@cjhyy/code-shell-core 0.8.8 → 0.8.10

package/dist/tool-system/builtin/skill.js

@@ -70,7 +70,9 @@ export async function skillTool(args, ctx) {
     });
     const found = skills.find((s) => s.name === skillName);
     if (!found) {
-        return `Skill "${skillName}" not found. Run /skills to list available skills.`;
+        return (`Skill "${skillName}" not found. Run /skills to list available skills. ` +
+            "If the user asked to add it and you know its trusted GitHub source, use " +
+            "InstallCapability with kind='skill' instead of constructing a shell command.");
     }
     const skillDir = dirname(found.filePath);
     const body = found.content

package/dist/tool-system/executor.js

@@ -502,6 +502,7 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            isError: result.isError,
             signal: this.signal ?? this.toolCtx?.signal,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)

package/dist/tool-system/path-policy.js

@@ -449,8 +449,6 @@ function isRegisteredSkillResourceRead(resolved) {
         return false;
     if (isSkillTreeResource(resolved, join(codeShellRoot, "skills")))
         return true;
-    if (isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot))
-        return true;
     let cacheRoot;
     try {
         cacheRoot = realpathSync(join(codeShellRoot, "plugins", "cache"));
@@ -479,20 +477,26 @@ function isRegisteredSkillResourceRead(resolved) {
     return false;
 }
 /**
- * Panel App Skills live under the otherwise-sensitive
- * `~/.code-shell/panel-apps` tree. Installation already reviews and copies the
- * package, and the Skill scanner exposes only entries declared by the app
- * manifest. Mirror that exact boundary here so reading a Skill reference does
- * not trigger a second approval prompt.
+ * Installed Panel Apps live under the otherwise-sensitive
+ * `~/.code-shell/panel-apps` tree. Their package contents are reviewed and
+ * copied by the installer, so ordinary source, manifests, assets and declared
+ * Agent resources should not require a second approval merely because their
+ * parent directory is `~/.code-shell`.
  *
- * Registry, app root, manifest, declared SKILL.md and target are all
- * realpathed and containment-checked. This deliberately does not trust an
- * undeclared Skill directory or a symlink escaping the installed app.
+ * Keep the exception read-only at the call site and require a valid installed
+ * registry entry plus a matching V2 manifest. Registry, app root, manifest and
+ * target are all realpathed and containment-checked. Credential-shaped files
+ * are still caught by `SENSITIVE_FILE_PATTERNS` before this exception, and a
+ * symlink escaping the installed package never inherits its read authority.
  */
-function isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot) {
+function isInstalledPanelAppResourceRead(resolved) {
+    let codeShellRoot;
     let appsRoot;
     let registryPath;
     try {
+        codeShellRoot = realpathSync(join(configuredUserHome(), ".code-shell"));
+        if (!isInsideDir(resolved, codeShellRoot))
+            return false;
         appsRoot = realpathSync(join(codeShellRoot, "panel-apps"));
         if (!isInsideDir(appsRoot, codeShellRoot))
             return false;
@@ -526,29 +530,10 @@ function isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot) {
             if (!isInsideDir(manifestPath, appRoot) || !statSync(manifestPath).isFile())
                 continue;
             const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-            if (manifest.schemaVersion !== 2 ||
-                manifest.id !== id ||
-                !Array.isArray(manifest.agent?.skills)) {
+            if (manifest.schemaVersion !== 2 || manifest.id !== id)
                 continue;
-            }
-            for (const skillEntry of manifest.agent.skills) {
-                if (typeof skillEntry !== "string")
-                    continue;
-                const segments = skillEntry.split("/");
-                if (segments.length !== 4 ||
-                    segments[0] !== "agent" ||
-                    segments[1] !== "skills" ||
-                    !/^[a-z][a-z0-9-]{0,63}$/.test(segments[2] ?? "") ||
-                    segments[3] !== "SKILL.md") {
-                    continue;
-                }
-                const skillManifest = realpathSync(join(appRoot, ...segments));
-                if (!isInsideDir(skillManifest, appRoot) || !statSync(skillManifest).isFile())
-                    continue;
-                const skillRoot = dirname(skillManifest);
-                if (isInsideDir(resolved, skillRoot))
-                    return true;
-            }
+            if (isInsideDir(resolved, appRoot))
+                return true;
         }
         catch {
             // A stale, malformed, or tampered Panel App entry grants no read access.
@@ -652,6 +637,13 @@ export function classifyPath(rawPath, opts) {
             resolvedPath: resolved,
         };
     }
+    if (opts.operation === "read" && !sensitiveFile && isInstalledPanelAppResourceRead(resolved)) {
+        return {
+            decision: "allow",
+            reason: "installed Panel App resource read",
+            resolvedPath: resolved,
+        };
+    }
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {

package/dist/tool-system/registry.js

@@ -57,6 +57,11 @@ export class ToolRegistry {
         const fork = new ToolRegistry({ builtinTools: [] });
         fork.tools = new Map(this.tools);
         fork.builtinExecutors = new Map(this.builtinExecutors);
+        // Availability is part of the executable tool contract, not just prompt
+        // decoration. Engine instances run against this fork, so dropping the
+        // guards here lets a model invoke a tool that was correctly hidden from
+        // its current turn (for example GatewayReply in a desktop Mimi chat).
+        fork.availabilityGuards = new Map(this.availabilityGuards);
         return fork;
     }
     unregisterTool(name) {

package/dist/utils/file-mutex.d.ts

@@ -62,4 +62,6 @@ export declare function mutateJsonFile<T, R = void>(file: string, options: {
         result?: R;
     };
     mode?: number;
+    /** Bounds both the current file and newly serialized state. */
+    maxBytes?: number;
 }): R | undefined;

package/dist/utils/file-mutex.js

@@ -19,7 +19,7 @@
  * `<dir>.lock`), matching CronStore. Locking the directory rather than the file
  * means a writer that creates the file for the first time is still serialized.
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { lockSync } from "./lockfile.js";
@@ -39,6 +39,7 @@ const LOCK_STALE_MS = 10_000;
 /** Backoff bounds for the retry loop (see acquireLockOn). */
 const LOCK_RETRY_MIN_MS = 5;
 const LOCK_RETRY_MAX_MS = 50;
+const DEFAULT_JSON_FILE_MAX_BYTES = 16 * 1024 * 1024;
 // Atomics.wait only ever reads slot 0, which stays 0, so one shared buffer is
 // safe and avoids allocating per retry.
 const SLEEP_SIGNAL = new Int32Array(new SharedArrayBuffer(4));
@@ -123,19 +124,43 @@ export function writeFileAtomic(file, contents, mode) {
  * skips the write entirely (no-op mutations should not rewrite the file).
  */
 export function mutateJsonFile(file, options) {
+    const maxBytes = options.maxBytes ?? DEFAULT_JSON_FILE_MAX_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("JSON state maxBytes must be a positive safe integer");
+    }
     const release = acquireFileLock(file);
     try {
         let raw;
         try {
-            raw = readFileSync(file, "utf-8");
+            const pathInfo = lstatSync(file);
+            if (pathInfo.isSymbolicLink() || !pathInfo.isFile() || pathInfo.size > maxBytes) {
+                throw new Error(`JSON state is not a bounded regular file: ${file}`);
+            }
+            const descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            try {
+                const opened = fstatSync(descriptor);
+                if (!opened.isFile() || opened.size > maxBytes) {
+                    throw new Error(`JSON state is not a bounded regular file: ${file}`);
+                }
+                raw = readFileSync(descriptor, "utf-8");
+            }
+            finally {
+                closeSync(descriptor);
+            }
         }
-        catch {
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
             raw = undefined;
         }
         const current = options.parse(raw);
         const { value, result } = options.mutation(current);
         if (value !== undefined) {
-            writeFileAtomic(file, options.serialize(value), options.mode);
+            const serialized = options.serialize(value);
+            if (Buffer.byteLength(serialized, "utf8") > maxBytes) {
+                throw new Error(`JSON state exceeds ${maxBytes} bytes`);
+            }
+            writeFileAtomic(file, serialized, options.mode);
         }
         return result;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,6 +38,7 @@
   ],
   "scripts": {
     "build": "bun run clean && tsc -p tsconfig.json && bun run copy-assets",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
     "copy-assets": "node ../../scripts/copy-assets.mjs dist/prompt/sections src/prompt/sections/*.md && node ../../scripts/copy-assets.mjs dist/data src/data/*.json",
     "dev": "bun run copy-assets && tsc -p tsconfig.json --watch --preserveWatchOutput",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""