@cjhyy/code-shell-core 0.7.0-beta.1 → 0.7.0

package/dist/cc-orchestrator/session-history.js

@@ -19,23 +19,28 @@ function toolsOf(content) {
             const inp = p.input ?? {};
             const summary = inp.command ?? inp.file_path ?? inp.path ?? inp.url ?? inp.pattern ?? inp.query ?? "";
             const args = inp && typeof inp === "object" && Object.keys(inp).length > 0 ? inp : undefined;
-            out.push({ name: typeof p.name === "string" ? p.name : "tool", summary: String(summary).slice(0, 120), args });
+            out.push({
+                name: typeof p.name === "string" ? p.name : "tool",
+                summary: String(summary).slice(0, 120),
+                args,
+            });
         }
     }
     return out;
 }
-/** Read the last `limit` user/assistant messages from a claude session jsonl. */
-export function readRecentHistory(cwd, sessionId, limit, claudeHome = join(homedir(), ".claude")) {
-    const file = join(claudeHome, "projects", encodeCwd(cwd), `${sessionId}.jsonl`);
-    if (!existsSync(file))
-        return { messages: [], hasMore: false, totalCount: 0 };
-    let raw;
-    try {
-        raw = readFileSync(file, "utf-8");
-    }
-    catch {
-        return { messages: [], hasMore: false, totalCount: 0 };
-    }
+function toolResultText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => typeof part === "string" ? part : typeof part?.text === "string" ? part.text : "")
+        .join("");
+}
+/** Parse a bounded/raw Claude Code transcript snapshot. Exported so a live
+ * follower can take its initial snapshot and EOF cursor from the same read,
+ * eliminating the snapshot→subscribe race. */
+export function parseRecentHistory(raw, limit) {
     const all = [];
     for (const line of raw.split("\n")) {
         if (!line.trim())
@@ -65,3 +70,81 @@ export function readRecentHistory(cwd, sessionId, limit, claudeHome = join(homed
     const start = Math.max(0, all.length - lim);
     return { messages: all.slice(start), hasMore: start > 0, totalCount: all.length };
 }
+/** Parse one newly-appended Claude Code transcript JSONL line into the compact
+ * event vocabulary consumed by the desktop room follower. */
+export function parseClaudeTranscriptLine(line) {
+    let d;
+    try {
+        d = JSON.parse(line);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    if (d.type === "user") {
+        const content = d.message?.content;
+        if (Array.isArray(content)) {
+            for (const part of content) {
+                if (part?.type !== "tool_result")
+                    continue;
+                out.push({
+                    type: "tool_result",
+                    id: typeof part.tool_use_id === "string" ? part.tool_use_id : undefined,
+                    result: toolResultText(part.content).slice(0, 4000),
+                    isError: Boolean(part.is_error),
+                });
+            }
+        }
+        const text = textOf(content).trim();
+        if (text && !NOISE.some((noise) => text.startsWith(noise))) {
+            out.unshift({ type: "user", text });
+        }
+        return out;
+    }
+    if (d.type === "assistant" && Array.isArray(d.message?.content)) {
+        for (const part of d.message.content) {
+            if (part?.type === "text" && typeof part.text === "string" && part.text) {
+                out.push({ type: "assistant", text: part.text });
+            }
+            else if (part?.type === "tool_use") {
+                const input = part.input && typeof part.input === "object"
+                    ? part.input
+                    : undefined;
+                out.push({
+                    type: "tool",
+                    id: typeof part.id === "string" ? part.id : undefined,
+                    name: typeof part.name === "string" ? part.name : "tool",
+                    summary: toolsOf([part])[0]?.summary ?? "",
+                    args: input,
+                });
+            }
+        }
+        if (d.message.stop_reason === "end_turn") {
+            out.push({ type: "turn_end", reason: "completed" });
+        }
+        return out;
+    }
+    if (d.type === "result") {
+        return [
+            {
+                type: "turn_end",
+                reason: typeof d.subtype === "string" ? d.subtype : "completed",
+            },
+        ];
+    }
+    return [];
+}
+/** Read the last `limit` user/assistant messages from a claude session jsonl. */
+export function readRecentHistory(cwd, sessionId, limit, claudeHome = join(homedir(), ".claude")) {
+    const file = join(claudeHome, "projects", encodeCwd(cwd), `${sessionId}.jsonl`);
+    if (!existsSync(file))
+        return { messages: [], hasMore: false, totalCount: 0 };
+    let raw;
+    try {
+        raw = readFileSync(file, "utf-8");
+    }
+    catch {
+        return { messages: [], hasMore: false, totalCount: 0 };
+    }
+    return parseRecentHistory(raw, limit);
+}

package/dist/credentials/access.d.ts

@@ -12,6 +12,7 @@ export interface CredentialMetadata {
     meta?: Credential["meta"];
     hasSecret: boolean;
     secretHint?: string;
+    oauthStatus?: import("./types.js").OAuthCredentialPublicStatus;
 }
 export interface CredentialAccess {
     listMasked(cwd: string | undefined, scope: CredentialAccessScope): CredentialMetadata[];

package/dist/credentials/access.js

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { CredentialStore } from "./store.js";
 import { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
+import { summarizeOAuthCredentialSecret } from "./oauth.js";
 const COOKIE_FILE_PREFIX = "codeshell-cred-cookie-";
 const COOKIE_FILE_MAX_AGE_MS = 30 * 60 * 1000;
 let defaultCredentialAccess = null;
@@ -107,6 +108,7 @@ function toMetadata(cred) {
         ...rest,
         hasSecret: available,
         secretHint: available ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
+        ...(cred.type === "oauth" ? { oauthStatus: summarizeOAuthCredentialSecret(secret) } : {}),
     };
 }
 function cloneMetadata(list) {

package/dist/credentials/index.d.ts

@@ -2,7 +2,8 @@ export { CredentialStore } from "./store.js";
 export type { CredentialScope, MaskedCredential } from "./store.js";
 export { type EncryptionCipher, PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
 export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, type CredentialAccess, type CredentialAccessScope, type CredentialMetadata, type CredentialSnapshot, type CredentialSnapshotEntry, } from "./access.js";
-export type { Credential, CredentialType, CredentialStoreFile } from "./types.js";
+export type { Credential, CredentialType, CredentialStoreFile, OAuthCredentialPublicStatus, OAuthCredentialSecret, } from "./types.js";
+export { buildOAuthRefreshRequest, isOAuthAccessTokenExpired, oauthCredentialStatus, parseOAuthCredentialSecret, summarizeOAuthCredentialSecret, type OAuthClockOptions, type OAuthRefreshHandler, type OAuthRefreshRequest, } from "./oauth.js";
 export { formatNetscapeCookies, parseCookieJar, type CookieLike } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
 export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/index.js

@@ -1,6 +1,7 @@
 export { CredentialStore } from "./store.js";
 export { PlaintextCipher, setDefaultCredentialCipher, getDefaultCredentialCipher, } from "./cipher.js";
 export { getCredentialAccess, setDefaultCredentialAccess, createIpcCredentialAccess, localCredentialAccess, credentialAccessScope, isCredentialSecretAvailable, materializeCookieSecret, } from "./access.js";
+export { buildOAuthRefreshRequest, isOAuthAccessTokenExpired, oauthCredentialStatus, parseOAuthCredentialSecret, summarizeOAuthCredentialSecret, } from "./oauth.js";
 export { formatNetscapeCookies, parseCookieJar } from "./cookie-jar.js";
 export { useCredentialToolDef, useCredentialToolDefFor, useCredentialTool, sweepStaleCredentialCookies, } from "./use-credential-tool.js";
 export { credentialUseGate } from "./use-gate.js";

package/dist/credentials/oauth.d.ts

@@ -0,0 +1,20 @@
+import type { OAuthCredentialPublicStatus, OAuthCredentialSecret } from "./types.js";
+export interface OAuthClockOptions {
+    now?: number | (() => number);
+    skewMs?: number;
+}
+export interface OAuthRefreshRequest {
+    credentialId: string;
+    tokenEndpoint: string;
+    refreshToken: string;
+    clientId?: string;
+    clientSecret?: string;
+    scope?: string;
+    scopes?: string[];
+}
+export type OAuthRefreshHandler = (req: OAuthRefreshRequest) => Promise<OAuthCredentialSecret>;
+export declare function parseOAuthCredentialSecret(secret: string): OAuthCredentialSecret;
+export declare function isOAuthAccessTokenExpired(secret: Pick<OAuthCredentialSecret, "accessToken" | "expiresAt">, opts?: OAuthClockOptions): boolean;
+export declare function oauthCredentialStatus(secret: Pick<OAuthCredentialSecret, "accessToken" | "expiresAt">, opts?: OAuthClockOptions): Pick<OAuthCredentialPublicStatus, "state" | "expiresAt" | "expiresInMs">;
+export declare function buildOAuthRefreshRequest(credentialId: string, secret: OAuthCredentialSecret): OAuthRefreshRequest | undefined;
+export declare function summarizeOAuthCredentialSecret(secret: string | undefined, opts?: OAuthClockOptions): OAuthCredentialPublicStatus;

package/dist/credentials/oauth.js

@@ -0,0 +1,114 @@
+const DEFAULT_OAUTH_REFRESH_SKEW_MS = 60_000;
+function nowMs(opts = {}) {
+    if (typeof opts.now === "function")
+        return opts.now();
+    if (typeof opts.now === "number")
+        return opts.now;
+    return Date.now();
+}
+function optionalString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function optionalStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = value.filter((x) => typeof x === "string" && x.length > 0);
+    return out.length > 0 ? out : undefined;
+}
+function parseExpiresAt(value) {
+    if (!value)
+        return undefined;
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms)) {
+        throw new Error(`OAuth credential secret has invalid expiresAt: ${value}`);
+    }
+    return ms;
+}
+export function parseOAuthCredentialSecret(secret) {
+    let parsed;
+    try {
+        parsed = JSON.parse(secret);
+    }
+    catch {
+        throw new Error("OAuth credential secret must be a JSON object");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("OAuth credential secret must be a JSON object");
+    }
+    const raw = parsed;
+    if (raw.version !== undefined && raw.version !== 1) {
+        throw new Error("OAuth credential secret version must be 1");
+    }
+    const accessToken = optionalString(raw.accessToken);
+    if (!accessToken) {
+        throw new Error("OAuth credential secret must include accessToken");
+    }
+    const expiresAt = optionalString(raw.expiresAt);
+    parseExpiresAt(expiresAt);
+    return {
+        version: raw.version === 1 ? 1 : undefined,
+        accessToken,
+        refreshToken: optionalString(raw.refreshToken),
+        expiresAt,
+        tokenType: optionalString(raw.tokenType),
+        scope: optionalString(raw.scope),
+        scopes: optionalStringArray(raw.scopes),
+        tokenEndpoint: optionalString(raw.tokenEndpoint),
+        clientId: optionalString(raw.clientId),
+        clientSecret: optionalString(raw.clientSecret),
+    };
+}
+export function isOAuthAccessTokenExpired(secret, opts = {}) {
+    const expiresAtMs = parseExpiresAt(secret.expiresAt);
+    if (expiresAtMs === undefined)
+        return false;
+    const skewMs = opts.skewMs ?? DEFAULT_OAUTH_REFRESH_SKEW_MS;
+    return expiresAtMs <= nowMs(opts) + skewMs;
+}
+export function oauthCredentialStatus(secret, opts = {}) {
+    const expiresAtMs = parseExpiresAt(secret.expiresAt);
+    if (expiresAtMs === undefined) {
+        return { state: "valid", expiresAt: undefined, expiresInMs: undefined };
+    }
+    const expiresInMs = expiresAtMs - nowMs(opts);
+    return {
+        state: isOAuthAccessTokenExpired(secret, opts) ? "expired" : "valid",
+        expiresAt: secret.expiresAt,
+        expiresInMs,
+    };
+}
+export function buildOAuthRefreshRequest(credentialId, secret) {
+    if (!secret.refreshToken || !secret.tokenEndpoint)
+        return undefined;
+    return {
+        credentialId,
+        tokenEndpoint: secret.tokenEndpoint,
+        refreshToken: secret.refreshToken,
+        clientId: secret.clientId,
+        clientSecret: secret.clientSecret,
+        scope: secret.scope,
+        scopes: secret.scopes,
+    };
+}
+export function summarizeOAuthCredentialSecret(secret, opts = {}) {
+    if (!secret)
+        return { state: "missing" };
+    try {
+        const parsed = parseOAuthCredentialSecret(secret);
+        const status = oauthCredentialStatus(parsed, opts);
+        return {
+            ...status,
+            hasRefreshToken: Boolean(parsed.refreshToken),
+            tokenEndpoint: parsed.tokenEndpoint,
+            clientId: parsed.clientId,
+            scope: parsed.scope,
+            scopes: parsed.scopes,
+        };
+    }
+    catch (err) {
+        return {
+            state: "invalid",
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}

package/dist/credentials/store.d.ts

@@ -5,6 +5,7 @@ export interface MaskedCredential extends Omit<Credential, "secret"> {
     hasSecret: boolean;
     /** 形如 `****abcd`,绝不含完整明文。 */
     secretHint?: string;
+    oauthStatus?: import("./types.js").OAuthCredentialPublicStatus;
 }
 /**
  * 两层凭证库,镜像 SettingsManager 的 user(~/.code-shell)/ project(<cwd>/.code-shell)

package/dist/credentials/store.js

@@ -1,8 +1,9 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { getDefaultCredentialCipher } from "./cipher.js";
 import { logger } from "../logging/logger.js";
+import { summarizeOAuthCredentialSecret } from "./oauth.js";
 /** 测试可经 process.env.HOME 覆盖(镜像 settings/manager.ts userHome)。 */
 function userHome() {
     return process.env.HOME ?? homedir();
@@ -178,6 +179,7 @@ export class CredentialStore {
                 // than 4, so those chars aren't the whole secret. `"ab".slice(-4)` is
                 // "ab", so a short secret would otherwise leak in full through the hint.
                 secretHint: secret ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
+                ...(c.type === "oauth" ? { oauthStatus: summarizeOAuthCredentialSecret(secret) } : {}),
             };
         });
     }

package/dist/credentials/types.d.ts

@@ -3,7 +3,40 @@
  * - token/link 第一期已有;cookie 第二期改为「具名 cookie 凭证」进库
  *   (用户主动按域拓取存,支持同域多账号),见 credential-use-gate 设计稿。
  */
-export type CredentialType = "token" | "link" | "cookie";
+export type CredentialType = "token" | "link" | "cookie" | "oauth";
+export interface OAuthCredentialSecret {
+    /** Schema version for the JSON stored in Credential.secret. */
+    version?: 1;
+    /** Current access token. MCP HTTP auth sends this as Authorization: Bearer. */
+    accessToken: string;
+    /** Optional refresh token. Stored encrypted with the credential secret. */
+    refreshToken?: string;
+    /** ISO-8601 expiry time for accessToken. Missing means "unknown", not expired. */
+    expiresAt?: string;
+    /** Upstream token type, usually Bearer. Stored for round-trip/debugging. */
+    tokenType?: string;
+    /** Space-delimited OAuth scope string returned by many token endpoints. */
+    scope?: string;
+    /** Structured scopes used by first-party UI/catalog metadata. */
+    scopes?: string[];
+    /** Token endpoint to use when a future refresh flow is wired. */
+    tokenEndpoint?: string;
+    /** OAuth client id associated with this token. */
+    clientId?: string;
+    /** Optional confidential client secret, if the integration requires it. */
+    clientSecret?: string;
+}
+export interface OAuthCredentialPublicStatus {
+    state: "valid" | "expired" | "missing" | "invalid";
+    expiresAt?: string;
+    expiresInMs?: number;
+    hasRefreshToken?: boolean;
+    tokenEndpoint?: string;
+    clientId?: string;
+    scope?: string;
+    scopes?: string[];
+    error?: string;
+}
 export interface Credential {
     /**
      * 引用键,kebab-case,全局/项目两层内唯一。
@@ -19,6 +52,7 @@ export interface Credential {
      * 密文(UI 只显示掩码):
      * - token: token 值;
      * - link: client id/secret 等的 JSON 字符串;
+     * - oauth: OAuthCredentialSecret JSON 字符串(access/refresh/expiry/client info);
      * - cookie: 序列化的 cookie jar(JSON.stringify 的 ElectronCookieLike[])。
      */
     secret?: string;
@@ -48,6 +82,18 @@ export interface Credential {
         domain?: string;
         scope?: "domain" | "all";
         switchMode?: "clear" | "merge";
+        /** OAuth provider/integration id, e.g. "figma". */
+        oauthProvider?: string;
+        /** OAuth authorization endpoint, used by UI/login launchers. */
+        authUrl?: string;
+        /** OAuth token endpoint, duplicated from secret for non-secret UI display. */
+        tokenEndpoint?: string;
+        /** OAuth client id, duplicated from secret for non-secret UI display. */
+        clientId?: string;
+        /** OAuth scopes requested for this credential. */
+        scopes?: string[];
+        /** Last successful refresh time; refresh wiring is reserved for a later step. */
+        lastRefreshAt?: string;
     };
 }
 export interface CredentialStoreFile {

package/dist/engine/engine.d.ts

@@ -154,6 +154,7 @@ export declare class Engine {
      * LLM response arrives.
      */
     private ctxOverheadBySid;
+    private lastCacheReadBySid;
     /**
      * Step-gap steering queue (per sessionId, in-memory). Host pushes user
      * messages here via enqueueSteer while a run is in flight; the turn loop
@@ -278,7 +279,7 @@ export declare class Engine {
      * the queued draft) and is the handle `unsteer` uses to revoke a still-pending
      * entry. A blank id is tolerated but means the entry can't be revoked.
      */
-    enqueueSteer(sessionId: string, text: string, id?: string, clientMessageId?: string): EnqueueSteerResult;
+    enqueueSteer(sessionId: string, text: string, id?: string, clientMessageId?: string, attachments?: InputAttachmentMeta[]): EnqueueSteerResult;
     /**
      * Revoke a still-pending steer entry (the 撤回 path). Returns true if it was
      * removed, false if it was already consumed by the turn loop (can't take it
@@ -287,6 +288,8 @@ export declare class Engine {
     unsteer(sessionId: string, id: string): boolean;
     /** Drain + clear the steer queue for a session (turn loop consumes per step). */
     private consumeSteer;
+    /** Put failed steer preparation back ahead of messages queued while it was being prepared. */
+    private restoreSteer;
     /** Wire the cookie→browser injection callback (InjectCredential tool). Same
      *  post-construction injection model as setBrowserBridge. */
     setInjectCredential(fn: import("../tool-system/context.js").InjectCredentialFn | undefined): void;
@@ -482,7 +485,8 @@ export declare class Engine {
         after: number;
         strategy: "none (no active session)" | "no compaction needed" | "compacted" | CompactStrategy;
     }>;
-    private stripUserContextMessage;
+    private stripInjectedContextMessages;
+    private recordCacheReadDiagnostics;
     private getSettingsManager;
     /**
      * Update a config setting at runtime.