@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/tool-system/mcp-manager.js

@@ -7,11 +7,13 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { logger } from "../logging/logger.js";
-import { CredentialStore } from "../credentials/index.js";
+import { getCredentialAccess } from "../credentials/access.js";
+import { buildOAuthRefreshRequest, oauthCredentialStatus, parseOAuthCredentialSecret, } from "../credentials/oauth.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
+import { codeShellHome } from "../session/session-manager.js";
 /**
  * Read a required secret from `process.env` by NAME (Codex-style env-secret
  * handling — the value is never persisted in MCP config). A referenced env var
@@ -72,14 +74,14 @@ export function buildStdioEnv(serverName, config) {
  * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
  * and win on conflict. Pure + exported for unit testing.
  */
-export function buildHttpHeaders(serverName, config, resolveCredential) {
+export function buildHttpHeaders(serverName, config, resolveCredential, options = {}) {
     const headers = { ...(config.headers ?? {}) };
     if (config.credentialRef) {
-        const secret = resolveCredential?.(config.credentialRef);
-        if (secret === undefined || secret === "") {
+        const credential = normalizeResolvedMcpCredential(resolveCredential?.(config.credentialRef));
+        if (!credential || credential.secret === "") {
             throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
         }
-        headers["Authorization"] = `Bearer ${secret}`;
+        headers["Authorization"] = `Bearer ${bearerTokenFromMcpCredential(serverName, config.credentialRef, credential, options)}`;
     }
     else if (config.bearerTokenEnvVar) {
         headers["Authorization"] = `Bearer ${readRequiredEnv(serverName, "bearerTokenEnvVar", config.bearerTokenEnvVar)}`;
@@ -89,6 +91,68 @@ export function buildHttpHeaders(serverName, config, resolveCredential) {
     }
     return headers;
 }
+function normalizeResolvedMcpCredential(value) {
+    if (typeof value === "string")
+        return { secret: value };
+    if (!value)
+        return undefined;
+    return value;
+}
+export function bearerTokenFromMcpCredential(serverName, credentialId, credential, options = {}) {
+    if (credential.type === undefined)
+        return credential.secret;
+    if (credential.type !== "oauth") {
+        if (credential.type !== "token" && credential.type !== "link") {
+            throw new Error(`MCP server "${serverName}": credential "${credentialId}" type "${credential.type}" cannot be used as a bearer token`);
+        }
+        try {
+            const parsed = JSON.parse(credential.secret);
+            if (parsed !== null && typeof parsed === "object") {
+                throw new Error(`MCP server "${serverName}": credential "${credentialId}" resolved to a structured secret that does not match token metadata; refusing bearer injection`);
+            }
+        }
+        catch (err) {
+            if (err instanceof SyntaxError)
+                return credential.secret;
+            throw err;
+        }
+        return credential.secret;
+    }
+    const secret = parseOAuthCredentialSecret(credential.secret);
+    const status = oauthCredentialStatus(secret, {
+        now: options.now,
+        skewMs: options.oauthRefreshSkewMs,
+    });
+    if (status.state === "expired") {
+        const refresh = buildOAuthRefreshRequest(credentialId, secret);
+        const refreshHint = refresh
+            ? "refresh data is present, but automatic OAuth refresh is reserved and not wired yet"
+            : "missing refreshToken or tokenEndpoint for automatic refresh";
+        throw new Error(`MCP server "${serverName}": oauth credential "${credentialId}" access token expired; ${refreshHint}`);
+    }
+    return secret.accessToken;
+}
+export async function buildHttpHeadersWithCredentialAccess(serverName, config, access = getCredentialAccess(), options = {}) {
+    if (!config.credentialRef)
+        return buildHttpHeaders(serverName, config, undefined, options);
+    if (!access.resolveValue) {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" not found or empty`);
+    }
+    const meta = access.resolveMeta?.(undefined, config.credentialRef, "full");
+    if (!meta) {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" metadata is unavailable; refusing bearer injection`);
+    }
+    if (meta.type !== "token" && meta.type !== "link" && meta.type !== "oauth") {
+        throw new Error(`MCP server "${serverName}": credential "${config.credentialRef}" type "${meta.type}" cannot be used as a bearer token`);
+    }
+    const secret = await access.resolveValue({
+        cwd: undefined,
+        id: config.credentialRef,
+        scope: "full",
+        purpose: "mcp",
+    });
+    return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? { secret, type: meta?.type, label: meta?.label } : undefined, options);
+}
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
@@ -118,7 +182,29 @@ export function inferTransportType(config) {
  * spill itself is bounded by the byte budget below; this cap is just
  * to keep ls(~/.code-shell/mcp_images) tractable.
  */
+const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
+function spillTimestamp(filename, prefix) {
+    const suffix = filename.slice(prefix.length);
+    const dot = suffix.lastIndexOf(".");
+    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
+    const timestamp = Number(raw);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+async function pruneMcpImageSpills(baseDir, prefix) {
+    const entries = await readdir(baseDir, { withFileTypes: true });
+    const spills = entries
+        .filter((entry) => entry.isFile() && entry.name.startsWith(prefix))
+        .map((entry) => ({
+        name: entry.name,
+        timestamp: spillTimestamp(entry.name, prefix),
+    }))
+        .sort((a, b) => a.timestamp - b.timestamp || a.name.localeCompare(b.name));
+    const excess = spills.length - MAX_MCP_IMAGE_SPILLS_PER_TOOL;
+    if (excess <= 0)
+        return;
+    await Promise.all(spills.slice(0, excess).map((entry) => unlink(join(baseDir, entry.name)).catch(() => { })));
+}
 /**
  * Persist an MCP-returned image to disk and return the textual
  * reference the LLM should see. Images larger than
@@ -130,9 +216,7 @@ const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
  *   [mcp-image] server=playwright tool=screenshot saved=/abs/path.png (123 KB)
  */
 export async function spillMcpImage(serverName, toolName, base64, mimeType, opts) {
-    const home = process.env.CODE_SHELL_HOME ?? process.env.HOME ?? "";
-    const baseDir = opts?.baseDir ??
-        (home ? join(home, ".code-shell", "mcp_images") : join("/tmp", "code-shell-mcp-images"));
+    const baseDir = opts?.baseDir ?? join(codeShellHome(), "mcp_images");
     const now = opts?.now ?? Date.now;
     const decodedBytes = Math.floor((base64.length * 3) / 4);
     if (decodedBytes > MAX_MCP_IMAGE_BYTES) {
@@ -147,11 +231,13 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
                 : "png";
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
-    const filename = `${safeServer}-${safeTool}-${now()}.${ext}`;
+    const prefix = `${safeServer}-${safeTool}-`;
+    const filename = `${prefix}${now()}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
         await writeFile(filePath, Buffer.from(base64, "base64"));
+        await pruneMcpImageSpills(baseDir, prefix);
     }
     catch (err) {
         logger.warn("mcp.image_spill_failed", {
@@ -205,7 +291,10 @@ export function buildRegisteredTool(serverName, tool) {
     return {
         name: toOpenAIToolName(`mcp_${serverName}_${tool.name}`),
         description: `[${serverName}] ${tool.description ?? tool.name}`,
-        inputSchema: tool.inputSchema ?? { type: "object", properties: {} },
+        inputSchema: tool.inputSchema ?? {
+            type: "object",
+            properties: {},
+        },
         source: "mcp",
         serverName,
         permissionDefault: "ask",
@@ -247,13 +336,16 @@ export class MCPManager {
      * Connect to all configured MCP servers and register their tools.
      */
     async connectAll(servers, owner) {
+        const enabledNames = this.enabledServerNames(servers);
         // Register this owner's desired set up front (see reconcile's shared-pool
         // note) so a later reconcile from ANOTHER session can't disconnect servers
         // this session connected at run start.
         if (owner !== undefined) {
-            this.desiredByOwner.set(owner, new Set(Object.entries(servers)
-                .filter(([, c]) => c.enabled !== false)
-                .map(([n]) => n)));
+            this.desiredByOwner.set(owner, enabledNames);
+            this.desiredServerNames = this.unionDesired() ?? new Set();
+        }
+        else if (this.desiredByOwner.size === 0) {
+            this.desiredServerNames = enabledNames;
         }
         // Codex-style toggle: skip servers explicitly disabled in settings.
         // Only the literal `false` disables — absent / true / any other value
@@ -279,26 +371,42 @@ export class MCPManager {
         }
     }
     async reconcile(servers, owner) {
-        const enabledNames = new Set(Object.entries(servers)
-            .filter(([, config]) => config.enabled !== false)
-            .map(([name]) => name));
-        this.desiredServerNames = enabledNames;
+        const enabledNames = this.enabledServerNames(servers);
         // Shared-pool semantics: this ONE pool serves every session in the worker,
         // and sessions in different projects legitimately want DIFFERENT server
         // sets (per-project capabilityOverrides). Disconnect only servers that NO
         // registered owner wants — otherwise the per-session hot-reload patches
         // would thrash each other's connections (last reconcile wins, killing a
-        // server another project's session is using). Owners are engines; a
-        // closed session's desires linger (no engine-teardown hook), which merely
-        // over-RETAINS idle connections — per-session tool visibility keeps
-        // correctness regardless.
+        // server another project's session is using). Owners are engines; closed
+        // sessions call unregisterOwner() so their desired sets stop retaining idle
+        // connections.
         if (owner !== undefined)
             this.desiredByOwner.set(owner, enabledNames);
         const union = this.unionDesired() ?? enabledNames;
+        this.desiredServerNames = union;
         const stale = this.listServers().filter((name) => !union.has(name));
         await Promise.all(stale.map((name) => this.disconnect(name)));
         await this.connectAll(servers, owner);
     }
+    /**
+     * Remove one owner from the shared desired-server pool and disconnect servers
+     * that no remaining owner wants. This is called when a session-owned Engine
+     * is closed; without it project-scoped MCP servers can stay connected until
+     * worker shutdown.
+     */
+    async unregisterOwner(owner) {
+        if (!this.desiredByOwner.delete(owner))
+            return;
+        const desired = this.unionDesired() ?? new Set();
+        this.desiredServerNames = desired;
+        const stale = this.listServers().filter((name) => !desired.has(name));
+        await Promise.all(stale.map((name) => this.disconnect(name)));
+    }
+    enabledServerNames(servers) {
+        return new Set(Object.entries(servers)
+            .filter(([, config]) => config.enabled !== false)
+            .map(([name]) => name));
+    }
     /** Union of every registered owner's desired set; null when none registered. */
     unionDesired() {
         if (this.desiredByOwner.size === 0)
@@ -361,12 +469,10 @@ export class MCPManager {
             if (!config.url) {
                 throw new Error(`MCP server "${name}": url is required for ${transportType} transport`);
             }
-            // credentialRef resolves against the user-scope CredentialStore. The
-            // shared MCPManager pool has no per-session cwd (see desiredByOwner note),
-            // and MCP-referenced credentials (e.g. a Figma token) are user-global by
-            // nature, so user scope is the right resolution surface here.
-            const credStore = new CredentialStore(undefined);
-            const headers = buildHttpHeaders(name, config, (id) => credStore.resolve(id)?.secret);
+            // credentialRef resolves against user-scope credential access. The shared
+            // MCPManager pool has no per-session cwd, and MCP-referenced credentials
+            // (e.g. a Figma token) remain user-global by design.
+            const headers = await buildHttpHeadersWithCredentialAccess(name, config);
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
                 requestInit: Object.keys(headers).length ? { headers } : undefined,
             });
@@ -429,59 +535,65 @@ export class MCPManager {
      * Discover tools from an MCP server and register them.
      */
     async discoverTools(serverName, client) {
-        const result = await client.listTools();
-        for (const tool of result.tools) {
-            const registered = buildRegisteredTool(serverName, tool);
-            // Register with an executor that calls the MCP server
-            this.toolRegistry.registerTool(registered, async (args) => {
-                const callResult = await client.callTool({
-                    name: tool.name,
-                    arguments: stripInternalToolArgs(args),
-                });
-                // Extract text + image content from the result. Image blobs
-                // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
-                // the LLM message tree — same pattern as the GenerateImage
-                // tool — and the model sees a textual reference it can Read
-                // on a later turn if it needs the pixels. This sidesteps the
-                // "MCP returned a 5MB screenshot → token budget exploded"
-                // failure mode that bit Codex (issue #11845); we never put
-                // raw base64 image data in the result text. See
-                // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
-                const parts = [];
-                if (Array.isArray(callResult.content)) {
-                    for (const item of callResult.content) {
-                        if (typeof item === "string") {
-                            parts.push(item);
-                            continue;
-                        }
-                        if (typeof item !== "object" || item === null)
-                            continue;
-                        if ("text" in item) {
-                            parts.push(String(item.text));
-                            continue;
-                        }
-                        if (item.type === "image") {
-                            const block = item;
-                            if (typeof block.data === "string" && block.data.length > 0) {
-                                const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
-                                parts.push(note);
+        try {
+            const result = await client.listTools();
+            for (const tool of result.tools) {
+                const registered = buildRegisteredTool(serverName, tool);
+                // Register with an executor that calls the MCP server
+                this.toolRegistry.registerTool(registered, async (args, ctx) => {
+                    const callResult = await client.callTool({
+                        name: tool.name,
+                        arguments: stripInternalToolArgs(args),
+                    }, undefined, ctx?.signal ? { signal: ctx.signal } : undefined);
+                    // Extract text + image content from the result. Image blobs
+                    // are spilled to ~/.code-shell/mcp_images/ so they don't bloat
+                    // the LLM message tree — same pattern as the GenerateImage
+                    // tool — and the model sees a textual reference it can Read
+                    // on a later turn if it needs the pixels. This sidesteps the
+                    // "MCP returned a 5MB screenshot → token budget exploded"
+                    // failure mode that bit Codex (issue #11845); we never put
+                    // raw base64 image data in the result text. See
+                    // TODO-week.md #9c + docs/research-cc-vs-codex-image-handling.md §B.
+                    const parts = [];
+                    if (Array.isArray(callResult.content)) {
+                        for (const item of callResult.content) {
+                            if (typeof item === "string") {
+                                parts.push(item);
+                                continue;
+                            }
+                            if (typeof item !== "object" || item === null)
+                                continue;
+                            if ("text" in item) {
+                                parts.push(String(item.text));
+                                continue;
+                            }
+                            if (item.type === "image") {
+                                const block = item;
+                                if (typeof block.data === "string" && block.data.length > 0) {
+                                    const note = await spillMcpImage(serverName, tool.name, block.data, block.mimeType ?? "image/png");
+                                    parts.push(note);
+                                }
                             }
                         }
                     }
-                }
-                const body = parts.join("\n") || "(no output)";
-                // Trust boundary: MCP output is external content. Wrap it so the
-                // model sees an explicit reminder that the body comes from an
-                // untrusted server and any instructions inside are content, not
-                // commands. The marker is intentionally short so it doesn't bloat
-                // every tool result, but distinct enough that prompt-injected
-                // strings can't fake their way out.
-                return wrapMcpOutput(serverName, tool.name, body);
-            });
-            const set = this.registeredToolsByServer.get(serverName) ?? new Set();
-            set.add(registered.name);
-            this.registeredToolsByServer.set(serverName, set);
-            logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+                    const body = parts.join("\n") || "(no output)";
+                    // Trust boundary: MCP output is external content. Wrap it so the
+                    // model sees an explicit reminder that the body comes from an
+                    // untrusted server and any instructions inside are content, not
+                    // commands. The marker is intentionally short so it doesn't bloat
+                    // every tool result, but distinct enough that prompt-injected
+                    // strings can't fake their way out.
+                    return wrapMcpOutput(serverName, tool.name, body);
+                });
+                const set = this.registeredToolsByServer.get(serverName) ?? new Set();
+                set.add(registered.name);
+                this.registeredToolsByServer.set(serverName, set);
+                logger.info("mcp.tool_registered", { server: serverName, tool: registered.name });
+            }
+        }
+        catch (err) {
+            await this.disconnect(serverName);
+            throw err;
         }
     }
     /**
@@ -489,6 +601,8 @@ export class MCPManager {
      */
     async disconnectAll() {
         await Promise.all([...this.connections.keys()].map((name) => this.disconnect(name)));
+        this.desiredByOwner.clear();
+        this.desiredServerNames = null;
     }
     async disconnect(name) {
         const conn = this.connections.get(name);
@@ -562,6 +676,7 @@ export class MCPManager {
                         uri: r.uri,
                         name: r.name ?? r.uri,
                         description: r.description,
+                        serverName: name,
                     });
                 }
             }

package/dist/tool-system/path-policy.d.ts

@@ -52,6 +52,8 @@ export interface ClassifyOptions {
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
+export declare function openSessionPathApprovals(sessionId: string): void;
+export declare function clearSessionPathApprovals(sessionId: string): void;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -105,6 +105,10 @@ function expandTilde(p) {
 }
 /** sessionId → set of approved directory grants (prefix + operation). */
 const sessionPathGrants = new Map();
+/** Session ids explicitly closed by ChatSessionManager; late approvals must not recreate grants. */
+const closedPathApprovalSessions = new Set();
+/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
+const askChains = new Map();
 /** True if a grant for `grantOp` authorizes an operation of `wantOp`. */
 function grantCoversOp(grantOp, wantOp) {
     // write ⊇ {read, write}; read ⊇ {read}.
@@ -198,6 +202,8 @@ function storedOp(g) {
 function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
     if (scope === "once")
         return;
+    if (sessionId && closedPathApprovalSessions.has(sessionId))
+        return;
     const prefix = dirPrefix(dirname(resolved));
     if (scope === "session") {
         if (!sessionId)
@@ -271,6 +277,16 @@ function recordPathApproval(scope, resolved, operation, cwd, sessionId) {
 /** Test seam: clear the in-memory session grants. */
 export function _resetSessionPathGrants() {
     sessionPathGrants.clear();
+    closedPathApprovalSessions.clear();
+    askChains.clear();
+}
+export function openSessionPathApprovals(sessionId) {
+    closedPathApprovalSessions.delete(sessionId);
+}
+export function clearSessionPathApprovals(sessionId) {
+    sessionPathGrants.delete(sessionId);
+    closedPathApprovalSessions.add(sessionId);
+    askChains.delete(sessionId);
 }
 /**
  * Best-effort resolution. realpath fails when the path doesn't exist yet —
@@ -356,6 +372,12 @@ function isSafeCodeShellDiagnosticRead(resolved) {
     }
     return false;
 }
+function isNoRepoAttachmentRead(resolved, operation) {
+    if (operation !== "read")
+        return false;
+    const root = join(homedir(), ".code-shell", "no-repo", ".code-shell", "attachments");
+    return isInsideDir(resolved, root);
+}
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *
@@ -396,6 +418,13 @@ export function classifyPath(rawPath, opts) {
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {
+        if (isNoRepoAttachmentRead(resolved, opts.operation)) {
+            return {
+                decision: "allow",
+                reason: "no-repo attachment read",
+                resolvedPath: resolved,
+            };
+        }
         if (opts.operation === "read" && isSafeCodeShellDiagnosticRead(resolved)) {
             return {
                 decision: "allow",
@@ -461,8 +490,8 @@ export function enforcePathPolicy(filePath, operation, workspaceRoot) {
     }
     // ask — MVP refuses with explanatory message until askUser plumbing
     // lands. The conservative bias matches the plan's leaning answer for Q1.
-    return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`;
+    return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+        `Set CODESHELL_PATH_POLICY=off to disable enforcement during a rollback.`);
 }
 export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (ctx?.cwd === undefined)
@@ -481,8 +510,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
         return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}`;
     }
     if (operation === "write" && ctx.planMode) {
-        return `Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `Plan mode does not allow file writes.`;
+        return (`Error: blocked by path policy — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `Plan mode does not allow file writes.`);
     }
     // Already approved this directory for this OPERATION (this session or
     // persisted for the project)? Proceed without re-prompting — this is the fix
@@ -491,8 +520,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
         return null;
     if (!ctx.askUser) {
-        return `Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
-            `No interactive approval UI is available in this run.`;
+        return (`Error: path requires approval — ${c.reason}. Path: ${c.resolvedPath}. ` +
+            `No interactive approval UI is available in this run.`);
     }
     // Serialize concurrent asks (per session) and RE-CHECK grants when our turn
     // comes. Parallel tools hitting the same not-yet-approved directory all pass
@@ -502,7 +531,8 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     const chainKey = ctx.sessionId ?? "__global__";
     const prevTurn = askChains.get(chainKey) ?? Promise.resolve();
     let release;
-    askChains.set(chainKey, new Promise((r) => (release = r)));
+    const currentTurn = new Promise((r) => (release = r));
+    askChains.set(chainKey, currentTurn);
     try {
         await prevTurn;
         if (isPathPreApproved(c.resolvedPath, operation, ctx.cwd, ctx.sessionId))
@@ -511,6 +541,9 @@ export async function enforcePathPolicyWithApproval(filePath, operation, ctx) {
     }
     finally {
         release();
+        if (askChains.get(chainKey) === currentTurn) {
+            askChains.delete(chainKey);
+        }
     }
 }
 /** The actual interactive ask — split out so the serialized section reads flat.
@@ -521,9 +554,7 @@ async function promptForPathApproval(c, operation, ctx) {
     // "工作区外路径" header was misleading for sensitive-path asks.
     const isSensitive = c.reason.startsWith("sensitive");
     const what = operation === "read" ? "读取" : "写入";
-    const title = isSensitive
-        ? `工具想${what}敏感文件`
-        : `工具想${what}工作区外路径`;
+    const title = isSensitive ? `工具想${what}敏感文件` : `工具想${what}工作区外路径`;
     const header = isSensitive ? "敏感文件权限" : "路径权限";
     // Scope options carry remembered grants for the directory of this path, so
     // the same folder isn't re-prompted. Labels are matched by exact string
@@ -566,8 +597,6 @@ async function promptForPathApproval(c, operation, ctx) {
     }
     return `Error: path approval denied by user — ${c.reason}. Path: ${c.resolvedPath}`;
 }
-/** Per-session prompt chains for enforcePathPolicyWithApproval (see comment there). */
-const askChains = new Map();
 /**
  * Internal: reset the "disabled warning" latch. Tests flip the env var
  * between cases and need each one to be able to re-trigger the warning.

package/dist/tool-system/permission.d.ts

@@ -21,6 +21,17 @@ export declare class AutoApprovalBackend implements ApprovalBackend {
     requestApproval(req: ApprovalRequest): Promise<ApprovalResult>;
     private isSafeOperation;
 }
+/**
+ * Closed-session tombstones are a bounded replay guard. A prompt that started
+ * before close is still protected by the state-object identity check in
+ * isActiveSessionState(): clearSession deletes the captured state, so the late
+ * result cannot write into a new bucket even if an old tombstone has aged out.
+ * The tombstone only blocks fresh post-close calls carrying a recently closed
+ * sessionId from creating an empty bucket. 4096 is 256x the default
+ * ChatSessionManager.maxSessions (16), which covers normal late-result bursts
+ * while keeping long-lived processes from retaining every historical id.
+ */
+export declare const CLOSED_SESSION_TOMBSTONE_LIMIT = 4096;
 /**
  * Interactive approval backend — prompts the user via a callback.
  *
@@ -34,13 +45,11 @@ export declare class AutoApprovalBackend implements ApprovalBackend {
  * the next time the user opens the project.
  */
 export declare class InteractiveApprovalBackend implements ApprovalBackend {
-    private sessionAllowRules;
-    private sessionDenyRules;
+    private sessionStateById;
+    private closedSessionIds;
     private promptFn;
-    private cwd;
-    private savedProjectRules;
-    private onProjectRules;
-    private promptTurn;
+    private legacyPromptTurn;
+    private legacyContext;
     setPromptFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
     /**
      * Has someone installed a real prompt callback? Engine consults this
@@ -59,8 +68,18 @@ export declare class InteractiveApprovalBackend implements ApprovalBackend {
      * earlier approvals.
      */
     setOnProjectRules(fn: (rules: PermissionRule[]) => void): void;
+    setSessionContext(sessionId: string, context: {
+        cwd: string;
+        onProjectRules: (rules: PermissionRule[]) => void;
+    }): void;
+    openSession(sessionId: string): void;
+    clearSession(sessionId: string): void;
+    private rememberClosedSession;
+    private makeSessionState;
+    private getSessionState;
+    private isActiveSessionState;
     requestApproval(req: ApprovalRequest): Promise<ApprovalResult>;
-    /** Session-rule lookup — operation-scoped (see sessionAllowRules doc). Deny
+    /** Session-rule lookup — operation-scoped (see sessionStateById doc). Deny
      *  wins over allow if both somehow match (conservative). Null = no rule. */
     private checkSessionRules;
     /** The actual interactive ask + rule recording (runs inside the prompt turn). */
@@ -89,6 +108,8 @@ export declare function pathRuleArgsPattern(absPath: string, scope: "file" | "di
  */
 export declare function ruleMatches(rule: PermissionRule, toolName: string, args: Record<string, unknown>): boolean;
 export declare function getInteractiveApprovalBackend(): InteractiveApprovalBackend;
+export declare function openInteractiveApprovalSession(sessionId: string): void;
+export declare function clearInteractiveApprovalSession(sessionId: string): void;
 export declare function setInteractiveApprovalFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
 type BashSafetyLevel = "safe-read" | "safe-write" | "unsafe" | "dangerous";
 /**