@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0-beta.1

package/dist/credentials/inject-credential-tool.js

@@ -10,9 +10,9 @@
  * 跨进程:实际的 restoreCookiesToBrowser 在 desktop main(core 够不到 Electron
  * session),经 `ctx.injectCredentialToBrowser` 回调(宿主注入,镜像 askUser)触发。
  */
-import { CredentialStore } from "./store.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
+import { credentialAccessScope, getCredentialAccess } from "./access.js";
 const TOOL_NAME = "InjectCredential";
 const BASE_DESCRIPTION = "Inject a stored COOKIE credential into the built-in browser to restore its " +
     "login state, so you can then drive the page as that logged-in account with the " +
@@ -62,9 +62,14 @@ function sessionAllowFor(ctx) {
     }
     return set;
 }
-function readAutoApprove(cwd) {
+// CredentialStore only distinguishes full user+project from project-only.
+// Isolated engines must be at least as restrictive as project-scoped engines.
+function credentialScope(scope) {
+    return credentialAccessScope(scope);
+}
+function readAutoApprove(cwd, scope) {
     try {
-        const s = new SettingsManager(cwd, "full").get();
+        const s = new SettingsManager(cwd, scope === "full" ? "full" : "project").get();
         return s.credentialUse?.autoApprove === true;
     }
     catch {
@@ -72,9 +77,11 @@ function readAutoApprove(cwd) {
     }
 }
 /** 该工具仅在有 cookie 凭证 且 宿主接了注入回调时才可见(BUILTIN_TOOL_GUARDS)。 */
-export function isInjectCredentialAvailable(cwd) {
+export function isInjectCredentialAvailable(cwd, settingsScope) {
     try {
-        return new CredentialStore(cwd).listMasked().some((c) => c.type === "cookie");
+        return getCredentialAccess()
+            .listMasked(cwd, credentialScope(settingsScope))
+            .some((c) => c.type === "cookie");
     }
     catch {
         return false;
@@ -82,10 +89,14 @@ export function isInjectCredentialAvailable(cwd) {
 }
 export async function injectCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
+    const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     if (!id) {
-        return json({ kind: "error", error: "缺少 id。先用 UseCredential(无参)列出凭证,再用 cookie 凭证的 id 调本工具。" });
+        return json({
+            kind: "error",
+            error: "缺少 id。先用 UseCredential(无参)列出凭证,再用 cookie 凭证的 id 调本工具。",
+        });
     }
     if (!ctx?.injectCredentialToBrowser) {
         return json({
@@ -93,17 +104,22 @@ export async function injectCredentialTool(args, ctx) {
             error: "当前环境无内置浏览器(headless/无面板),无法注入。请改用 UseCredential 取 cookie 走 HTTP 请求。",
         });
     }
-    const cred = new CredentialStore(cwd).resolve(id);
+    const cred = getCredentialAccess().resolveMeta(cwd, id, scope);
     if (!cred) {
-        return json({ kind: "error", error: `凭证不存在: "${id}"。调用 UseCredential(无参)可列出可用凭证。` });
+        return json({
+            kind: "error",
+            error: `凭证不存在: "${id}"。调用 UseCredential(无参)可列出可用凭证。`,
+        });
     }
     if (cred.type !== "cookie") {
         return json({ kind: "error", error: `凭证「${cred.label}」不是 cookie 类型,不能注入浏览器。` });
     }
     // 过门:复用三档,但用该凭证的 autoInjectByAI(不是 autoUseByAI)。
-    const ask = ctx.askUser ? (q, opts) => ctx.askUser(q, opts) : undefined;
+    const ask = ctx.askUser
+        ? (q, opts) => ctx.askUser(q, opts)
+        : undefined;
     const decision = await credentialUseGate({ id: cred.id, label: cred.label, purpose }, {
-        autoApprove: readAutoApprove(cwd),
+        autoApprove: readAutoApprove(cwd, scope),
         credentialAutoUse: cred.autoInjectByAI === true,
         sessionAllow: sessionAllowFor(ctx),
         ask,
@@ -115,7 +131,7 @@ export async function injectCredentialTool(args, ctx) {
         return json({ kind: "error", error: msg });
     }
     // 跨进程触发宿主注入。
-    const res = await ctx.injectCredentialToBrowser(cred.id);
+    const res = await ctx.injectCredentialToBrowser(cred.id, scope);
     if (!res.ok) {
         return json({ kind: "error", error: res.error ?? "注入浏览器失败(宿主未返回成功)。" });
     }
@@ -128,3 +144,6 @@ function json(r) {
 export function __resetInjectCredentialSessionAllowForTests() {
     injectSessionAllowByEngine.clear();
 }
+export function clearInjectCredentialSessionAllow(sessionId) {
+    injectSessionAllowByEngine.delete(sessionId);
+}

package/dist/credentials/types.d.ts

@@ -39,8 +39,8 @@ export interface Credential {
     /**
      * link: 业务方 app 注册地址;cookie: 拓取所用平台与主域 + 抓取范围 + 切换策略。
      * - scope="all" 表示该 jar 是整分区全量抓的(切换时整包导回);缺省/"domain" = 仅该域。
-     * - switchMode 决定「切换」时怎么写回浏览器:"clear"(默认)先清空整分区再注入(干净换号);
-     *   "merge" 只覆盖同名 cookie、保留分区里其他站(不踢掉别的登录态)。
+     * - switchMode 决定「切换」时怎么写回浏览器:"merge"(默认)只覆盖同名 cookie、保留
+     *   分区里其他站(不踢掉别的登录态);"clear" 先清空整分区再注入(干净换号,需显式选)。
      */
     meta?: {
         appUrl?: string;

package/dist/credentials/use-credential-tool.d.ts

@@ -7,7 +7,8 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
@@ -25,5 +26,12 @@ export declare function useCredentialToolDefFor(cwd: string): ToolDefinition;
  */
 export declare function sweepStaleCredentialCookies(now?: number): void;
 export declare function useCredentialTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+export declare function useCredentialBuiltinTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string | {
+    result: string;
+    sensitive: true;
+    displayResult: string;
+    transcriptResult: string;
+}>;
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export declare function __resetCredentialSessionAllowForTests(): void;
+export declare function clearCredentialSessionAllow(sessionId: string): void;

package/dist/credentials/use-credential-tool.js

@@ -7,22 +7,17 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
-import { writeFileSync, existsSync, readdirSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
-import { CredentialStore } from "./store.js";
-import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+import { SENSITIVE_TOOL_RESULT_PLACEHOLDER } from "../tool-system/tool-result-redaction.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
 import { logger } from "../logging/logger.js";
+import { credentialAccessScope, getCredentialAccess, materializeCookieSecret, sweepStaleCredentialCookieFiles, } from "./access.js";
 const TOOL_NAME = "UseCredential";
-const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
-const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000; // 30min 启动 sweep 上限
 const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cookie) to run a command. " +
     "Call with NO arguments first to list available credentials (id + label + type); " +
     "then call again with `id` to fetch one. Token/link credentials return their secret " +
@@ -52,7 +47,7 @@ export const useCredentialToolDef = {
  */
 export function useCredentialToolDefFor(cwd) {
     try {
-        const list = new CredentialStore(cwd).listMasked();
+        const list = getCredentialAccess().listMasked(cwd, "full");
         if (list.length === 0)
             return useCredentialToolDef;
         const names = list.map((c) => `${c.id} (${c.type})`).join(", ");
@@ -70,26 +65,7 @@ export function useCredentialToolDefFor(cwd) {
  * 不引入 lease 对象/定时器 —— 文件用完靠进程退出 + 这个轻量 sweep。
  */
 export function sweepStaleCredentialCookies(now = Date.now()) {
-    const dir = tmpdir();
-    try {
-        if (!existsSync(dir))
-            return;
-        for (const f of readdirSync(dir)) {
-            if (!f.startsWith(COOKIE_FILE_PREFIX))
-                continue;
-            const p = join(dir, f);
-            try {
-                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
-                    rmSync(p, { force: true });
-            }
-            catch {
-                /* skip */
-            }
-        }
-    }
-    catch {
-        /* best-effort */
-    }
+    sweepStaleCredentialCookieFiles(now);
 }
 /** 内存会话 allow 集:每个 Engine 一份(从 ctx.sessionId 键)。纯内存,关进程即忘。 */
 const sessionAllowByEngine = new Map();
@@ -112,7 +88,7 @@ function sessionAllowFor(ctx) {
 // (project-only). An "isolated" engine is at least as restrictive as project,
 // so it maps to "project" — it must never read the host user's ~/.code-shell.
 function credentialScope(scope) {
-    return scope === "full" || scope === undefined ? "full" : "project";
+    return credentialAccessScope(scope);
 }
 function readAutoApprove(cwd, scope) {
     try {
@@ -128,19 +104,19 @@ function readAutoApprove(cwd, scope) {
 }
 export async function useCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
-    const store = new CredentialStore(cwd);
+    const access = getCredentialAccess();
     const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     // 无 id → 清单(脱敏,权威实时源)。按 engine scope 过滤:project/isolated
     // 引擎不得列出宿主 user 层凭证。
     if (!id) {
-        const credentials = store
-            .listMasked(scope)
+        const credentials = access
+            .listMasked(cwd, scope)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
         return json({ kind: "list", credentials });
     }
-    const cred = store.resolve(id, scope);
+    const cred = access.resolveMeta(cwd, id, scope);
     if (!cred) {
         return json({ kind: "error", error: `凭证不存在: "${id}"。调用本工具(无参)可列出可用凭证。` });
     }
@@ -162,14 +138,20 @@ export async function useCredentialTool(args, ctx) {
     }
     // token/link → 直接返回值
     if (cred.type === "token" || cred.type === "link") {
-        if (!cred.secret)
+        if (!cred.hasSecret || !access.resolveValue) {
+            return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
+        }
+        try {
+            const value = await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" });
+            return json({ kind: "value", value });
+        }
+        catch {
             return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
-        return json({ kind: "value", value: cred.secret });
+        }
     }
     // cookie → 就地写临时 cookies.txt
     if (cred.type === "cookie") {
-        const jar = parseCookieJar(cred.secret);
-        if (jar.length === 0) {
+        if (!cred.hasSecret) {
             return json({
                 kind: "error",
                 error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
@@ -180,26 +162,57 @@ export async function useCredentialTool(args, ctx) {
         // same process — the second write would clobber the first and a caller could
         // read another account's cookies. A random component makes each file distinct.
         // Prefix is unchanged so the 30-min startup sweep still matches & cleans them.
-        const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safe(cred.id)}-${process.pid}-${randomUUID()}.txt`);
         try {
-            writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+            const materialized = access.materializeCookie
+                ? await access.materializeCookie({ cwd, id: cred.id, scope })
+                : materializeCookieSecret(cred.id, await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" }));
+            return json({
+                kind: "cookie",
+                cookiesFile: materialized.cookiesFile,
+                count: materialized.count,
+            });
         }
         catch (e) {
+            if (String(e).includes("cookie jar is empty or invalid")) {
+                return json({
+                    kind: "error",
+                    error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
+                });
+            }
             logger.warn(`UseCredential: failed to write cookies.txt: ${String(e)}`);
             return json({ kind: "error", error: `写临时 cookie 文件失败: ${String(e)}` });
         }
-        return json({ kind: "cookie", cookiesFile: file, count: jar.length });
     }
     return json({ kind: "error", error: `未知凭证类型: ${cred.type}` });
 }
-/** 文件名安全化(凭证 id 用了 `__`,这里只挡路径分隔符/控制字符)。 */
-function safe(s) {
-    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+export async function useCredentialBuiltinTool(args, ctx) {
+    const result = await useCredentialTool(args, ctx);
+    if (!isValueResult(result))
+        return result;
+    const redacted = json({ kind: "value", value: SENSITIVE_TOOL_RESULT_PLACEHOLDER });
+    return {
+        result,
+        sensitive: true,
+        displayResult: redacted,
+        transcriptResult: redacted,
+    };
 }
 function json(r) {
     return JSON.stringify(r);
 }
+function isValueResult(result) {
+    try {
+        const parsed = JSON.parse(result);
+        return parsed.kind === "value" && typeof parsed.value === "string";
+    }
+    catch {
+        return false;
+    }
+}
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export function __resetCredentialSessionAllowForTests() {
     sessionAllowByEngine.clear();
 }
+export function clearCredentialSessionAllow(sessionId) {
+    sessionAllowByEngine.delete(sessionId);
+}

package/dist/engine/engine.d.ts

@@ -12,9 +12,11 @@ import type { AskUserFn } from "../tool-system/builtin/ask-user.js";
 import type { CapabilityOverride } from "../settings/schema.js";
 import { type FeatureFlagName } from "../settings/feature-flags.js";
 import type { ToolContext } from "../tool-system/context.js";
+import { type SandboxBackend } from "../tool-system/sandbox/index.js";
 import { ModelPool, type ModelEntry } from "../llm/model-pool.js";
 import { AgentDefinitionRegistry } from "../agent/agent-definition-registry.js";
 import { EngineRuntime } from "./runtime.js";
+import type { InputAttachmentMeta } from "../protocol/types.js";
 /**
  * Build ScanOptions.compatFileNames from the user's instruction compat toggles.
  * Primary file name stays hard-wired to CODESHELL.md (not exposed). Turning a
@@ -53,7 +55,7 @@ export declare function resolveChildLlm(modelKey: string | undefined, pool: Mode
  * Names in `disabledAgents` are filtered out so the LLM never sees them.
  */
 /**
- * Resolve the working directory for a run. Precedence:
+ * Resolve the working directory for a run. Precedence for legacy sessions:
  *   options.cwd  >  resumed session's state.cwd  >  config.cwd  >  process.cwd()
  *
  * The session-cwd tier is what stops a project-bound session from being
@@ -261,6 +263,8 @@ export declare class Engine {
      * clear "no browser panel" error.
      */
     setBrowserBridge(bridge: import("../tool-system/browser-bridge.js").BrowserBridge | undefined): void;
+    /** Inject the host-backed workspace bridge after construction. */
+    setWorkspaceBridge(bridge: import("../tool-system/workspace-bridge.js").WorkspaceBridge | undefined): void;
     /**
      * Queue a user message to be spliced into the in-flight run for `sessionId`
      * at the next turn-loop step boundary — the 不打断 steering path (vs cancel +
@@ -325,6 +329,8 @@ export declare class Engine {
         injected?: boolean;
         /** Stable id for this user-intent, used to make duplicate submits idempotent. */
         clientMessageId?: string;
+        /** Structured input attachments. Legacy `<codeshell-image>` blocks remain supported. */
+        attachments?: InputAttachmentMeta[];
     }): Promise<EngineResult>;
     /**
      * Run the end-of-session memory pipeline as a fire-and-forget background
@@ -460,6 +466,12 @@ export declare class Engine {
      * session with no active goal is a no-op returning false.
      */
     clearGoal(sessionId: string): boolean;
+    /**
+     * Reset a session's workspace pointer back to its main root. If the session is
+     * actively running, mutate that live SessionBundle first so the run's next
+     * saveState cannot resurrect a stale worktree pointer.
+     */
+    releaseSessionWorkspace(sessionId: string): import("../types.js").SessionWorkspace | null;
     injectContext(sessionId: string, content: string): void;
     /**
      * Force context compaction on a session.
@@ -570,6 +582,7 @@ export declare class Engine {
      * by tests that want a ToolContext without a full run() cycle.
      */
     private resolveSandboxWithoutRuntime;
+    private resolveSandboxConfigForCwd;
     /**
      * Build the shell env layered onto the Bash tool / background shells (see
      * mergeShellEnv). Three user-configured sources, merged lowest → highest:
@@ -622,6 +635,9 @@ export declare class Engine {
         linux?: string;
         windows?: string;
     } | undefined;
+    readWorktreeBranchPrefix(cwd?: string): string | undefined;
+    resolveWorktreeSetupSandbox(cwd: string): Promise<SandboxBackend | undefined>;
+    readWorktreeSetupShellEnv(cwd?: string): Record<string, string> | undefined;
     buildToolContext(): ToolContext;
     /**
      * Read settings.disabledSkills + settings.disabledPlugins in a single