@cjhyy/code-shell-core 0.7.0-beta.1 → 0.7.1

package/dist/tool-system/builtin/sleep.definition.js

@@ -0,0 +1,28 @@
+/**
+ * Sleep tool metadata.
+ *
+ * Kept separate from the executor so registration and presets can consume the
+ * definition without importing implementation code.
+ */
+export const sleepToolDef = {
+    name: "Sleep",
+    description: "Pause execution for a brief, deterministic wait (e.g. letting a just-started service settle for a few seconds). " +
+        "Do NOT use Sleep to poll for or wait on background work (background shells, async sub-agents, video generation): " +
+        "the system wakes you automatically when that work completes — just end your turn instead of looping Sleep. " +
+        "If you want a safety net in case a background task hangs and never signals completion, do NOT loop Sleep either — " +
+        "instead end your turn and schedule a one-shot self-wakeup with CronCreate " +
+        "({ schedule: '5m', once: true, continueInSession: true, permissionLevel: 'read-only', " +
+        "prompt: 'check whether <that task> finished; if still running, wait again' }). " +
+        "That returns control to you at the interval without burning a turn spinning. " +
+        "Maximum duration is 300 seconds (5 minutes).",
+    inputSchema: {
+        type: "object",
+        properties: {
+            seconds: {
+                type: "number",
+                description: "Number of seconds to sleep (max 300)",
+            },
+        },
+        required: ["seconds"],
+    },
+};

package/dist/tool-system/builtin/sleep.js

@@ -1,28 +1,7 @@
 /**
  * SleepTool — pause execution for a specified duration.
  */
-export const sleepToolDef = {
-    name: "Sleep",
-    description: "Pause execution for a brief, deterministic wait (e.g. letting a just-started service settle for a few seconds). " +
-        "Do NOT use Sleep to poll for or wait on background work (background shells, async sub-agents, video generation): " +
-        "the system wakes you automatically when that work completes — just end your turn instead of looping Sleep. " +
-        "If you want a safety net in case a background task hangs and never signals completion, do NOT loop Sleep either — " +
-        "instead end your turn and schedule a one-shot self-wakeup with CronCreate " +
-        "({ schedule: '5m', once: true, continueInSession: true, permissionLevel: 'read-only', " +
-        "prompt: 'check whether <that task> finished; if still running, wait again' }). " +
-        "That returns control to you at the interval without burning a turn spinning. " +
-        "Maximum duration is 300 seconds (5 minutes).",
-    inputSchema: {
-        type: "object",
-        properties: {
-            seconds: {
-                type: "number",
-                description: "Number of seconds to sleep (max 300)",
-            },
-        },
-        required: ["seconds"],
-    },
-};
+export { sleepToolDef } from "./sleep.definition.js";
 export async function sleepTool(args) {
     const seconds = Math.min(Math.max(Number(args.seconds) || 1, 0.1), 300);
     const signal = args.__signal;

package/dist/tool-system/builtin/video-providers.d.ts

@@ -40,6 +40,7 @@ export type VideoPollResult = {
 } | {
     ok: true;
     status: "succeeded";
+    url?: string;
 } | {
     ok: true;
     status: "failed";
@@ -57,6 +58,14 @@ export type VideoDownloadResult = {
     ok: false;
     error: string;
 };
+export interface VideoDownloadRequest {
+    jobId: string;
+    creds: VideoProviderCreds;
+    signal?: AbortSignal;
+    /** Called as soon as the provider exposes the remote result URL, before the
+     *  potentially long byte download begins. */
+    onUrl?: (url: string) => void;
+}
 export interface VideoProvider {
     readonly kind: string;
     submit(req: VideoSubmitRequest): Promise<VideoSubmitResult>;
@@ -65,11 +74,7 @@ export interface VideoProvider {
         creds: VideoProviderCreds;
         signal?: AbortSignal;
     }): Promise<VideoPollResult>;
-    download(req: {
-        jobId: string;
-        creds: VideoProviderCreds;
-        signal?: AbortSignal;
-    }): Promise<VideoDownloadResult>;
+    download(req: VideoDownloadRequest): Promise<VideoDownloadResult>;
 }
 /**
  * Deterministic in-memory adapter for tests and local dev — no network. Models
@@ -95,11 +100,7 @@ export declare class FakeVideoProvider implements VideoProvider {
         creds?: VideoProviderCreds;
         signal?: AbortSignal;
     }): Promise<VideoPollResult>;
-    download(_req: {
-        jobId: string;
-        creds?: VideoProviderCreds;
-        signal?: AbortSignal;
-    }): Promise<VideoDownloadResult>;
+    download(_req: VideoDownloadRequest): Promise<VideoDownloadResult>;
 }
 /**
  * fal.ai video adapter — submit/poll/download against the fal queue API
@@ -138,11 +139,7 @@ export declare class FalVideoProvider implements VideoProvider {
         creds: VideoProviderCreds;
         signal?: AbortSignal;
     }): Promise<VideoPollResult>;
-    download(req: {
-        jobId: string;
-        creds: VideoProviderCreds;
-        signal?: AbortSignal;
-    }): Promise<VideoDownloadResult>;
+    download(req: VideoDownloadRequest): Promise<VideoDownloadResult>;
 }
 /** Default model per video provider kind (filled in with real adapters). */
 export declare const DEFAULT_VIDEO_MODEL: Record<string, string>;

package/dist/tool-system/builtin/video-providers.js

@@ -197,6 +197,7 @@ export class FalVideoProvider {
             const videoUrl = j.video?.url;
             if (!videoUrl)
                 return { ok: false, error: "fal result: no video.url" };
+            req.onUrl?.(videoUrl);
             // hop 2: video bytes
             const vr = await this.fetchImpl(videoUrl, { method: "GET", signal: req.signal });
             if (!vr.ok) {

package/dist/tool-system/builtin/view-image.d.ts

@@ -13,6 +13,6 @@
  */
 import type { ToolDefinition } from "../../types.js";
 import type { ToolContext } from "../context.js";
-import type { BuiltinToolResult } from "./index.js";
+import type { BuiltinToolReturn } from "./index.js";
 export declare const viewImageToolDef: ToolDefinition;
-export declare function viewImageTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<BuiltinToolResult>;
+export declare function viewImageTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<BuiltinToolReturn>;

package/dist/tool-system/builtin/web-fetch.js

@@ -25,6 +25,7 @@ export const webFetchToolDef = {
 };
 const MAX_OUTPUT = 100_000;
 const DEFAULT_MAX = 50_000;
+const RAW_BYTE_BUDGET_MULTIPLIER = 4;
 // Header names that must not be overridable via args.headers (SSRF / auth injection)
 const BLOCKED_REQUEST_HEADERS = new Set([
     "host", "authorization", "cookie", "proxy-authorization",
@@ -252,7 +253,46 @@ export async function webFetchTool(args) {
 }
 async function readAndTruncateBody(res, maxLength) {
     const contentType = res.headers.get("content-type") ?? "";
-    const body = await res.text();
+    const maxBytes = maxLength * RAW_BYTE_BUDGET_MULTIPLIER;
+    const reader = res.body?.getReader();
+    let body;
+    let rawTruncated = false;
+    if (!reader) {
+        body = await res.text();
+    }
+    else {
+        const decoder = new TextDecoder("utf-8");
+        const chunks = [];
+        let bytesRead = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                const remaining = maxBytes - bytesRead;
+                if (value.byteLength >= remaining) {
+                    chunks.push(decoder.decode(value.subarray(0, remaining), { stream: true }));
+                    bytesRead += remaining;
+                    rawTruncated = true;
+                    await reader.cancel();
+                    break;
+                }
+                chunks.push(decoder.decode(value, { stream: true }));
+                bytesRead += value.byteLength;
+            }
+            const tail = decoder.decode();
+            // When the byte budget cuts through a multi-byte code point, flushing
+            // the decoder would turn that intentionally incomplete suffix into �.
+            // All complete code points were already emitted by stream:true, so the
+            // truncated tail is safe to discard.
+            if (!rawTruncated)
+                chunks.push(tail);
+            body = chunks.join("");
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
     let text;
     if (contentType.includes("text/html") || contentType.includes("application/xhtml")) {
         text = extractTextFromHTML(body);
@@ -260,8 +300,9 @@ async function readAndTruncateBody(res, maxLength) {
     else {
         text = body;
     }
-    if (text.length > maxLength) {
-        text = text.slice(0, maxLength) + `\n\n... content truncated (${text.length} chars total)`;
+    if (rawTruncated || text.length > maxLength) {
+        const shownChars = Math.min(text.length, maxLength);
+        text = text.slice(0, maxLength) + `\n\n... content truncated (showing first ${shownChars} chars)`;
     }
     return text || "(page returned empty content)";
 }

package/dist/tool-system/builtin/worktree.js

@@ -3,7 +3,7 @@
  */
 import { existsSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-import { createWorktree, removeWorktree, listWorktrees, validateWorktreeSlug, selectPlatformScript, runWorktreeSetup, worktreeHasUncommittedOrAheadChanges, currentBranch, } from "../../git/worktree.js";
+import { createWorktree, removeWorktree, listWorktrees, validateWorktreeSlug, selectPlatformScript, runWorktreeSetup, worktreeHasUncommittedOrAheadChanges, currentBranch, cleanupAbortedWorktree, } from "../../git/worktree.js";
 export const switchSessionWorkspaceToolDef = {
     name: "SwitchSessionWorkspace",
     description: "Switch this current conversation session into or out of a workspace through the host UI path. " +
@@ -44,7 +44,7 @@ export async function switchSessionWorkspaceTool(args, ctx) {
             nextTurnNotice(workspace.root, ctx?.cwd ?? workspace.root));
     }
     catch (err) {
-        return `Error switching workspace: ${err.message}`;
+        return `Error: switching workspace failed: ${err.message}`;
     }
 }
 export const enterWorktreeToolDef = {
@@ -86,6 +86,7 @@ export async function enterWorktreeTool(args, ctx) {
     const branchPrefix = ctx?.engine?.readWorktreeBranchPrefix?.(mainRoot);
     try {
         if (target === "main") {
+            ctx?.signal?.throwIfAborted();
             const workspace = { root: mainRoot, kind: "main" };
             persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
             sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
@@ -101,13 +102,26 @@ export async function enterWorktreeTool(args, ctx) {
             sessionId,
             currentWorkspace: fromWorkspace,
             branchPrefix,
+            signal: ctx?.signal,
         });
+        if (ctx?.signal?.aborted) {
+            if (selected.created) {
+                await cleanupAbortedWorktree(mainRoot, selected.session.worktreePath, selected.session.worktreeBranch);
+            }
+            throw new Error("Worktree creation aborted");
+        }
         const workspace = toSessionWorkspace(selected, fromWorkspace);
-        persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
-        sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
         const setupNote = selected.created
             ? await runSetupIfConfigured(selected.session.worktreePath, mainRoot, ctx)
             : "";
+        if (ctx?.signal?.aborted) {
+            if (selected.created) {
+                await cleanupAbortedWorktree(mainRoot, selected.session.worktreePath, selected.session.worktreeBranch);
+            }
+            throw new Error("Worktree creation aborted");
+        }
+        persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
+        sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
         const verb = selected.created ? "Worktree created and switched" : "Switched to worktree";
         return (`${verb}:\n` +
             `  Path:   ${workspace.worktree.path}\n` +
@@ -118,7 +132,7 @@ export async function enterWorktreeTool(args, ctx) {
             setupNote);
     }
     catch (err) {
-        return `Error switching worktree: ${err.message}`;
+        return `Error: switching worktree failed: ${err.message}`;
     }
 }
 /** Keep setup output from bloating the tool result — head+tail-ish trim. */
@@ -229,7 +243,7 @@ export async function exitWorktreeTool(args, ctx) {
             nextTurnNotice(mainRoot, currentTurnRoot));
     }
     catch (err) {
-        return `Error exiting worktree: ${err.message}`;
+        return `Error: exiting worktree failed: ${err.message}`;
     }
 }
 function sessionServices(ctx) {
@@ -261,6 +275,7 @@ function sharedWorktreeRemovalSkippedMessage(otherOwners, mainRoot, currentTurnR
 }
 async function resolveWorktreeTarget(opts) {
     const entries = await listWorktrees(opts.mainRoot);
+    opts.signal?.throwIfAborted();
     const pathTarget = pathLike(opts.target) ? resolvePathTarget(opts.target, opts.cwd) : undefined;
     const branchTarget = normalizeBranchName(opts.target);
     const match = entries.find((entry) => {
@@ -269,6 +284,8 @@ async function resolveWorktreeTarget(opts) {
         return entry.branch === branchTarget;
     });
     if (match) {
+        const originalBranch = await currentBranch(opts.mainRoot);
+        opts.signal?.throwIfAborted();
         return {
             created: false,
             session: {
@@ -276,7 +293,7 @@ async function resolveWorktreeTarget(opts) {
                 worktreePath: match.path,
                 worktreeName: match.path.split(/[\\/]/).pop() ?? match.branch,
                 worktreeBranch: match.branch,
-                originalBranch: await currentBranch(opts.mainRoot),
+                originalBranch,
                 sessionId: opts.sessionId,
                 createdAt: Date.now(),
             },
@@ -289,6 +306,7 @@ async function resolveWorktreeTarget(opts) {
     validateWorktreeSlug(opts.target);
     const created = await createWorktree(opts.mainRoot, opts.target, opts.sessionId, {
         prefix: opts.branchPrefix,
+        signal: opts.signal,
     });
     return { created: true, session: created, from: created.originalBranch ?? "HEAD" };
 }

package/dist/tool-system/builtin/write.d.ts

@@ -3,5 +3,6 @@
  */
 import type { ToolDefinition } from "../../types.js";
 import type { ToolContext } from "../context.js";
+import type { ToolFailure } from "./index.js";
 export declare const writeToolDef: ToolDefinition;
-export declare function writeTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+export declare function writeTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string | ToolFailure>;

package/dist/tool-system/builtin/write.js

@@ -1,9 +1,10 @@
 /**
  * Built-in Write file tool.
  */
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { fileCache } from "./file-cache.js";
+import { getFinalWritePathSnapshot, revalidateFinalWritePath, writeFileNoFollow, } from "../path-policy.js";
 export const writeToolDef = {
     name: "Write",
     description: "Write content to a file. Creates the file if it doesn't exist, " +
@@ -27,12 +28,21 @@ export async function writeTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
     const filePath = isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
     try {
-        await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(filePath, content, "utf-8");
+        const approvedPath = getFinalWritePathSnapshot(args, filePath, cwd);
+        const beforeMkdir = revalidateFinalWritePath(filePath, cwd, approvedPath);
+        if ("error" in beforeMkdir)
+            return { ok: false, error: beforeMkdir.error };
+        await mkdir(dirname(beforeMkdir.resolvedPath), { recursive: true });
+        // mkdir may have crossed an existing symlink in a missing parent chain;
+        // resolve again immediately before opening the final file.
+        const beforeWrite = revalidateFinalWritePath(filePath, cwd, approvedPath);
+        if ("error" in beforeWrite)
+            return { ok: false, error: beforeWrite.error };
+        await writeFileNoFollow(beforeWrite.resolvedPath, content);
         fileCache.invalidate(filePath);
         return `Successfully wrote to ${filePath}`;
     }
     catch (err) {
-        return `Error writing file: ${err.message}`;
+        return { ok: false, error: `Error writing file: ${err.message}` };
     }
 }

package/dist/tool-system/context.d.ts

@@ -12,7 +12,7 @@
  * Tools that don't need any context (Read/Write/Bash/...) just ignore
  * the second argument; the type is purely additive.
  */
-import type { LLMConfig, StreamCallback } from "../types.js";
+import type { LLMConfig, StreamCallback, TokenUsage } from "../types.js";
 import type { ModelPool } from "../llm/model-pool.js";
 import type { ToolRegistry } from "./registry.js";
 import type { AgentPresetName } from "../preset/index.js";
@@ -20,6 +20,7 @@ import type { SandboxBackend } from "./sandbox/index.js";
 import type { HookRegistry } from "../hooks/registry.js";
 import type { SessionManager } from "../session/session-manager.js";
 import type { SessionWorkspace } from "../types.js";
+import type { ApprovalRouter } from "./permission.js";
 /**
  * Narrow view of the owning Engine that tools are allowed to call back into.
  * Defined here (in the low-level tool-system) rather than importing the
@@ -154,10 +155,7 @@ export interface SubAgentSpawner {
      * (or `resumeSessionId` when resuming), so the parent can address follow-up
      * input at the same session via AgentSendInput (transcript replay).
      */
-    spawn(req: SubAgentSpawnRequest): Promise<{
-        text: string;
-        sessionId: string;
-    }>;
+    spawn(req: SubAgentSpawnRequest): Promise<SubAgentSpawnResult>;
     /**
      * Whether a child session id exists on disk. Lets AgentSendInput resume an
      * agent across a process restart (when the in-memory registry is empty but
@@ -173,6 +171,12 @@ export interface SubAgentSpawner {
         permissionMode: string;
     };
 }
+export interface SubAgentSpawnResult {
+    text: string;
+    sessionId: string;
+    /** Complete billed usage returned by the child Engine run. */
+    usage?: TokenUsage;
+}
 /**
  * The full context object handed to every tool invocation.
  *
@@ -184,6 +188,15 @@ export interface ToolVisibilityContext {
     hasGoal: boolean;
     settingsScope?: import("../settings/manager.js").SettingsScope;
 }
+export interface ExternalFileChangesRecord {
+    jobId: string;
+    description: string;
+    cli: "claude" | "codex";
+    cwd: string;
+    status: "completed" | "failed" | "cancelled";
+    changedFiles: string[];
+    originClientMessageId?: string;
+}
 export interface ToolContext {
     /** Active working directory for this Engine. */
     cwd: string;
@@ -238,6 +251,14 @@ export interface ToolContext {
      * headless/test mode; tools must tolerate absence.
      */
     streamCallback?: StreamCallback;
+    /**
+     * Report provider usage produced by a tool or child Engine into the owning
+     * session and run-scoped Goal budget. This must not invoke the process-wide
+     * billing hook again; the originating provider client already did that.
+     */
+    recordBilledUsage?: (usage: TokenUsage) => void;
+    /** Connection-scoped approval owner router supplied by the protocol host. */
+    approvalRouter?: ApprovalRouter;
     /** Whether the owning Engine is currently in plan mode. Replaces the
      *  removed module-level `isInPlanMode()` singleton. */
     planMode: boolean;
@@ -261,6 +282,15 @@ export interface ToolContext {
      * narrow context, or standalone tool tests. (B2 — Gate 1, standard §S3.)
      */
     sessionId?: string;
+    /** Stable id of the real user turn that owns async work launched here. */
+    originClientMessageId?: string;
+    /**
+     * Persist file attribution from an async external DriveAgent completion in
+     * the owning CodeShell transcript. The callback closes over the live parent
+     * transcript, so a background job can record its files after the run that
+     * launched it has already returned.
+     */
+    recordExternalFileChanges?: (record: ExternalFileChangesRecord) => void;
     /**
      * Skill names the user has hidden from the LLM (full namespaced names
      * for plugin skills, e.g. "docs:pdf"). The skill builtin tool uses

package/dist/tool-system/executor.js

@@ -9,7 +9,7 @@ import { logger as rootLogger, getCurrentSid } from "../logging/logger.js";
 import { recordToolCall, recordToolResult } from "../logging/session-recorder.js";
 import { validateToolArgs } from "./validation.js";
 import { PLAN_MODE_ALLOWED_TOOLS } from "./plan-mode-allowlist.js";
-import { enforcePathPolicyWithApproval } from "./path-policy.js";
+import { attachFinalWritePathSnapshot, enforcePathPolicyWithApproval, } from "./path-policy.js";
 import { parsePatch } from "./builtin/apply-patch/parser.js";
 import { BUILTIN_TOOL_GUARDS } from "./builtin/index.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "./builtin/complete-goal.js";
@@ -244,6 +244,7 @@ export class ToolExecutor {
             toolName: call.toolName,
             args: call.args,
             toolCallId: call.id,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         if (hookResult.decision === "deny") {
             return {
@@ -280,6 +281,16 @@ export class ToolExecutor {
         // path surface on RegisteredTool.pathPolicy; the executor enforces it
         // after hooks have had a chance to rewrite args, but before permission
         // classification or the handler can touch the filesystem.
+        if ((call.toolName === "Write" || call.toolName === "Edit") &&
+            this.toolCtx?.cwd &&
+            typeof call.args.file_path === "string") {
+            const raw = call.args.file_path;
+            const target = isAbsolutePath(raw) ? raw : resolvePath(this.toolCtx.cwd, raw);
+            call = {
+                ...call,
+                args: attachFinalWritePathSnapshot(call.args, target, this.toolCtx.cwd),
+            };
+        }
         const pathPolicyError = await this.enforceDeclaredPathPolicy(toolDef, call.args);
         if (pathPolicyError) {
             return {
@@ -325,6 +336,7 @@ export class ToolExecutor {
             args: call.args,
             toolCallId: call.id,
             classifierDecision,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         const preClamped = clampHookDecision(classifierDecision, hookResult.decision);
         let decision = preClamped.decision;
@@ -383,6 +395,7 @@ export class ToolExecutor {
             toolName: call.toolName,
             args: call.args,
             toolCallId: call.id,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // 3. Execute. Use a span so begin/end share one cat and end carries
         // duration_ms; widen args truncation from 200→2000 so Edit/Write payloads
@@ -431,25 +444,25 @@ export class ToolExecutor {
         result.id = call.id;
         // Prepend any non-blocking guard reminder onto a successful result so the
         // model sees it on its next turn alongside the content it just fetched.
-        if (guardDecision?.prepend && !result.error && result.result) {
+        if (guardDecision?.prepend && !result.isError && result.result) {
             result.result = `${guardDecision.prepend}\n${result.result}`;
         }
         const observerResult = toolResultDisplayText(result);
         const payload = observerResult ?? result.error ?? "";
         span.end({
-            ok: !result.error,
+            ok: !result.isError,
             chars: payload.length,
             // Snippet only on failure — successful tool output can be huge and is
             // already on the transcript. Failures are rare and the first 500 chars
             // usually contain the message we need.
-            ...(result.error ? { errorSnippet: payload.slice(0, 500) } : {}),
+            ...(result.isError ? { errorSnippet: payload.slice(0, 500) } : {}),
         });
         recordToolResult(sid, {
             id: call.id,
             toolName: call.toolName,
-            ok: !result.error,
+            ok: !result.isError,
             durationMs: Date.now() - toolStartedAt,
-            output: result.error ? undefined : observerResult,
+            output: result.isError ? undefined : observerResult,
             error: result.error,
         });
         // 4. Post-tool hook
@@ -458,6 +471,7 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)
         const postHook = await this.hooks.emit("post_tool_use", {
@@ -465,13 +479,14 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // Append handler-supplied context (linter output, type-check result,
         // etc.) onto the tool result so the model sees it on the next turn.
         // Tagged with a separator so the model can tell hook output from
         // tool output. Skip when the tool errored — additional context on a
         // failed tool would be confusing.
-        if (postHook.additionalContext && !result.error) {
+        if (postHook.additionalContext && !result.isError) {
             const tag = "--- additional context from post_tool_use hook ---";
             result.result = result.result
                 ? `${result.result}\n\n${tag}\n${postHook.additionalContext}`
@@ -484,10 +499,11 @@ export class ToolExecutor {
             });
         }
         // 6. file_changed hook for Write/Edit tools
-        if ((call.toolName === "Write" || call.toolName === "Edit") && !result.error) {
+        if ((call.toolName === "Write" || call.toolName === "Edit") && !result.isError) {
             await this.hooks.emit("file_changed", {
                 toolName: call.toolName,
                 filePath: call.args.file_path,
+                signal: this.signal ?? this.toolCtx?.signal,
             });
         }
         return result;

package/dist/tool-system/mcp-manager.d.ts

@@ -5,6 +5,7 @@
  */
 import type { Tool as McpTool } from "@modelcontextprotocol/sdk/types.js";
 import type { MCPServerConfig, RegisteredTool } from "../types.js";
+import type { CredentialType } from "../credentials/types.js";
 import { ToolRegistry } from "./registry.js";
 import { type CredentialAccess } from "../credentials/access.js";
 interface MCPResourceInfo {
@@ -21,6 +22,16 @@ interface MCPResourceInfo {
  * and the env var.
  */
 export declare function readRequiredEnv(serverName: string, field: string, envName: string): string;
+export interface ResolvedMcpCredential {
+    secret: string;
+    type?: CredentialType;
+    label?: string;
+}
+export type HttpCredentialResolverResult = string | ResolvedMcpCredential | undefined;
+export interface BuildHttpHeadersOptions {
+    now?: () => number;
+    oauthRefreshSkewMs?: number;
+}
 /**
  * Build the spawned stdio server's environment. Priority (lowest → highest):
  * a minimal inherited allowlist < forwarded `envVars` (read from process.env by
@@ -34,8 +45,15 @@ export declare function buildStdioEnv(serverName: string, config: MCPServerConfi
  * base; env-sourced secrets (`bearerTokenEnvVar`, `envHeaders`) layer on top
  * and win on conflict. Pure + exported for unit testing.
  */
-export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => string | undefined): Record<string, string>;
-export declare function buildHttpHeadersWithCredentialAccess(serverName: string, config: MCPServerConfig, access?: Pick<CredentialAccess, "resolveValue">): Promise<Record<string, string>>;
+export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => HttpCredentialResolverResult, options?: BuildHttpHeadersOptions): Record<string, string>;
+export declare function bearerTokenFromMcpCredential(serverName: string, credentialId: string, credential: ResolvedMcpCredential, options?: BuildHttpHeadersOptions): string;
+export declare function buildHttpHeadersWithCredentialAccess(serverName: string, config: MCPServerConfig, access?: Pick<CredentialAccess, "resolveValue"> & Partial<Pick<CredentialAccess, "resolveMeta">>, options?: BuildHttpHeadersOptions): Promise<Record<string, string>>;
+/**
+ * Fetch adapter for long-lived HTTP MCP transports. OAuth access tokens are
+ * resolved for every request, refreshed by the host inside the skew window,
+ * and force-refreshed once after a replayable 401.
+ */
+export declare function createMcpAuthenticatedFetch(serverName: string, config: MCPServerConfig, access?: CredentialAccess, baseFetch?: typeof fetch): typeof fetch;
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —