@cjhyy/code-shell-core 0.8.8 → 0.8.10

package/dist/sources/types.js

@@ -9,18 +9,21 @@ export const SOURCE_KINDS = ["mock", "mcp-resource", "local-files"];
 export const SourceDefinitionSchema = z.object({
     id: z.string().regex(SOURCE_ID_RE),
     kind: z.enum(SOURCE_KINDS),
-    label: z.string().min(1),
-    description: z.string().optional(),
+    label: z.string().min(1).max(512).refine((value) => !value.includes("\0")),
+    description: z.string().max(4_096).refine((value) => !value.includes("\0")).optional(),
     /** 按 kind 的 adapter 配置（如 mcp-resource: { server }）。 */
     adapterConfig: z.record(z.unknown()).default({}),
     /** 指向全局 CredentialStore 的 id；local-files/mock 不需要。 */
-    credentialRef: z.string().optional(),
+    credentialRef: z.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/).optional(),
     enabled: z.boolean().default(true),
 });
 export const WorkspaceSourceBindingSchema = z.object({
     sourceId: z.string().regex(SOURCE_ID_RE),
     /** 显式勾选的 scope id；空数组 = 什么都不可见（不是"全部"）。 */
-    scopes: z.array(z.string()),
+    scopes: z
+        .array(z.string().min(1).max(512).refine((value) => !value.includes("\0")))
+        .max(1_000)
+        .refine((scopes) => new Set(scopes).size === scopes.length, "source scopes must be unique"),
     /** ask（默认，ReadSource 每次审批）| deny（只许 list metadata，禁读内容）。无 allow 档（ADR §1.2）。 */
     readPolicy: z.enum(["ask", "deny"]).default("ask"),
 });

package/dist/themes/installer.js

@@ -8,13 +8,18 @@
  * executable content, so there are no hooks/mcp/skills to approve.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { detectThemeImage } from "./image.js";
 import { parseThemeManifest } from "./manifest.js";
 import { THEME_ASSET_DIR, ThemeInstallError, ThemeReviewChangedError, assertSafeThemeName, themeInstallDir, themesRegistryPath, themesRoot, } from "./paths.js";
+import { lock } from "../utils/lockfile.js";
 const MANIFEST_FILE = ".cs-theme.json";
 const MAX_ASSET_BYTES = 8 * 1024 * 1024;
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const MAX_REGISTRY_BYTES = 1024 * 1024;
+const MAX_INSTALLED_THEMES = 1_000;
 async function readImageAsset(sourceDir, rel) {
     const abs = resolve(sourceDir, rel);
     if (!abs.startsWith(resolve(sourceDir) + "/") && abs !== resolve(sourceDir)) {
@@ -88,7 +93,7 @@ function digestProjection(manifest, bytesByName) {
 async function loadManifest(sourceDir) {
     let raw;
     try {
-        raw = await readFile(join(sourceDir, MANIFEST_FILE), "utf-8");
+        raw = await readBoundedText(join(sourceDir, MANIFEST_FILE), MAX_MANIFEST_BYTES);
     }
     catch {
         throw new ThemeInstallError(`missing ${MANIFEST_FILE}`);
@@ -102,6 +107,23 @@ async function loadManifest(sourceDir) {
     }
     return parseThemeManifest(json);
 }
+async function readBoundedText(path, maxBytes) {
+    const metadata = await lstat(path);
+    if (metadata.isSymbolicLink() || !metadata.isFile() || metadata.size > maxBytes) {
+        throw new Error("state must be a bounded regular file");
+    }
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size > maxBytes) {
+            throw new Error("state must be a bounded regular file");
+        }
+        return await handle.readFile("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
 function previewOf(manifest, bytesByName, warnings) {
     const petStates = ["idle", "running", "alert"].filter((s) => manifest.pet?.[s]);
     const wallpaperModes = ["light", "dark"].filter((m) => manifest.wallpaper?.[m]);
@@ -164,19 +186,68 @@ export async function installReviewedLocalTheme(sourceDir, reviewToken) {
                 mode: 0o600,
             });
         }
-        await rm(finalDir, { recursive: true, force: true });
-        await rename(staging, finalDir);
+        const entry = {
+            id: manifest.id,
+            name: manifest.name,
+            version: manifest.version,
+            installedAt: Date.now(),
+        };
+        await withRegistryLock(async (registry) => {
+            const next = {
+                version: 1,
+                themes: [...registry.themes.filter((theme) => theme.id !== entry.id), entry],
+            };
+            assertRegistryCount(next);
+            // Keep the previous install recoverable until the registry commit has
+            // succeeded. Reading/validating the registry above happens before any
+            // directory mutation, so corrupt legacy state cannot delete a theme.
+            const backup = `${finalDir}.replace-${process.pid}-${randomUUID()}`;
+            let hasBackup = false;
+            let installedNew = false;
+            try {
+                try {
+                    const existing = await lstat(finalDir);
+                    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+                        throw new Error("installed theme target must be a real directory");
+                    }
+                    await rename(finalDir, backup);
+                    hasBackup = true;
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+                await rename(staging, finalDir);
+                installedNew = true;
+                await writeRegistry(next);
+            }
+            catch (error) {
+                if (installedNew)
+                    await rm(finalDir, { recursive: true, force: true });
+                if (hasBackup) {
+                    try {
+                        await rename(backup, finalDir);
+                        hasBackup = false;
+                    }
+                    catch {
+                        throw new Error("theme install failed and the previous version could not be restored", {
+                            cause: error,
+                        });
+                    }
+                }
+                throw error;
+            }
+            // A committed install remains valid even if best-effort cleanup of the
+            // hidden old directory is interrupted; a later maintenance pass can
+            // safely remove the orphan.
+            if (hasBackup)
+                await rm(backup, { recursive: true, force: true }).catch(() => undefined);
+        });
     }
     catch (error) {
         await rm(staging, { recursive: true, force: true }).catch(() => undefined);
         throw error;
     }
-    await appendRegistryEntry({
-        id: manifest.id,
-        name: manifest.name,
-        version: manifest.version,
-        installedAt: Date.now(),
-    });
     return toInstalledTheme(canonicalManifestFor(manifest, assets));
 }
 /** Canonical manifest stored on disk: asset fields point at THEME_ASSET_DIR/*. */
@@ -233,27 +304,89 @@ function toInstalledTheme(manifest) {
 }
 async function readRegistry() {
     try {
-        const raw = await readFile(themesRegistryPath(), "utf-8");
+        const raw = await readBoundedText(themesRegistryPath(), MAX_REGISTRY_BYTES);
         const parsed = JSON.parse(raw);
-        if (parsed?.version === 1 && Array.isArray(parsed.themes))
+        if (parsed?.version === 1 &&
+            Array.isArray(parsed.themes) &&
+            parsed.themes.length <= MAX_INSTALLED_THEMES &&
+            parsed.themes.every((theme) => theme &&
+                typeof theme === "object" &&
+                typeof theme.id === "string" &&
+                typeof theme.name === "string" &&
+                theme.name.length <= 256 &&
+                typeof theme.version === "string" &&
+                theme.version.length <= 128 &&
+                Number.isSafeInteger(theme.installedAt) &&
+                theme.installedAt >= 0)) {
+            for (const theme of parsed.themes)
+                assertSafeThemeName(theme.id);
             return parsed;
+        }
+        throw new Error("theme registry is corrupt");
     }
-    catch {
-        /* missing/corrupt → empty */
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, themes: [] };
+        throw error;
     }
-    return { version: 1, themes: [] };
 }
 async function writeRegistry(registry) {
-    await mkdir(dirname(themesRegistryPath()), { recursive: true, mode: 0o700 });
-    const tmp = `${themesRegistryPath()}.${process.pid}.${randomUUID()}.tmp`;
-    await writeFile(tmp, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
-    await rename(tmp, themesRegistryPath());
+    const path = themesRegistryPath();
+    const parent = dirname(path);
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const parentInfo = await lstat(parent);
+    if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+        throw new Error("theme registry parent must be a real directory");
+    }
+    try {
+        const target = await lstat(path);
+        if (target.isSymbolicLink() || !target.isFile()) {
+            throw new Error("theme registry target must be a regular file");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const serialized = `${JSON.stringify(registry, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_REGISTRY_BYTES) {
+        throw new Error("theme registry is too large");
+    }
+    const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(tmp, serialized, { mode: 0o600, flag: "wx" });
+        if (process.platform !== "win32")
+            await chmod(tmp, 0o600);
+        await rename(tmp, path);
+    }
+    finally {
+        await rm(tmp, { force: true }).catch(() => undefined);
+    }
+}
+async function withRegistryLock(operation) {
+    const directory = dirname(themesRegistryPath());
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const metadata = await lstat(directory);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error("theme registry parent must be a real directory");
+    }
+    const release = await lock(directory, {
+        realpath: true,
+        stale: 10_000,
+        retries: { retries: 80, minTimeout: 10, maxTimeout: 120, factor: 1.3 },
+    });
+    try {
+        const registry = await readRegistry();
+        return await operation(registry);
+    }
+    finally {
+        await release();
+    }
 }
-async function appendRegistryEntry(entry) {
-    const registry = await readRegistry();
-    registry.themes = registry.themes.filter((t) => t.id !== entry.id);
-    registry.themes.push(entry);
-    await writeRegistry(registry);
+function assertRegistryCount(registry) {
+    if (registry.themes.length > MAX_INSTALLED_THEMES) {
+        throw new Error("too many installed themes");
+    }
 }
 /** Read all installed themes (manifest re-read from disk), skipping broken ones. */
 export async function listInstalledThemes() {
@@ -283,8 +416,39 @@ export async function listInstalledThemes() {
 /** Remove an installed theme and its registry entry. */
 export async function uninstallTheme(id) {
     assertSafeThemeName(id);
-    await rm(themeInstallDir(id), { recursive: true, force: true });
-    const registry = await readRegistry();
-    registry.themes = registry.themes.filter((t) => t.id !== id);
-    await writeRegistry(registry);
+    const finalDir = themeInstallDir(id);
+    await withRegistryLock(async (registry) => {
+        const next = {
+            version: 1,
+            themes: registry.themes.filter((theme) => theme.id !== id),
+        };
+        const quarantine = `${finalDir}.remove-${process.pid}-${randomUUID()}`;
+        let quarantined = false;
+        try {
+            const existing = await lstat(finalDir);
+            if (existing.isSymbolicLink() || !existing.isDirectory()) {
+                throw new Error("installed theme target must be a real directory");
+            }
+            await rename(finalDir, quarantine);
+            quarantined = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        try {
+            await writeRegistry(next);
+        }
+        catch (error) {
+            if (quarantined) {
+                await rename(quarantine, finalDir);
+            }
+            throw error;
+        }
+        // Registry commit is authoritative. Directory cleanup is retryable and
+        // must not turn a successful uninstall into a registry/files mismatch.
+        if (quarantined) {
+            await rm(quarantine, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
 }

package/dist/tool-system/builtin/add-marketplace.js

@@ -8,6 +8,7 @@
  * Side effects (network + git clone + disk write) → permissionDefault "ask".
  */
 import { addMarketplace } from "../../plugins/marketplaceManager.js";
+import { isValidMarketplaceName } from "../../plugins/knownMarketplaces.js";
 export const addMarketplaceToolDef = {
     name: "AddMarketplace",
     description: "Register a plugin marketplace source so the user can browse and install " +
@@ -44,6 +45,13 @@ export async function addMarketplaceTool(args) {
     if (typeof name !== "string" || !name.trim()) {
         return "Error: name is required";
     }
+    // Validate against the SAME rule the registry enforces on read. Accepting a
+    // name here that knownMarketplaces later rejects would clone the repo and
+    // then fail to persist it, leaving an orphaned directory behind.
+    if (!isValidMarketplaceName(name)) {
+        return (`Error: marketplace name '${name}' is not valid. Use letters or digits, ` +
+            "then letters, digits, '.', '_' or '-' (max 128 characters).");
+    }
     const sourceType = args.source_type;
     let source;
     if (sourceType === "github") {
@@ -68,7 +76,19 @@ export async function addMarketplaceTool(args) {
         if (!result.ok) {
             return `Error adding marketplace ${name}: ${result.error}`;
         }
-        return `Marketplace '${name}' added. The user can now browse and install plugins from it in the Extensions → Market UI.`;
+        const preview = result.marketplace.plugins
+            .slice(0, 25)
+            .map((plugin) => `- ${plugin.name}${plugin.description ? ` — ${plugin.description}` : ""}`)
+            .join("\n");
+        const omitted = Math.max(0, result.marketplace.plugins.length - 25);
+        return [
+            `Marketplace '${name}' added (${result.marketplace.plugins.length} plugins).`,
+            preview,
+            omitted > 0 ? `… ${omitted} more plugins; browse them in Extensions → Market.` : "",
+            "To install one in this conversation, call InstallCapability with kind='plugin', its exact plugin name, and this marketplace name.",
+        ]
+            .filter(Boolean)
+            .join("\n");
     }
     catch (err) {
         return `Error adding marketplace ${name}: ${err.message}`;

package/dist/tool-system/builtin/cron.d.ts

@@ -2,6 +2,7 @@
  * Cron tools — CronCreate, CronDelete, CronList.
  */
 import type { ToolDefinition } from "../../types.js";
+import type { ToolContext } from "../context.js";
 export { cronListToolDef } from "./cron-list.definition.js";
 /** Sink notified after a cron job is created/deleted, so the host (Electron
  *  main) can reload+arm the scheduler that actually executes jobs. The worker
@@ -10,7 +11,7 @@ export { cronListToolDef } from "./cron-list.definition.js";
 type CronChangedSink = () => void;
 export declare function setCronChangedSink(sink: CronChangedSink | null): void;
 export declare const cronCreateToolDef: ToolDefinition;
-export declare function cronCreateTool(args: Record<string, unknown>): Promise<string>;
+export declare function cronCreateTool(args: Record<string, unknown>, context?: ToolContext): Promise<string>;
 export declare const cronDeleteToolDef: ToolDefinition;
 export declare function cronDeleteTool(args: Record<string, unknown>): Promise<string>;
 export declare function cronListTool(_args: Record<string, unknown>): Promise<string>;

package/dist/tool-system/builtin/cron.js

@@ -1,6 +1,7 @@
 /**
  * Cron tools — CronCreate, CronDelete, CronList.
  */
+import { resolve } from "node:path";
 import { cronScheduler } from "../../automation/scheduler.js";
 import { getCurrentSid } from "../../logging/logger.js";
 export { cronListToolDef } from "./cron-list.definition.js";
@@ -84,12 +85,16 @@ export const cronCreateToolDef = {
         required: ["name", "schedule", "prompt"],
     },
 };
-export async function cronCreateTool(args) {
-    const name = args.name;
-    const schedule = args.schedule;
-    const prompt = args.prompt;
-    if (!name || !schedule || !prompt)
+export async function cronCreateTool(args, context) {
+    const name = typeof args.name === "string" ? args.name : "";
+    const schedule = typeof args.schedule === "string" ? args.schedule : "";
+    const prompt = typeof args.prompt === "string" ? args.prompt : "";
+    if (!name.trim() || !schedule.trim() || !prompt.trim()) {
         return "Error: name, schedule, and prompt are required";
+    }
+    if (name.length > 512 || schedule.length > 512 || prompt.length > 1024 * 1024) {
+        return "Error: automation payload is too large";
+    }
     const timezone = typeof args.timezone === "string"
         ? args.timezone
         : (() => {
@@ -100,7 +105,16 @@ export async function cronCreateTool(args) {
                 return undefined;
             }
         })();
-    const cwd = typeof args.cwd === "string" ? args.cwd : undefined;
+    const requestedCwd = typeof args.cwd === "string" && args.cwd ? args.cwd : undefined;
+    if (requestedCwd && requestedCwd.length > 32_768)
+        return "Error: automation cwd is too long";
+    if (context && requestedCwd && resolve(requestedCwd) !== resolve(context.cwd)) {
+        return "Error: CronCreate cannot schedule work outside the current session workspace";
+    }
+    // The model may omit cwd, but production tool calls always have a host-owned
+    // context. Bind to that authoritative workspace instead of creating a job
+    // that later falls back to an unrelated process cwd.
+    const cwd = context?.cwd ?? requestedCwd;
     const once = args.once === true;
     const permissionLevel = args.permissionLevel === "read-only" ||
         args.permissionLevel === "workspace-write" ||

package/dist/tool-system/builtin/index.js

@@ -32,6 +32,7 @@ import { memoryListToolDef, memoryListTool, memoryReadToolDef, memoryReadTool, m
 import { completeGoalToolDef, completeGoalTool } from "./complete-goal.js";
 import { cancelGoalToolDef, cancelGoalTool } from "./cancel-goal.js";
 import { addMarketplaceToolDef, addMarketplaceTool } from "./add-marketplace.js";
+import { installCapabilityToolDef, installCapabilityTool } from "./install-capability.js";
 import { bashOutputToolDef, bashOutputTool, killShellToolDef, killShellTool, listShellsToolDef, listShellsTool, } from "./background-shell-tools.js";
 import { browserObserveToolDef, browserObserveTool, browserActToolDef, browserActTool, browserNavigateToolDef, browserNavigateTool, } from "./browser-tools.js";
 import { panelToolDef, panelTool } from "./panel.js";
@@ -310,7 +311,10 @@ const BUILTIN_CONTRIBUTIONS = [
             timeoutMs: 1_800_000, // 30min — sub-agent runs may execute many tool calls
         },
         execute: agentTool,
-        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(agentToolDef.name) }),
+        exposure: expose(HARNESS_TAGS, {
+            defaultPermissionRules: allow(agentToolDef.name),
+            availability: (ctx) => ctx.behaviorProfile !== "quickChatRestricted",
+        }),
     },
     {
         definition: {
@@ -646,6 +650,49 @@ const BUILTIN_CONTRIBUTIONS = [
         execute: addMarketplaceTool,
         exposure: expose(GENERAL_TAGS),
     },
+    // ─── Conversational capability installation ───────────────────
+    // Mirrors the host-owned install lifecycle used by the settings UI: the
+    // exact plugin/Skill/MCP source is visible in the approval card, then the
+    // implementation delegates to the existing installer/settings services.
+    {
+        definition: {
+            ...installCapabilityToolDef,
+            source: "builtin",
+            permissionDefault: "ask",
+            isReadOnly: false,
+            isConcurrencySafe: false,
+            timeoutMs: 190_000,
+        },
+        execute: installCapabilityTool,
+        exposure: expose(GENERAL_TAGS, {
+            defaultPermissionRules: [
+                {
+                    tool: installCapabilityToolDef.name,
+                    argsPattern: { action: "^list$" },
+                    decision: "allow",
+                    reason: "Capability listing is read-only",
+                },
+                {
+                    tool: installCapabilityToolDef.name,
+                    argsPattern: { action: "^inspect$", kind: "^(plugin|mcp)$" },
+                    decision: "allow",
+                    reason: "Installed configuration and marketplace metadata inspection are read-only",
+                },
+                {
+                    tool: installCapabilityToolDef.name,
+                    argsPattern: { action: "^inspect$", kind: "^skill$" },
+                    decision: "ask",
+                    reason: "Skill repository inspection starts an external discovery command",
+                },
+                {
+                    tool: installCapabilityToolDef.name,
+                    argsPattern: { action: "^(install|update|enable|disable|uninstall)$" },
+                    decision: "ask",
+                    reason: "Capability lifecycle mutations change installed code or settings",
+                },
+            ],
+        }),
+    },
     // Browser automation — 3 semantic tools driving the in-app webview via the
     // BrowserBridge (CDP). All serial on one webview (isConcurrencySafe:false).
     // browser_observe is read-only. browser_act declares a UI hint of allow; its

package/dist/tool-system/builtin/install-capability.d.ts

@@ -0,0 +1,52 @@
+/**
+ * First-party conversational lifecycle manager for CodeShell capabilities.
+ *
+ * Read-only list/inspect actions are preset-allowed; every mutation is narrowed
+ * by an action-specific permission rule and remains approval-gated. Arguments
+ * contain the exact source, scope and executable/URL that will be persisted or
+ * run. The implementation deliberately reuses host installers instead of
+ * asking the model to synthesize shell commands or edit settings JSON by hand.
+ */
+import type { ToolDefinition } from "../../types.js";
+import type { ToolContext } from "../context.js";
+import { SettingsManager } from "../../settings/manager.js";
+import { invalidateSkillCache, scanSkills } from "../../skills/scanner.js";
+import { installPlugin, listInstalled, uninstallPlugin } from "../../plugins/pluginInstaller.js";
+import { describePluginContent } from "../../plugins/pluginContent.js";
+import { listPluginMcpTrust } from "../../plugins/pluginMcpApproval.js";
+import { refreshMarketplace } from "../../plugins/marketplaceManager.js";
+import { type LocalPluginPreview } from "../../plugins/installer/preview.js";
+import type { PluginMarketplaceEntry } from "../../plugins/types.js";
+import { computeEffectiveDisabledLists } from "../../capability-control/disabled-lists.js";
+import { safeSpawn } from "../../runtime/safe-spawn.js";
+import { resolveExecutable } from "../../utils/exec.js";
+interface MarketplacePluginPreview {
+    entry: PluginMarketplaceEntry;
+    inventory: LocalPluginPreview | null;
+    note?: string;
+}
+type CapabilityChangedSink = () => void;
+/** Host notification seam. Desktop maps this to agent/settingsChanged. */
+export declare function setCapabilityChangedSink(sink: CapabilityChangedSink | null): void;
+export declare const installCapabilityToolDef: ToolDefinition;
+export interface InstallCapabilityDeps {
+    computeEffectiveDisabledLists: typeof computeEffectiveDisabledLists;
+    describePluginContent: typeof describePluginContent;
+    installPlugin: typeof installPlugin;
+    invalidateSkillCache: typeof invalidateSkillCache;
+    listInstalled: typeof listInstalled;
+    listPluginMcpTrust: typeof listPluginMcpTrust;
+    makeSettingsManager: (cwd: string, scope: "full" | "project") => SettingsManager;
+    previewMarketplacePlugin: (plugin: string, marketplace: string) => Promise<MarketplacePluginPreview | {
+        error: string;
+    }>;
+    refreshMarketplace: typeof refreshMarketplace;
+    resolveExecutable: typeof resolveExecutable;
+    safeSpawn: typeof safeSpawn;
+    scanSkills: typeof scanSkills;
+    uninstallPlugin: typeof uninstallPlugin;
+}
+export declare function installCapabilityTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;
+/** Test seam: production always calls {@link installCapabilityTool}. */
+export declare function installCapabilityWithDeps(args: Record<string, unknown>, ctx: ToolContext | undefined, deps: InstallCapabilityDeps): Promise<string>;
+export {};