@cjhyy/code-shell-core 0.7.0 → 0.8.0

package/dist/plugins/pluginMcpIntegrity.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const DIGEST_DOMAIN = "codeshell-plugin-mcp-v1";
+const ABSENT_MCP = "<absent>";
+const UNSAFE_MCP = "<unsafe>";
+const MAX_PLUGIN_MCP_CONFIG_BYTES = 1024 * 1024;
+function effectiveMcpBytes(installPath) {
+    for (const fileName of ["mcp-servers.json", ".mcp.json"]) {
+        const path = join(installPath, fileName);
+        let info;
+        try {
+            info = lstatSync(path);
+        }
+        catch {
+            // mcp-servers.json wins when present; otherwise try the CC fallback.
+            continue;
+        }
+        if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_PLUGIN_MCP_CONFIG_BYTES) {
+            return `${UNSAFE_MCP}:${fileName}`;
+        }
+        try {
+            return Buffer.concat([Buffer.from(`${fileName}\0`), readFileSync(path)]);
+        }
+        catch {
+            return `${UNSAFE_MCP}:${fileName}`;
+        }
+    }
+    return ABSENT_MCP;
+}
+/**
+ * Digest the exact effective declaration selected by the runtime. The file
+ * name is part of the digest so switching between native and CC shapes cannot
+ * inherit approval accidentally.
+ */
+export function pluginMcpDigest(installPath) {
+    return createHash("sha256")
+        .update(DIGEST_DOMAIN)
+        .update("\0")
+        .update(effectiveMcpBytes(installPath))
+        .digest("hex");
+}
+export function verifyPluginMcpIntegrity(entry) {
+    if (!entry.mcpDigest)
+        return "legacy";
+    return pluginMcpDigest(entry.installPath) === entry.mcpDigest ? "verified" : "changed";
+}
+/**
+ * Compute trust for one install. The caller supplies whether the declaration
+ * currently normalizes to at least one runnable MCP server, keeping the trust
+ * layer coupled to the runtime's strict schema rather than a second parser.
+ */
+export function pluginMcpApprovalState(entry, hasMcpServers) {
+    const integrity = verifyPluginMcpIntegrity(entry);
+    if (integrity === "changed")
+        return "changed";
+    if (!hasMcpServers)
+        return "none";
+    if (integrity === "legacy")
+        return "legacy";
+    return entry.approvedMcpDigest === entry.mcpDigest ? "approved" : "pending";
+}
+/**
+ * Fields written at install/update. Installs with runnable MCP servers start
+ * pending; an explicitly approved identical digest survives an update.
+ */
+export function pluginMcpInstallRecord(installPath, hasMcpServers, previousEntries = []) {
+    const mcpDigest = pluginMcpDigest(installPath);
+    const previouslyApproved = previousEntries.some((entry) => entry.mcpDigest === mcpDigest && entry.approvedMcpDigest === entry.mcpDigest);
+    return {
+        mcpDigest,
+        ...(!hasMcpServers || previouslyApproved ? { approvedMcpDigest: mcpDigest } : {}),
+    };
+}

package/dist/plugins/types.d.ts

@@ -71,6 +71,36 @@ export interface PluginInstallEntry {
     installedAt: string;
     lastUpdated: string;
     gitCommitSha?: string;
+    /** CodeShell extension: digest of hooks/hooks.json captured at install/update. */
+    hookDigest?: string;
+    /**
+     * CodeShell extension: the hook digest the user explicitly approved.
+     * Missing means executable hooks are pending approval. Hook-free installs
+     * auto-approve their absent-hooks digest so they never show a prompt.
+     */
+    approvedHookDigest?: string;
+    /**
+     * Bounded display snapshot of the last explicitly approved hook definition.
+     * It is non-executable review metadata used to show per-command update diffs.
+     */
+    approvedHookSnapshot?: StoredPluginHookReview[];
+    /** CodeShell extension: digest of the effective plugin MCP declaration. */
+    mcpDigest?: string;
+    /**
+     * CodeShell extension: the MCP digest the user explicitly approved.
+     * Missing means plugin-provided external processes / remote connections are
+     * pending approval. Installs without any valid MCP servers auto-approve.
+     */
+    approvedMcpDigest?: string;
+}
+export interface StoredPluginHookReview {
+    rawEvent: string;
+    matcher?: string;
+    command: string;
+    commandDigest: string;
+    commandTruncated?: boolean;
+    async?: boolean;
+    timeoutMs?: number;
 }
 export interface InstalledPluginsV2 {
     version: 2;

package/dist/plugins/varRewrite.d.ts

@@ -2,7 +2,11 @@
  * Plugin variable rewriter.
  *
  * After a plugin is materialized into the cache dir, walk its files and
- * rewrite every occurrence of `CLAUDE_PLUGIN_ROOT` to `CODESHELL_PLUGIN_ROOT`.
+ * rewrite Claude-specific plugin environment variables to CodeShell-native
+ * names:
+ *
+ * - `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT`
+ * - `CLAUDE_PLUGIN_DATA` → `CODESHELL_PLUGIN_DATA`
  *
  * Why: plugins authored against Claude Code's protocol embed
  * `${CLAUDE_PLUGIN_ROOT}` in their hooks.json command strings and inside
@@ -32,11 +36,11 @@ export interface RewriteSummary {
     rewrittenPaths: string[];
 }
 /**
- * Rewrite every `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT` under
- * `installPath`, then drop a breadcrumb file at the root.
+ * Rewrite Claude-specific plugin environment variables under `installPath`,
+ * then drop a breadcrumb file at the root.
  *
  * Idempotent: re-running on an already-rewritten tree is a no-op for the
- * rewrite (no `CLAUDE_PLUGIN_ROOT` left) but refreshes the breadcrumb's
- * timestamp so the user can see when the most recent install/update ran.
+ * rewrite but refreshes the breadcrumb's timestamp so the user can see when
+ * the most recent install/update ran.
  */
 export declare function rewritePluginVars(installPath: string): RewriteSummary;

package/dist/plugins/varRewrite.js

@@ -2,7 +2,11 @@
  * Plugin variable rewriter.
  *
  * After a plugin is materialized into the cache dir, walk its files and
- * rewrite every occurrence of `CLAUDE_PLUGIN_ROOT` to `CODESHELL_PLUGIN_ROOT`.
+ * rewrite Claude-specific plugin environment variables to CodeShell-native
+ * names:
+ *
+ * - `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT`
+ * - `CLAUDE_PLUGIN_DATA` → `CODESHELL_PLUGIN_DATA`
  *
  * Why: plugins authored against Claude Code's protocol embed
  * `${CLAUDE_PLUGIN_ROOT}` in their hooks.json command strings and inside
@@ -28,8 +32,10 @@
  */
 import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-const FROM = "CLAUDE_PLUGIN_ROOT";
-const TO = "CODESHELL_PLUGIN_ROOT";
+const REWRITES = [
+    ["CLAUDE_PLUGIN_ROOT", "CODESHELL_PLUGIN_ROOT"],
+    ["CLAUDE_PLUGIN_DATA", "CODESHELL_PLUGIN_DATA"],
+];
 const SCAN_BYTES = 8192;
 function isLikelyBinary(buf) {
     const len = Math.min(buf.length, SCAN_BYTES);
@@ -72,9 +78,12 @@ function walkAndRewrite(dir, summary) {
         if (isLikelyBinary(raw))
             continue;
         const text = raw.toString("utf8");
-        if (!text.includes(FROM))
+        let rewritten = text;
+        for (const [from, to] of REWRITES) {
+            rewritten = rewritten.split(from).join(to);
+        }
+        if (rewritten === text)
             continue;
-        const rewritten = text.split(FROM).join(TO);
         try {
             writeFileSync(full, rewritten, "utf8");
             summary.filesRewritten += 1;
@@ -87,12 +96,12 @@ function walkAndRewrite(dir, summary) {
     }
 }
 /**
- * Rewrite every `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT` under
- * `installPath`, then drop a breadcrumb file at the root.
+ * Rewrite Claude-specific plugin environment variables under `installPath`,
+ * then drop a breadcrumb file at the root.
  *
  * Idempotent: re-running on an already-rewritten tree is a no-op for the
- * rewrite (no `CLAUDE_PLUGIN_ROOT` left) but refreshes the breadcrumb's
- * timestamp so the user can see when the most recent install/update ran.
+ * rewrite but refreshes the breadcrumb's timestamp so the user can see when
+ * the most recent install/update ran.
  */
 export function rewritePluginVars(installPath) {
     const summary = {
@@ -100,23 +109,23 @@ export function rewritePluginVars(installPath) {
         filesRewritten: 0,
         rewrittenPaths: [],
     };
-    let exists = false;
     try {
-        exists = statSync(installPath).isDirectory();
+        if (!statSync(installPath).isDirectory())
+            return summary;
     }
     catch {
-        exists = false;
-    }
-    if (!exists)
         return summary;
+    }
     walkAndRewrite(installPath, summary);
     const breadcrumb = {
         rewrittenAt: new Date().toISOString(),
-        from: FROM,
-        to: TO,
+        // Keep the original fields for older tooling that reads this breadcrumb.
+        from: REWRITES[0][0],
+        to: REWRITES[0][1],
+        rewrites: REWRITES.map(([from, to]) => ({ from, to })),
         filesScanned: summary.filesScanned,
         filesRewritten: summary.filesRewritten,
-        note: "codeshell rewrote plugin files at install time so ${CLAUDE_PLUGIN_ROOT} placeholders use codeshell's native env var. " +
+        note: "codeshell rewrote Claude-specific plugin environment placeholders to codeshell-native names at install time. " +
             "Upstream plugin sources are unchanged; only this local copy was modified.",
     };
     try {

package/dist/preset/index.d.ts

@@ -8,7 +8,9 @@
  * src/prompt/sections/*.md — each preset declares which sections to include.
  */
 import type { PermissionRule } from "../types.js";
-export declare const AGENT_PRESET_NAMES: readonly ["general", "terminal-coding"];
+import { type BuiltinTool } from "../tool-system/builtin/index.js";
+import type { CapabilityModule } from "../capabilities/index.js";
+export declare const AGENT_PRESET_NAMES: readonly ["harness-min", "general"];
 /** Built-in preset names. Custom presets use arbitrary strings via registerPreset(). */
 export type BuiltinPresetName = (typeof AGENT_PRESET_NAMES)[number];
 /** Any preset name — built-in or custom-registered. */
@@ -19,13 +21,12 @@ export interface AgentPreset {
     description: string;
     /** Ordered list of prompt section filenames (without .md). */
     promptSections: readonly string[];
-    /** Whether to inject git status into system context. */
-    injectGitStatus: boolean;
     builtinTools: string[];
     defaultPermissionRules: PermissionRule[];
 }
-export declare const BUILTIN_AGENT_PRESETS: Record<AgentPresetName, AgentPreset>;
+export declare const BUILTIN_AGENT_PRESETS: Record<BuiltinPresetName, AgentPreset>;
 export declare const DEFAULT_AGENT_PRESET: AgentPresetName;
+/** @deprecated Product hosts should install a capability with `defaultPreset`. */
 export declare const DEFAULT_CLI_PRESET: AgentPresetName;
 /**
  * Register a custom agent preset.
@@ -39,7 +40,6 @@ export declare const DEFAULT_CLI_PRESET: AgentPresetName;
  *   label: "Data Pipeline Orchestrator",
  *   description: "Manages ETL workflows and data quality checks.",
  *   promptSections: ["base", "orchestration"],
- *   injectGitStatus: false,
  *   builtinTools: ["Read", "Write", "Bash", "Glob", "Grep", "Agent"],
  *   defaultPermissionRules: [{ tool: "Read", decision: "allow" }],
  * });
@@ -47,11 +47,13 @@ export declare const DEFAULT_CLI_PRESET: AgentPresetName;
  */
 export declare function registerPreset(preset: AgentPreset): void;
 /** List all available preset names (built-in + custom). */
-export declare function listPresetNames(): string[];
-export declare function resolveAgentPreset(name?: string): AgentPreset;
+export declare function listPresetNames(capabilities?: readonly CapabilityModule[]): string[];
+export declare function resolveAgentPreset(name?: string, capabilities?: readonly CapabilityModule[]): AgentPreset;
 export interface BuildPresetSystemPromptOptions {
     activeToolNames?: readonly string[];
     platform?: NodeJS.Platform;
+    promptSections?: Readonly<Record<string, string>>;
+    toolCatalog?: readonly BuiltinTool[];
 }
 /**
  * Build the full system prompt for a preset by loading and joining its sections.
@@ -65,7 +67,8 @@ export interface BuildPresetSystemPromptOptions {
 export declare function buildPresetSystemPrompt(preset: AgentPreset, optionsOrActiveToolNames?: BuildPresetSystemPromptOptions | readonly string[]): string;
 export declare function resolveBuiltinToolNames(options?: {
     preset?: string;
-    host?: "desktop";
+    host?: string;
     enabledBuiltinTools?: string[];
     disabledBuiltinTools?: string[];
+    capabilities?: readonly CapabilityModule[];
 }): string[];

package/dist/preset/index.js

@@ -8,192 +8,32 @@
  * src/prompt/sections/*.md — each preset declares which sections to include.
  */
 import { loadSections } from "../prompt/section-loader.js";
-import { cronListToolDef } from "../tool-system/builtin/cron-list.definition.js";
-import { sleepToolDef } from "../tool-system/builtin/sleep.definition.js";
-export const AGENT_PRESET_NAMES = ["general", "terminal-coding"];
-// ─── Tool sets ───────────────────────────────────────────────────
-const GENERAL_BUILTIN_TOOLS = [
-    "Read",
-    "Write",
-    "Edit",
-    "ApplyPatch",
-    "Glob",
-    "Grep",
-    "Bash",
-    // Bash(run_in_background=true) companions — without these in the preset
-    // whitelist, the registry skips them (registerBuiltins filters BUILTIN_TOOLS
-    // by the selected set), so a model that correctly calls BashOutput after
-    // launching a background shell hits "Tool not found" and the turn dies.
-    "BashOutput",
-    "KillShell",
-    "ListShells",
-    // Browser automation (drive the in-app webview) — 3 semantic tools. Same
-    // whitelist requirement as the BashOutput trio above: registerBuiltins filters
-    // BUILTIN_TOOLS by the preset set, so without these the model calling
-    // browser_observe/etc. hits "Tool not found". They self-degrade to a clear
-    // error when no browser panel is wired (headless), so listing is safe.
-    "browser_observe",
-    "browser_act",
-    "browser_navigate",
-    "WebSearch",
-    "WebFetch",
-    "GenerateImage",
-    "GenerateVideo",
-    // Load a workspace image (by path) or an earlier history image (by number)
-    // into context so a vision model can SEE it. Same whitelist requirement as
-    // the rest: registered in BUILTIN_TOOLS but filtered out by registerBuiltins
-    // unless the preset names it — so it was registered-but-invisible before.
-    // Self-degrades to a text placeholder on non-vision models and gates format/
-    // size, so listing it unconditionally is safe.
-    "view_image",
-    "AskUserQuestion",
-    "Agent",
-    // AgentStatus removed: background agents now write to ~/.code-shell/agents/
-    // <id>.txt — the parent agent can Read/Bash tail that file for live progress.
-    // The implementation is still in the registry for SDK consumers if needed.
-    "AgentCancel",
-    "EnterPlanMode",
-    "ExitPlanMode",
-    "ToolSearch",
-    "TodoWrite",
-    sleepToolDef.name,
-    "Config",
-    "CronCreate",
-    "CronDelete",
-    cronListToolDef.name,
-    // cc-orchestrator:驱动外部 claude CLI 跑一轮。同 BashOutput/UseCredential/
-    // EditModelCatalog 的 whitelist 要求:已在 BUILTIN_TOOLS 注册,但 registerBuiltins
-    // 按 preset 集过滤 → 名单里没有它,agent 就没有「指挥 Claude Code」的工具,只能幻觉
-    // RemoteTrigger / 兜底 Bash `claude -p`(用户实测「为什么驱动 cc 没作为工具」)。
-    // 定时/循环驱动统一走 CronCreate(到点跑一轮引擎,prompt 里调 DriveAgent);
-    // 无人值守审批由 DriveAgent 自身 bypass 解决,不需要定时层专门的 CC 调度工具。
-    // DriveAgent 是通用驱动(cli: claude|codex);DriveClaudeCode 保留为 cli:claude 的
-    // 别名(老 prompt/记忆兼容)。两个都要在白名单里,否则 registerBuiltins 滤掉。
-    "DriveAgent",
-    "DriveAgentJobs",
-    "DriveClaudeCode",
-    // 编排时读 CC/Codex 剩余额度做规划(开几个/等重置/换 provider)。
-    "CheckQuota",
-    "Skill",
-    "AddMarketplace",
-    "MCPTool",
-    "ListMcpResources",
-    "ReadMcpResource",
-    "REPL",
-    "PowerShell",
-    // Persistent cross-session memory. Including these in the default preset is
-    // what lets the LLM list/read/save/delete memories during a normal session,
-    // AND what makes the end-of-session auto-dream consolidation work — its
-    // tool-call loop pulls these from the registry, so without them every dream
-    // run bailed with "missing memory tools". Save/Delete in the user scope have
-    // no explicit allow rule, so the default-mode classifier fallback asks;
-    // dream-scope writes go through freely.
-    "MemoryList",
-    "MemoryRead",
-    "MemorySave",
-    "MemoryDelete",
-    // AI 取用已存凭证(cookie/token/link)给 yt-dlp/curl 等。必须在 preset 白名单里
-    // 否则 registerBuiltins 滤掉它 → 即使存了凭证、注册了工具,AI 列表里也没有
-    // UseCredential(用户实测「找不到这个工具」的真因)。它带 isUseCredentialAvailable
-    // guard:cwd 凭证库为空时仍自动隐藏,所以无条件列入是安全的(空库不会冒出来)。
-    "UseCredential",
-    // 同理:把 cookie 凭证注入内置浏览器(恢复登录态后用 browser_* 工具)。带
-    // isInjectCredentialAvailable guard(无 cookie 凭证时自动隐藏),无条件列入安全。
-    "InjectCredential",
-    // AI 增/改模型 catalog(写 ~/.code-shell/model-catalog.user.json)。同 BashOutput/
-    // UseCredential 一样的 whitelist 要求:registerBuiltins 按 preset 集过滤 BUILTIN_TOOLS,
-    // 名单里没有它 → 即使工具已注册,AI 列表里也没有 → 用户实测「找不到这个工具」。
-    // 列入只是让 AI 看得到；执行期没有显式 allow rule，默认 classifier fallback 会审批。
-    "EditModelCatalog",
-    // Goal-mode control tools. Same whitelist requirement as the rest:
-    // registerBuiltins filters BUILTIN_TOOLS by the preset set, so a goal tool
-    // absent here is registered-but-invisible — the model never sees it and can
-    // neither self-declare completion (complete_goal) nor honor a user's request
-    // to abandon the goal (cancel_goal), stranding a persistent goal that only a
-    // manual disk edit could clear. cancel_goal is the "strong intent" escape
-    // hatch (requires confirm+reason); the turn-loop enforces the guard.
-    "complete_goal",
-    "cancel_goal",
-];
-const TERMINAL_CODING_EXTRA_TOOLS = [
-    "EnterWorktree",
-    "ExitWorktree",
-    "NotebookEdit",
-    "LSP",
-    "Brief",
-    "Arena",
-];
-// ─── Permission rules ────────────────────────────────────────────
-const GENERAL_PERMISSION_RULES = [
-    { tool: "Read", decision: "allow" },
-    { tool: "Glob", decision: "allow" },
-    { tool: "Grep", decision: "allow" },
-    { tool: "WebSearch", decision: "allow" },
-    { tool: "WebFetch", decision: "allow" },
-    { tool: "AskUserQuestion", decision: "allow" },
-    { tool: "Agent", decision: "allow" },
-    { tool: "AgentStatus", decision: "allow" },
-    { tool: "AgentCancel", decision: "allow" },
-    { tool: "EnterPlanMode", decision: "allow" },
-    { tool: "ExitPlanMode", decision: "allow" },
-    { tool: "ToolSearch", decision: "allow" },
-    { tool: "TodoWrite", decision: "allow" },
-    { tool: sleepToolDef.name, decision: "allow" },
-    { tool: cronListToolDef.name, decision: "allow" },
-    { tool: "CheckQuota", decision: "allow" },
-    { tool: "Skill", decision: "allow" },
-    // ListMcpResources only enumerates resource names (and the executor filters
-    // the list to this session's enabled servers). ReadMcpResource pulls actual
-    // content and is intentionally NOT auto-allowed here — with no explicit rule,
-    // default-mode classifier fallback asks the user. The tool's
-    // permissionDefault is only UI/metadata, not classifier input.
-    { tool: "ListMcpResources", decision: "allow" },
-    // Reading memory is always safe; writes (MemorySave/MemoryDelete) stay gated
-    // by explicit rules below plus default-mode ask fallback.
-    { tool: "MemoryList", decision: "allow" },
-    { tool: "MemoryRead", decision: "allow" },
-    // Browser automation (3 semantic tools). Rules are first-match-wins, ordered
-    // by specificity — so the action-gating rule for browser_act MUST come first:
-    // click/type/select mutate the page/form → "ask"; all other actions (hover/
-    // scroll/wait/press_key/list_tabs/switch_tab) fall through to the default
-    // allow rule below. observe (read-only) and navigate auto-allow.
-    // (Main-side sensitive-action + domain-whitelist enforcement also applies.)
-    {
-        tool: "browser_act",
-        argsPattern: { action: "^(click|type|select)$" },
-        decision: "ask",
-        reason: "browser_act click/type/select mutate the page",
-    },
-    { tool: "browser_observe", decision: "allow" },
-    { tool: "browser_navigate", decision: "allow" },
-];
+import { deriveBuiltinPresetExposure, deriveToolGatedPromptSections, } from "../tool-system/builtin/index.js";
+export const AGENT_PRESET_NAMES = ["harness-min", "general"];
+const HARNESS_MIN_EXPOSURE = deriveBuiltinPresetExposure("harness-min");
+const GENERAL_EXPOSURE = deriveBuiltinPresetExposure("general");
 // ─── Preset definitions ──────────────────────────────────────────
 export const BUILTIN_AGENT_PRESETS = {
+    "harness-min": {
+        name: "harness-min",
+        label: "Minimal Agent Harness",
+        description: "Domain-neutral orchestration with the minimal reusable tool surface.",
+        promptSections: ["harness-base", "orchestration", "tone"],
+        builtinTools: HARNESS_MIN_EXPOSURE.builtinTools,
+        defaultPermissionRules: HARNESS_MIN_EXPOSURE.defaultPermissionRules,
+    },
     general: {
         name: "general",
         label: "General Orchestrator",
         description: "Domain-agnostic orchestration for research, operations, automation, and long-running tasks.",
         promptSections: ["base", "orchestration", "browser", "tone"],
-        injectGitStatus: false,
-        builtinTools: [...GENERAL_BUILTIN_TOOLS],
-        defaultPermissionRules: GENERAL_PERMISSION_RULES,
-    },
-    "terminal-coding": {
-        name: "terminal-coding",
-        label: "Terminal Coding Assistant",
-        description: "General orchestration plus coding-focused guidance and code-navigation tools.",
-        promptSections: ["base", "orchestration", "coding", "browser", "tone"],
-        injectGitStatus: true,
-        builtinTools: [...GENERAL_BUILTIN_TOOLS, ...TERMINAL_CODING_EXTRA_TOOLS],
-        defaultPermissionRules: [
-            ...GENERAL_PERMISSION_RULES,
-            { tool: "LSP", decision: "allow" },
-            { tool: "Brief", decision: "allow" },
-        ],
+        builtinTools: GENERAL_EXPOSURE.builtinTools,
+        defaultPermissionRules: GENERAL_EXPOSURE.defaultPermissionRules,
     },
 };
-export const DEFAULT_AGENT_PRESET = "general";
-export const DEFAULT_CLI_PRESET = "terminal-coding";
+export const DEFAULT_AGENT_PRESET = "harness-min";
+/** @deprecated Product hosts should install a capability with `defaultPreset`. */
+export const DEFAULT_CLI_PRESET = DEFAULT_AGENT_PRESET;
 /** Registry of custom presets registered by external consumers. */
 const _customPresets = new Map();
 /**
@@ -208,7 +48,6 @@ const _customPresets = new Map();
  *   label: "Data Pipeline Orchestrator",
  *   description: "Manages ETL workflows and data quality checks.",
  *   promptSections: ["base", "orchestration"],
- *   injectGitStatus: false,
  *   builtinTools: ["Read", "Write", "Bash", "Glob", "Grep", "Agent"],
  *   defaultPermissionRules: [{ tool: "Read", decision: "allow" }],
  * });
@@ -218,32 +57,46 @@ export function registerPreset(preset) {
     _customPresets.set(preset.name, preset);
 }
 /** List all available preset names (built-in + custom). */
-export function listPresetNames() {
-    return [...AGENT_PRESET_NAMES, ..._customPresets.keys()];
+export function listPresetNames(capabilities = []) {
+    return [
+        ...new Set([
+            ...AGENT_PRESET_NAMES,
+            ..._customPresets.keys(),
+            ...capabilities.flatMap((capability) => (capability.presets ?? []).map((preset) => preset.name)),
+        ]),
+    ];
 }
-export function resolveAgentPreset(name) {
-    if (!name)
-        return BUILTIN_AGENT_PRESETS[DEFAULT_AGENT_PRESET];
+export function resolveAgentPreset(name, capabilities = []) {
+    let resolvedName = name;
+    if (!resolvedName) {
+        const defaults = [
+            ...new Set(capabilities
+                .map((capability) => capability.defaultPreset)
+                .filter((preset) => Boolean(preset))),
+        ];
+        if (defaults.length > 1) {
+            throw new Error(`Capabilities contributed conflicting default presets: ${defaults.join(", ")}`);
+        }
+        resolvedName = defaults[0] ?? DEFAULT_AGENT_PRESET;
+    }
+    const contributed = capabilities
+        .flatMap((capability) => [...(capability.presets ?? [])])
+        .find((preset) => preset.name === resolvedName);
+    if (contributed)
+        return contributed;
     // Check built-in first
-    const builtin = BUILTIN_AGENT_PRESETS[name];
+    const builtin = BUILTIN_AGENT_PRESETS[resolvedName];
     if (builtin)
         return builtin;
     // Check custom presets
-    const custom = _customPresets.get(name);
+    const custom = _customPresets.get(resolvedName);
     if (custom)
         return custom;
-    const allowed = listPresetNames().join(", ");
-    throw new Error(`Unknown agent preset "${name}". Available presets: ${allowed}`);
+    const allowed = listPresetNames(capabilities).join(", ");
+    throw new Error(`Unknown agent preset "${resolvedName}". Available presets: ${allowed}`);
 }
-/** Tool names that gate the "browser" prompt section — if NONE of these are in
- *  the active tool set (browser capability turned off), the section is dropped
- *  so the model isn't told how to use tools it can't see. Keep in sync with the
- *  browser tools registered in builtin/index.ts. */
-const BROWSER_SECTION_TOOLS = ["browser_observe", "browser_act", "browser_navigate"];
-/** Prompt sections whose inclusion is gated by an active tool being present. */
-const TOOL_GATED_SECTIONS = {
-    browser: BROWSER_SECTION_TOOLS,
-};
+/** Prompt-section capability links are contributed by builtin exposure metadata. */
+const TOOL_GATED_SECTIONS = deriveToolGatedPromptSections();
 function isActiveToolNamesList(value) {
     return Array.isArray(value);
 }
@@ -275,24 +128,30 @@ export function buildPresetSystemPrompt(preset, optionsOrActiveToolNames) {
     if (activeToolNames) {
         const active = new Set(activeToolNames);
         sections = sections.filter((s) => {
-            const gate = TOOL_GATED_SECTIONS[s];
+            const gate = options.toolCatalog
+                ? deriveToolGatedPromptSections(options.toolCatalog)[s]
+                : TOOL_GATED_SECTIONS[s];
             return !gate || gate.some((t) => active.has(t));
         });
     }
-    return [loadSections(sections), platformShellGuidance(options.platform ?? process.platform)]
+    return [
+        loadSections(sections, options.promptSections),
+        platformShellGuidance(options.platform ?? process.platform),
+    ]
         .filter(Boolean)
         .join("\n\n");
 }
 export function resolveBuiltinToolNames(options) {
-    const preset = resolveAgentPreset(options?.preset);
+    const preset = resolveAgentPreset(options?.preset, options?.capabilities);
     const names = new Set(preset.builtinTools);
     for (const name of options?.enabledBuiltinTools ?? []) {
         names.add(name);
     }
-    if (options?.host === "desktop") {
-        names.delete("EnterWorktree");
-        names.delete("ExitWorktree");
-        names.add("SwitchSessionWorkspace");
+    for (const capability of options?.capabilities ?? []) {
+        capability.adjustToolSelection?.(names, {
+            preset: preset.name,
+            host: options?.host,
+        });
     }
     for (const name of options?.disabledBuiltinTools ?? []) {
         names.delete(name);

package/dist/product/define.js

@@ -46,8 +46,15 @@ export function defineProduct(definition, runtime) {
     const presetName = presetDef.name;
     // Determine builtin tools: start from a base set, apply adapter overrides
     const baseTools = [
-        "Read", "Write", "Edit", "Glob", "Grep", "Bash",
-        "AskUserQuestion", "Agent", "ToolSearch",
+        "Read",
+        "Write",
+        "Edit",
+        "Glob",
+        "Grep",
+        "Bash",
+        "AskUserQuestion",
+        "Agent",
+        "ToolSearch",
         "TodoWrite",
     ];
     const enabledSet = new Set([...baseTools, ...(adapter?.enableTools ?? [])]);
@@ -71,7 +78,6 @@ export function defineProduct(definition, runtime) {
         label: presetDef.label,
         description: presetDef.description,
         promptSections: presetDef.sections ?? ["base", "orchestration"],
-        injectGitStatus: presetDef.injectGitStatus ?? false,
         builtinTools: [...enabledSet],
         defaultPermissionRules: permissionRules,
     };

package/dist/product/types.d.ts

@@ -39,8 +39,6 @@ export interface ProductPreset {
     customPrompt?: string;
     /** Additional text appended after the main system prompt. */
     appendPrompt?: string;
-    /** Whether to inject git status into system context. Default: false */
-    injectGitStatus?: boolean;
 }
 export interface CustomTool {
     /** Tool definition (name, description, inputSchema). */