cookies.txt
     if (cred.type === "cookie") {
-        const jar = parseCookieJar(cred.secret);
-        if (jar.length === 0) {
+        if (!cred.hasSecret) {
             return json({
                 kind: "error",
                 error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
@@ -180,26 +162,57 @@ export async function useCredentialTool(args, ctx) {
         // same process — the second write would clobber the first and a caller could
         // read another account's cookies. A random component makes each file distinct.
         // Prefix is unchanged so the 30-min startup sweep still matches & cleans them.
-        const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safe(cred.id)}-${process.pid}-${randomUUID()}.txt`);
         try {
-            writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+            const materialized = access.materializeCookie
+                ? await access.materializeCookie({ cwd, id: cred.id, scope })
+                : materializeCookieSecret(cred.id, await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" }));
+            return json({
+                kind: "cookie",
+                cookiesFile: materialized.cookiesFile,
+                count: materialized.count,
+            });
         }
         catch (e) {
+            if (String(e).includes("cookie jar is empty or invalid")) {
+                return json({
+                    kind: "error",
+                    error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
+                });
+            }
             logger.warn(`UseCredential: failed to write cookies.txt: ${String(e)}`);
             return json({ kind: "error", error: `写临时 cookie 文件失败: ${String(e)}` });
         }
-        return json({ kind: "cookie", cookiesFile: file, count: jar.length });
     }
     return json({ kind: "error", error: `未知凭证类型: ${cred.type}` });
 }
-/** 文件名安全化(凭证 id 用了 `__`,这里只挡路径分隔符/控制字符)。 */
-function safe(s) {
-    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+export async function useCredentialBuiltinTool(args, ctx) {
+    const result = await useCredentialTool(args, ctx);
+    if (!isValueResult(result))
+        return result;
+    const redacted = json({ kind: "value", value: SENSITIVE_TOOL_RESULT_PLACEHOLDER });
+    return {
+        result,
+        sensitive: true,
+        displayResult: redacted,
+        transcriptResult: redacted,
+    };
 }
 function json(r) {
     return JSON.stringify(r);
 }
+function isValueResult(result) {
+    try {
+        const parsed = JSON.parse(result);
+        return parsed.kind === "value" && typeof parsed.value === "string";
+    }
+    catch {
+        return false;
+    }
+}
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export function __resetCredentialSessionAllowForTests() {
     sessionAllowByEngine.clear();
 }
+export function clearCredentialSessionAllow(sessionId) {
+    sessionAllowByEngine.delete(sessionId);
+}