@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/tool-system/executor.js

@@ -14,22 +14,33 @@ import { parsePatch } from "./builtin/apply-patch/parser.js";
 import { BUILTIN_TOOL_GUARDS } from "./builtin/index.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "./builtin/complete-goal.js";
 import { CANCEL_GOAL_TOOL_NAME } from "./builtin/cancel-goal.js";
-// A1 hardening: hooks must never promote a non-`allow` classifier
-// decision to `allow`. They may otherwise adjust the decision freely
-// (e.g. tighten `allow` to `deny`/`ask`, or relax `deny` to `ask` to
-// request interactive confirmation — both legitimate audit patterns).
-// The user remains the only source of `allow` when the classifier
-// said `ask`/`deny`.
-//
-// See standard §S4 and spec docs/superpowers/specs/2026-05-26-a1-permission-hardening-design.md.
+import { toolResultDisplayText } from "./tool-result-redaction.js";
+const PERMISSION_DECISION_RANK = {
+    allow: 0,
+    ask: 1,
+    deny: 2,
+};
+// Permission hooks may only keep or tighten the current decision. The merge
+// order is deny > ask > allow, so classifier deny/rules stay hard-deny even if
+// a hook asks the user for confirmation.
 function clampHookDecision(classifier, hook) {
     if (!hook)
         return { decision: classifier, rejectedUpgrade: false };
-    if (hook === "allow" && classifier !== "allow") {
+    if (PERMISSION_DECISION_RANK[hook] < PERMISSION_DECISION_RANK[classifier]) {
         return { decision: classifier, rejectedUpgrade: true };
     }
     return { decision: hook, rejectedUpgrade: false };
 }
+function permissionAskReason(preHookMessages, permissionHookMessages) {
+    const parts = [];
+    if (preHookMessages?.length) {
+        parts.push(`pre_tool_use:\n${preHookMessages.join("\n")}`);
+    }
+    if (permissionHookMessages?.length) {
+        parts.push(`on_permission_check:\n${permissionHookMessages.join("\n")}`);
+    }
+    return parts.length > 0 ? parts.join("\n\n") : undefined;
+}
 export class ToolExecutor {
     registry;
     permission;
@@ -132,7 +143,9 @@ export class ToolExecutor {
             };
         }
         const visibilityGuard = BUILTIN_TOOL_GUARDS.get(call.toolName);
-        if (visibilityGuard && this.toolCtx?.toolVisibility && !visibilityGuard(this.toolCtx.toolVisibility)) {
+        if (visibilityGuard &&
+            this.toolCtx?.toolVisibility &&
+            !visibilityGuard(this.toolCtx.toolVisibility)) {
             return {
                 id: call.id,
                 toolName: call.toolName,
@@ -276,41 +289,16 @@ export class ToolExecutor {
                 isError: true,
             };
         }
-        // A1 hardening: pre_tool_use can no longer pre-approve a tool via
-        // `decision === "allow"`. Hooks may relax `allow` and may force
-        // `ask`/`deny`, but they cannot promote a `deny`/`ask` decision to
-        // `allow`. The only paths to `allow` are the classifier (rules,
-        // safe-read, allowlist) and the user (interactive approval).
-        if (hookResult.decision === "allow") {
-            this.log.info("permission.hook_upgrade_rejected", {
-                cat: "permission",
-                tool: call.toolName,
-                site: "pre_tool_use",
-            });
-        }
-        // pre_tool_use can request interactive confirmation via
-        // decision: "ask". We invoke the same handleAsk path the classifier
-        // uses, but feed the hook's messages so the user sees the handler's
-        // reasoning. If the user approves, we skip the classifier below —
-        // the hook and the user together have decided.
-        if (hookResult.decision === "ask") {
-            const reason = hookResult.messages?.join("\n") ?? undefined;
-            const approved = await this.permission.handleAsk(call.toolName, call.args, reason, { sessionId: this.toolCtx?.sessionId });
-            if (!approved) {
-                return {
-                    id: call.id,
-                    toolName: call.toolName,
-                    error: `Tool call denied by user (pre_tool_use ask).`,
-                    isError: true,
-                };
-            }
-        }
         // 0.7. Investigation guard — block redundant reads and tag soft reminders
         // onto results. See investigation-guard.ts for the rules; they enforce the
         // soft prompt guidance in coding.md ("never re-read", "3-call budget").
         const guardDecision = this.guard?.preToolCheck(call);
         if (guardDecision?.block) {
-            this.log.info("guard.block", { cat: "guard", tool: call.toolName, reason: guardDecision.block.slice(0, 200) });
+            this.log.info("guard.block", {
+                cat: "guard",
+                tool: call.toolName,
+                reason: guardDecision.block.slice(0, 200),
+            });
             return {
                 id: call.id,
                 toolName: call.toolName,
@@ -318,68 +306,77 @@ export class ToolExecutor {
                 isError: true,
             };
         }
-        // 1. Permission check — skipped only when pre_tool_use issued an
-        // `ask` that the user just approved (we don't double-prompt).
-        if (hookResult.decision !== "ask") {
-            const classifierDecision = this.permission.classify(call.toolName, call.args);
-            this.log.info("permission.classify", {
+        // 1. Permission check. `pre_tool_use: ask` only adds a stricter ask
+        // requirement; user approval for that ask cannot bypass classifier deny
+        // rules. Final merge order is deny > ask > allow, and at most one prompt
+        // is shown for the merged ask decision.
+        const classifierDecision = this.permission.classify(call.toolName, call.args);
+        this.log.info("permission.classify", {
+            cat: "permission",
+            tool: call.toolName,
+            decision: classifierDecision,
+            mode: this.permission.getMode(),
+        });
+        // on_permission_check hook: lets handlers audit and tighten the decision
+        // (e.g. `allow → ask/deny`). Attempts to relax classifier/pre-hook deny or
+        // ask are rejected by clampHookDecision.
+        const permHook = await this.hooks.emit("on_permission_check", {
+            toolName: call.toolName,
+            args: call.args,
+            toolCallId: call.id,
+            classifierDecision,
+        });
+        const preClamped = clampHookDecision(classifierDecision, hookResult.decision);
+        let decision = preClamped.decision;
+        if (preClamped.rejectedUpgrade) {
+            this.log.info("permission.hook_upgrade_rejected", {
+                cat: "permission",
+                tool: call.toolName,
+                site: "pre_tool_use",
+                attempted: hookResult.decision,
+                classifier: classifierDecision,
+            });
+        }
+        const permClamped = clampHookDecision(decision, permHook.decision);
+        decision = permClamped.decision;
+        if (permClamped.rejectedUpgrade) {
+            this.log.info("permission.hook_upgrade_rejected", {
+                cat: "permission",
+                tool: call.toolName,
+                site: "on_permission_check",
+                attempted: permHook.decision,
+                classifier: classifierDecision,
+            });
+        }
+        if (decision !== classifierDecision) {
+            this.log.info("permission.hook_override", {
                 cat: "permission",
                 tool: call.toolName,
-                decision: classifierDecision,
-                mode: this.permission.getMode(),
+                from: classifierDecision,
+                to: decision,
             });
-            // on_permission_check hook: lets handlers audit and *downgrade*
-            // the classifier decision (e.g. `allow → ask/deny`, `deny →
-            // ask`). Promotion to `allow` is rejected by clampHookDecision
-            // — only the classifier and the user can grant `allow`.
-            const permHook = await this.hooks.emit("on_permission_check", {
+        }
+        if (decision === "deny") {
+            return {
+                id: call.id,
                 toolName: call.toolName,
-                args: call.args,
-                toolCallId: call.id,
-                classifierDecision,
+                error: `Permission denied for tool: ${call.toolName}`,
+                isError: true,
+            };
+        }
+        if (decision === "ask") {
+            const reason = permissionAskReason(hookResult.decision === "ask" ? hookResult.messages : undefined, permHook.decision === "ask" ? permHook.messages : undefined);
+            const approved = await this.permission.handleAsk(call.toolName, call.args, reason, {
+                sessionId: this.toolCtx?.sessionId,
             });
-            // A1 hardening: clamp hook decision to downgrades only.
-            const clamped = clampHookDecision(classifierDecision, permHook.decision);
-            const decision = clamped.decision;
-            if (clamped.rejectedUpgrade) {
-                this.log.info("permission.hook_upgrade_rejected", {
-                    cat: "permission",
-                    tool: call.toolName,
-                    site: "on_permission_check",
-                    attempted: permHook.decision,
-                    classifier: classifierDecision,
-                });
-            }
-            if (decision !== classifierDecision) {
-                this.log.info("permission.hook_override", {
-                    cat: "permission",
-                    tool: call.toolName,
-                    from: classifierDecision,
-                    to: decision,
-                });
-            }
-            if (decision === "deny") {
+            if (!approved) {
                 return {
                     id: call.id,
                     toolName: call.toolName,
-                    error: `Permission denied for tool: ${call.toolName}`,
+                    error: `Permission denied by user for tool: ${call.toolName}`,
                     isError: true,
                 };
             }
-            if (decision === "ask") {
-                const reason = permHook.messages?.join("\n");
-                const approved = await this.permission.handleAsk(call.toolName, call.args, reason, {
-                    sessionId: this.toolCtx?.sessionId,
-                });
-                if (!approved) {
-                    return {
-                        id: call.id,
-                        toolName: call.toolName,
-                        error: `Permission denied by user for tool: ${call.toolName}`,
-                        isError: true,
-                    };
-                }
-            }
         }
         // 2. Pre-tool hook
         await this.hooks.emit("on_tool_start", {
@@ -415,7 +412,7 @@ export class ToolExecutor {
                 toolName: call.toolName,
                 ok: false,
                 durationMs: Date.now() - toolStartedAt,
-                error: err instanceof Error ? err.stack ?? err.message : String(err),
+                error: err instanceof Error ? (err.stack ?? err.message) : String(err),
             });
             // A model calling a tool that isn't in the registry (hallucinated name,
             // or a builtin missing from the active preset's whitelist) must not kill
@@ -437,7 +434,8 @@ export class ToolExecutor {
         if (guardDecision?.prepend && !result.error && result.result) {
             result.result = `${guardDecision.prepend}\n${result.result}`;
         }
-        const payload = result.result ?? result.error ?? "";
+        const observerResult = toolResultDisplayText(result);
+        const payload = observerResult ?? result.error ?? "";
         span.end({
             ok: !result.error,
             chars: payload.length,
@@ -451,21 +449,21 @@ export class ToolExecutor {
             toolName: call.toolName,
             ok: !result.error,
             durationMs: Date.now() - toolStartedAt,
-            output: result.error ? undefined : result.result,
+            output: result.error ? undefined : observerResult,
             error: result.error,
         });
         // 4. Post-tool hook
         await this.hooks.emit("on_tool_end", {
             toolName: call.toolName,
             toolCallId: call.id,
-            result: result.result,
+            result: observerResult,
             error: result.error,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)
         const postHook = await this.hooks.emit("post_tool_use", {
             toolName: call.toolName,
             toolCallId: call.id,
-            result: result.result,
+            result: observerResult,
             error: result.error,
         });
         // Append handler-supplied context (linter output, type-check result,
@@ -574,23 +572,4 @@ export class ToolExecutor {
             return `Error: ${err.message}`;
         }
     }
-    /**
-     * Convert tool results into Message entries for the transcript.
-     */
-    resultsToMessages(toolCalls, results) {
-        const blocks = [];
-        for (const result of results) {
-            blocks.push({
-                type: "tool_result",
-                tool_use_id: result.id,
-                content: result.error ? `Error: ${result.error}` : (result.result ?? "(no output)"),
-            });
-        }
-        return [
-            {
-                role: "user",
-                content: blocks,
-            },
-        ];
-    }
 }

package/dist/tool-system/mcp-manager.d.ts

@@ -5,7 +5,15 @@
  */
 import type { Tool as McpTool } from "@modelcontextprotocol/sdk/types.js";
 import type { MCPServerConfig, RegisteredTool } from "../types.js";
+import type { CredentialType } from "../credentials/types.js";
 import { ToolRegistry } from "./registry.js";
+import { type CredentialAccess } from "../credentials/access.js";
+interface MCPResourceInfo {
+    uri: string;
+    name: string;
+    description?: string;
+    serverName: string;
+}
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -14,6 +22,16 @@ import { ToolRegistry } from "./registry.js";
  * and the env var.
  */
 export declare function readRequiredEnv(serverName: string, field: string, envName: string): string;
+export interface ResolvedMcpCredential {
+    secret: string;
+    type?: CredentialType;
+    label?: string;
+}
+export type HttpCredentialResolverResult = string | ResolvedMcpCredential | undefined;
+export interface BuildHttpHeadersOptions {
+    now?: () => number;
+    oauthRefreshSkewMs?: number;
+}
 /**
  * Build the spawned stdio server's environment. Priority (lowest → highest):
  * a minimal inherited allowlist < forwarded `envVars` (read from process.env by
@@ -27,7 +45,9 @@ export declare function buildStdioEnv(serverName: string, config: MCPServerConfi
  * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
  * and win on conflict. Pure + exported for unit testing.
  */
-export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => string | undefined): Record<string, string>;
+export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => HttpCredentialResolverResult, options?: BuildHttpHeadersOptions): Record<string, string>;
+export declare function bearerTokenFromMcpCredential(serverName: string, credentialId: string, credential: ResolvedMcpCredential, options?: BuildHttpHeadersOptions): string;
+export declare function buildHttpHeadersWithCredentialAccess(serverName: string, config: MCPServerConfig, access?: Pick<CredentialAccess, "resolveValue"> & Partial<Pick<CredentialAccess, "resolveMeta">>, options?: BuildHttpHeadersOptions): Promise<Record<string, string>>;
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
@@ -80,6 +100,14 @@ export declare class MCPManager {
      */
     connectAll(servers: Record<string, MCPServerConfig>, owner?: unknown): Promise<void>;
     reconcile(servers: Record<string, MCPServerConfig>, owner?: unknown): Promise<void>;
+    /**
+     * Remove one owner from the shared desired-server pool and disconnect servers
+     * that no remaining owner wants. This is called when a session-owned Engine
+     * is closed; without it project-scoped MCP servers can stay connected until
+     * worker shutdown.
+     */
+    unregisterOwner(owner: unknown): Promise<void>;
+    private enabledServerNames;
     /** Union of every registered owner's desired set; null when none registered. */
     private unionDesired;
     /**
@@ -117,13 +145,10 @@ export declare class MCPManager {
     /**
      * List resources from MCP servers.
      */
-    listResources(serverName?: string, signal?: AbortSignal): Promise<Array<{
-        uri: string;
-        name: string;
-        description?: string;
-    }>>;
+    listResources(serverName?: string, signal?: AbortSignal): Promise<MCPResourceInfo[]>;
     /**
      * Read a resource from an MCP server.
      */
     readResource(serverName: string, uri: string, signal?: AbortSignal): Promise<string>;
 }
+export {};