@cjhyy/code-shell-core 0.8.1 → 0.8.3

package/dist/settings/schema.d.ts

@@ -118,14 +118,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
@@ -1109,14 +1142,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
@@ -2100,14 +2166,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers

package/dist/settings/schema.js

@@ -116,6 +116,19 @@ export const SettingsSchema = z
          * Default on.
          */
         memoryAutoExtract: z.boolean().default(true),
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z
+            .object({
+            responseLanguage: z.string().max(120).optional(),
+            userProfile: z.string().max(2_000).optional(),
+            communicationStyle: z.string().max(2_000).optional(),
+            customInstructions: z.string().max(6_000).optional(),
+        })
+            .optional(),
     })
         .default({}),
     /**

package/dist/tool-system/builtin/tool-search.js

@@ -8,9 +8,10 @@
 import { isRegisteredMcpToolAllowed } from "../mcp-tool-policy.js";
 export const toolSearchToolDef = {
     name: "ToolSearch",
-    description: "Search for and discover available tools by name or keyword. " +
+    description: "Search only the tools available in the current Session context by name or keyword. " +
         "Some tools (especially from MCP servers) are deferred — their full schemas " +
-        "are only loaded when you search for them. Use this to find the right tool.",
+        "are only loaded when you search for them. If an exact tool is reported unavailable, " +
+        "do not retry unless the Session context changes.",
     inputSchema: {
         type: "object",
         properties: {
@@ -37,6 +38,18 @@ export async function toolSearchTool(args, ctx) {
     // returning the wrong tool set. `|| 5` only caught 0/NaN, not negatives.
     const rawMax = args.max_results;
     const maxResults = Math.min(typeof rawMax === "number" && rawMax > 0 ? rawMax : 5, 20);
+    const currentDefinitions = ctx.searchableToolDefinitions;
+    if (currentDefinitions) {
+        const currentTools = currentDefinitions.map((definition) => definitionToSearchableTool(definition, ctx.toolRegistry));
+        if (query.startsWith("select:")) {
+            const names = query
+                .slice(7)
+                .split(",")
+                .map((name) => name.trim());
+            return matchCurrentExact(currentTools, names);
+        }
+        return searchCurrentByKeyword(currentTools, query, maxResults);
+    }
     // The tool registry is worker-SHARED (B1): it holds MCP tools registered by
     // every session, including servers another project enabled. ToolSearch is a
     // side door around the per-turn toolDefs filter — without this gate it would
@@ -63,6 +76,32 @@ export async function toolSearchTool(args, ctx) {
     // Keyword search
     return searchByKeyword(ctx.toolRegistry, query, maxResults, visible);
 }
+function definitionToSearchableTool(definition, registry) {
+    const registered = registry.getTool(definition.name);
+    return {
+        name: definition.name,
+        description: definition.description,
+        inputSchema: definition.inputSchema,
+        source: registered?.source ?? "builtin",
+        ...(registered?.serverName ? { serverName: registered.serverName } : {}),
+        ...(registered?.mcpToolName ? { mcpToolName: registered.mcpToolName } : {}),
+        permissionDefault: registered?.permissionDefault ?? "ask",
+    };
+}
+function matchCurrentExact(tools, names) {
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+    return names
+        .map((name) => {
+        const tool = byName.get(name);
+        return tool
+            ? formatTool(tool)
+            : `Tool "${name}" is not available in the current Session context. Do not retry unless the Session context changes.`;
+    })
+        .join("\n\n---\n\n");
+}
+function searchCurrentByKeyword(tools, query, maxResults) {
+    return searchDetailedTools(tools, query, maxResults);
+}
 function matchExact(registry, names, visible) {
     const results = [];
     for (const name of names) {
@@ -78,6 +117,9 @@ function matchExact(registry, names, visible) {
 }
 function searchByKeyword(registry, query, maxResults, visible) {
     const allTools = registry.listToolsDetailed().filter(visible);
+    return searchDetailedTools(allTools, query, maxResults);
+}
+function searchDetailedTools(allTools, query, maxResults) {
     const queryLower = query.toLowerCase();
     const keywords = queryLower.split(/\s+/);
     // Score each tool

package/dist/tool-system/context.d.ts

@@ -12,7 +12,7 @@
  * Tools that don't need any context (Read/Write/Bash/...) just ignore
  * the second argument; the type is purely additive.
  */
-import type { LLMConfig, StreamCallback, TokenUsage } from "../types.js";
+import type { LLMConfig, StreamCallback, TokenUsage, ToolDefinition } from "../types.js";
 import type { ModelPool } from "../llm/model-pool.js";
 import type { ToolRegistry } from "./registry.js";
 import type { AgentPresetName } from "../preset/index.js";
@@ -225,6 +225,12 @@ export interface ToolRunYieldController {
 export interface ToolContext {
     /** Active working directory for this Engine. */
     cwd: string;
+    /**
+     * True when this call belongs to an external Agent Runtime rather than the
+     * native Engine loop. Async handoff tools use this to keep their result on
+     * the current turn instead of queueing a wake-up only the Engine can consume.
+     */
+    externalRuntime?: boolean;
     /**
      * Active digital-human profile's portable memory root. Present only when
      * the resolved WorkspaceProfile enables portableMemory for this run.
@@ -242,6 +248,13 @@ export interface ToolContext {
     modelPool?: ModelPool;
     /** Tool registry (ToolSearch reads this to enumerate available tools). */
     toolRegistry: ToolRegistry;
+    /**
+     * Final per-turn tool surface after availability guards, feature flags,
+     * behavior-profile allowlists, plan-mode filtering, and definition rewrites.
+     * ToolSearch must prefer this list over the worker-shared registry so it
+     * cannot advertise a tool the current Session cannot actually call.
+     */
+    searchableToolDefinitions?: readonly ToolDefinition[];
     /** Opaque services contributed by capability modules, keyed by capability id. */
     capabilityServices?: Readonly<Record<string, unknown>>;
     /**

package/dist/tool-system/external-tool-exposure.js

@@ -9,15 +9,10 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
         tool: "Panel",
         kind: "host-loopback",
         status: "exposed",
-        reason: "Only list/open/tools. These are read-or-focus, and they have a broadcast " +
-            "fallback, so they work without an owning window. invoke stays out for now " +
-            "for a DIFFERENT reason than originally recorded: the owner claim it was " +
-            "waiting on now exists and is wired (ExternalRuntimeService claims before " +
-            "the runtime starts), so the blocker is no longer technical. What is still " +
-            "missing is a per-Panel-App risk review — invoke runs third-party Panel App " +
-            "code with whatever arguments the model supplies, and argsPatterns cannot " +
-            "constrain a nested payload. Enabling it is a policy decision, not a wiring " +
-            "one, and it belongs to whoever reviews the first Panel App to be trusted.",
+        reason: "list/open/tools plus invoke for the reviewed job-hunt-hq tool catalog. The " +
+            "invoke exception is constrained by panel id and exact tool name; the Panel " +
+            "App manifest validates the nested payload. Other Panel Apps remain " +
+            "discovery/focus-only until they receive their own review.",
     },
     {
         // NOTE the names: there is no tool called "Browser". The registry exposes
@@ -65,11 +60,10 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
             "external runtime. If that approval is ever made skippable, this entry must " +
             "go back to excluded.",
     },
-    // ── Still excluded, and for a different KIND of reason ───────────
-    // The four below are not held back out of caution — widening the allowlist
-    // does not make them work. Each is excluded by a structural property that
-    // would have to be designed away first, so listing them would produce a tool
-    // that is advertised and then fails or misbehaves.
+    // ── Delegation and state-machine exceptions ──────────────────────
+    // Agent and the two plan-state tools remain structurally excluded. DriveAgent
+    // is the reviewed exception because the external host forces it into a
+    // foreground, one-level handoff with an observable result.
     {
         tool: "Agent",
         kind: "self-contained",
@@ -82,8 +76,21 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
     {
         tool: "DriveAgent",
         kind: "self-contained",
-        status: "excluded",
-        reason: "Same recursion hazard as Agent (§12.5).",
+        status: "exposed",
+        reason: "Delegates one bounded task to an installed Codex/Claude CLI. External " +
+            "sessions force foreground execution and disable automatic background " +
+            "handoff, so the parent turn receives the result instead of losing a wake-up " +
+            "inside the native Engine queue. The child CLI does not inherit this host " +
+            "bridge, which bounds nesting at one level; the outer call still requires " +
+            "the normal DriveAgent approval.",
+    },
+    {
+        tool: "DriveAgentJobs",
+        kind: "self-contained",
+        status: "exposed",
+        reason: "Lets the runtime inspect or cancel retained DriveAgent jobs. New external " +
+            "delegations run in the foreground, but retained jobs from the same Session " +
+            "still need an observable cleanup surface.",
     },
     {
         tool: "EnterPlanMode",
@@ -218,17 +225,32 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
  * This is a second, independent layer from the tool's own
  * `defaultPermissionRules`: those decide allow/ask for a call that IS permitted,
  * while this decides whether the action is reachable from an external runtime at
- * all. Both are narrowed to read-only actions in phase one, and `Panel.invoke`
- * additionally fails closed on owner routing — three independent barriers, by
- * design.
+ * all. `Panel.invoke` additionally fails closed on owner routing. Its exception
+ * here is limited to the reviewed job-hunt-hq panel and exact tool names; write
+ * operations still pass through Panel's schema, owner routing, permission rules,
+ * and approval handling.
  */
+const JOB_HUNT_TOOL_NAMES = [
+    "get_job_search_context",
+    "save_candidate_context",
+    "save_job_opportunities",
+    "save_workflow_progress",
+    "save_job_research",
+    "save_interview_question_set",
+    "save_preparation_plan",
+    "save_interview_debrief",
+    "save_resume_draft",
+].join("|");
+const PANEL_ARGUMENT_PATTERNS = [
+    { action: "list|open|tools" },
+    {
+        action: "invoke",
+        panel_id: "panel-app:job-hunt-hq",
+        tool_name: JOB_HUNT_TOOL_NAMES,
+    },
+];
 const FIRST_PHASE_ARGS_PATTERNS = new Map([
-    // Panel.invoke remains the one action-level restriction. It runs third-party
-    // Panel App code with whatever arguments the model supplies, and argsPatterns
-    // cannot constrain a nested payload — so unlike every tool widened above, the
-    // authorization layer genuinely cannot see what is being authorized. Enabling
-    // it belongs to whoever reviews the first Panel App to be trusted.
-    ["Panel", { action: "list|open|tools" }],
+    ["Panel", PANEL_ARGUMENT_PATTERNS],
 ]);
 /**
  * `ReadonlySet` / `ReadonlyMap` are compile-time only — the underlying `Set` and
@@ -299,6 +321,8 @@ export const FIRST_PHASE_EXPOSURE = Object.freeze({
     toolNames: frozenSet(FIRST_PHASE_EXPOSURE_RATIONALE.filter((entry) => entry.status === "exposed").map((entry) => entry.tool)),
     argsPatterns: frozenMap([...FIRST_PHASE_ARGS_PATTERNS].map(([tool, patterns]) => [
         tool,
-        Object.freeze({ ...patterns }),
+        Array.isArray(patterns)
+            ? Object.freeze(patterns.map((pattern) => Object.freeze({ ...pattern })))
+            : Object.freeze({ ...patterns }),
     ])),
 });

package/dist/tool-system/session-tool-host.d.ts

@@ -61,7 +61,7 @@ export interface ExternalToolExposurePolicy {
      * Panel App) is the tool's own schema validation, not this. Do not treat an
      * `argsPatterns` entry as a sandbox for everything a tool might accept.
      */
-    argsPatterns?: ReadonlyMap<string, Readonly<Record<string, string>>>;
+    argsPatterns?: ReadonlyMap<string, Readonly<Record<string, string>> | readonly Readonly<Record<string, string>>[]>;
 }
 export interface SessionToolHost {
     readonly businessSessionId: string;

package/dist/tool-system/session-tool-host.js

@@ -3,6 +3,7 @@ import { PermissionClassifier } from "./permission.js";
 import { HookRegistry } from "../hooks/registry.js";
 import { buildToolVisibility } from "../engine/run-tooling.js";
 import { composePermissionRules } from "../engine/permission-controller.js";
+import { PLAN_MODE_ALLOWED_TOOLS } from "./plan-mode-allowlist.js";
 const FORBIDDEN_MODES = new Set(["bypassPermissions", "dontAsk"]);
 /**
  * Whole-string match for an exposure pattern.
@@ -27,6 +28,10 @@ function matchesWholeValue(source, value) {
 function argsMatch(patterns, input) {
     if (!patterns)
         return true;
+    const alternatives = Array.isArray(patterns) ? patterns : [patterns];
+    return alternatives.some((alternative) => argsPatternMatches(alternative, input));
+}
+function argsPatternMatches(patterns, input) {
     for (const [key, source] of Object.entries(patterns)) {
         // Read own properties only: a model-supplied JSON body cannot smuggle a
         // match through the prototype chain.
@@ -81,6 +86,7 @@ export function createSessionToolHost(options) {
         // just rejected.
         ...options.contextOverrides,
         sessionId: options.businessSessionId,
+        externalRuntime: true,
         planMode: options.planMode,
         permissionMode: options.permissionMode,
         toolVisibility: buildToolVisibility(options.visibility),
@@ -106,7 +112,12 @@ export function createSessionToolHost(options) {
                 return [];
             return registry
                 .getToolDefinitions()
-                .filter((definition) => exposure.toolNames.has(definition.name));
+                .filter((definition) => exposure.toolNames.has(definition.name))
+                .filter((definition) => !options.planMode || PLAN_MODE_ALLOWED_TOOLS.has(definition.name))
+                .filter((definition) => {
+                const guard = registry.getAvailabilityGuard(definition.name);
+                return !guard || guard(toolCtx.toolVisibility);
+            });
         },
         async execute(call, callSignal) {
             if (disposed) {
@@ -129,6 +140,19 @@ export function createSessionToolHost(options) {
             if (sessionSignal.aborted || callSignal?.aborted) {
                 return failClosed(call.id, call.name, `Tool aborted before execution: ${call.name}`);
             }
+            const emit = async (event) => {
+                try {
+                    await toolCtx.streamCallback?.(event);
+                }
+                catch {
+                    // Stream projection is observational; a broken renderer/recorder must
+                    // not turn an authorized tool execution into an unrelated failure.
+                }
+            };
+            await emit({
+                type: "tool_use_start",
+                toolCall: { id: call.id, toolName: call.name, args: input },
+            });
             // Forward the per-call signal rather than only checking it at entry: an MCP
             // cancellation arriving mid-flight has to actually stop the work.
             //
@@ -139,20 +163,24 @@ export function createSessionToolHost(options) {
             // state. Calls without one use the shared executor unchanged.
             if (!callSignal) {
                 // The one authorized path. Everything above only NARROWS what may reach it.
-                return await executor.executeSingle({
+                const result = await executor.executeSingle({
                     id: call.id,
                     toolName: call.name,
                     args: input,
                 });
+                await emit({ type: "tool_result", result });
+                return result;
             }
             const scoped = new ToolExecutor(registry, permission, hooks);
             scoped.setContext(toolCtx);
             scoped.setSignal(AbortSignal.any([sessionSignal, callSignal]));
-            return await scoped.executeSingle({
+            const result = await scoped.executeSingle({
                 id: call.id,
                 toolName: call.name,
                 args: input,
             });
+            await emit({ type: "tool_result", result });
+            return result;
         },
         async dispose() {
             // Order matters (§13.4): stop accepting new calls, THEN abort in-flight

package/dist/types.d.ts

@@ -298,9 +298,10 @@ export interface SessionState {
     /** User-fork lineage; deliberately separate from sub-agent ownership. */
     forkedFrom?: SessionForkLineage;
     /**
-     * Temporary child sessions are persisted only while their owning surface is
-     * alive. Ordinary resume/session pickers must omit them. Absent on legacy
-     * sessions; desktop also recognizes its historical `qchat-*` namespace.
+     * Temporary child sessions live only in process memory. Ordinary
+     * resume/session pickers omit them, and closing/expiry forgets them instead
+     * of publishing state or transcript files. Absent on legacy sessions;
+     * desktop also recognizes its historical `qchat-*` namespace.
      */
     ephemeral?: boolean;
     /**
@@ -636,6 +637,9 @@ export type StreamEvent = {
     sessionCacheReadTokens?: number;
     sessionCacheCreationTokens?: number;
     sessionPromptTokens?: number;
+    /** Provider-reported completion tokens for the latest and whole thread. */
+    completionTokens?: number;
+    cumulativeCompletionTokens?: number;
     agentId?: string;
 } | {
     type: "background_agent_completed";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",