@cjhyy/code-shell-core 0.7.0 → 0.7.1

package/dist/tool-system/builtin/video-providers.js

@@ -197,6 +197,7 @@ export class FalVideoProvider {
             const videoUrl = j.video?.url;
             if (!videoUrl)
                 return { ok: false, error: "fal result: no video.url" };
+            req.onUrl?.(videoUrl);
             // hop 2: video bytes
             const vr = await this.fetchImpl(videoUrl, { method: "GET", signal: req.signal });
             if (!vr.ok) {

package/dist/tool-system/builtin/view-image.d.ts

@@ -13,6 +13,6 @@
  */
 import type { ToolDefinition } from "../../types.js";
 import type { ToolContext } from "../context.js";
-import type { BuiltinToolResult } from "./index.js";
+import type { BuiltinToolReturn } from "./index.js";
 export declare const viewImageToolDef: ToolDefinition;
-export declare function viewImageTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<BuiltinToolResult>;
+export declare function viewImageTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<BuiltinToolReturn>;

package/dist/tool-system/builtin/web-fetch.js

@@ -25,6 +25,7 @@ export const webFetchToolDef = {
 };
 const MAX_OUTPUT = 100_000;
 const DEFAULT_MAX = 50_000;
+const RAW_BYTE_BUDGET_MULTIPLIER = 4;
 // Header names that must not be overridable via args.headers (SSRF / auth injection)
 const BLOCKED_REQUEST_HEADERS = new Set([
     "host", "authorization", "cookie", "proxy-authorization",
@@ -252,7 +253,46 @@ export async function webFetchTool(args) {
 }
 async function readAndTruncateBody(res, maxLength) {
     const contentType = res.headers.get("content-type") ?? "";
-    const body = await res.text();
+    const maxBytes = maxLength * RAW_BYTE_BUDGET_MULTIPLIER;
+    const reader = res.body?.getReader();
+    let body;
+    let rawTruncated = false;
+    if (!reader) {
+        body = await res.text();
+    }
+    else {
+        const decoder = new TextDecoder("utf-8");
+        const chunks = [];
+        let bytesRead = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                const remaining = maxBytes - bytesRead;
+                if (value.byteLength >= remaining) {
+                    chunks.push(decoder.decode(value.subarray(0, remaining), { stream: true }));
+                    bytesRead += remaining;
+                    rawTruncated = true;
+                    await reader.cancel();
+                    break;
+                }
+                chunks.push(decoder.decode(value, { stream: true }));
+                bytesRead += value.byteLength;
+            }
+            const tail = decoder.decode();
+            // When the byte budget cuts through a multi-byte code point, flushing
+            // the decoder would turn that intentionally incomplete suffix into �.
+            // All complete code points were already emitted by stream:true, so the
+            // truncated tail is safe to discard.
+            if (!rawTruncated)
+                chunks.push(tail);
+            body = chunks.join("");
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
     let text;
     if (contentType.includes("text/html") || contentType.includes("application/xhtml")) {
         text = extractTextFromHTML(body);
@@ -260,8 +300,9 @@ async function readAndTruncateBody(res, maxLength) {
     else {
         text = body;
     }
-    if (text.length > maxLength) {
-        text = text.slice(0, maxLength) + `\n\n... content truncated (${text.length} chars total)`;
+    if (rawTruncated || text.length > maxLength) {
+        const shownChars = Math.min(text.length, maxLength);
+        text = text.slice(0, maxLength) + `\n\n... content truncated (showing first ${shownChars} chars)`;
     }
     return text || "(page returned empty content)";
 }

package/dist/tool-system/builtin/worktree.js

@@ -3,7 +3,7 @@
  */
 import { existsSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-import { createWorktree, removeWorktree, listWorktrees, validateWorktreeSlug, selectPlatformScript, runWorktreeSetup, worktreeHasUncommittedOrAheadChanges, currentBranch, } from "../../git/worktree.js";
+import { createWorktree, removeWorktree, listWorktrees, validateWorktreeSlug, selectPlatformScript, runWorktreeSetup, worktreeHasUncommittedOrAheadChanges, currentBranch, cleanupAbortedWorktree, } from "../../git/worktree.js";
 export const switchSessionWorkspaceToolDef = {
     name: "SwitchSessionWorkspace",
     description: "Switch this current conversation session into or out of a workspace through the host UI path. " +
@@ -44,7 +44,7 @@ export async function switchSessionWorkspaceTool(args, ctx) {
             nextTurnNotice(workspace.root, ctx?.cwd ?? workspace.root));
     }
     catch (err) {
-        return `Error switching workspace: ${err.message}`;
+        return `Error: switching workspace failed: ${err.message}`;
     }
 }
 export const enterWorktreeToolDef = {
@@ -86,6 +86,7 @@ export async function enterWorktreeTool(args, ctx) {
     const branchPrefix = ctx?.engine?.readWorktreeBranchPrefix?.(mainRoot);
     try {
         if (target === "main") {
+            ctx?.signal?.throwIfAborted();
             const workspace = { root: mainRoot, kind: "main" };
             persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
             sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
@@ -101,13 +102,26 @@ export async function enterWorktreeTool(args, ctx) {
             sessionId,
             currentWorkspace: fromWorkspace,
             branchPrefix,
+            signal: ctx?.signal,
         });
+        if (ctx?.signal?.aborted) {
+            if (selected.created) {
+                await cleanupAbortedWorktree(mainRoot, selected.session.worktreePath, selected.session.worktreeBranch);
+            }
+            throw new Error("Worktree creation aborted");
+        }
         const workspace = toSessionWorkspace(selected, fromWorkspace);
-        persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
-        sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
         const setupNote = selected.created
             ? await runSetupIfConfigured(selected.session.worktreePath, mainRoot, ctx)
             : "";
+        if (ctx?.signal?.aborted) {
+            if (selected.created) {
+                await cleanupAbortedWorktree(mainRoot, selected.session.worktreePath, selected.session.worktreeBranch);
+            }
+            throw new Error("Worktree creation aborted");
+        }
+        persistSessionWorkspace(sessionManager, sessionId, workspace, ctx);
+        sessionManager.recordWorkspaceHandoff(sessionId, fromWorkspace, workspace);
         const verb = selected.created ? "Worktree created and switched" : "Switched to worktree";
         return (`${verb}:\n` +
             `  Path:   ${workspace.worktree.path}\n` +
@@ -118,7 +132,7 @@ export async function enterWorktreeTool(args, ctx) {
             setupNote);
     }
     catch (err) {
-        return `Error switching worktree: ${err.message}`;
+        return `Error: switching worktree failed: ${err.message}`;
     }
 }
 /** Keep setup output from bloating the tool result — head+tail-ish trim. */
@@ -229,7 +243,7 @@ export async function exitWorktreeTool(args, ctx) {
             nextTurnNotice(mainRoot, currentTurnRoot));
     }
     catch (err) {
-        return `Error exiting worktree: ${err.message}`;
+        return `Error: exiting worktree failed: ${err.message}`;
     }
 }
 function sessionServices(ctx) {
@@ -261,6 +275,7 @@ function sharedWorktreeRemovalSkippedMessage(otherOwners, mainRoot, currentTurnR
 }
 async function resolveWorktreeTarget(opts) {
     const entries = await listWorktrees(opts.mainRoot);
+    opts.signal?.throwIfAborted();
     const pathTarget = pathLike(opts.target) ? resolvePathTarget(opts.target, opts.cwd) : undefined;
     const branchTarget = normalizeBranchName(opts.target);
     const match = entries.find((entry) => {
@@ -269,6 +284,8 @@ async function resolveWorktreeTarget(opts) {
         return entry.branch === branchTarget;
     });
     if (match) {
+        const originalBranch = await currentBranch(opts.mainRoot);
+        opts.signal?.throwIfAborted();
         return {
             created: false,
             session: {
@@ -276,7 +293,7 @@ async function resolveWorktreeTarget(opts) {
                 worktreePath: match.path,
                 worktreeName: match.path.split(/[\\/]/).pop() ?? match.branch,
                 worktreeBranch: match.branch,
-                originalBranch: await currentBranch(opts.mainRoot),
+                originalBranch,
                 sessionId: opts.sessionId,
                 createdAt: Date.now(),
             },
@@ -289,6 +306,7 @@ async function resolveWorktreeTarget(opts) {
     validateWorktreeSlug(opts.target);
     const created = await createWorktree(opts.mainRoot, opts.target, opts.sessionId, {
         prefix: opts.branchPrefix,
+        signal: opts.signal,
     });
     return { created: true, session: created, from: created.originalBranch ?? "HEAD" };
 }

package/dist/tool-system/builtin/write.d.ts

@@ -3,5 +3,6 @@
  */
 import type { ToolDefinition } from "../../types.js";
 import type { ToolContext } from "../context.js";
+import type { ToolFailure } from "./index.js";
 export declare const writeToolDef: ToolDefinition;
-export declare function writeTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+export declare function writeTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string | ToolFailure>;

package/dist/tool-system/builtin/write.js

@@ -1,9 +1,10 @@
 /**
  * Built-in Write file tool.
  */
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { fileCache } from "./file-cache.js";
+import { getFinalWritePathSnapshot, revalidateFinalWritePath, writeFileNoFollow, } from "../path-policy.js";
 export const writeToolDef = {
     name: "Write",
     description: "Write content to a file. Creates the file if it doesn't exist, " +
@@ -27,12 +28,21 @@ export async function writeTool(args, ctx) {
     const cwd = ctx?.cwd ?? process.cwd();
     const filePath = isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
     try {
-        await mkdir(dirname(filePath), { recursive: true });
-        await writeFile(filePath, content, "utf-8");
+        const approvedPath = getFinalWritePathSnapshot(args, filePath, cwd);
+        const beforeMkdir = revalidateFinalWritePath(filePath, cwd, approvedPath);
+        if ("error" in beforeMkdir)
+            return { ok: false, error: beforeMkdir.error };
+        await mkdir(dirname(beforeMkdir.resolvedPath), { recursive: true });
+        // mkdir may have crossed an existing symlink in a missing parent chain;
+        // resolve again immediately before opening the final file.
+        const beforeWrite = revalidateFinalWritePath(filePath, cwd, approvedPath);
+        if ("error" in beforeWrite)
+            return { ok: false, error: beforeWrite.error };
+        await writeFileNoFollow(beforeWrite.resolvedPath, content);
         fileCache.invalidate(filePath);
         return `Successfully wrote to ${filePath}`;
     }
     catch (err) {
-        return `Error writing file: ${err.message}`;
+        return { ok: false, error: `Error writing file: ${err.message}` };
     }
 }

package/dist/tool-system/context.d.ts

@@ -12,7 +12,7 @@
  * Tools that don't need any context (Read/Write/Bash/...) just ignore
  * the second argument; the type is purely additive.
  */
-import type { LLMConfig, StreamCallback } from "../types.js";
+import type { LLMConfig, StreamCallback, TokenUsage } from "../types.js";
 import type { ModelPool } from "../llm/model-pool.js";
 import type { ToolRegistry } from "./registry.js";
 import type { AgentPresetName } from "../preset/index.js";
@@ -20,6 +20,7 @@ import type { SandboxBackend } from "./sandbox/index.js";
 import type { HookRegistry } from "../hooks/registry.js";
 import type { SessionManager } from "../session/session-manager.js";
 import type { SessionWorkspace } from "../types.js";
+import type { ApprovalRouter } from "./permission.js";
 /**
  * Narrow view of the owning Engine that tools are allowed to call back into.
  * Defined here (in the low-level tool-system) rather than importing the
@@ -154,10 +155,7 @@ export interface SubAgentSpawner {
      * (or `resumeSessionId` when resuming), so the parent can address follow-up
      * input at the same session via AgentSendInput (transcript replay).
      */
-    spawn(req: SubAgentSpawnRequest): Promise<{
-        text: string;
-        sessionId: string;
-    }>;
+    spawn(req: SubAgentSpawnRequest): Promise<SubAgentSpawnResult>;
     /**
      * Whether a child session id exists on disk. Lets AgentSendInput resume an
      * agent across a process restart (when the in-memory registry is empty but
@@ -173,6 +171,12 @@ export interface SubAgentSpawner {
         permissionMode: string;
     };
 }
+export interface SubAgentSpawnResult {
+    text: string;
+    sessionId: string;
+    /** Complete billed usage returned by the child Engine run. */
+    usage?: TokenUsage;
+}
 /**
  * The full context object handed to every tool invocation.
  *
@@ -247,6 +251,14 @@ export interface ToolContext {
      * headless/test mode; tools must tolerate absence.
      */
     streamCallback?: StreamCallback;
+    /**
+     * Report provider usage produced by a tool or child Engine into the owning
+     * session and run-scoped Goal budget. This must not invoke the process-wide
+     * billing hook again; the originating provider client already did that.
+     */
+    recordBilledUsage?: (usage: TokenUsage) => void;
+    /** Connection-scoped approval owner router supplied by the protocol host. */
+    approvalRouter?: ApprovalRouter;
     /** Whether the owning Engine is currently in plan mode. Replaces the
      *  removed module-level `isInPlanMode()` singleton. */
     planMode: boolean;

package/dist/tool-system/executor.js

@@ -9,7 +9,7 @@ import { logger as rootLogger, getCurrentSid } from "../logging/logger.js";
 import { recordToolCall, recordToolResult } from "../logging/session-recorder.js";
 import { validateToolArgs } from "./validation.js";
 import { PLAN_MODE_ALLOWED_TOOLS } from "./plan-mode-allowlist.js";
-import { enforcePathPolicyWithApproval } from "./path-policy.js";
+import { attachFinalWritePathSnapshot, enforcePathPolicyWithApproval, } from "./path-policy.js";
 import { parsePatch } from "./builtin/apply-patch/parser.js";
 import { BUILTIN_TOOL_GUARDS } from "./builtin/index.js";
 import { COMPLETE_GOAL_TOOL_NAME } from "./builtin/complete-goal.js";
@@ -244,6 +244,7 @@ export class ToolExecutor {
             toolName: call.toolName,
             args: call.args,
             toolCallId: call.id,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         if (hookResult.decision === "deny") {
             return {
@@ -280,6 +281,16 @@ export class ToolExecutor {
         // path surface on RegisteredTool.pathPolicy; the executor enforces it
         // after hooks have had a chance to rewrite args, but before permission
         // classification or the handler can touch the filesystem.
+        if ((call.toolName === "Write" || call.toolName === "Edit") &&
+            this.toolCtx?.cwd &&
+            typeof call.args.file_path === "string") {
+            const raw = call.args.file_path;
+            const target = isAbsolutePath(raw) ? raw : resolvePath(this.toolCtx.cwd, raw);
+            call = {
+                ...call,
+                args: attachFinalWritePathSnapshot(call.args, target, this.toolCtx.cwd),
+            };
+        }
         const pathPolicyError = await this.enforceDeclaredPathPolicy(toolDef, call.args);
         if (pathPolicyError) {
             return {
@@ -325,6 +336,7 @@ export class ToolExecutor {
             args: call.args,
             toolCallId: call.id,
             classifierDecision,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         const preClamped = clampHookDecision(classifierDecision, hookResult.decision);
         let decision = preClamped.decision;
@@ -383,6 +395,7 @@ export class ToolExecutor {
             toolName: call.toolName,
             args: call.args,
             toolCallId: call.id,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // 3. Execute. Use a span so begin/end share one cat and end carries
         // duration_ms; widen args truncation from 200→2000 so Edit/Write payloads
@@ -431,25 +444,25 @@ export class ToolExecutor {
         result.id = call.id;
         // Prepend any non-blocking guard reminder onto a successful result so the
         // model sees it on its next turn alongside the content it just fetched.
-        if (guardDecision?.prepend && !result.error && result.result) {
+        if (guardDecision?.prepend && !result.isError && result.result) {
             result.result = `${guardDecision.prepend}\n${result.result}`;
         }
         const observerResult = toolResultDisplayText(result);
         const payload = observerResult ?? result.error ?? "";
         span.end({
-            ok: !result.error,
+            ok: !result.isError,
             chars: payload.length,
             // Snippet only on failure — successful tool output can be huge and is
             // already on the transcript. Failures are rare and the first 500 chars
             // usually contain the message we need.
-            ...(result.error ? { errorSnippet: payload.slice(0, 500) } : {}),
+            ...(result.isError ? { errorSnippet: payload.slice(0, 500) } : {}),
         });
         recordToolResult(sid, {
             id: call.id,
             toolName: call.toolName,
-            ok: !result.error,
+            ok: !result.isError,
             durationMs: Date.now() - toolStartedAt,
-            output: result.error ? undefined : observerResult,
+            output: result.isError ? undefined : observerResult,
             error: result.error,
         });
         // 4. Post-tool hook
@@ -458,6 +471,7 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)
         const postHook = await this.hooks.emit("post_tool_use", {
@@ -465,13 +479,14 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            signal: this.signal ?? this.toolCtx?.signal,
         });
         // Append handler-supplied context (linter output, type-check result,
         // etc.) onto the tool result so the model sees it on the next turn.
         // Tagged with a separator so the model can tell hook output from
         // tool output. Skip when the tool errored — additional context on a
         // failed tool would be confusing.
-        if (postHook.additionalContext && !result.error) {
+        if (postHook.additionalContext && !result.isError) {
             const tag = "--- additional context from post_tool_use hook ---";
             result.result = result.result
                 ? `${result.result}\n\n${tag}\n${postHook.additionalContext}`
@@ -484,10 +499,11 @@ export class ToolExecutor {
             });
         }
         // 6. file_changed hook for Write/Edit tools
-        if ((call.toolName === "Write" || call.toolName === "Edit") && !result.error) {
+        if ((call.toolName === "Write" || call.toolName === "Edit") && !result.isError) {
             await this.hooks.emit("file_changed", {
                 toolName: call.toolName,
                 filePath: call.args.file_path,
+                signal: this.signal ?? this.toolCtx?.signal,
             });
         }
         return result;

package/dist/tool-system/mcp-manager.d.ts

@@ -48,6 +48,12 @@ export declare function buildStdioEnv(serverName: string, config: MCPServerConfi
 export declare function buildHttpHeaders(serverName: string, config: MCPServerConfig, resolveCredential?: (id: string) => HttpCredentialResolverResult, options?: BuildHttpHeadersOptions): Record<string, string>;
 export declare function bearerTokenFromMcpCredential(serverName: string, credentialId: string, credential: ResolvedMcpCredential, options?: BuildHttpHeadersOptions): string;
 export declare function buildHttpHeadersWithCredentialAccess(serverName: string, config: MCPServerConfig, access?: Pick<CredentialAccess, "resolveValue"> & Partial<Pick<CredentialAccess, "resolveMeta">>, options?: BuildHttpHeadersOptions): Promise<Record<string, string>>;
+/**
+ * Fetch adapter for long-lived HTTP MCP transports. OAuth access tokens are
+ * resolved for every request, refreshed by the host inside the skew window,
+ * and force-refreshed once after a replayable 401.
+ */
+export declare function createMcpAuthenticatedFetch(serverName: string, config: MCPServerConfig, access?: CredentialAccess, baseFetch?: typeof fetch): typeof fetch;
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —

package/dist/tool-system/mcp-manager.js

@@ -11,6 +11,7 @@ import { getCredentialAccess } from "../credentials/access.js";
 import { buildOAuthRefreshRequest, oauthCredentialStatus, parseOAuthCredentialSecret, } from "../credentials/oauth.js";
 import { ENV_ALLOWLIST } from "../runtime/spawn-common.js";
 import { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { diagnoseMcpStdioMissingCommand, previewPath } from "./mcp-stdio-diagnostics.js";
 import { codeShellHome } from "../session/session-manager.js";
@@ -153,6 +154,55 @@ export async function buildHttpHeadersWithCredentialAccess(serverName, config, a
     });
     return buildHttpHeaders(serverName, config, (id) => id === config.credentialRef ? { secret, type: meta?.type, label: meta?.label } : undefined, options);
 }
+/**
+ * Fetch adapter for long-lived HTTP MCP transports. OAuth access tokens are
+ * resolved for every request, refreshed by the host inside the skew window,
+ * and force-refreshed once after a replayable 401.
+ */
+export function createMcpAuthenticatedFetch(serverName, config, access = getCredentialAccess(), baseFetch = fetch) {
+    return (async (input, init) => {
+        const credentialId = config.credentialRef;
+        const meta = credentialId ? access.resolveMeta(undefined, credentialId, "full") : undefined;
+        const isOAuth = meta?.type === "oauth";
+        const headers = isOAuth
+            ? buildHttpHeaders(serverName, { ...config, credentialRef: undefined })
+            : await buildHttpHeadersWithCredentialAccess(serverName, config, access);
+        let token;
+        if (isOAuth) {
+            if (!access.resolveOAuthAccess) {
+                throw new Error(`MCP server "${serverName}": oauth credential "${credentialId}" requires host OAuth access`);
+            }
+            token = (await access.resolveOAuthAccess({ id: credentialId, scope: "full" })).accessToken;
+        }
+        const source = new Request(input, init);
+        let replayable = true;
+        try {
+            source.clone();
+        }
+        catch {
+            replayable = false;
+        }
+        const send = async (accessToken) => {
+            const request = replayable ? source.clone() : source;
+            const requestHeaders = new Headers(request.headers);
+            for (const [name, value] of Object.entries(headers))
+                requestHeaders.set(name, value);
+            if (accessToken)
+                requestHeaders.set("Authorization", `Bearer ${accessToken}`);
+            return baseFetch(new Request(request, { headers: requestHeaders }));
+        };
+        const first = await send(token);
+        if (first.status !== 401 || !isOAuth || !credentialId || !replayable || source.signal.aborted) {
+            return first;
+        }
+        const refreshed = await access.resolveOAuthAccess({
+            id: credentialId,
+            scope: "full",
+            forceRefresh: true,
+        });
+        return send(refreshed.accessToken);
+    });
+}
 /**
  * Infer the transport when the config doesn't name one: a url-only entry is
  * HTTP, everything else stdio. This is the CC `.mcp.json` convention —
@@ -186,9 +236,7 @@ const MAX_MCP_IMAGE_SPILLS_PER_TOOL = 50;
 const MAX_MCP_IMAGE_BYTES = 8 * 1024 * 1024;
 function spillTimestamp(filename, prefix) {
     const suffix = filename.slice(prefix.length);
-    const dot = suffix.lastIndexOf(".");
-    const raw = dot === -1 ? suffix : suffix.slice(0, dot);
-    const timestamp = Number(raw);
+    const timestamp = Number(/^\d+/.exec(suffix)?.[0]);
     return Number.isFinite(timestamp) ? timestamp : 0;
 }
 async function pruneMcpImageSpills(baseDir, prefix) {
@@ -232,7 +280,7 @@ export async function spillMcpImage(serverName, toolName, base64, mimeType, opts
     const safeServer = serverName.replace(/[^\w.-]+/g, "_");
     const safeTool = toolName.replace(/[^\w.-]+/g, "_");
     const prefix = `${safeServer}-${safeTool}-`;
-    const filename = `${prefix}${now()}.${ext}`;
+    const filename = `${prefix}${now()}-${randomUUID().slice(0, 8)}.${ext}`;
     const filePath = join(baseDir, filename);
     try {
         await mkdir(baseDir, { recursive: true });
@@ -472,9 +520,11 @@ export class MCPManager {
             // credentialRef resolves against user-scope credential access. The shared
             // MCPManager pool has no per-session cwd, and MCP-referenced credentials
             // (e.g. a Figma token) remain user-global by design.
-            const headers = await buildHttpHeadersWithCredentialAccess(name, config);
+            const access = getCredentialAccess();
+            const headers = buildHttpHeaders(name, { ...config, credentialRef: undefined });
             transport = new StreamableHTTPClientTransport(new URL(config.url), {
                 requestInit: Object.keys(headers).length ? { headers } : undefined,
+                fetch: createMcpAuthenticatedFetch(name, config, access),
             });
         }
         else {

package/dist/tool-system/path-policy.d.ts

@@ -49,11 +49,30 @@ export interface ClassifyOptions {
     /** "read" or "write" — different defaults for sensitive paths. */
     operation: PathOperation;
 }
+export interface FinalWritePathSnapshot {
+    resolvedPath: string;
+    workspacePath: string;
+    insideWorkspace: boolean;
+}
 export type PathApprovalScope = "once" | "session" | "project";
 /** Test seam: clear the in-memory session grants. */
 export declare function _resetSessionPathGrants(): void;
 export declare function openSessionPathApprovals(sessionId: string): void;
 export declare function clearSessionPathApprovals(sessionId: string): void;
+/**
+ * Capture the concrete target approved by the executor's first path-policy
+ * pass. The snapshot is carried on the internal args object via a symbol, so
+ * it cannot collide with an LLM-supplied schema property or leak into logs.
+ */
+export declare function attachFinalWritePathSnapshot(args: Record<string, unknown>, filePath: string, workspaceRoot: string): Record<string, unknown>;
+export declare function getFinalWritePathSnapshot(args: Record<string, unknown>, filePath: string, workspaceRoot: string): FinalWritePathSnapshot;
+export declare function revalidateFinalWritePath(filePath: string, workspaceRoot: string, approved: FinalWritePathSnapshot): {
+    resolvedPath: string;
+} | {
+    error: string;
+};
+/** Open the already-revalidated final path without following its last segment. */
+export declare function writeFileNoFollow(filePath: string, content: string): Promise<void>;
 /**
  * Classify a file path against the workspace + sensitive-path policy.
  *

package/dist/tool-system/path-policy.js

@@ -29,10 +29,12 @@
  * approval round-trip; it is not an authority to write anywhere on disk.
  * Callers must consult classifyPath before honoring acceptEdits.
  */
-import { realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { open } from "node:fs/promises";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { dirname, isAbsolute, join, resolve as resolvePath, sep } from "node:path";
+const FINAL_WRITE_PATH_SNAPSHOT = Symbol("codeshell.finalWritePathSnapshot");
 /**
  * Default sensitive path patterns. These are evaluated AFTER home-expansion
  * and resolution, so a literal "$HOME/.ssh" and a symlink at /tmp/x → ~/.ssh
@@ -325,6 +327,65 @@ function safeRealpath(p) {
     }
     return abs;
 }
+/**
+ * Capture the concrete target approved by the executor's first path-policy
+ * pass. The snapshot is carried on the internal args object via a symbol, so
+ * it cannot collide with an LLM-supplied schema property or leak into logs.
+ */
+export function attachFinalWritePathSnapshot(args, filePath, workspaceRoot) {
+    const resolvedPath = safeRealpath(filePath);
+    const workspacePath = safeRealpath(workspaceRoot);
+    const snapshot = {
+        resolvedPath,
+        workspacePath,
+        insideWorkspace: isInsideDir(resolvedPath, workspacePath),
+    };
+    return { ...args, [FINAL_WRITE_PATH_SNAPSHOT]: snapshot };
+}
+export function getFinalWritePathSnapshot(args, filePath, workspaceRoot) {
+    const carried = args[FINAL_WRITE_PATH_SNAPSHOT];
+    if (carried && typeof carried === "object") {
+        return carried;
+    }
+    // Direct tool calls do not pass through ToolExecutor. Preserve that API by
+    // taking the baseline at handler entry, while still protecting Edit's
+    // read-to-write interval with a second check before its writeFile.
+    const resolvedPath = safeRealpath(filePath);
+    const workspacePath = safeRealpath(workspaceRoot);
+    return {
+        resolvedPath,
+        workspacePath,
+        insideWorkspace: isInsideDir(resolvedPath, workspacePath),
+    };
+}
+export function revalidateFinalWritePath(filePath, workspaceRoot, approved) {
+    const currentPath = safeRealpath(filePath);
+    const currentWorkspace = safeRealpath(workspaceRoot);
+    const sameTarget = normPath(currentPath) === normPath(approved.resolvedPath);
+    const sameWorkspace = normPath(currentWorkspace) === normPath(approved.workspacePath);
+    const crossedWorkspaceBoundary = approved.insideWorkspace && !isInsideDir(currentPath, currentWorkspace);
+    if (crossedWorkspaceBoundary || !sameTarget || !sameWorkspace) {
+        const reason = crossedWorkspaceBoundary
+            ? "final write path resolved outside the workspace after approval"
+            : "final write path changed after approval";
+        return {
+            error: `Error: ${reason}; refusing to write. ` +
+                `Approved target: ${approved.resolvedPath}. Current target: ${currentPath}`,
+        };
+    }
+    return { resolvedPath: currentPath };
+}
+/** Open the already-revalidated final path without following its last segment. */
+export async function writeFileNoFollow(filePath, content) {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
+    const handle = await open(filePath, flags, 0o666);
+    try {
+        await handle.writeFile(content, "utf-8");
+    }
+    finally {
+        await handle.close();
+    }
+}
 function isInsideDir(child, parent) {
     const c = normPath(child);
     const par = normPath(parent);