@cjhyy/code-shell-core 0.6.0-rc.9 → 0.7.0

package/dist/engine/run-image-input.js

@@ -0,0 +1,195 @@
+import { existsSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { capabilitiesFor } from "../llm/capabilities/index.js";
+import { logger } from "../logging/logger.js";
+import { tryCompressImages } from "./image-compression.js";
+import { byteLengthFromBase64, collectAttachedImagePaths, dropOversizedImages, enforceImagePolicy, } from "./image-policy.js";
+import { buildInputAttachmentContext } from "./input-attachments.js";
+import { parseTaskWithImages } from "./parse-task.js";
+export async function prepareRunImageInput(args) {
+    const { task, cwd, llm, sessionId } = args;
+    // Parse `<codeshell-image>` blocks out of the raw task string before
+    // any other gate looks at it. Two concerns:
+    //   1. The noise detector sees raw base64 as gibberish and would reject the
+    //      whole turn — split images out first so it only inspects prose.
+    //   2. Models that don't accept vision must be refused immediately, with the
+    //      image bytes intact for the user to retry on another model.
+    let parsedTask;
+    try {
+        parsedTask = parseTaskWithImages(task);
+    }
+    catch (err) {
+        const msg = err.message;
+        logger.warn("engine.run.image_parse_failed", { error: msg });
+        return {
+            ok: false,
+            result: {
+                text: `ERROR: image attachment is malformed (${msg}). Drop the image and try again, or re-attach it.`,
+                reason: "image_error",
+                sessionId: sessionId ?? "image-parse-failed",
+                turnCount: 0,
+                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+            },
+        };
+    }
+    const cap = capabilitiesFor((llm.providerKind ?? llm.provider), llm.model);
+    let attachmentContext;
+    try {
+        attachmentContext = await buildInputAttachmentContext(args.attachments, cwd, {
+            includeImageBytes: cap.supportsVision,
+            expectedSessionId: sessionId,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.error("engine.run.input_attachment_exception", {
+            stage: "build_input_attachment_context",
+            attachmentCount: args.attachments?.length ?? 0,
+            error: message,
+        });
+        return {
+            ok: false,
+            result: {
+                text: `ERROR: input attachment could not be prepared (${message}). Re-attach it or choose a path inside the workspace.`,
+                reason: "image_error",
+                sessionId: sessionId ?? "input-attachment-exception",
+                turnCount: 0,
+                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+            },
+        };
+    }
+    if (attachmentContext.errors.length > 0) {
+        const detail = attachmentContext.errors.join("; ");
+        logger.warn("engine.run.input_attachment_failed", { error: detail });
+        return {
+            ok: false,
+            result: {
+                text: `ERROR: input attachment could not be read (${detail}). Re-attach it or choose a path inside the workspace.`,
+                reason: "image_error",
+                sessionId: sessionId ?? "input-attachment-failed",
+                turnCount: 0,
+                usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+            },
+        };
+    }
+    if (attachmentContext.text || attachmentContext.hasStructuredImageAttachments) {
+        parsedTask = {
+            text: [parsedTask.text, attachmentContext.text].filter(Boolean).join("\n\n"),
+            images: [...parsedTask.images, ...attachmentContext.images],
+            hasImages: parsedTask.hasImages ||
+                attachmentContext.images.length > 0 ||
+                attachmentContext.hasStructuredImageAttachments,
+        };
+    }
+    if (parsedTask.hasImages) {
+        if (!cap.supportsVision) {
+            logger.warn("engine.run.vision_not_supported", {
+                provider: llm.provider,
+                model: llm.model,
+                imageCount: parsedTask.images.length,
+            });
+            return {
+                ok: false,
+                result: {
+                    text: `ERROR: model "${llm.model}" does not accept image input. ` +
+                        `Switch to a vision-capable model (e.g. gpt-4o, claude-sonnet, gemini-1.5-pro) and resend.`,
+                    reason: "image_error",
+                    sessionId: sessionId ?? "vision-not-supported",
+                    turnCount: 0,
+                    usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+                },
+            };
+        }
+        // Size gate. Hosts are expected to pre-compress to IMAGE_TARGETS; this is
+        // the last cheap refusal point before a provider request carries the bytes.
+        let verdict = enforceImagePolicy(parsedTask.images);
+        if (!verdict.ok && verdict.code === "image_too_large") {
+            const compressed = await tryCompressImages(parsedTask.images);
+            if (compressed.anyCompressed) {
+                parsedTask.images = compressed.images;
+                logger.info("engine.run.image_compressed", {
+                    before: verdict.offender?.bytes,
+                    after: compressed.images.reduce((s, i) => s + byteLengthFromBase64(i.base64), 0),
+                });
+                verdict = enforceImagePolicy(parsedTask.images);
+            }
+        }
+        // After compression, anything still over the per-image cap is dropped with
+        // a textual placeholder so oversized bytes do not poison conversation history.
+        if (!verdict.ok && verdict.code === "image_too_large") {
+            const drop = dropOversizedImages(parsedTask.images);
+            if (drop.droppedCount > 0) {
+                parsedTask.images = drop.kept;
+                parsedTask.hasImages = drop.kept.length > 0;
+                parsedTask.text = drop.placeholder + "\n\n" + parsedTask.text;
+                logger.warn("engine.run.image_dropped", {
+                    droppedCount: drop.droppedCount,
+                    keptCount: drop.kept.length,
+                });
+                verdict = enforceImagePolicy(parsedTask.images);
+            }
+        }
+        if (!verdict.ok) {
+            logger.warn("engine.run.image_policy_failed", {
+                code: verdict.code,
+                imageCount: verdict.totals.imageCount,
+                totalBytes: verdict.totals.totalBytes,
+                offender: verdict.offender,
+            });
+            return {
+                ok: false,
+                result: {
+                    text: `ERROR: ${verdict.message}`,
+                    reason: "image_error",
+                    sessionId: sessionId ?? `image-policy-${verdict.code}`,
+                    turnCount: 0,
+                    usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+                },
+            };
+        }
+    }
+    // For downstream noise-detection + transcript persistence we want the text
+    // portion only. Image bytes ride in parsedTask.images and re-enter the message
+    // tree below.
+    const taskText = parsedTask.text;
+    return { ok: true, parsedTask, taskText };
+}
+export function buildRunUserMessageContent(parsedTask, cwd, taskText) {
+    // Compose the user-turn payload once so resume + cold paths agree on shape.
+    // When an attached image came from a workspace file, surface that path to the
+    // model as text so file-oriented tools can use the real on-disk path.
+    const attachedPaths = collectAttachedImagePaths(parsedTask.images, (name) => (isAbsolute(name) ? name : join(cwd, name)), existsSync);
+    const pathHint = attachedPaths.length > 0
+        ? `\n\n<attached-image-paths>\n${attachedPaths.join("\n")}\n</attached-image-paths>\n` +
+            `(上面附带的图片在工作区的真实路径，如需把它们作为工具输入（例如 GenerateImage 的 referenceImages、图生图参考图），直接使用这些路径。)`
+        : "";
+    const userMessageContent = parsedTask.hasImages
+        ? [
+            ...(parsedTask.text || pathHint
+                ? [{ type: "text", text: `${parsedTask.text}${pathHint}` }]
+                : []),
+            ...parsedTask.images.map((img) => ({
+                type: "image",
+                source: {
+                    type: "base64",
+                    media_type: img.mime,
+                    data: img.base64,
+                },
+            })),
+        ]
+        : taskText;
+    logger.info("engine.run.user_message_content_built", {
+        contentShape: Array.isArray(userMessageContent) ? "content_blocks" : "text",
+        textBlockCount: Array.isArray(userMessageContent)
+            ? userMessageContent.filter((block) => block.type === "text").length
+            : userMessageContent
+                ? 1
+                : 0,
+        imageBlockCount: Array.isArray(userMessageContent)
+            ? userMessageContent.filter((block) => block.type === "image").length
+            : 0,
+        attachedPathCount: attachedPaths.length,
+        textLength: taskText.length,
+    });
+    return userMessageContent;
+}

package/dist/engine/steer-queue.d.ts

@@ -6,13 +6,15 @@
  * it. Pure + side-effect-free so it unit-tests without the Engine/TurnLoop
  * harness (same rationale as the renderer's queuedInput.ts).
  */
+import type { InputAttachmentMeta } from "../protocol/types.js";
 export interface SteerItem {
     id: string;
     text: string;
     clientMessageId?: string;
+    attachments?: InputAttachmentMeta[];
 }
 /** Append a steer entry. Blank text is dropped (returns the list unchanged). */
-export declare function enqueueSteerItem(list: SteerItem[], id: string, text: string, clientMessageId?: string): SteerItem[];
+export declare function enqueueSteerItem(list: SteerItem[], id: string, text: string, clientMessageId?: string, attachments?: InputAttachmentMeta[]): SteerItem[];
 /**
  * Take everything currently queued and clear the list. Returns the drained
  * entries (in order) and the now-empty remainder. The turn loop calls this at

package/dist/engine/steer-queue.js

@@ -1,9 +1,17 @@
 /** Append a steer entry. Blank text is dropped (returns the list unchanged). */
-export function enqueueSteerItem(list, id, text, clientMessageId) {
+export function enqueueSteerItem(list, id, text, clientMessageId, attachments) {
     const t = text?.trim();
     if (!id || !t)
         return list;
-    return [...list, { id, text: t, ...(clientMessageId ? { clientMessageId } : {}) }];
+    return [
+        ...list,
+        {
+            id,
+            text: t,
+            ...(clientMessageId ? { clientMessageId } : {}),
+            ...(attachments && attachments.length > 0 ? { attachments: [...attachments] } : {}),
+        },
+    ];
 }
 /**
  * Take everything currently queued and clear the list. Returns the drained

package/dist/engine/streaming-tool-queue.d.ts

@@ -1,13 +1,16 @@
 /**
- * Streaming tool queue — enqueues tools for execution during streaming,
- * starts concurrency-safe tools immediately, queues unsafe tools for
- * sequential execution.
+ * Tool execution queue for a completed model response.
+ *
+ * Despite the historical name, TurnLoop currently enqueues tool calls only
+ * after `callModelWithFallback()` returns a complete LLMResponse. The queue's
+ * job is concurrency policy inside that post-response batch: start
+ * concurrency-safe tools as soon as they are enqueued, keep unsafe tools
+ * sequential, and return results in original tool-call order.
  *
  * Usage:
  *   const queue = new StreamingToolQueue(executor);
- *   // During streaming, as tool_use blocks arrive:
+ *   // After the full LLMResponse is available:
  *   queue.enqueue(toolCall);
- *   // After streaming completes:
  *   const results = await queue.drain();
  */
 import type { ToolCall, ToolResult } from "../types.js";
@@ -21,8 +24,9 @@ export declare class StreamingToolQueue {
     private draining;
     constructor(executor: ToolExecutor);
     /**
-     * Enqueue a tool for execution. Concurrency-safe tools start immediately;
-     * unsafe tools are queued for sequential execution during drain().
+     * Enqueue a tool from the completed response. Concurrency-safe tools start
+     * immediately within this post-response phase; unsafe tools are queued for
+     * sequential execution during drain().
      */
     enqueue(call: ToolCall): void;
     /**

package/dist/engine/streaming-tool-queue.js

@@ -1,13 +1,16 @@
 /**
- * Streaming tool queue — enqueues tools for execution during streaming,
- * starts concurrency-safe tools immediately, queues unsafe tools for
- * sequential execution.
+ * Tool execution queue for a completed model response.
+ *
+ * Despite the historical name, TurnLoop currently enqueues tool calls only
+ * after `callModelWithFallback()` returns a complete LLMResponse. The queue's
+ * job is concurrency policy inside that post-response batch: start
+ * concurrency-safe tools as soon as they are enqueued, keep unsafe tools
+ * sequential, and return results in original tool-call order.
  *
  * Usage:
  *   const queue = new StreamingToolQueue(executor);
- *   // During streaming, as tool_use blocks arrive:
+ *   // After the full LLMResponse is available:
  *   queue.enqueue(toolCall);
- *   // After streaming completes:
  *   const results = await queue.drain();
  */
 export class StreamingToolQueue {
@@ -21,8 +24,9 @@ export class StreamingToolQueue {
         this.executor = executor;
     }
     /**
-     * Enqueue a tool for execution. Concurrency-safe tools start immediately;
-     * unsafe tools are queued for sequential execution during drain().
+     * Enqueue a tool from the completed response. Concurrency-safe tools start
+     * immediately within this post-response phase; unsafe tools are queued for
+     * sequential execution during drain().
      */
     enqueue(call) {
         this.callOrder.push(call.id);

package/dist/engine/turn-loop.d.ts

@@ -4,15 +4,16 @@
  * Following Claude Code's po_() pattern:
  * pre_check → model_call → post_check → tool_exec → context_mgmt → hook_notify → next turn
  */
-import type { Message, StreamCallback, TerminalReason, ContentBlock, ToolResult, TokenUsage } from "../types.js";
+import type { Message, StreamCallback, TerminalReason, ContentBlock, ToolResult, TokenUsage, ContextUsageAnchor } from "../types.js";
 import type { SteerItem } from "./steer-queue.js";
 import { ModelFacade } from "./model-facade.js";
 import { ToolExecutor } from "../tool-system/executor.js";
 import { ContextManager } from "../context/manager.js";
 import { HookRegistry } from "../hooks/registry.js";
+import { type GoalJudgeRuntimeContext } from "../hooks/goal-stop-hook.js";
 import { Transcript } from "../session/transcript.js";
 import { type CumulativeUsageCounters } from "./session-usage.js";
-import { type GoalConfig, type GoalExtension } from "./goal.js";
+import { type GoalConfig, type GoalExtension, type GoalTerminationReason } from "./goal.js";
 export interface TurnLoopConfig {
     maxTurns: number;
     maxToolCallsPerTurn: number;
@@ -25,6 +26,11 @@ export interface TurnLoopConfig {
      * response, then downgrades them to placeholders in the working history.
      */
     freshImageMessages?: Iterable<Message>;
+    /**
+     * Per-run injected context that must be visible to the model but must not be
+     * summarized into durable history. Engine uses this for dynamicContext.
+     */
+    volatileContextMessages?: Iterable<Message>;
     /**
      * Fired after each turn boundary is recorded. Lets the engine flush an
      * up-to-date snapshot to state.json mid-run, so a long run doesn't leave
@@ -88,6 +94,13 @@ export interface TurnLoopDeps {
      * Returns the updated counters so usage_update can carry both metric scopes.
      */
     recordCumulativeUsage?: (usage: TokenUsage) => CumulativeUsageCounters;
+    /**
+     * Lightweight per-session prompt-cache diagnostic, owned by Engine because it
+     * needs memory across TurnLoop instances.
+     */
+    recordCacheReadDiagnostics?: (usage: TokenUsage) => void;
+    /** Persist the latest context-estimation anchor derived from provider usage. */
+    recordContextUsageAnchor?: (anchor: ContextUsageAnchor) => void;
     /**
      * Reads/clears any user messages queued for THIS session via the steering
      * channel (Engine.enqueueSteer) while a run is in flight. Consumed at the top
@@ -97,12 +110,20 @@ export interface TurnLoopDeps {
      * tests (turn loop tolerates undefined).
      */
     consumeSteer?: (source?: "normal_step" | "finalize_backfill") => SteerItem[];
+    /** Restore steer items whose model-facing content could not be prepared. */
+    restoreSteer?: (items: SteerItem[]) => void;
+    /** Build model-facing content for a queued steer item, including attachments. */
+    buildSteerUserMessageContent?: (item: SteerItem) => string | ContentBlock[] | Promise<string | ContentBlock[]>;
     /**
      * Execution-level idempotency guard for host-supplied user/steer intents.
      * Returns false only when a present clientMessageId has already entered this
      * run or the persisted transcript. Messages without an id bypass this guard.
      */
     claimClientMessageId?: (clientMessageId: string, source: "steer") => boolean;
+    /** Release a steer id reservation when preparation fails before persistence. */
+    releaseClientMessageId?: (clientMessageId: string) => void;
+    /** Make tools launched after an injected steer attribute side effects to that steer. */
+    setOriginClientMessageId?: (clientMessageId: string | undefined) => void;
     /**
      * Clear this session's PERSISTED goal (state.activeGoal) and drop the
      * in-flight goal-stop hook, so a user-initiated cancel_goal both stops the
@@ -112,11 +133,18 @@ export interface TurnLoopDeps {
      * goalTracker short-circuit still stops the run).
      */
     clearPersistedGoal?: () => void;
+    /**
+     * Private Goal-judge evidence seam. Engine stores this snapshot in the
+     * built-in judge closure; it is never added to the public on_stop context.
+     */
+    updateGoalJudgeContext?: (context: GoalJudgeRuntimeContext) => void;
 }
 export interface TurnLoopResult {
     text: string;
     reason: TerminalReason;
     messages: Message[];
+    /** Goal-specific forced terminal outcome; public TerminalReason stays stable. */
+    goalTermination?: GoalTerminationReason;
 }
 /**
  * 把一个 ToolResult 映射成发给 LLM 的 tool_result ContentBlock。
@@ -141,7 +169,9 @@ export declare class TurnLoop {
     private lastCtxEmit;
     private currentTurnUsage;
     private currentCumulativeUsage;
+    private readonly sensitiveToolResultRedactions;
     private readonly pendingImageMessages;
+    private readonly volatileContextMessages;
     /**
      * Consecutive on_stop blocks (Goal mode kept the agent going). Reset to 0
      * on any unblocked completion. When it reaches config.maxStopBlocks the
@@ -200,7 +230,11 @@ export declare class TurnLoop {
      */
     private markStopped;
     private prepareMessagesForModel;
+    private stripVolatileContextMessages;
+    private appendVolatileContextMessages;
     private markPendingImagesConsumed;
+    private redactConsumedSensitiveToolResults;
+    private modelCallRecordingOptions;
     private trackFreshImageMessage;
     private emitHook;
     /**
@@ -217,6 +251,7 @@ export declare class TurnLoop {
      * Run the multi-turn agent loop until completion.
      */
     run(initialMessages: Message[]): Promise<TurnLoopResult>;
+    private runUnredacted;
     /**
      * Call model with streaming fallback.
      * If streaming fails, emit tombstone and retry non-streaming.