@cjhyy/code-shell-core 0.8.8 → 0.8.10

package/dist/credentials/store.js

@@ -1,11 +1,88 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { credentialAllowsEnvExposure, credentialSecretHint, } from "./types.js";
 import { getDefaultCredentialCipher } from "./cipher.js";
 import { logger } from "../logging/logger.js";
 import { summarizeOAuthCredentialSecret } from "./oauth.js";
 import { isBrowserOAuthLinkCredential } from "./oauth.js";
+import { acquireFileLock, writeFileAtomic } from "../utils/file-mutex.js";
+const MAX_CREDENTIALS = 4_096;
+const MAX_CREDENTIAL_FILE_BYTES = 32 * 1024 * 1024;
+const MAX_CREDENTIAL_SECRET_BYTES = 16 * 1024 * 1024;
+const MAX_CREDENTIAL_META_BYTES = 1024 * 1024;
+const MAX_CREDENTIAL_ID_CHARS = 512;
+const MAX_CREDENTIAL_LABEL_CHARS = 4_096;
+function normalizeCredential(value, strict) {
+    const invalid = (message) => {
+        if (strict)
+            throw new Error(`invalid credential: ${message}`);
+        return undefined;
+    };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return invalid("object");
+    const raw = value;
+    if (typeof raw.id !== "string" ||
+        !raw.id ||
+        raw.id.length > MAX_CREDENTIAL_ID_CHARS ||
+        raw.id.includes("\0")) {
+        return invalid("id");
+    }
+    if (raw.type !== "token" &&
+        raw.type !== "link" &&
+        raw.type !== "cookie" &&
+        raw.type !== "oauth") {
+        return invalid("type");
+    }
+    if (typeof raw.label !== "string" ||
+        raw.label.length > MAX_CREDENTIAL_LABEL_CHARS ||
+        raw.label.includes("\0")) {
+        return invalid("label");
+    }
+    if (raw.secret !== undefined &&
+        (typeof raw.secret !== "string" || Buffer.byteLength(raw.secret) > MAX_CREDENTIAL_SECRET_BYTES)) {
+        return invalid("secret");
+    }
+    if (raw.exposeAsEnv !== undefined &&
+        (typeof raw.exposeAsEnv !== "string" ||
+            raw.exposeAsEnv.length > 512 ||
+            raw.exposeAsEnv.includes("\0"))) {
+        return invalid("exposeAsEnv");
+    }
+    if (raw.autoUseByAI !== undefined && typeof raw.autoUseByAI !== "boolean") {
+        return invalid("autoUseByAI");
+    }
+    if (raw.autoInjectByAI !== undefined && typeof raw.autoInjectByAI !== "boolean") {
+        return invalid("autoInjectByAI");
+    }
+    let meta;
+    if (raw.meta !== undefined) {
+        if (!raw.meta || typeof raw.meta !== "object" || Array.isArray(raw.meta)) {
+            return invalid("meta");
+        }
+        try {
+            const encoded = JSON.stringify(raw.meta);
+            if (Buffer.byteLength(encoded) > MAX_CREDENTIAL_META_BYTES)
+                return invalid("meta");
+            // Clone through JSON so callers cannot retain a mutable/cyclic object or
+            // smuggle a surprising prototype into later credential consumers.
+            meta = JSON.parse(encoded);
+        }
+        catch {
+            return invalid("meta");
+        }
+    }
+    return {
+        id: raw.id,
+        type: raw.type,
+        label: raw.label,
+        ...(typeof raw.secret === "string" ? { secret: raw.secret } : {}),
+        ...(typeof raw.exposeAsEnv === "string" ? { exposeAsEnv: raw.exposeAsEnv } : {}),
+        ...(typeof raw.autoUseByAI === "boolean" ? { autoUseByAI: raw.autoUseByAI } : {}),
+        ...(typeof raw.autoInjectByAI === "boolean" ? { autoInjectByAI: raw.autoInjectByAI } : {}),
+        ...(meta ? { meta } : {}),
+    };
+}
 /** 测试可经 process.env.HOME 覆盖(镜像 settings/manager.ts userHome)。 */
 function userHome() {
     return process.env.HOME ?? homedir();
@@ -40,6 +117,9 @@ export class CredentialStore {
         this.cipher = cipher ?? getDefaultCredentialCipher();
     }
     pathFor(scope) {
+        if (scope !== "user" && scope !== "project") {
+            throw new Error(`invalid credential scope: ${String(scope)}`);
+        }
         if (scope === "user") {
             return join(this.userDirOverride ?? join(userHome(), ".code-shell"), "credentials.json");
         }
@@ -66,54 +146,165 @@ export class CredentialStore {
         }
     }
     read(scope) {
+        return this.readGuarded(scope).file;
+    }
+    /**
+     * Read the store, reporting whether the on-disk state was fully understood.
+     *
+     * `readable: false` means "there is a file here but this build could not
+     * parse it" — NOT "there are no credentials". The distinction matters because
+     * mutate() commits whatever this returns: treating an unreadable file as an
+     * empty list turns any later save() into a wipe of every stored credential.
+     *
+     * `unknown` carries entries this build's schema rejects (for example a
+     * credential type added by a newer version). They are kept verbatim so a
+     * round-trip through an older build preserves rather than deletes them.
+     */
+    readGuarded(scope) {
+        const empty = { ...EMPTY, credentials: [] };
         const p = this.pathFor(scope);
-        if (!p || !existsSync(p))
-            return { ...EMPTY, credentials: [] };
+        if (!p)
+            return { file: empty, readable: true, unknown: [] };
+        let descriptor;
         try {
-            const raw = JSON.parse(readFileSync(p, "utf8"));
-            const creds = Array.isArray(raw.credentials) ? raw.credentials : [];
+            const parent = lstatSync(dirname(p));
+            if (parent.isSymbolicLink() || !parent.isDirectory()) {
+                logger.warn("credentials.invalid_parent", { path: p });
+                return { file: empty, readable: false, unknown: [] };
+            }
+            const metadata = lstatSync(p);
+            if (metadata.isSymbolicLink() ||
+                !metadata.isFile() ||
+                metadata.size > MAX_CREDENTIAL_FILE_BYTES) {
+                logger.warn("credentials.file_too_large", { path: p });
+                return { file: empty, readable: false, unknown: [] };
+            }
+            descriptor = openSync(p, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(descriptor);
+            if (!opened.isFile() || opened.size > MAX_CREDENTIAL_FILE_BYTES) {
+                return { file: empty, readable: false, unknown: [] };
+            }
+            const raw = JSON.parse(readFileSync(descriptor, "utf8"));
+            const values = Array.isArray(raw.credentials)
+                ? raw.credentials.slice(0, MAX_CREDENTIALS)
+                : [];
+            const creds = [];
+            const unknown = [];
             // Decrypt secrets at the disk boundary so all callers see plaintext.
-            for (const c of creds) {
+            for (const value of values) {
+                const c = normalizeCredential(value, false);
+                if (!c) {
+                    unknown.push(value);
+                    continue;
+                }
                 if (typeof c.secret === "string" && c.secret.length > 0) {
                     c.secret = this.decryptSecret(c.secret);
                 }
+                creds.push(c);
             }
-            return { version: 1, credentials: creds };
+            return { file: { version: 1, credentials: creds }, readable: true, unknown };
         }
-        catch {
-            return { ...EMPTY, credentials: [] };
+        catch (error) {
+            // A missing file is genuinely empty; anything else (torn JSON, EACCES)
+            // is unreadable and must not be committed over.
+            if (error.code === "ENOENT") {
+                return { file: empty, readable: true, unknown: [] };
+            }
+            logger.warn("credentials.unreadable", { path: p, error: error.message });
+            return { file: empty, readable: false, unknown: [] };
+        }
+        finally {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
         }
     }
-    write(scope, file) {
+    write(scope, file, 
+    /** Entries this build's schema rejected; re-emitted verbatim so an older
+     *  build cannot delete a newer build's credential types. */
+    preserved = []) {
         const p = this.pathFor(scope);
         if (!p)
             return;
-        mkdirSync(dirname(p), { recursive: true });
         // Encrypt secrets at the disk boundary. `file` carries plaintext secrets
         // (read() decrypted them); serialize a copy with each secret encrypted so
         // we never persist plaintext under an encrypting cipher.
         const onDisk = {
             version: file.version,
-            credentials: file.credentials.map((c) => typeof c.secret === "string" && c.secret.length > 0
-                ? { ...c, secret: this.cipher.encrypt(c.secret) }
-                : c),
+            credentials: [
+                ...file.credentials.map((c) => typeof c.secret === "string" && c.secret.length > 0
+                    ? { ...c, secret: this.cipher.encrypt(c.secret) }
+                    : c),
+                ...preserved,
+            ],
         };
-        const tmp = `${p}.${process.pid}.${String(performance.now()).replace(".", "")}.tmp`;
-        writeFileSync(tmp, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
-        renameSync(tmp, p);
+        const encoded = JSON.stringify(onDisk, null, 2);
+        if (Buffer.byteLength(encoded) > MAX_CREDENTIAL_FILE_BYTES) {
+            throw new Error("credential store exceeds the maximum file size");
+        }
+        const parentPath = dirname(p);
+        mkdirSync(parentPath, { recursive: true, mode: 0o700 });
+        const parent = lstatSync(parentPath);
+        if (parent.isSymbolicLink() || !parent.isDirectory()) {
+            throw new Error("credential store parent must be a real directory");
+        }
+        try {
+            const target = lstatSync(p);
+            if (target.isSymbolicLink() || !target.isFile()) {
+                throw new Error("credential store target must be a regular file");
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        writeFileAtomic(p, encoded, 0o600);
+    }
+    mutate(scope, change) {
+        const p = this.pathFor(scope);
+        if (!p)
+            return;
+        const parent = dirname(p);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const parentInfo = lstatSync(parent);
+        if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+            throw new Error("credential store parent must be a real directory");
+        }
+        const release = acquireFileLock(p);
+        try {
+            // Reload only after acquiring the cross-process lock; otherwise two app
+            // instances can each write back a stale snapshot and silently lose one.
+            const { file, readable, unknown } = this.readGuarded(scope);
+            // Refuse to commit over state we could not parse. Writing here would
+            // replace every existing credential with whatever this mutation adds.
+            if (!readable) {
+                throw new Error("refusing to modify an unreadable credential store; " +
+                    "move the corrupt file aside to start a new one");
+            }
+            if (change(file))
+                this.write(scope, file, unknown);
+        }
+        finally {
+            release();
+        }
     }
     /** Upsert by id within a scope. */
     save(scope, cred) {
-        const file = this.read(scope);
-        const safeCredential = credentialAllowsEnvExposure(cred.type)
-            ? cred
-            : { ...cred, exposeAsEnv: undefined };
-        const idx = file.credentials.findIndex((c) => c.id === cred.id);
-        if (idx >= 0)
-            file.credentials[idx] = safeCredential;
-        else
-            file.credentials.push(safeCredential);
-        this.write(scope, file);
+        const normalized = normalizeCredential(cred, true);
+        const safeCredential = credentialAllowsEnvExposure(normalized.type)
+            ? normalized
+            : { ...normalized, exposeAsEnv: undefined };
+        this.mutate(scope, (file) => {
+            const idx = file.credentials.findIndex((c) => c.id === safeCredential.id);
+            if (idx >= 0)
+                file.credentials[idx] = safeCredential;
+            else {
+                if (file.credentials.length >= MAX_CREDENTIALS) {
+                    throw new Error("credential store has reached its maximum entry count");
+                }
+                file.credentials.push(safeCredential);
+            }
+            return true;
+        });
     }
     /**
      * 只改元数据(label / exposeAsEnv / autoUseByAI / meta),保留 secret 原样。
@@ -121,22 +312,34 @@ export class CredentialStore {
      * id 不存在则 no-op。
      */
     patch(scope, id, fields) {
-        const file = this.read(scope);
-        const idx = file.credentials.findIndex((c) => c.id === id);
-        if (idx < 0)
-            return;
-        const current = file.credentials[idx];
-        file.credentials[idx] = {
-            ...current,
-            ...fields,
-            ...(credentialAllowsEnvExposure(current.type) ? {} : { exposeAsEnv: undefined }),
-        };
-        this.write(scope, file);
+        if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
+            throw new Error("invalid credential id");
+        }
+        this.mutate(scope, (file) => {
+            const idx = file.credentials.findIndex((c) => c.id === id);
+            if (idx < 0)
+                return false;
+            const current = file.credentials[idx];
+            const updated = normalizeCredential({
+                ...current,
+                ...fields,
+                ...(credentialAllowsEnvExposure(current.type) ? {} : { exposeAsEnv: undefined }),
+            }, true);
+            file.credentials[idx] = updated;
+            return true;
+        });
     }
     remove(scope, id) {
-        const file = this.read(scope);
-        file.credentials = file.credentials.filter((c) => c.id !== id);
-        this.write(scope, file);
+        if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
+            throw new Error("invalid credential id");
+        }
+        this.mutate(scope, (file) => {
+            const next = file.credentials.filter((c) => c.id !== id);
+            if (next.length === file.credentials.length)
+                return false;
+            file.credentials = next;
+            return true;
+        });
     }
     /**
      * List credentials visible to an engine of the given settings scope.

package/dist/engine/engine.js

@@ -44,7 +44,7 @@ import { detectProviderFromApiKey, buildModelPool } from "../onboarding.js";
 import { detectPastedNoise } from "../utils/task-sanitizer.js";
 import { PromptCacheDiagnosticRecorder, promptCacheDropHint, } from "./prompt-cache-diagnostics.js";
 import { buildRunUserMessageContent, prepareRunImageInput } from "./run-image-input.js";
-import { QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
+import { ISOLATED_TASK_PROFILE, QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
 import { createSubAgentSpawner } from "./subagent-spawner.js";
 import { AuxiliaryPipeline, sameLlmIdentity } from "./auxiliary-pipeline.js";
 import { PermissionController } from "./permission-controller.js";
@@ -413,6 +413,7 @@ export class Engine {
         // extension modules — later registrations override earlier ones by id.
         this.behaviorProfiles = new Map([
             QUICK_CHAT_RESTRICTED_PROFILE,
+            ISOLATED_TASK_PROFILE,
             ...(config.behaviorProfiles ?? []),
             ...(config.extensionModules ?? []).flatMap((module) => module.behaviorProfiles ?? []),
         ].map((profile) => [profile.id, profile]));
@@ -1069,10 +1070,6 @@ export class Engine {
         // surfacing as `[-32603] Session not found: <sid>` on the very first
         // TUI turn. Detection now uses `sessionManager.exists()` (one stat
         // call) instead of a try/catch on resume.
-        // wrappedOnStream (defined before the session opens, executed only after)
-        // closes over `session`, so keep the declaration here and assign from the
-        // opener's result.
-        let session;
         const openedResult = openRunSession({
             sessionManager: this.sessionManager,
             options,
@@ -1095,20 +1092,65 @@ export class Engine {
         });
         if (!openedResult.ok)
             return openedResult.result;
-        const { messages, freshImageMessage, resumedFromDisk, claimClientMessageId, releaseClientMessageId, } = openedResult.opened;
-        session = openedResult.opened.session;
+        const { messages: openedMessages, freshImageMessage, resumedFromDisk, claimClientMessageId, releaseClientMessageId, } = openedResult.opened;
+        const session = openedResult.opened.session;
+        let messages = openedMessages;
+        // A host-owned time/topic boundary must be applied only after the current
+        // user message exists in the transcript (it is the exclusive end anchor),
+        // yet before this turn assembles prompts or calls the model. Doing this as
+        // a separate host query races both sides of that boundary: too early and
+        // the anchor is dead; too late and the first new-topic prompt still sees
+        // the entire old topic. Fail open to full history if summarization fails.
+        if (options?.archiveBeforeCurrentTurn && options.clientMessageId) {
+            try {
+                const archived = await this.archiveTurnRange(session.state.sessionId, { start: 0, end: 0 }, {
+                    toClientMessageId: options.clientMessageId,
+                    ...(options.archiveBeforeCurrentTurn.fromClientMessageId
+                        ? {
+                            fromClientMessageId: options.archiveBeforeCurrentTurn.fromClientMessageId,
+                        }
+                        : {}),
+                    ...(options.archiveBeforeCurrentTurn.segmentId
+                        ? { segmentId: options.archiveBeforeCurrentTurn.segmentId }
+                        : {}),
+                });
+                if (archived.before > archived.after) {
+                    options.onStream?.({
+                        type: "context_compact",
+                        strategy: "range",
+                        before: archived.before,
+                        after: archived.after,
+                    });
+                }
+                // openRunSession captured the pre-marker replay. Rebuild from the
+                // persisted marker so this very first post-boundary model call gets
+                // the archived view rather than waiting until the following turn.
+                messages =
+                    this.compactedMessagesBySession.get(session.state.sessionId) ??
+                        this.sessionManager.resume(session.state.sessionId).transcript.toMessages();
+            }
+            catch (error) {
+                logger.warn("engine.pre_run_archive.failed", {
+                    sessionId: session.state.sessionId,
+                    segmentId: options.archiveBeforeCurrentTurn.segmentId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         this.stampRunToolContext(toolCtx, session, options);
         const sessionRun = runWithSid(session.state.sessionId, async () => {
-            const hookMessages = await this.runSessionStartHooks({
-                session,
-                task,
-                cwd,
-                runPermissionMode,
-                resumedFromDisk,
-                options,
-                taskText,
-                messages,
-            });
+            const hookMessages = profile?.disableHooks
+                ? []
+                : await this.runSessionStartHooks({
+                    session,
+                    task,
+                    cwd,
+                    runPermissionMode,
+                    resumedFromDisk,
+                    options,
+                    taskText,
+                    messages,
+                });
             const sid = session.state.sessionId;
             const { contextManager, llmClientPromise, toolExecutor } = this.wireRunContextAndPermission({
                 session,
@@ -1939,17 +1981,23 @@ export class Engine {
         // A profile whose tool allowlist excludes the Skill tool can never invoke
         // a skill, so the full skills listing would be dead context for every one
         // of its turns (e.g. the Pet manager) — inject none via an empty allowlist.
-        const profileCanUseSkills = !profile?.allowedToolNames || profile.allowedToolNames.has(skillToolDef.name);
+        const runAllowedToolNames = toolCtx.allowedToolNames;
+        const profileCanUseSkills = !runAllowedToolNames || runAllowedToolNames.has(skillToolDef.name);
         const promptComposer = new PromptComposer(buildPromptComposerConfig({
             cwd,
             model: this.config.llm.model,
             preset: this.preset,
-            customSystemPrompt: this.config.customSystemPrompt,
-            appendSystemPrompt: [this.config.appendSystemPrompt, profile?.systemPromptAppend]
+            customSystemPrompt: profile?.disableInstructions
+                ? undefined
+                : this.config.customSystemPrompt,
+            appendSystemPrompt: [
+                profile?.disableInstructions ? undefined : this.config.appendSystemPrompt,
+                profile?.systemPromptAppend,
+            ]
                 .filter(Boolean)
                 .join("\n\n") || undefined,
             responseLanguage: this.config.responseLanguage,
-            userProfile: this.config.userProfile,
+            userProfile: profile?.disableInstructions ? undefined : this.config.userProfile,
             workspaceProfile: runWorkspaceProfile,
             // Read from the Session's own persisted state, so every turn — not just
             // the first — carries the standing brief.
@@ -1959,15 +2007,21 @@ export class Engine {
             instructionBoundaryFinder: (scanCwd) => resolveInstructionBoundary(scanCwd, this.capabilities),
             disabledSkills,
             disabledPlugins,
-            skillAllowlist: profileCanUseSkills ? this.config.skillAllowlist : [],
+            skillAllowlist: profileCanUseSkills ? toolCtx.skillAllowlist : [],
             memoriesMaxAgeDays: this.readMemoriesConfig()?.maxAge,
             memoryCurrentProjectOnly: profile?.memoryCurrentProjectOnly,
-            goalToolState: !profile?.allowedToolNames ||
-                profile.allowedToolNames.has("complete_goal") ||
-                profile.allowedToolNames.has("cancel_goal")
+            disableInstructions: profile?.disableInstructions,
+            disableMemoryContext: profile?.disableMemoryContext,
+            disableCapabilityContext: profile?.disableCapabilityContext,
+            disableSourcesContext: profile?.disableSourcesContext,
+            goalToolState: !runAllowedToolNames ||
+                runAllowedToolNames.has("complete_goal") ||
+                runAllowedToolNames.has("cancel_goal")
                 ? { hasGoal: hasRunnableGoal }
                 : undefined,
-            capabilityPromptSections: this.capabilityPromptSections,
+            capabilityPromptSections: profile?.disableCapabilityContext
+                ? {}
+                : this.capabilityPromptSections,
             dynamicContextProviders: this.capabilityDynamicContextProviders,
             getSettingsManager: () => this.getSettingsManager(),
             toolCatalog: this.toolCatalog,
@@ -2024,7 +2078,7 @@ export class Engine {
             toolRewriters: this.toolRewriters,
             toolFeatureFlags: TOOL_FEATURE_FLAGS,
             applyBuiltinOverrideVisibility,
-            profileAllowedToolNames: profile?.allowedToolNames,
+            profileAllowedToolNames: runAllowedToolNames,
             runPlanMode,
         });
         return { promptComposer, toolDefs };

package/dist/engine/file-history-hook.js

@@ -1,13 +1,19 @@
 import { FileHistory } from "../session/file-history.js";
 export function registerFileHistoryHook(options) {
     const history = FileHistory.loadFromDir(options.sessionDir);
-    const handler = async (context) => {
+    const pendingCreates = new Map();
+    const startHandler = async (context) => {
         const toolName = context.data?.toolName;
         const args = context.data?.args;
+        const toolCallId = context.data?.toolCallId;
         const turnSeq = options.getTurnSeq();
         if ((toolName === "Write" || toolName === "Edit") && typeof args?.file_path === "string") {
-            if (history.saveSnapshot(args.file_path, turnSeq) === null && turnSeq !== undefined) {
-                history.recordCreated(args.file_path, turnSeq);
+            const marker = turnSeq === undefined ? null : history.prepareCreated(args.file_path, turnSeq);
+            if (marker && typeof toolCallId === "string") {
+                pendingCreates.set(toolCallId, marker);
+            }
+            else {
+                history.saveSnapshot(args.file_path, turnSeq);
             }
         }
         else if (args) {
@@ -18,14 +24,27 @@ export function registerFileHistoryHook(options) {
         }
         return {};
     };
-    options.hooks.register("on_tool_start", handler, 100, "file_history_backup");
+    const endHandler = async (context) => {
+        const toolCallId = context.data?.toolCallId;
+        if (typeof toolCallId !== "string")
+            return {};
+        const marker = pendingCreates.get(toolCallId);
+        pendingCreates.delete(toolCallId);
+        if (marker && context.data?.isError !== true)
+            history.commitCreated(marker);
+        return {};
+    };
+    options.hooks.register("on_tool_start", startHandler, 100, "file_history_backup");
+    options.hooks.register("on_tool_end", endHandler, 100, "file_history_backup");
     let disposed = false;
     return {
         dispose() {
             if (disposed)
                 return;
             disposed = true;
-            options.hooks.unregister("on_tool_start", handler);
+            pendingCreates.clear();
+            options.hooks.unregister("on_tool_start", startHandler);
+            options.hooks.unregister("on_tool_end", endHandler);
         },
     };
 }

package/dist/engine/run-finalize.js

@@ -88,11 +88,13 @@ export async function finalizeRunSuccess(args) {
     // the turn loop has resolved (completion, error, or abort). Handlers
     // are notify-only — any returned messages are dropped because the run
     // is already over and there's no next turn to inject into.
-    await args.emitHook("on_session_end", {
-        sessionId: session.state.sessionId,
-        reason: result.reason,
-        turnCount,
-    }, options?.signal);
+    if (profile?.disableHooks !== true) {
+        await args.emitHook("on_session_end", {
+            sessionId: session.state.sessionId,
+            reason: result.reason,
+            turnCount,
+        }, options?.signal);
+    }
     // Ephemeral side chats must never leak into durable memory, even after
     // the user explicitly elevates tool permissions for a turn. Lifecycle
     // isolation is independent of the run-scoped behavior/permission mode.
@@ -106,7 +108,7 @@ export async function finalizeRunSuccess(args) {
     // Reuses the already-resolved auxSummaryClient (aux model, cheap). Best-
     // effort: failures never touch the run result. The renderer writes the
     // title into the sidebar on receipt of the session_title stream event.
-    {
+    if (profile?.disableSessionTitle !== true) {
         const messageEvents = session.transcript.getEvents("message");
         const userMsgEvents = messageEvents.filter((e) => e.data.role === "user");
         const userMsgCount = userMsgEvents.length;

package/dist/engine/run-session-open.js

@@ -113,7 +113,7 @@ export function openRunSession(args) {
     else {
         // Cold start: shape (2) reuses the host-supplied sid; shape (3)
         // lets sessionManager generate one with nanoid.
-        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind);
+        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind, options?.ephemeral === true);
         const userMsg = { role: "user", content: args.userMessageContent };
         claimClientMessageId(session, options?.clientMessageId, "submit");
         if (args.parsedTask.hasImages)

package/dist/engine/run-setup.d.ts

@@ -33,6 +33,10 @@ export interface RunPromptComposerConfigInput {
     skillAllowlist: ComposerOptions["skillAllowlist"];
     memoriesMaxAgeDays: ComposerOptions["memoriesMaxAgeDays"];
     memoryCurrentProjectOnly?: ComposerOptions["memoryCurrentProjectOnly"];
+    disableInstructions?: ComposerOptions["disableInstructions"];
+    disableMemoryContext?: ComposerOptions["disableMemoryContext"];
+    disableCapabilityContext?: ComposerOptions["disableCapabilityContext"];
+    disableSourcesContext?: ComposerOptions["disableSourcesContext"];
     goalToolState: ComposerOptions["goalToolState"];
     capabilityPromptSections: ComposerOptions["capabilityPromptSections"];
     dynamicContextProviders: ComposerOptions["dynamicContextProviders"];

package/dist/engine/run-setup.js

@@ -23,7 +23,7 @@ export function resolveRunProfileState(args) {
 }
 /** Build the prompt-composer options for a run without capturing the Engine facade. */
 export function buildPromptComposerConfig(args) {
-    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, memoryCurrentProjectOnly, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
+    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, memoryCurrentProjectOnly, disableInstructions, disableMemoryContext, disableCapabilityContext, disableSourcesContext, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
     return {
         cwd,
         model,
@@ -50,6 +50,10 @@ export function buildPromptComposerConfig(args) {
         skillAllowlist,
         memoriesMaxAgeDays,
         memoryCurrentProjectOnly,
+        disableInstructions,
+        disableMemoryContext,
+        disableCapabilityContext,
+        disableSourcesContext,
         goalToolState,
         capabilityPromptSections,
         dynamicContextProviders,

package/dist/engine/run-tooling.js

@@ -51,8 +51,14 @@ export function buildRunToolContext(args) {
                 return reason;
             },
         },
+        skillAllowlist: options?.skillAllowlist !== undefined
+            ? [...options.skillAllowlist]
+            : args.base.skillAllowlist,
     };
-    if (profile?.allowedToolNames) {
+    if (options?.toolAllowlist !== undefined) {
+        toolCtx.allowedToolNames = new Set(options.toolAllowlist);
+    }
+    else if (profile?.allowedToolNames) {
         toolCtx.allowedToolNames = profile.allowedToolNames;
     }
     if (profile?.createRunServices) {