@cjhyy/code-shell-core 0.8.0 → 0.8.2

package/dist/engine/run-tooling.js

@@ -279,5 +279,9 @@ export function assembleRunToolDefs(args) {
     const toolDefs = args.runPlanMode
         ? profileToolDefs.filter((t) => PLAN_MODE_ALLOWED_TOOLS.has(t.name))
         : profileToolDefs;
+    // ToolSearch shares the worker registry across Sessions, but discovery must
+    // reflect this exact run's filtered and rewritten surface. Keep the context
+    // snapshot in lockstep with the definitions sent to the model.
+    toolCtx.searchableToolDefinitions = toolDefs;
     return toolDefs;
 }

package/dist/engine/turn-loop.d.ts

@@ -202,6 +202,9 @@ export declare class TurnLoop {
      * loop forces a stop so a stuck goal can't loop forever.
      */
     private stopBlockCount;
+    /** Consecutive identical tool-call/result batches, ignoring provider call ids. */
+    private repeatedToolBatchFingerprint;
+    private repeatedToolBatchCount;
     /**
      * Run-scoped goal budget tracker (Goal mode). Hoisted to an instance field
      * (not a run() local) so extend() can bump its budgets mid-run. Null when no

package/dist/engine/turn-loop.js

@@ -4,7 +4,7 @@
  * Following Claude Code's po_() pattern:
  * pre_check → model_call → post_check → tool_exec → context_mgmt → hook_notify → next turn
  */
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { buildAgentDirectionMessage } from "../tool-system/builtin/agent-notifications.js";
 import { newTurnId } from "./turn-state.js";
 import { formatFriendlyError } from "./friendly-error.js";
@@ -40,6 +40,39 @@ export function toolResultToBlock(result) {
         block.is_error = true;
     return block;
 }
+const REPEATED_TOOL_BATCH_LIMIT = 3;
+function canonicalToolValue(value) {
+    if (value === null)
+        return "null";
+    if (value === undefined)
+        return "undefined";
+    if (Array.isArray(value))
+        return `[${value.map(canonicalToolValue).join(",")}]`;
+    if (typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalToolValue(entry)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function repeatedToolBatchFingerprint(toolCalls, results) {
+    // Hash immediately and never log the canonical source: tool results may
+    // contain credentials or large media payloads. Call ids are deliberately
+    // omitted because providers generate a fresh id for every identical retry.
+    return createHash("sha256")
+        .update(canonicalToolValue({
+        calls: toolCalls.map((call) => ({ toolName: call.toolName, args: call.args })),
+        results: results.map((result) => ({
+            toolName: result.toolName,
+            isError: result.isError === true || Boolean(result.error),
+            error: result.error,
+            result: result.result,
+            contentBlocks: result.contentBlocks,
+        })),
+    }))
+        .digest("hex");
+}
 export class TurnLoop {
     deps;
     config;
@@ -76,6 +109,9 @@ export class TurnLoop {
      * loop forces a stop so a stuck goal can't loop forever.
      */
     stopBlockCount = 0;
+    /** Consecutive identical tool-call/result batches, ignoring provider call ids. */
+    repeatedToolBatchFingerprint;
+    repeatedToolBatchCount = 0;
     /**
      * Run-scoped goal budget tracker (Goal mode). Hoisted to an instance field
      * (not a run() local) so extend() can bump its budgets mid-run. Null when no
@@ -1409,6 +1445,49 @@ export class TurnLoop {
                         tlog.info("guard.stale_task", { cat: "guard", turn: this.turnCount });
                     }
                 }
+                const toolBatchFingerprint = repeatedToolBatchFingerprint(toolCalls, results);
+                if (toolBatchFingerprint === this.repeatedToolBatchFingerprint) {
+                    this.repeatedToolBatchCount++;
+                }
+                else {
+                    this.repeatedToolBatchFingerprint = toolBatchFingerprint;
+                    this.repeatedToolBatchCount = 1;
+                }
+                if (this.repeatedToolBatchCount >= REPEATED_TOOL_BATCH_LIMIT) {
+                    tlog.warn("turn.repeated_tool_batch_stopped", {
+                        cat: "turn",
+                        repeatedCount: this.repeatedToolBatchCount,
+                        tools: toolCalls.map((call) => call.toolName),
+                    });
+                    await this.emitHook("on_turn_end", {
+                        turnNumber: this.turnCount,
+                        hasToolUse: true,
+                        toolCallCount: toolCalls.length,
+                    });
+                    finalText =
+                        `检测到同一组工具调用及其结果连续重复 ${REPEATED_TOOL_BATCH_LIMIT} 次，` +
+                            "已自动停止，避免继续空转。请调整请求或让 Session 获取新的上下文后再试。";
+                    this.deps.transcript.appendMessage("assistant", finalText);
+                    messages.push({ role: "assistant", content: finalText });
+                    this.config.onStream?.({
+                        type: "assistant_message",
+                        messageId: assistantMessageId,
+                        message: { role: "assistant", content: finalText },
+                    });
+                    this.finalizeModelTurn();
+                    if (await this.consumeQueuedSteer(messages, "finalize_backfill")) {
+                        this.repeatedToolBatchFingerprint = undefined;
+                        this.repeatedToolBatchCount = 0;
+                        continue;
+                    }
+                    messages = this.redactConsumedSensitiveToolResults(messages);
+                    return {
+                        text: finalText,
+                        reason: "completed",
+                        messages,
+                        completionKind: "limit_stop",
+                    };
+                }
                 // Hook: turn end
                 await this.emitHook("on_turn_end", {
                     turnNumber: this.turnCount,

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.8.0";
+export declare const VERSION = "0.8.2";
 export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionKind, SessionWorkspace, SessionForkLineage, ContextUsageAnchor, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, TurnCompletionKind, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export type { GoalConfig, GoalLifecycleConfig, GoalLifecyclePhase, GoalLifecycleTerminalReason, GoalLifecycleV1, } from "./goal/lifecycle.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.8.0";
+export const VERSION = "0.8.2";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────

package/dist/tool-system/builtin/tool-search.js

@@ -8,9 +8,10 @@
 import { isRegisteredMcpToolAllowed } from "../mcp-tool-policy.js";
 export const toolSearchToolDef = {
     name: "ToolSearch",
-    description: "Search for and discover available tools by name or keyword. " +
+    description: "Search only the tools available in the current Session context by name or keyword. " +
         "Some tools (especially from MCP servers) are deferred — their full schemas " +
-        "are only loaded when you search for them. Use this to find the right tool.",
+        "are only loaded when you search for them. If an exact tool is reported unavailable, " +
+        "do not retry unless the Session context changes.",
     inputSchema: {
         type: "object",
         properties: {
@@ -37,6 +38,18 @@ export async function toolSearchTool(args, ctx) {
     // returning the wrong tool set. `|| 5` only caught 0/NaN, not negatives.
     const rawMax = args.max_results;
     const maxResults = Math.min(typeof rawMax === "number" && rawMax > 0 ? rawMax : 5, 20);
+    const currentDefinitions = ctx.searchableToolDefinitions;
+    if (currentDefinitions) {
+        const currentTools = currentDefinitions.map((definition) => definitionToSearchableTool(definition, ctx.toolRegistry));
+        if (query.startsWith("select:")) {
+            const names = query
+                .slice(7)
+                .split(",")
+                .map((name) => name.trim());
+            return matchCurrentExact(currentTools, names);
+        }
+        return searchCurrentByKeyword(currentTools, query, maxResults);
+    }
     // The tool registry is worker-SHARED (B1): it holds MCP tools registered by
     // every session, including servers another project enabled. ToolSearch is a
     // side door around the per-turn toolDefs filter — without this gate it would
@@ -63,6 +76,32 @@ export async function toolSearchTool(args, ctx) {
     // Keyword search
     return searchByKeyword(ctx.toolRegistry, query, maxResults, visible);
 }
+function definitionToSearchableTool(definition, registry) {
+    const registered = registry.getTool(definition.name);
+    return {
+        name: definition.name,
+        description: definition.description,
+        inputSchema: definition.inputSchema,
+        source: registered?.source ?? "builtin",
+        ...(registered?.serverName ? { serverName: registered.serverName } : {}),
+        ...(registered?.mcpToolName ? { mcpToolName: registered.mcpToolName } : {}),
+        permissionDefault: registered?.permissionDefault ?? "ask",
+    };
+}
+function matchCurrentExact(tools, names) {
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+    return names
+        .map((name) => {
+        const tool = byName.get(name);
+        return tool
+            ? formatTool(tool)
+            : `Tool "${name}" is not available in the current Session context. Do not retry unless the Session context changes.`;
+    })
+        .join("\n\n---\n\n");
+}
+function searchCurrentByKeyword(tools, query, maxResults) {
+    return searchDetailedTools(tools, query, maxResults);
+}
 function matchExact(registry, names, visible) {
     const results = [];
     for (const name of names) {
@@ -78,6 +117,9 @@ function matchExact(registry, names, visible) {
 }
 function searchByKeyword(registry, query, maxResults, visible) {
     const allTools = registry.listToolsDetailed().filter(visible);
+    return searchDetailedTools(allTools, query, maxResults);
+}
+function searchDetailedTools(allTools, query, maxResults) {
     const queryLower = query.toLowerCase();
     const keywords = queryLower.split(/\s+/);
     // Score each tool

package/dist/tool-system/context.d.ts

@@ -12,7 +12,7 @@
  * Tools that don't need any context (Read/Write/Bash/...) just ignore
  * the second argument; the type is purely additive.
  */
-import type { LLMConfig, StreamCallback, TokenUsage } from "../types.js";
+import type { LLMConfig, StreamCallback, TokenUsage, ToolDefinition } from "../types.js";
 import type { ModelPool } from "../llm/model-pool.js";
 import type { ToolRegistry } from "./registry.js";
 import type { AgentPresetName } from "../preset/index.js";
@@ -242,6 +242,13 @@ export interface ToolContext {
     modelPool?: ModelPool;
     /** Tool registry (ToolSearch reads this to enumerate available tools). */
     toolRegistry: ToolRegistry;
+    /**
+     * Final per-turn tool surface after availability guards, feature flags,
+     * behavior-profile allowlists, plan-mode filtering, and definition rewrites.
+     * ToolSearch must prefer this list over the worker-shared registry so it
+     * cannot advertise a tool the current Session cannot actually call.
+     */
+    searchableToolDefinitions?: readonly ToolDefinition[];
     /** Opaque services contributed by capability modules, keyed by capability id. */
     capabilityServices?: Readonly<Record<string, unknown>>;
     /**

package/dist/tool-system/path-policy.js

@@ -29,11 +29,12 @@
  * approval round-trip; it is not an authority to write anywhere on disk.
  * Callers must consult classifyPath before honoring acceptEdits.
  */
-import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, } from "node:fs";
+import { constants, realpathSync, existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, statSync, } from "node:fs";
 import { open } from "node:fs/promises";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
-import { dirname, isAbsolute, join, resolve as resolvePath, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve as resolvePath, sep } from "node:path";
+import { readInstalledPlugins } from "../plugins/installedPlugins.js";
 const FINAL_WRITE_PATH_SNAPSHOT = Symbol("codeshell.finalWritePathSnapshot");
 /**
  * Default sensitive path patterns. These are evaluated AFTER home-expansion
@@ -392,6 +393,88 @@ function isInsideDir(child, parent) {
     const p = par.endsWith(sep) ? par : par + sep;
     return c === par || c.startsWith(p);
 }
+function configuredUserHome() {
+    return process.env.HOME ?? homedir();
+}
+/**
+ * Whether `resolved` belongs to one concrete Skill tree rooted below
+ * `<skillsRoot>/<skill>/`.
+ *
+ * Both the root and manifest are realpathed, so a reference symlink cannot
+ * turn this read-only exception into access outside the managed Skill tree.
+ */
+function isSkillTreeResource(resolved, skillsRoot) {
+    try {
+        const realSkillsRoot = realpathSync(skillsRoot);
+        if (!isInsideDir(resolved, realSkillsRoot))
+            return false;
+        const rel = relative(realSkillsRoot, resolved);
+        const skillName = rel.split(sep).filter(Boolean)[0];
+        if (!skillName || skillName === "..")
+            return false;
+        const skillRoot = realpathSync(join(realSkillsRoot, skillName));
+        if (!isInsideDir(skillRoot, realSkillsRoot))
+            return false;
+        const manifest = realpathSync(join(skillRoot, "SKILL.md"));
+        if (!isInsideDir(manifest, skillRoot) || !statSync(manifest).isFile())
+            return false;
+        return isInsideDir(resolved, skillRoot);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Skill instructions routinely link to sibling references/scripts/assets.
+ * The Skill builtin can already read the registered SKILL.md, so asking again
+ * for every referenced file is both inconsistent and capable of wedging a
+ * headless run.
+ *
+ * Keep the exception narrow:
+ *   - read-only (the caller checks the operation);
+ *   - user Skills, or an installed plugin recorded in the V2 registry;
+ *   - plugin installs must realpath beneath the managed plugin cache;
+ *   - the target must remain inside a directory containing a real SKILL.md.
+ */
+function isRegisteredSkillResourceRead(resolved) {
+    let codeShellRoot;
+    try {
+        codeShellRoot = realpathSync(join(configuredUserHome(), ".code-shell"));
+    }
+    catch {
+        return false;
+    }
+    if (!isInsideDir(resolved, codeShellRoot))
+        return false;
+    if (isSkillTreeResource(resolved, join(codeShellRoot, "skills")))
+        return true;
+    let cacheRoot;
+    try {
+        cacheRoot = realpathSync(join(codeShellRoot, "plugins", "cache"));
+    }
+    catch {
+        return false;
+    }
+    const installed = readInstalledPlugins();
+    for (const entries of Object.values(installed.plugins)) {
+        for (const entry of entries) {
+            try {
+                const installRoot = realpathSync(entry.installPath);
+                if (installRoot === cacheRoot || !isInsideDir(installRoot, cacheRoot))
+                    continue;
+                const skillsRoot = realpathSync(join(installRoot, "skills"));
+                if (!isInsideDir(skillsRoot, installRoot))
+                    continue;
+                if (isSkillTreeResource(resolved, skillsRoot))
+                    return true;
+            }
+            catch {
+                // A stale/tampered registry entry must never broaden read authority.
+            }
+        }
+    }
+    return false;
+}
 /**
  * Returns the matching sensitive-dir entry (with the user's home prefix) if
  * `resolved` lives underneath any sensitive directory, else undefined.
@@ -476,6 +559,20 @@ export function classifyPath(rawPath, opts) {
     const sensitiveFile = matchSensitiveFile(resolved);
     const sensitiveLabel = sensitiveDir ?? sensitiveFile;
     const insideWorkspace = isInsideDir(resolved, workspace);
+    // Registered Skill resources are managed runtime inputs. Their SKILL.md is
+    // already readable through the Skill builtin; allow its contained reference
+    // files through the ordinary Read tool as well. A credential-shaped basename
+    // (.env, token.txt, key files, ...) deliberately keeps the sensitive-file
+    // gate even inside a Skill tree.
+    if (opts.operation === "read" &&
+        !sensitiveFile &&
+        isRegisteredSkillResourceRead(resolved)) {
+        return {
+            decision: "allow",
+            reason: "registered Skill resource read",
+            resolvedPath: resolved,
+        };
+    }
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",