@cjhyy/code-shell-core 0.7.1 → 0.8.0

package/dist/plugins/pluginMcpApproval.js

@@ -0,0 +1,110 @@
+import { readInstalledPlugins, writeInstalledPlugins } from "./installedPlugins.js";
+import { readPluginMcp } from "./installer/loadPluginMcp.js";
+import { pluginMcpApprovalState, pluginMcpDigest, } from "./pluginMcpIntegrity.js";
+function pluginNameFromKey(key) {
+    const at = key.lastIndexOf("@");
+    return at > 0 ? key.slice(0, at) : key;
+}
+function matchingInstallKeys(data, target) {
+    if (!target.trim())
+        throw new Error("plugin MCP approval requires a plugin name or install key");
+    if (data.plugins[target])
+        return [target];
+    const matches = Object.keys(data.plugins).filter((key) => pluginNameFromKey(key) === target);
+    if (matches.length === 0)
+        throw new Error(`plugin "${target}" is not installed`);
+    if (matches.length > 1) {
+        throw new Error(`plugin "${target}" has multiple installs; use one of: ${matches.join(", ")}`);
+    }
+    return matches;
+}
+function trustEntry(installKey, entry, changed) {
+    const plugin = pluginNameFromKey(installKey);
+    const serverNames = Object.keys(readPluginMcp(entry.installPath, plugin))
+        .map((name) => name.slice(plugin.length + 1))
+        .sort();
+    const base = {
+        installKey,
+        plugin,
+        serverNames,
+        status: pluginMcpApprovalState(entry, serverNames.length > 0),
+    };
+    return changed === undefined ? base : { ...base, changed };
+}
+/** List every installed plugin's MCP trust without merging user MCP config. */
+export function listPluginMcpTrust() {
+    const data = readInstalledPlugins();
+    const out = [];
+    for (const [installKey, entries] of Object.entries(data.plugins)) {
+        for (const entry of entries) {
+            out.push(trustEntry(installKey, entry));
+        }
+    }
+    return out.sort((a, b) => a.installKey.localeCompare(b.installKey));
+}
+/** Approve only the install-time MCP bytes; tampered bytes require update/reinstall. */
+export function approvePluginMcp(target) {
+    const data = readInstalledPlugins();
+    const keys = matchingInstallKeys(data, target);
+    const out = [];
+    let writeNeeded = false;
+    for (const installKey of keys) {
+        for (const entry of data.plugins[installKey] ?? []) {
+            let entryChanged = false;
+            const currentDigest = pluginMcpDigest(entry.installPath);
+            if (entry.mcpDigest && currentDigest !== entry.mcpDigest) {
+                throw new Error(`plugin "${installKey}" MCP config changed after install; reinstall or update before approving`);
+            }
+            if (!entry.mcpDigest) {
+                entry.mcpDigest = currentDigest;
+                entryChanged = true;
+            }
+            if (entry.approvedMcpDigest !== entry.mcpDigest) {
+                entry.approvedMcpDigest = entry.mcpDigest;
+                entryChanged = true;
+            }
+            writeNeeded ||= entryChanged;
+            out.push(trustEntry(installKey, entry, entryChanged));
+        }
+    }
+    if (writeNeeded)
+        writeInstalledPlugins(data);
+    return out;
+}
+/**
+ * Revoke plugin MCP execution. Legacy entries first record their current
+ * digest, preventing revocation from falling back to legacy compatibility.
+ */
+export function revokePluginMcp(target) {
+    const data = readInstalledPlugins();
+    const keys = matchingInstallKeys(data, target);
+    const out = [];
+    let writeNeeded = false;
+    for (const installKey of keys) {
+        const plugin = pluginNameFromKey(installKey);
+        for (const entry of data.plugins[installKey] ?? []) {
+            let entryChanged = false;
+            const hasServers = Object.keys(readPluginMcp(entry.installPath, plugin)).length > 0;
+            const currentDigest = pluginMcpDigest(entry.installPath);
+            if (!entry.mcpDigest) {
+                entry.mcpDigest = currentDigest;
+                entryChanged = true;
+            }
+            if (hasServers || currentDigest !== entry.mcpDigest) {
+                if (entry.approvedMcpDigest !== undefined) {
+                    delete entry.approvedMcpDigest;
+                    entryChanged = true;
+                }
+            }
+            else if (entry.approvedMcpDigest !== entry.mcpDigest) {
+                entry.approvedMcpDigest = entry.mcpDigest;
+                entryChanged = true;
+            }
+            writeNeeded ||= entryChanged;
+            out.push(trustEntry(installKey, entry, entryChanged));
+        }
+    }
+    if (writeNeeded)
+        writeInstalledPlugins(data);
+    return out;
+}

package/dist/plugins/pluginMcpIntegrity.d.ts

@@ -0,0 +1,21 @@
+import type { PluginInstallEntry } from "./types.js";
+/**
+ * Digest the exact effective declaration selected by the runtime. The file
+ * name is part of the digest so switching between native and CC shapes cannot
+ * inherit approval accidentally.
+ */
+export declare function pluginMcpDigest(installPath: string): string;
+export type PluginMcpIntegrity = "verified" | "changed" | "legacy";
+export type PluginMcpApprovalState = "approved" | "pending" | "changed" | "legacy" | "none";
+export declare function verifyPluginMcpIntegrity(entry: PluginInstallEntry): PluginMcpIntegrity;
+/**
+ * Compute trust for one install. The caller supplies whether the declaration
+ * currently normalizes to at least one runnable MCP server, keeping the trust
+ * layer coupled to the runtime's strict schema rather than a second parser.
+ */
+export declare function pluginMcpApprovalState(entry: PluginInstallEntry, hasMcpServers: boolean): PluginMcpApprovalState;
+/**
+ * Fields written at install/update. Installs with runnable MCP servers start
+ * pending; an explicitly approved identical digest survives an update.
+ */
+export declare function pluginMcpInstallRecord(installPath: string, hasMcpServers: boolean, previousEntries?: PluginInstallEntry[]): Pick<PluginInstallEntry, "mcpDigest" | "approvedMcpDigest">;

package/dist/plugins/pluginMcpIntegrity.js

@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const DIGEST_DOMAIN = "codeshell-plugin-mcp-v1";
+const ABSENT_MCP = "<absent>";
+const UNSAFE_MCP = "<unsafe>";
+const MAX_PLUGIN_MCP_CONFIG_BYTES = 1024 * 1024;
+function effectiveMcpBytes(installPath) {
+    for (const fileName of ["mcp-servers.json", ".mcp.json"]) {
+        const path = join(installPath, fileName);
+        let info;
+        try {
+            info = lstatSync(path);
+        }
+        catch {
+            // mcp-servers.json wins when present; otherwise try the CC fallback.
+            continue;
+        }
+        if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_PLUGIN_MCP_CONFIG_BYTES) {
+            return `${UNSAFE_MCP}:${fileName}`;
+        }
+        try {
+            return Buffer.concat([Buffer.from(`${fileName}\0`), readFileSync(path)]);
+        }
+        catch {
+            return `${UNSAFE_MCP}:${fileName}`;
+        }
+    }
+    return ABSENT_MCP;
+}
+/**
+ * Digest the exact effective declaration selected by the runtime. The file
+ * name is part of the digest so switching between native and CC shapes cannot
+ * inherit approval accidentally.
+ */
+export function pluginMcpDigest(installPath) {
+    return createHash("sha256")
+        .update(DIGEST_DOMAIN)
+        .update("\0")
+        .update(effectiveMcpBytes(installPath))
+        .digest("hex");
+}
+export function verifyPluginMcpIntegrity(entry) {
+    if (!entry.mcpDigest)
+        return "legacy";
+    return pluginMcpDigest(entry.installPath) === entry.mcpDigest ? "verified" : "changed";
+}
+/**
+ * Compute trust for one install. The caller supplies whether the declaration
+ * currently normalizes to at least one runnable MCP server, keeping the trust
+ * layer coupled to the runtime's strict schema rather than a second parser.
+ */
+export function pluginMcpApprovalState(entry, hasMcpServers) {
+    const integrity = verifyPluginMcpIntegrity(entry);
+    if (integrity === "changed")
+        return "changed";
+    if (!hasMcpServers)
+        return "none";
+    if (integrity === "legacy")
+        return "legacy";
+    return entry.approvedMcpDigest === entry.mcpDigest ? "approved" : "pending";
+}
+/**
+ * Fields written at install/update. Installs with runnable MCP servers start
+ * pending; an explicitly approved identical digest survives an update.
+ */
+export function pluginMcpInstallRecord(installPath, hasMcpServers, previousEntries = []) {
+    const mcpDigest = pluginMcpDigest(installPath);
+    const previouslyApproved = previousEntries.some((entry) => entry.mcpDigest === mcpDigest && entry.approvedMcpDigest === entry.mcpDigest);
+    return {
+        mcpDigest,
+        ...(!hasMcpServers || previouslyApproved ? { approvedMcpDigest: mcpDigest } : {}),
+    };
+}

package/dist/plugins/types.d.ts

@@ -71,6 +71,36 @@ export interface PluginInstallEntry {
     installedAt: string;
     lastUpdated: string;
     gitCommitSha?: string;
+    /** CodeShell extension: digest of hooks/hooks.json captured at install/update. */
+    hookDigest?: string;
+    /**
+     * CodeShell extension: the hook digest the user explicitly approved.
+     * Missing means executable hooks are pending approval. Hook-free installs
+     * auto-approve their absent-hooks digest so they never show a prompt.
+     */
+    approvedHookDigest?: string;
+    /**
+     * Bounded display snapshot of the last explicitly approved hook definition.
+     * It is non-executable review metadata used to show per-command update diffs.
+     */
+    approvedHookSnapshot?: StoredPluginHookReview[];
+    /** CodeShell extension: digest of the effective plugin MCP declaration. */
+    mcpDigest?: string;
+    /**
+     * CodeShell extension: the MCP digest the user explicitly approved.
+     * Missing means plugin-provided external processes / remote connections are
+     * pending approval. Installs without any valid MCP servers auto-approve.
+     */
+    approvedMcpDigest?: string;
+}
+export interface StoredPluginHookReview {
+    rawEvent: string;
+    matcher?: string;
+    command: string;
+    commandDigest: string;
+    commandTruncated?: boolean;
+    async?: boolean;
+    timeoutMs?: number;
 }
 export interface InstalledPluginsV2 {
     version: 2;

package/dist/plugins/varRewrite.d.ts

@@ -2,7 +2,11 @@
  * Plugin variable rewriter.
  *
  * After a plugin is materialized into the cache dir, walk its files and
- * rewrite every occurrence of `CLAUDE_PLUGIN_ROOT` to `CODESHELL_PLUGIN_ROOT`.
+ * rewrite Claude-specific plugin environment variables to CodeShell-native
+ * names:
+ *
+ * - `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT`
+ * - `CLAUDE_PLUGIN_DATA` → `CODESHELL_PLUGIN_DATA`
  *
  * Why: plugins authored against Claude Code's protocol embed
  * `${CLAUDE_PLUGIN_ROOT}` in their hooks.json command strings and inside
@@ -32,11 +36,11 @@ export interface RewriteSummary {
     rewrittenPaths: string[];
 }
 /**
- * Rewrite every `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT` under
- * `installPath`, then drop a breadcrumb file at the root.
+ * Rewrite Claude-specific plugin environment variables under `installPath`,
+ * then drop a breadcrumb file at the root.
  *
  * Idempotent: re-running on an already-rewritten tree is a no-op for the
- * rewrite (no `CLAUDE_PLUGIN_ROOT` left) but refreshes the breadcrumb's
- * timestamp so the user can see when the most recent install/update ran.
+ * rewrite but refreshes the breadcrumb's timestamp so the user can see when
+ * the most recent install/update ran.
  */
 export declare function rewritePluginVars(installPath: string): RewriteSummary;

package/dist/plugins/varRewrite.js

@@ -2,7 +2,11 @@
  * Plugin variable rewriter.
  *
  * After a plugin is materialized into the cache dir, walk its files and
- * rewrite every occurrence of `CLAUDE_PLUGIN_ROOT` to `CODESHELL_PLUGIN_ROOT`.
+ * rewrite Claude-specific plugin environment variables to CodeShell-native
+ * names:
+ *
+ * - `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT`
+ * - `CLAUDE_PLUGIN_DATA` → `CODESHELL_PLUGIN_DATA`
  *
  * Why: plugins authored against Claude Code's protocol embed
  * `${CLAUDE_PLUGIN_ROOT}` in their hooks.json command strings and inside
@@ -28,8 +32,10 @@
  */
 import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-const FROM = "CLAUDE_PLUGIN_ROOT";
-const TO = "CODESHELL_PLUGIN_ROOT";
+const REWRITES = [
+    ["CLAUDE_PLUGIN_ROOT", "CODESHELL_PLUGIN_ROOT"],
+    ["CLAUDE_PLUGIN_DATA", "CODESHELL_PLUGIN_DATA"],
+];
 const SCAN_BYTES = 8192;
 function isLikelyBinary(buf) {
     const len = Math.min(buf.length, SCAN_BYTES);
@@ -72,9 +78,12 @@ function walkAndRewrite(dir, summary) {
         if (isLikelyBinary(raw))
             continue;
         const text = raw.toString("utf8");
-        if (!text.includes(FROM))
+        let rewritten = text;
+        for (const [from, to] of REWRITES) {
+            rewritten = rewritten.split(from).join(to);
+        }
+        if (rewritten === text)
             continue;
-        const rewritten = text.split(FROM).join(TO);
         try {
             writeFileSync(full, rewritten, "utf8");
             summary.filesRewritten += 1;
@@ -87,12 +96,12 @@ function walkAndRewrite(dir, summary) {
     }
 }
 /**
- * Rewrite every `CLAUDE_PLUGIN_ROOT` → `CODESHELL_PLUGIN_ROOT` under
- * `installPath`, then drop a breadcrumb file at the root.
+ * Rewrite Claude-specific plugin environment variables under `installPath`,
+ * then drop a breadcrumb file at the root.
  *
  * Idempotent: re-running on an already-rewritten tree is a no-op for the
- * rewrite (no `CLAUDE_PLUGIN_ROOT` left) but refreshes the breadcrumb's
- * timestamp so the user can see when the most recent install/update ran.
+ * rewrite but refreshes the breadcrumb's timestamp so the user can see when
+ * the most recent install/update ran.
  */
 export function rewritePluginVars(installPath) {
     const summary = {
@@ -100,23 +109,23 @@ export function rewritePluginVars(installPath) {
         filesRewritten: 0,
         rewrittenPaths: [],
     };
-    let exists = false;
     try {
-        exists = statSync(installPath).isDirectory();
+        if (!statSync(installPath).isDirectory())
+            return summary;
     }
     catch {
-        exists = false;
-    }
-    if (!exists)
         return summary;
+    }
     walkAndRewrite(installPath, summary);
     const breadcrumb = {
         rewrittenAt: new Date().toISOString(),
-        from: FROM,
-        to: TO,
+        // Keep the original fields for older tooling that reads this breadcrumb.
+        from: REWRITES[0][0],
+        to: REWRITES[0][1],
+        rewrites: REWRITES.map(([from, to]) => ({ from, to })),
         filesScanned: summary.filesScanned,
         filesRewritten: summary.filesRewritten,
-        note: "codeshell rewrote plugin files at install time so ${CLAUDE_PLUGIN_ROOT} placeholders use codeshell's native env var. " +
+        note: "codeshell rewrote Claude-specific plugin environment placeholders to codeshell-native names at install time. " +
             "Upstream plugin sources are unchanged; only this local copy was modified.",
     };
     try {

package/dist/preset/index.d.ts

@@ -8,7 +8,9 @@
  * src/prompt/sections/*.md — each preset declares which sections to include.
  */
 import type { PermissionRule } from "../types.js";
-export declare const AGENT_PRESET_NAMES: readonly ["general", "terminal-coding"];
+import { type BuiltinTool } from "../tool-system/builtin/index.js";
+import type { CapabilityModule } from "../capabilities/index.js";
+export declare const AGENT_PRESET_NAMES: readonly ["harness-min", "general"];
 /** Built-in preset names. Custom presets use arbitrary strings via registerPreset(). */
 export type BuiltinPresetName = (typeof AGENT_PRESET_NAMES)[number];
 /** Any preset name — built-in or custom-registered. */
@@ -19,13 +21,12 @@ export interface AgentPreset {
     description: string;
     /** Ordered list of prompt section filenames (without .md). */
     promptSections: readonly string[];
-    /** Whether to inject git status into system context. */
-    injectGitStatus: boolean;
     builtinTools: string[];
     defaultPermissionRules: PermissionRule[];
 }
-export declare const BUILTIN_AGENT_PRESETS: Record<AgentPresetName, AgentPreset>;
+export declare const BUILTIN_AGENT_PRESETS: Record<BuiltinPresetName, AgentPreset>;
 export declare const DEFAULT_AGENT_PRESET: AgentPresetName;
+/** @deprecated Product hosts should install a capability with `defaultPreset`. */
 export declare const DEFAULT_CLI_PRESET: AgentPresetName;
 /**
  * Register a custom agent preset.
@@ -39,7 +40,6 @@ export declare const DEFAULT_CLI_PRESET: AgentPresetName;
  *   label: "Data Pipeline Orchestrator",
  *   description: "Manages ETL workflows and data quality checks.",
  *   promptSections: ["base", "orchestration"],
- *   injectGitStatus: false,
  *   builtinTools: ["Read", "Write", "Bash", "Glob", "Grep", "Agent"],
  *   defaultPermissionRules: [{ tool: "Read", decision: "allow" }],
  * });
@@ -47,11 +47,13 @@ export declare const DEFAULT_CLI_PRESET: AgentPresetName;
  */
 export declare function registerPreset(preset: AgentPreset): void;
 /** List all available preset names (built-in + custom). */
-export declare function listPresetNames(): string[];
-export declare function resolveAgentPreset(name?: string): AgentPreset;
+export declare function listPresetNames(capabilities?: readonly CapabilityModule[]): string[];
+export declare function resolveAgentPreset(name?: string, capabilities?: readonly CapabilityModule[]): AgentPreset;
 export interface BuildPresetSystemPromptOptions {
     activeToolNames?: readonly string[];
     platform?: NodeJS.Platform;
+    promptSections?: Readonly<Record<string, string>>;
+    toolCatalog?: readonly BuiltinTool[];
 }
 /**
  * Build the full system prompt for a preset by loading and joining its sections.
@@ -65,7 +67,8 @@ export interface BuildPresetSystemPromptOptions {
 export declare function buildPresetSystemPrompt(preset: AgentPreset, optionsOrActiveToolNames?: BuildPresetSystemPromptOptions | readonly string[]): string;
 export declare function resolveBuiltinToolNames(options?: {
     preset?: string;
-    host?: "desktop";
+    host?: string;
     enabledBuiltinTools?: string[];
     disabledBuiltinTools?: string[];
+    capabilities?: readonly CapabilityModule[];
 }): string[];