@cjhyy/code-shell-core 0.7.0 → 0.8.0

package/dist/credentials/store.js

@@ -1,9 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
+import { credentialAllowsEnvExposure, credentialSecretHint, } from "./types.js";
 import { getDefaultCredentialCipher } from "./cipher.js";
 import { logger } from "../logging/logger.js";
 import { summarizeOAuthCredentialSecret } from "./oauth.js";
+import { isBrowserOAuthLinkCredential } from "./oauth.js";
 /** 测试可经 process.env.HOME 覆盖(镜像 settings/manager.ts userHome)。 */
 function userHome() {
     return process.env.HOME ?? homedir();
@@ -15,6 +17,7 @@ const EMPTY = { version: 1, credentials: [] };
  */
 export class CredentialStore {
     cwd;
+    userDirOverride;
     cipher;
     /**
      * @param cwd     project root for the project-scope store (undefined → user only).
@@ -24,13 +27,22 @@ export class CredentialStore {
      *                returns PLAINTEXT secrets; encryption is applied only at the
      *                disk boundary (read decrypts, write encrypts).
      */
-    constructor(cwd, cipher) {
+    constructor(cwd, cipher, 
+    /**
+     * Override the user-scope store directory (the `~/.code-shell` layer;
+     * `credentials.json` lives directly inside it). Absent → today's
+     * behavior: `join(userHome(), ".code-shell")` resolved per call.
+     * Injection point for identity-scoped server deployments.
+     */
+    userDirOverride) {
         this.cwd = cwd;
+        this.userDirOverride = userDirOverride;
         this.cipher = cipher ?? getDefaultCredentialCipher();
     }
     pathFor(scope) {
-        if (scope === "user")
-            return join(userHome(), ".code-shell", "credentials.json");
+        if (scope === "user") {
+            return join(this.userDirOverride ?? join(userHome(), ".code-shell"), "credentials.json");
+        }
         if (!this.cwd)
             return undefined;
         return join(this.cwd, ".code-shell", "credentials.json");
@@ -93,11 +105,14 @@ export class CredentialStore {
     /** Upsert by id within a scope. */
     save(scope, cred) {
         const file = this.read(scope);
+        const safeCredential = credentialAllowsEnvExposure(cred.type)
+            ? cred
+            : { ...cred, exposeAsEnv: undefined };
         const idx = file.credentials.findIndex((c) => c.id === cred.id);
         if (idx >= 0)
-            file.credentials[idx] = cred;
+            file.credentials[idx] = safeCredential;
         else
-            file.credentials.push(cred);
+            file.credentials.push(safeCredential);
         this.write(scope, file);
     }
     /**
@@ -110,7 +125,12 @@ export class CredentialStore {
         const idx = file.credentials.findIndex((c) => c.id === id);
         if (idx < 0)
             return;
-        file.credentials[idx] = { ...file.credentials[idx], ...fields };
+        const current = file.credentials[idx];
+        file.credentials[idx] = {
+            ...current,
+            ...fields,
+            ...(credentialAllowsEnvExposure(current.type) ? {} : { exposeAsEnv: undefined }),
+        };
         this.write(scope, file);
     }
     remove(scope, id) {
@@ -161,6 +181,8 @@ export class CredentialStore {
             : [this.read("user").credentials, this.read("project").credentials];
         for (const layer of layers) {
             for (const c of layer) {
+                if (!credentialAllowsEnvExposure(c.type))
+                    continue;
                 const name = c.exposeAsEnv?.trim();
                 if (name && typeof c.secret === "string" && c.secret.length > 0) {
                     out[name] = c.secret;
@@ -174,12 +196,12 @@ export class CredentialStore {
             const { secret, ...rest } = c;
             return {
                 ...rest,
+                ...(credentialAllowsEnvExposure(c.type) ? {} : { exposeAsEnv: undefined }),
                 hasSecret: typeof secret === "string" && secret.length > 0,
-                // Reveal at most the last 4 chars — and ONLY when the secret is longer
-                // than 4, so those chars aren't the whole secret. `"ab".slice(-4)` is
-                // "ab", so a short secret would otherwise leak in full through the hint.
-                secretHint: secret ? (secret.length > 4 ? `****${secret.slice(-4)}` : "****") : undefined,
-                ...(c.type === "oauth" ? { oauthStatus: summarizeOAuthCredentialSecret(secret) } : {}),
+                secretHint: credentialSecretHint(c.type, secret),
+                ...(c.type === "oauth" || isBrowserOAuthLinkCredential(c)
+                    ? { oauthStatus: summarizeOAuthCredentialSecret(secret) }
+                    : {}),
             };
         });
     }

package/dist/credentials/types.d.ts

@@ -4,6 +4,14 @@
  *   (用户主动按域拓取存,支持同域多账号),见 credential-use-gate 设计稿。
  */
 export type CredentialType = "token" | "link" | "cookie" | "oauth";
+/**
+ * Only established single-value credentials may be copied into a process
+ * environment. OAuth records and cookie jars are structured multi-secret
+ * values and must remain behind the credential resolver boundary.
+ */
+export declare function credentialAllowsEnvExposure(type: CredentialType): boolean;
+/** Build a renderer-safe hint without deriving bytes from structured JSON. */
+export declare function credentialSecretHint(type: CredentialType, secret: string | undefined): string | undefined;
 export interface OAuthCredentialSecret {
     /** Schema version for the JSON stored in Credential.secret. */
     version?: 1;
@@ -13,6 +21,8 @@ export interface OAuthCredentialSecret {
     refreshToken?: string;
     /** ISO-8601 expiry time for accessToken. Missing means "unknown", not expired. */
     expiresAt?: string;
+    /** Optional ISO-8601 expiry time for a rotating refresh token. */
+    refreshTokenExpiresAt?: string;
     /** Upstream token type, usually Bearer. Stored for round-trip/debugging. */
     tokenType?: string;
     /** Space-delimited OAuth scope string returned by many token endpoints. */
@@ -25,6 +35,26 @@ export interface OAuthCredentialSecret {
     clientId?: string;
     /** Optional confidential client secret, if the integration requires it. */
     clientSecret?: string;
+    /** OAuth issuer discovered for the MCP protected resource. */
+    issuer?: string;
+    /** RFC 8707 resource indicator used for authorization/token requests. */
+    resource?: string;
+    /** Optional endpoint used to revoke the refresh/access token on logout. */
+    revocationEndpoint?: string;
+    /** Dynamic registration result, retained with the encrypted secret. */
+    clientRegistration?: {
+        clientId: string;
+        clientSecret?: string;
+        clientIdIssuedAt?: number;
+        clientSecretExpiresAt?: number;
+    };
+}
+export interface OAuthTokenResponse {
+    access_token: unknown;
+    refresh_token?: unknown;
+    expires_in?: unknown;
+    token_type?: unknown;
+    scope?: unknown;
 }
 export interface OAuthCredentialPublicStatus {
     state: "valid" | "expired" | "missing" | "invalid";
@@ -82,8 +112,35 @@ export interface Credential {
         domain?: string;
         scope?: "domain" | "all";
         switchMode?: "clear" | "merge";
+        /** Link provider id for credentials owned by a local/server app connection. */
+        linkProvider?: string;
+        /** Provider-specific connection method, e.g. fine-grained-pat or github-app. */
+        linkConnectionMethod?: string;
+        /** Where Link actions execute. Local is preferred when both runtimes are usable. */
+        linkExecutionRuntime?: "local" | "server";
+        /** How a local Link credential was obtained without exposing its secret to the renderer. */
+        linkAuthSource?: "manual-token" | "github-cli" | "cli-session" | "browser-oauth";
+        /** Fixed execution adapter. CLI bindings never resolve or copy a provider token. */
+        linkExecutionBackend?: "http-token" | "cli";
+        /** False for provider-owned Link secrets that must only flow through LinkAction. */
+        agentExposable?: boolean;
+        /** Stable upstream account/user id returned by the provider validation endpoint. */
+        linkAccountId?: string;
+        /** Human-readable upstream account label shown in the Link page. */
+        linkAccountLabel?: string;
+        /** Safe resource labels returned during validation for a compact Link card preview. */
+        linkResourceLabels?: string[];
+        /** Provider Action ids enabled for this connection. */
+        linkCapabilityIds?: string[];
+        /** ISO timestamp of the last successful live provider validation. */
+        linkLastVerifiedAt?: string;
         /** OAuth provider/integration id, e.g. "figma". */
         oauthProvider?: string;
+        /** MCP server identity associated with an advanced OAuth login. */
+        mcpServerName?: string;
+        mcpServerUrl?: string;
+        issuer?: string;
+        resource?: string;
         /** OAuth authorization endpoint, used by UI/login launchers. */
         authUrl?: string;
         /** OAuth token endpoint, duplicated from secret for non-secret UI display. */
@@ -92,8 +149,12 @@ export interface Credential {
         clientId?: string;
         /** OAuth scopes requested for this credential. */
         scopes?: string[];
-        /** Last successful refresh time; refresh wiring is reserved for a later step. */
+        revocationEndpoint?: string;
+        /** Last successful refresh time. */
         lastRefreshAt?: string;
+        /** Normalized refresh diagnostics; never contains endpoint response bodies. */
+        lastRefreshFailedAt?: string;
+        lastRefreshErrorCode?: "invalid_grant" | "network" | "server_error" | "invalid_response";
     };
 }
 export interface CredentialStoreFile {

package/dist/credentials/types.js

@@ -1 +1,16 @@
-export {};
+/**
+ * Only established single-value credentials may be copied into a process
+ * environment. OAuth records and cookie jars are structured multi-secret
+ * values and must remain behind the credential resolver boundary.
+ */
+export function credentialAllowsEnvExposure(type) {
+    return type === "token" || type === "link";
+}
+/** Build a renderer-safe hint without deriving bytes from structured JSON. */
+export function credentialSecretHint(type, secret) {
+    if (!secret)
+        return undefined;
+    if (type === "oauth" || type === "cookie")
+        return "****";
+    return secret.length > 4 ? `****${secret.slice(-4)}` : "****";
+}

package/dist/credentials/use-credential-tool.js

@@ -24,6 +24,13 @@ const BASE_DESCRIPTION = "Use a stored credential (token / API key / login cooki
     "value; cookie credentials are materialized to a temporary Netscape cookies.txt file " +
     "(use it as `yt-dlp --cookies <cookiesFile>` / `curl -b <cookiesFile>`). " +
     "Each use is gated by a quick user approval unless auto-approve is on.";
+function isAgentExposableCredential(credential) {
+    if (credential.meta?.agentExposable === false)
+        return false;
+    return !(credential.type === "link" &&
+        credential.meta?.linkExecutionRuntime === "local" &&
+        credential.meta.linkProvider);
+}
 export const useCredentialToolDef = {
     name: TOOL_NAME,
     description: BASE_DESCRIPTION,
@@ -47,7 +54,7 @@ export const useCredentialToolDef = {
  */
 export function useCredentialToolDefFor(cwd) {
     try {
-        const list = getCredentialAccess().listMasked(cwd, "full");
+        const list = getCredentialAccess().listMasked(cwd, "full").filter(isAgentExposableCredential);
         if (list.length === 0)
             return useCredentialToolDef;
         const names = list.map((c) => `${c.id} (${c.type})`).join(", ");
@@ -113,6 +120,7 @@ export async function useCredentialTool(args, ctx) {
     if (!id) {
         const credentials = access
             .listMasked(cwd, scope)
+            .filter(isAgentExposableCredential)
             .map((c) => ({ id: c.id, label: c.label, type: c.type }));
         return json({ kind: "list", credentials });
     }
@@ -120,6 +128,12 @@ export async function useCredentialTool(args, ctx) {
     if (!cred) {
         return json({ kind: "error", error: `凭证不存在: "${id}"。调用本工具(无参)可列出可用凭证。` });
     }
+    if (!isAgentExposableCredential(cred)) {
+        return json({
+            kind: "error",
+            error: `凭证「${cred.label}」只能通过 Link Action 使用，不能读取原始 Token。`,
+        });
+    }
     // 取值前过门
     const ask = ctx?.askUser
         ? (q, opts) => ctx.askUser(q, opts)

package/dist/engine/auxiliary-pipeline.d.ts

@@ -0,0 +1,40 @@
+import type { LLMConfig, TokenUsage } from "../types.js";
+import { createLLMClient } from "../llm/client-factory.js";
+import type { ModelPool } from "../llm/model-pool.js";
+import type { SettingsManager } from "../settings/manager.js";
+import type { ToolRegistry } from "../tool-system/registry.js";
+import type { ToolContext } from "../tool-system/context.js";
+import type { Transcript } from "../session/transcript.js";
+import type { CumulativeUsageCounters } from "../session/usage.js";
+import type { EngineConfig } from "./types.js";
+export type EngineLlmClient = Awaited<ReturnType<typeof createLLMClient>>;
+export interface ResolvedAuxClient {
+    client: EngineLlmClient;
+    maxContextTokens: number;
+}
+export interface MemoriesConfig {
+    maxCount?: number;
+    maxAge?: number;
+    extractionModel?: string;
+    autoExtract?: boolean;
+}
+export declare function sameLlmIdentity(a: LLMConfig, b: LLMConfig): boolean;
+export declare function buildSummarizeFn(client: EngineLlmClient, recordCumulativeUsage?: (usage: TokenUsage) => CumulativeUsageCounters): (prompt: string, signal?: AbortSignal) => Promise<string>;
+export declare class AuxiliaryPipeline {
+    private readonly deps;
+    private auxClientCache?;
+    constructor(deps: {
+        config: () => EngineConfig;
+        settings: () => SettingsManager;
+        modelPool: () => ModelPool;
+        toolRegistry: () => ToolRegistry;
+        toolContext: () => ToolContext;
+    });
+    buildSummarizeFn(client: EngineLlmClient, recordCumulativeUsage?: (usage: TokenUsage) => CumulativeUsageCounters): (prompt: string, signal?: AbortSignal) => Promise<string>;
+    readMemoriesConfig(): MemoriesConfig | undefined;
+    resolveAuxClient(fallback: EngineLlmClient): Promise<EngineLlmClient>;
+    resolveAuxClientWithMetadata(fallback: EngineLlmClient, fallbackMaxContextTokens?: number): Promise<ResolvedAuxClient>;
+    runMemoryPipeline(transcript: Transcript, sessionId: string, cwd: string, primaryClient: EngineLlmClient, recordBilledUsage?: (usage: TokenUsage) => void): Promise<void>;
+    private runDreamLoop;
+    private resolveExtractionClient;
+}

package/dist/engine/auxiliary-pipeline.js

@@ -0,0 +1,181 @@
+import { createLLMClient } from "../llm/client-factory.js";
+import { logger } from "../logging/logger.js";
+import { sanitizeContent } from "../logging/sanitize-messages.js";
+import { MemoryOrchestrator } from "../services/memory-orchestrator.js";
+import { runDreamConsolidation } from "../services/dream-consolidation.js";
+import { resolveAuxKey } from "./aux-key.js";
+export function sameLlmIdentity(a, b) {
+    return (a.model === b.model &&
+        (a.baseUrl ?? undefined) === (b.baseUrl ?? undefined) &&
+        (a.provider ?? undefined) === (b.provider ?? undefined) &&
+        (a.providerKind ?? undefined) === (b.providerKind ?? undefined) &&
+        (a.maxTokens ?? undefined) === (b.maxTokens ?? undefined) &&
+        JSON.stringify(a.reasoning ?? null) === JSON.stringify(b.reasoning ?? null));
+}
+export function buildSummarizeFn(client, recordCumulativeUsage) {
+    return async (prompt, signal) => {
+        const response = await client.createMessage({
+            systemPrompt: "You are a conversation summarizer. Be concise and factual.",
+            messages: [{ role: "user", content: prompt }],
+            tools: [],
+            maxTokens: 1024,
+            billingEnabled: true,
+            requestVisible: false,
+            reasoning: { mode: "off" },
+            signal,
+        });
+        if (response.usage)
+            recordCumulativeUsage?.(response.usage);
+        return response.text;
+    };
+}
+export class AuxiliaryPipeline {
+    deps;
+    auxClientCache;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    buildSummarizeFn(client, recordCumulativeUsage) {
+        return buildSummarizeFn(client, recordCumulativeUsage);
+    }
+    readMemoriesConfig() {
+        try {
+            return this.deps.settings().get().memories;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async resolveAuxClient(fallback) {
+        return (await this.resolveAuxClientWithMetadata(fallback)).client;
+    }
+    async resolveAuxClientWithMetadata(fallback, fallbackMaxContextTokens = 200_000) {
+        let auxKey;
+        try {
+            const settings = this.deps.settings();
+            settings.invalidate();
+            auxKey = resolveAuxKey(settings.get());
+        }
+        catch {
+            return { client: fallback, maxContextTokens: fallbackMaxContextTokens };
+        }
+        if (!auxKey)
+            return { client: fallback, maxContextTokens: fallbackMaxContextTokens };
+        const modelPool = this.deps.modelPool();
+        const entry = modelPool.get(auxKey);
+        if (entry && sameLlmIdentity(modelPool.toLLMConfig(entry), this.deps.config().llm)) {
+            return {
+                client: fallback,
+                maxContextTokens: entry.maxContextTokens ?? fallbackMaxContextTokens,
+            };
+        }
+        if (this.auxClientCache?.key === auxKey) {
+            return {
+                client: this.auxClientCache.client,
+                maxContextTokens: entry?.maxContextTokens ?? fallbackMaxContextTokens,
+            };
+        }
+        if (!entry) {
+            logger.warn("engine.aux_model_missing", { auxModelKey: auxKey });
+            return { client: fallback, maxContextTokens: fallbackMaxContextTokens };
+        }
+        try {
+            const client = await createLLMClient(modelPool.toLLMConfig(entry), this.deps.config().clientDefaults);
+            this.auxClientCache = { key: auxKey, client };
+            return {
+                client,
+                maxContextTokens: entry.maxContextTokens ?? fallbackMaxContextTokens,
+            };
+        }
+        catch (error) {
+            logger.warn("engine.aux_model_build_failed", {
+                auxModelKey: auxKey,
+                error: error.message,
+            });
+            return { client: fallback, maxContextTokens: fallbackMaxContextTokens };
+        }
+    }
+    async runMemoryPipeline(transcript, sessionId, cwd, primaryClient, recordBilledUsage) {
+        try {
+            const llmClient = await this.resolveExtractionClient(primaryClient);
+            const messages = transcript
+                .toMessages()
+                .filter((message) => message.role === "user" || message.role === "assistant");
+            if (messages.length < 8)
+                return;
+            const plainMessages = messages.map((message) => {
+                const safe = sanitizeContent(message.content);
+                return {
+                    role: message.role,
+                    content: typeof safe === "string" ? safe : JSON.stringify(safe),
+                };
+            });
+            const memories = this.readMemoriesConfig();
+            const orchestrator = new MemoryOrchestrator({
+                callLLM: async (systemPrompt, userMessage) => {
+                    const response = await llmClient.createMessage({
+                        systemPrompt,
+                        messages: [{ role: "user", content: userMessage }],
+                        tools: [],
+                        maxTokens: 1024,
+                        billingEnabled: true,
+                        requestVisible: false,
+                        reasoning: { mode: "off" },
+                    });
+                    if (response.usage)
+                        recordBilledUsage?.(response.usage);
+                    return response.text;
+                },
+                runDream: async ({ projectDir }) => this.runDreamLoop({
+                    projectDir,
+                    llmClient,
+                    sessionId,
+                    recordBilledUsage,
+                }),
+                projectDir: cwd,
+                maxCount: memories?.maxCount,
+                autoExtract: memories?.autoExtract,
+            });
+            await orchestrator.run(plainMessages, sessionId);
+        }
+        catch (error) {
+            logger.warn("engine.memory_pipeline_failed", {
+                sessionId,
+                error: error.message,
+            });
+        }
+    }
+    async runDreamLoop(options) {
+        const { ran } = await runDreamConsolidation({
+            llmClient: options.llmClient,
+            toolRegistry: this.deps.toolRegistry(),
+            toolContext: this.deps.toolContext(),
+            projectDir: options.projectDir,
+            sessionId: options.sessionId,
+            onUsage: options.recordBilledUsage,
+        });
+        return ran;
+    }
+    async resolveExtractionClient(primaryClient) {
+        const key = this.readMemoriesConfig()?.extractionModel;
+        const modelPool = this.deps.modelPool();
+        if (key) {
+            const entry = modelPool.get(key);
+            if (entry) {
+                try {
+                    return await createLLMClient(modelPool.toLLMConfig(entry), this.deps.config().clientDefaults);
+                }
+                catch (error) {
+                    logger.warn("engine.extraction_model_build_failed", {
+                        extractionModel: key,
+                        error: error.message,
+                    });
+                }
+            }
+            else {
+                logger.warn("engine.extraction_model_missing", { extractionModel: key });
+            }
+        }
+        return this.resolveAuxClient(primaryClient);
+    }
+}

package/dist/{settings → engine}/disk-defaults.d.ts

@@ -1,5 +1,5 @@
-import type { ValidatedSettings } from "./schema.js";
-import type { EngineConfig } from "../engine/types.js";
+import type { ValidatedSettings } from "../settings/schema.js";
+import type { EngineConfig } from "./types.js";
 /**
  * The subset of EngineConfig the config hot-reload ("layer 2") pushes onto an
  * already-running session's `this.config`. These are the "disk-default" fields:

package/dist/{settings → engine}/disk-defaults.js

@@ -1,4 +1,4 @@
-import { personalizationFrom } from "./personalization.js";
+import { personalizationFrom } from "../settings/personalization.js";
 import { mergePluginMcpServers } from "../plugins/installer/loadPluginMcp.js";
 /**
  * Derive the disk-default config patch from freshly-read settings.
@@ -19,7 +19,10 @@ export function diskDefaultsFrom(settings,
 effectiveDisabledPlugins) {
     const agent = settings.agent ?? {};
     return {
-        preset: agent.preset,
+        // preset 优先级：用户显式 agent.preset > 激活数字人的 profile.preset >
+        // capability 默认（resolveAgentPreset 内）。settings 已含合并后的
+        // project 层，profile 子树随之而来。
+        preset: agent.preset ?? settings.profile?.preset,
         customSystemPrompt: agent.customSystemPrompt,
         appendSystemPrompt: agent.appendSystemPrompt,
         ...personalizationFrom(agent),

package/dist/engine/dynamic-tool-defs.d.ts

@@ -15,5 +15,9 @@ import type { AgentDefinitionRegistry } from "../agent/agent-definition-registry
  *
  * Non-matching tools are returned by identity (no allocation). Pure: it never
  * mutates the input or any shared const.
+ *
+ * Run-scoped rewrites (e.g. DelegateWork's closed workspace enum) do NOT live
+ * here — a builtin owns those via its exposure.rewriteDefinition hook, applied
+ * by Engine.run() before this function.
  */
 export declare function applyDynamicToolDef(t: ToolDefinition, agentDefinitions: AgentDefinitionRegistry | undefined, guardCwd: string): ToolDefinition;

package/dist/engine/dynamic-tool-defs.js

@@ -17,6 +17,10 @@ import { useCredentialToolDefFor } from "../credentials/use-credential-tool.js";
  *
  * Non-matching tools are returned by identity (no allocation). Pure: it never
  * mutates the input or any shared const.
+ *
+ * Run-scoped rewrites (e.g. DelegateWork's closed workspace enum) do NOT live
+ * here — a builtin owns those via its exposure.rewriteDefinition hook, applied
+ * by Engine.run() before this function.
  */
 export function applyDynamicToolDef(t, agentDefinitions, guardCwd) {
     if (t.name === "Agent") {