@cjhyy/code-shell-core 0.8.0 → 0.8.1

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.8.0";
+export declare const VERSION = "0.8.1";
 export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionKind, SessionWorkspace, SessionForkLineage, ContextUsageAnchor, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, TurnCompletionKind, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export type { GoalConfig, GoalLifecycleConfig, GoalLifecyclePhase, GoalLifecycleTerminalReason, GoalLifecycleV1, } from "./goal/lifecycle.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.8.0";
+export const VERSION = "0.8.1";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────

package/dist/tool-system/path-policy.js

@@ -29,11 +29,12 @@
  * approval round-trip; it is not an authority to write anywhere on disk.
  * Callers must consult classifyPath before honoring acceptEdits.
  */
-import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, statSync, } from "node:fs";
 import { open } from "node:fs/promises";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
-import { dirname, isAbsolute, join, resolve as resolvePath, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve as resolvePath, sep } from "node:path";
+import { readInstalledPlugins } from "../plugins/installedPlugins.js";
 const FINAL_WRITE_PATH_SNAPSHOT = Symbol("codeshell.finalWritePathSnapshot");
 /**
  * Default sensitive path patterns. These are evaluated AFTER home-expansion
@@ -392,6 +393,88 @@ function isInsideDir(child, parent) {
     const p = par.endsWith(sep) ? par : par + sep;
     return c === par || c.startsWith(p);
 }
+function configuredUserHome() {
+    return process.env.HOME ?? homedir();
+}
+/**
+ * Whether `resolved` belongs to one concrete Skill tree rooted below
+ * `<skillsRoot>/<skill>/`.
+ *
+ * Both the root and manifest are realpathed, so a reference symlink cannot
+ * turn this read-only exception into access outside the managed Skill tree.
+ */
+function isSkillTreeResource(resolved, skillsRoot) {
+    try {
+        const realSkillsRoot = realpathSync(skillsRoot);
+        if (!isInsideDir(resolved, realSkillsRoot))
+            return false;
+        const rel = relative(realSkillsRoot, resolved);
+        const skillName = rel.split(sep).filter(Boolean)[0];
+        if (!skillName || skillName === "..")
+            return false;
+        const skillRoot = realpathSync(join(realSkillsRoot, skillName));
+        if (!isInsideDir(skillRoot, realSkillsRoot))
+            return false;
+        const manifest = realpathSync(join(skillRoot, "SKILL.md"));
+        if (!isInsideDir(manifest, skillRoot) || !statSync(manifest).isFile())
+            return false;
+        return isInsideDir(resolved, skillRoot);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Skill instructions routinely link to sibling references/scripts/assets.
+ * The Skill builtin can already read the registered SKILL.md, so asking again
+ * for every referenced file is both inconsistent and capable of wedging a
+ * headless run.
+ *
+ * Keep the exception narrow:
+ *   - read-only (the caller checks the operation);
+ *   - user Skills, or an installed plugin recorded in the V2 registry;
+ *   - plugin installs must realpath beneath the managed plugin cache;
+ *   - the target must remain inside a directory containing a real SKILL.md.
+ */
+function isRegisteredSkillResourceRead(resolved) {
+    let codeShellRoot;
+    try {
+        codeShellRoot = realpathSync(join(configuredUserHome(), ".code-shell"));
+    }
+    catch {
+        return false;
+    }
+    if (!isInsideDir(resolved, codeShellRoot))
+        return false;
+    if (isSkillTreeResource(resolved, join(codeShellRoot, "skills")))
+        return true;
+    let cacheRoot;
+    try {
+        cacheRoot = realpathSync(join(codeShellRoot, "plugins", "cache"));
+    }
+    catch {
+        return false;
+    }
+    const installed = readInstalledPlugins();
+    for (const entries of Object.values(installed.plugins)) {
+        for (const entry of entries) {
+            try {
+                const installRoot = realpathSync(entry.installPath);
+                if (installRoot === cacheRoot || !isInsideDir(installRoot, cacheRoot))
+                    continue;
+                const skillsRoot = realpathSync(join(installRoot, "skills"));
+                if (!isInsideDir(skillsRoot, installRoot))
+                    continue;
+                if (isSkillTreeResource(resolved, skillsRoot))
+                    return true;
+            }
+            catch {
+                // A stale/tampered registry entry must never broaden read authority.
+            }
+        }
+    }
+    return false;
+}
 /**
  * Returns the matching sensitive-dir entry (with the user's home prefix) if
  * `resolved` lives underneath any sensitive directory, else undefined.
@@ -476,6 +559,20 @@ export function classifyPath(rawPath, opts) {
     const sensitiveFile = matchSensitiveFile(resolved);
     const sensitiveLabel = sensitiveDir ?? sensitiveFile;
     const insideWorkspace = isInsideDir(resolved, workspace);
+    // Registered Skill resources are managed runtime inputs. Their SKILL.md is
+    // already readable through the Skill builtin; allow its contained reference
+    // files through the ordinary Read tool as well. A credential-shaped basename
+    // (.env, token.txt, key files, ...) deliberately keeps the sensitive-file
+    // gate even inside a Skill tree.
+    if (opts.operation === "read" &&
+        !sensitiveFile &&
+        isRegisteredSkillResourceRead(resolved)) {
+        return {
+            decision: "allow",
+            reason: "registered Skill resource read",
+            resolvedPath: resolved,
+        };
+    }
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",