@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/credentials/use-credential-tool.js

@@ -7,22 +7,17 @@
  *     - token/link → `{ kind: "value", value }`
  *     - cookie     → 就地写临时 cookies.txt(0600),返回 `{ kind: "cookie", cookiesFile, count }`
  *
- * 取值全部 core 直读 CredentialStore(cookie 值第二期已进库),无跨进程。
+ * desktop 下通过 host credential access IPC 按需解析 secret；headless/SDK
+ * 仍可使用本地 CredentialStore。
  * 集中在 core/src/credentials/ 下,只经 ToolDefinition 注册 + ToolContext.askUser 耦合 core,
  * 满足设计稿 §1「可整块外移」约束。
  */
-import { writeFileSync, existsSync, readdirSync, statSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
-import { CredentialStore } from "./store.js";
-import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+import { SENSITIVE_TOOL_RESULT_PLACEHOLDER } from "../tool-system/tool-result-redaction.js";
 import { credentialUseGate, } from "./use-gate.js";
 import { SettingsManager } from "../settings/manager.js";
 import { logger } from "../logging/logger.js";
+import { credentialAccessScope, getCredentialAccess, materializeCookieSecret, sweepStaleCredentialCookieFiles, } from "./access.js";
 const TOOL_NAME = "UseCredential";
-const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
-const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000; // 30min 启动 sweep 上限
 const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cookie) to run a command. " +
     "Call with NO arguments first to list available credentials (id + label + type); " +
     "then call again with `id` to fetch one. Token/link credentials return their secret " +
@@ -52,7 +47,7 @@ export const useCredentialToolDef = {
  */
 export function useCredentialToolDefFor(cwd) {
     try {
-        const list = new CredentialStore(cwd).listMasked();
+        const list = getCredentialAccess().listMasked(cwd, "full");
         if (list.length === 0)
             return useCredentialToolDef;
         const names = list.map((c) => `${c.id} (${c.type})`).join(", ");
@@ -70,26 +65,7 @@ export function useCredentialToolDefFor(cwd) {
  * 不引入 lease 对象/定时器 —— 文件用完靠进程退出 + 这个轻量 sweep。
  */
 export function sweepStaleCredentialCookies(now = Date.now()) {
-    const dir = tmpdir();
-    try {
-        if (!existsSync(dir))
-            return;
-        for (const f of readdirSync(dir)) {
-            if (!f.startsWith(COOKIE_FILE_PREFIX))
-                continue;
-            const p = join(dir, f);
-            try {
-                if (now - statSync(p).mtimeMs > COOKIE_FILE_MAX_AGE_MS)
-                    rmSync(p, { force: true });
-            }
-            catch {
-                /* skip */
-            }
-        }
-    }
-    catch {
-        /* best-effort */
-    }
+    sweepStaleCredentialCookieFiles(now);
 }
 /** 内存会话 allow 集:每个 Engine 一份(从 ctx.sessionId 键)。纯内存,关进程即忘。 */
 const sessionAllowByEngine = new Map();
@@ -112,7 +88,7 @@ function sessionAllowFor(ctx) {
 // (project-only). An "isolated" engine is at least as restrictive as project,
 // so it maps to "project" — it must never read the host user's ~/.code-shell.
 function credentialScope(scope) {
-    return scope === "full" || scope === undefined ? "full" : "project";
+    return credentialAccessScope(scope);
 }
 function readAutoApprove(cwd, scope) {
     try {
@@ -128,19 +104,19 @@ function readAutoApprove(cwd, scope) {
 }
 export async function useCredentialTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
-    const store = new CredentialStore(cwd);
+    const access = getCredentialAccess();
     const scope = credentialScope(ctx?.settingsScope);
     const id = typeof args.id === "string" ? args.id.trim() : "";
     const purpose = typeof args.purpose === "string" ? args.purpose : undefined;
     // 无 id → 清单(脱敏,权威实时源)。按 engine scope 过滤:project/isolated
     // 引擎不得列出宿主 user 层凭证。
     if (!id) {
-        const credentials = store
-            .listMasked(scope)
+        const credentials = access
+            .listMasked(cwd, scope)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
         return json({ kind: "list", credentials });
     }
-    const cred = store.resolve(id, scope);
+    const cred = access.resolveMeta(cwd, id, scope);
     if (!cred) {
         return json({ kind: "error", error: `凭证不存在: "${id}"。调用本工具(无参)可列出可用凭证。` });
     }
@@ -162,14 +138,20 @@ export async function useCredentialTool(args, ctx) {
     }
     // token/link → 直接返回值
     if (cred.type === "token" || cred.type === "link") {
-        if (!cred.secret)
+        if (!cred.hasSecret || !access.resolveValue) {
+            return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
+        }
+        try {
+            const value = await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" });
+            return json({ kind: "value", value });
+        }
+        catch {
             return json({ kind: "error", error: `凭证「${cred.label}」没有可用的值。` });
-        return json({ kind: "value", value: cred.secret });
+        }
     }
     // cookie → 就地写临时 cookies.txt
     if (cred.type === "cookie") {
-        const jar = parseCookieJar(cred.secret);
-        if (jar.length === 0) {
+        if (!cred.hasSecret) {
             return json({
                 kind: "error",
                 error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
@@ -180,26 +162,57 @@ export async function useCredentialTool(args, ctx) {
         // same process — the second write would clobber the first and a caller could
         // read another account's cookies. A random component makes each file distinct.
         // Prefix is unchanged so the 30-min startup sweep still matches & cleans them.
-        const file = join(tmpdir(), `${COOKIE_FILE_PREFIX}${safe(cred.id)}-${process.pid}-${randomUUID()}.txt`);
         try {
-            writeFileSync(file, formatNetscapeCookies(jar), { mode: 0o600 });
+            const materialized = access.materializeCookie
+                ? await access.materializeCookie({ cwd, id: cred.id, scope })
+                : materializeCookieSecret(cred.id, await access.resolveValue({ cwd, id: cred.id, scope, purpose: "use" }));
+            return json({
+                kind: "cookie",
+                cookiesFile: materialized.cookiesFile,
+                count: materialized.count,
+            });
         }
         catch (e) {
+            if (String(e).includes("cookie jar is empty or invalid")) {
+                return json({
+                    kind: "error",
+                    error: `凭证「${cred.label}」的 cookie 为空或已失效,请在凭证页对该账号点「重拓」(重新登录后重新拓取)。`,
+                });
+            }
             logger.warn(`UseCredential: failed to write cookies.txt: ${String(e)}`);
             return json({ kind: "error", error: `写临时 cookie 文件失败: ${String(e)}` });
         }
-        return json({ kind: "cookie", cookiesFile: file, count: jar.length });
     }
     return json({ kind: "error", error: `未知凭证类型: ${cred.type}` });
 }
-/** 文件名安全化(凭证 id 用了 `__`,这里只挡路径分隔符/控制字符)。 */
-function safe(s) {
-    return s.replace(/[^a-zA-Z0-9_.-]/g, "_");
+export async function useCredentialBuiltinTool(args, ctx) {
+    const result = await useCredentialTool(args, ctx);
+    if (!isValueResult(result))
+        return result;
+    const redacted = json({ kind: "value", value: SENSITIVE_TOOL_RESULT_PLACEHOLDER });
+    return {
+        result,
+        sensitive: true,
+        displayResult: redacted,
+        transcriptResult: redacted,
+    };
 }
 function json(r) {
     return JSON.stringify(r);
 }
+function isValueResult(result) {
+    try {
+        const parsed = JSON.parse(result);
+        return parsed.kind === "value" && typeof parsed.value === "string";
+    }
+    catch {
+        return false;
+    }
+}
 /** 测试钩子:清空会话 allow 集(避免跨用例污染)。 */
 export function __resetCredentialSessionAllowForTests() {
     sessionAllowByEngine.clear();
 }
+export function clearCredentialSessionAllow(sessionId) {
+    sessionAllowByEngine.delete(sessionId);
+}

package/dist/engine/engine.d.ts

@@ -12,9 +12,11 @@ import type { AskUserFn } from "../tool-system/builtin/ask-user.js";
 import type { CapabilityOverride } from "../settings/schema.js";
 import { type FeatureFlagName } from "../settings/feature-flags.js";
 import type { ToolContext } from "../tool-system/context.js";
+import { type SandboxBackend } from "../tool-system/sandbox/index.js";
 import { ModelPool, type ModelEntry } from "../llm/model-pool.js";
 import { AgentDefinitionRegistry } from "../agent/agent-definition-registry.js";
 import { EngineRuntime } from "./runtime.js";
+import type { InputAttachmentMeta } from "../protocol/types.js";
 /**
  * Build ScanOptions.compatFileNames from the user's instruction compat toggles.
  * Primary file name stays hard-wired to CODESHELL.md (not exposed). Turning a
@@ -53,7 +55,7 @@ export declare function resolveChildLlm(modelKey: string | undefined, pool: Mode
  * Names in `disabledAgents` are filtered out so the LLM never sees them.
  */
 /**
- * Resolve the working directory for a run. Precedence:
+ * Resolve the working directory for a run. Precedence for legacy sessions:
  *   options.cwd  >  resumed session's state.cwd  >  config.cwd  >  process.cwd()
  *
  * The session-cwd tier is what stops a project-bound session from being
@@ -152,6 +154,7 @@ export declare class Engine {
      * LLM response arrives.
      */
     private ctxOverheadBySid;
+    private lastCacheReadBySid;
     /**
      * Step-gap steering queue (per sessionId, in-memory). Host pushes user
      * messages here via enqueueSteer while a run is in flight; the turn loop
@@ -261,6 +264,8 @@ export declare class Engine {
      * clear "no browser panel" error.
      */
     setBrowserBridge(bridge: import("../tool-system/browser-bridge.js").BrowserBridge | undefined): void;
+    /** Inject the host-backed workspace bridge after construction. */
+    setWorkspaceBridge(bridge: import("../tool-system/workspace-bridge.js").WorkspaceBridge | undefined): void;
     /**
      * Queue a user message to be spliced into the in-flight run for `sessionId`
      * at the next turn-loop step boundary — the 不打断 steering path (vs cancel +
@@ -274,7 +279,7 @@ export declare class Engine {
      * the queued draft) and is the handle `unsteer` uses to revoke a still-pending
      * entry. A blank id is tolerated but means the entry can't be revoked.
      */
-    enqueueSteer(sessionId: string, text: string, id?: string, clientMessageId?: string): EnqueueSteerResult;
+    enqueueSteer(sessionId: string, text: string, id?: string, clientMessageId?: string, attachments?: InputAttachmentMeta[]): EnqueueSteerResult;
     /**
      * Revoke a still-pending steer entry (the 撤回 path). Returns true if it was
      * removed, false if it was already consumed by the turn loop (can't take it
@@ -283,6 +288,8 @@ export declare class Engine {
     unsteer(sessionId: string, id: string): boolean;
     /** Drain + clear the steer queue for a session (turn loop consumes per step). */
     private consumeSteer;
+    /** Put failed steer preparation back ahead of messages queued while it was being prepared. */
+    private restoreSteer;
     /** Wire the cookie→browser injection callback (InjectCredential tool). Same
      *  post-construction injection model as setBrowserBridge. */
     setInjectCredential(fn: import("../tool-system/context.js").InjectCredentialFn | undefined): void;
@@ -325,6 +332,8 @@ export declare class Engine {
         injected?: boolean;
         /** Stable id for this user-intent, used to make duplicate submits idempotent. */
         clientMessageId?: string;
+        /** Structured input attachments. Legacy `<codeshell-image>` blocks remain supported. */
+        attachments?: InputAttachmentMeta[];
     }): Promise<EngineResult>;
     /**
      * Run the end-of-session memory pipeline as a fire-and-forget background
@@ -460,6 +469,12 @@ export declare class Engine {
      * session with no active goal is a no-op returning false.
      */
     clearGoal(sessionId: string): boolean;
+    /**
+     * Reset a session's workspace pointer back to its main root. If the session is
+     * actively running, mutate that live SessionBundle first so the run's next
+     * saveState cannot resurrect a stale worktree pointer.
+     */
+    releaseSessionWorkspace(sessionId: string): import("../types.js").SessionWorkspace | null;
     injectContext(sessionId: string, content: string): void;
     /**
      * Force context compaction on a session.
@@ -470,7 +485,8 @@ export declare class Engine {
         after: number;
         strategy: "none (no active session)" | "no compaction needed" | "compacted" | CompactStrategy;
     }>;
-    private stripUserContextMessage;
+    private stripInjectedContextMessages;
+    private recordCacheReadDiagnostics;
     private getSettingsManager;
     /**
      * Update a config setting at runtime.
@@ -570,6 +586,7 @@ export declare class Engine {
      * by tests that want a ToolContext without a full run() cycle.
      */
     private resolveSandboxWithoutRuntime;
+    private resolveSandboxConfigForCwd;
     /**
      * Build the shell env layered onto the Bash tool / background shells (see
      * mergeShellEnv). Three user-configured sources, merged lowest → highest:
@@ -622,6 +639,9 @@ export declare class Engine {
         linux?: string;
         windows?: string;
     } | undefined;
+    readWorktreeBranchPrefix(cwd?: string): string | undefined;
+    resolveWorktreeSetupSandbox(cwd: string): Promise<SandboxBackend | undefined>;
+    readWorktreeSetupShellEnv(cwd?: string): Record<string, string> | undefined;
     buildToolContext(): ToolContext;
     /**
      * Read settings.disabledSkills + settings.disabledPlugins in a single