@cjhyy/code-shell-core 0.8.6 → 0.8.8

package/dist/tool-system/path-policy.js

@@ -432,9 +432,10 @@ function isSkillTreeResource(resolved, skillsRoot) {
  *
  * Keep the exception narrow:
  *   - read-only (the caller checks the operation);
- *   - user Skills, or an installed plugin recorded in the V2 registry;
+ *   - user Skills, an installed plugin recorded in the V2 registry, or a
+ *     declared Skill in the installed Panel App registry;
  *   - plugin installs must realpath beneath the managed plugin cache;
- *   - the target must remain inside a directory containing a real SKILL.md.
+ *   - the target must remain inside the registered Skill directory.
  */
 function isRegisteredSkillResourceRead(resolved) {
     let codeShellRoot;
@@ -448,6 +449,8 @@ function isRegisteredSkillResourceRead(resolved) {
         return false;
     if (isSkillTreeResource(resolved, join(codeShellRoot, "skills")))
         return true;
+    if (isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot))
+        return true;
     let cacheRoot;
     try {
         cacheRoot = realpathSync(join(codeShellRoot, "plugins", "cache"));
@@ -475,6 +478,84 @@ function isRegisteredSkillResourceRead(resolved) {
     }
     return false;
 }
+/**
+ * Panel App Skills live under the otherwise-sensitive
+ * `~/.code-shell/panel-apps` tree. Installation already reviews and copies the
+ * package, and the Skill scanner exposes only entries declared by the app
+ * manifest. Mirror that exact boundary here so reading a Skill reference does
+ * not trigger a second approval prompt.
+ *
+ * Registry, app root, manifest, declared SKILL.md and target are all
+ * realpathed and containment-checked. This deliberately does not trust an
+ * undeclared Skill directory or a symlink escaping the installed app.
+ */
+function isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot) {
+    let appsRoot;
+    let registryPath;
+    try {
+        appsRoot = realpathSync(join(codeShellRoot, "panel-apps"));
+        if (!isInsideDir(appsRoot, codeShellRoot))
+            return false;
+        registryPath = realpathSync(join(appsRoot, "installed.json"));
+        if (!isInsideDir(registryPath, appsRoot))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    let registry;
+    try {
+        registry = JSON.parse(readFileSync(registryPath, "utf-8"));
+    }
+    catch {
+        return false;
+    }
+    if (registry.version !== 1 || !Array.isArray(registry.apps))
+        return false;
+    for (const rawEntry of registry.apps) {
+        if (!rawEntry || typeof rawEntry !== "object")
+            continue;
+        const id = rawEntry.id;
+        if (typeof id !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(id))
+            continue;
+        try {
+            const appRoot = realpathSync(join(appsRoot, id));
+            if (appRoot === appsRoot || !isInsideDir(appRoot, appsRoot))
+                continue;
+            const manifestPath = realpathSync(join(appRoot, ".codeshell-panel", "panel.json"));
+            if (!isInsideDir(manifestPath, appRoot) || !statSync(manifestPath).isFile())
+                continue;
+            const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+            if (manifest.schemaVersion !== 2 ||
+                manifest.id !== id ||
+                !Array.isArray(manifest.agent?.skills)) {
+                continue;
+            }
+            for (const skillEntry of manifest.agent.skills) {
+                if (typeof skillEntry !== "string")
+                    continue;
+                const segments = skillEntry.split("/");
+                if (segments.length !== 4 ||
+                    segments[0] !== "agent" ||
+                    segments[1] !== "skills" ||
+                    !/^[a-z][a-z0-9-]{0,63}$/.test(segments[2] ?? "") ||
+                    segments[3] !== "SKILL.md") {
+                    continue;
+                }
+                const skillManifest = realpathSync(join(appRoot, ...segments));
+                if (!isInsideDir(skillManifest, appRoot) || !statSync(skillManifest).isFile())
+                    continue;
+                const skillRoot = dirname(skillManifest);
+                if (isInsideDir(resolved, skillRoot))
+                    return true;
+            }
+        }
+        catch {
+            // A stale, malformed, or tampered Panel App entry grants no read access.
+        }
+    }
+    return false;
+}
 /**
  * Returns the matching sensitive-dir entry (with the user's home prefix) if
  * `resolved` lives underneath any sensitive directory, else undefined.
@@ -564,9 +645,7 @@ export function classifyPath(rawPath, opts) {
     // files through the ordinary Read tool as well. A credential-shaped basename
     // (.env, token.txt, key files, ...) deliberately keeps the sensitive-file
     // gate even inside a Skill tree.
-    if (opts.operation === "read" &&
-        !sensitiveFile &&
-        isRegisteredSkillResourceRead(resolved)) {
+    if (opts.operation === "read" && !sensitiveFile && isRegisteredSkillResourceRead(resolved)) {
         return {
             decision: "allow",
             reason: "registered Skill resource read",

package/dist/types.d.ts

@@ -145,7 +145,7 @@ export interface RegisteredTool {
      */
     timeoutMs?: number;
 }
-export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "context_transfer" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "subagent" | "external_file_changes" | "turn_boundary" | "run_result" | "goal_progress" | "turn_stopped" | "error";
+export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "context_transfer" | "range_archive" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "subagent" | "external_file_changes" | "turn_boundary" | "run_result" | "goal_progress" | "turn_stopped" | "error";
 export interface TranscriptEvent {
     id: string;
     type: TranscriptEventType;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",