@cjhyy/code-shell-core 0.8.8 → 0.8.9

package/dist/engine/engine.js

@@ -44,7 +44,7 @@ import { detectProviderFromApiKey, buildModelPool } from "../onboarding.js";
 import { detectPastedNoise } from "../utils/task-sanitizer.js";
 import { PromptCacheDiagnosticRecorder, promptCacheDropHint, } from "./prompt-cache-diagnostics.js";
 import { buildRunUserMessageContent, prepareRunImageInput } from "./run-image-input.js";
-import { QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
+import { ISOLATED_TASK_PROFILE, QUICK_CHAT_RESTRICTED_PROFILE, } from "./run-types.js";
 import { createSubAgentSpawner } from "./subagent-spawner.js";
 import { AuxiliaryPipeline, sameLlmIdentity } from "./auxiliary-pipeline.js";
 import { PermissionController } from "./permission-controller.js";
@@ -413,6 +413,7 @@ export class Engine {
         // extension modules — later registrations override earlier ones by id.
         this.behaviorProfiles = new Map([
             QUICK_CHAT_RESTRICTED_PROFILE,
+            ISOLATED_TASK_PROFILE,
             ...(config.behaviorProfiles ?? []),
             ...(config.extensionModules ?? []).flatMap((module) => module.behaviorProfiles ?? []),
         ].map((profile) => [profile.id, profile]));
@@ -1099,16 +1100,18 @@ export class Engine {
         session = openedResult.opened.session;
         this.stampRunToolContext(toolCtx, session, options);
         const sessionRun = runWithSid(session.state.sessionId, async () => {
-            const hookMessages = await this.runSessionStartHooks({
-                session,
-                task,
-                cwd,
-                runPermissionMode,
-                resumedFromDisk,
-                options,
-                taskText,
-                messages,
-            });
+            const hookMessages = profile?.disableHooks
+                ? []
+                : await this.runSessionStartHooks({
+                    session,
+                    task,
+                    cwd,
+                    runPermissionMode,
+                    resumedFromDisk,
+                    options,
+                    taskText,
+                    messages,
+                });
             const sid = session.state.sessionId;
             const { contextManager, llmClientPromise, toolExecutor } = this.wireRunContextAndPermission({
                 session,
@@ -1939,17 +1942,23 @@ export class Engine {
         // A profile whose tool allowlist excludes the Skill tool can never invoke
         // a skill, so the full skills listing would be dead context for every one
         // of its turns (e.g. the Pet manager) — inject none via an empty allowlist.
-        const profileCanUseSkills = !profile?.allowedToolNames || profile.allowedToolNames.has(skillToolDef.name);
+        const runAllowedToolNames = toolCtx.allowedToolNames;
+        const profileCanUseSkills = !runAllowedToolNames || runAllowedToolNames.has(skillToolDef.name);
         const promptComposer = new PromptComposer(buildPromptComposerConfig({
             cwd,
             model: this.config.llm.model,
             preset: this.preset,
-            customSystemPrompt: this.config.customSystemPrompt,
-            appendSystemPrompt: [this.config.appendSystemPrompt, profile?.systemPromptAppend]
+            customSystemPrompt: profile?.disableInstructions
+                ? undefined
+                : this.config.customSystemPrompt,
+            appendSystemPrompt: [
+                profile?.disableInstructions ? undefined : this.config.appendSystemPrompt,
+                profile?.systemPromptAppend,
+            ]
                 .filter(Boolean)
                 .join("\n\n") || undefined,
             responseLanguage: this.config.responseLanguage,
-            userProfile: this.config.userProfile,
+            userProfile: profile?.disableInstructions ? undefined : this.config.userProfile,
             workspaceProfile: runWorkspaceProfile,
             // Read from the Session's own persisted state, so every turn — not just
             // the first — carries the standing brief.
@@ -1959,15 +1968,21 @@ export class Engine {
             instructionBoundaryFinder: (scanCwd) => resolveInstructionBoundary(scanCwd, this.capabilities),
             disabledSkills,
             disabledPlugins,
-            skillAllowlist: profileCanUseSkills ? this.config.skillAllowlist : [],
+            skillAllowlist: profileCanUseSkills ? toolCtx.skillAllowlist : [],
             memoriesMaxAgeDays: this.readMemoriesConfig()?.maxAge,
             memoryCurrentProjectOnly: profile?.memoryCurrentProjectOnly,
-            goalToolState: !profile?.allowedToolNames ||
-                profile.allowedToolNames.has("complete_goal") ||
-                profile.allowedToolNames.has("cancel_goal")
+            disableInstructions: profile?.disableInstructions,
+            disableMemoryContext: profile?.disableMemoryContext,
+            disableCapabilityContext: profile?.disableCapabilityContext,
+            disableSourcesContext: profile?.disableSourcesContext,
+            goalToolState: !runAllowedToolNames ||
+                runAllowedToolNames.has("complete_goal") ||
+                runAllowedToolNames.has("cancel_goal")
                 ? { hasGoal: hasRunnableGoal }
                 : undefined,
-            capabilityPromptSections: this.capabilityPromptSections,
+            capabilityPromptSections: profile?.disableCapabilityContext
+                ? {}
+                : this.capabilityPromptSections,
             dynamicContextProviders: this.capabilityDynamicContextProviders,
             getSettingsManager: () => this.getSettingsManager(),
             toolCatalog: this.toolCatalog,
@@ -2024,7 +2039,7 @@ export class Engine {
             toolRewriters: this.toolRewriters,
             toolFeatureFlags: TOOL_FEATURE_FLAGS,
             applyBuiltinOverrideVisibility,
-            profileAllowedToolNames: profile?.allowedToolNames,
+            profileAllowedToolNames: runAllowedToolNames,
             runPlanMode,
         });
         return { promptComposer, toolDefs };

package/dist/engine/run-finalize.js

@@ -88,11 +88,13 @@ export async function finalizeRunSuccess(args) {
     // the turn loop has resolved (completion, error, or abort). Handlers
     // are notify-only — any returned messages are dropped because the run
     // is already over and there's no next turn to inject into.
-    await args.emitHook("on_session_end", {
-        sessionId: session.state.sessionId,
-        reason: result.reason,
-        turnCount,
-    }, options?.signal);
+    if (profile?.disableHooks !== true) {
+        await args.emitHook("on_session_end", {
+            sessionId: session.state.sessionId,
+            reason: result.reason,
+            turnCount,
+        }, options?.signal);
+    }
     // Ephemeral side chats must never leak into durable memory, even after
     // the user explicitly elevates tool permissions for a turn. Lifecycle
     // isolation is independent of the run-scoped behavior/permission mode.
@@ -106,7 +108,7 @@ export async function finalizeRunSuccess(args) {
     // Reuses the already-resolved auxSummaryClient (aux model, cheap). Best-
     // effort: failures never touch the run result. The renderer writes the
     // title into the sidebar on receipt of the session_title stream event.
-    {
+    if (profile?.disableSessionTitle !== true) {
         const messageEvents = session.transcript.getEvents("message");
         const userMsgEvents = messageEvents.filter((e) => e.data.role === "user");
         const userMsgCount = userMsgEvents.length;

package/dist/engine/run-session-open.js

@@ -113,7 +113,7 @@ export function openRunSession(args) {
     else {
         // Cold start: shape (2) reuses the host-supplied sid; shape (3)
         // lets sessionManager generate one with nanoid.
-        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind);
+        session = args.sessionManager.create(args.cwd, args.llmModel, args.llmProvider, options?.sessionId, args.isSubAgent ? getCurrentSid() : undefined, args.isSubAgent ? "subagent" : args.origin, args.sessionKind, options?.ephemeral === true);
         const userMsg = { role: "user", content: args.userMessageContent };
         claimClientMessageId(session, options?.clientMessageId, "submit");
         if (args.parsedTask.hasImages)

package/dist/engine/run-setup.d.ts

@@ -33,6 +33,10 @@ export interface RunPromptComposerConfigInput {
     skillAllowlist: ComposerOptions["skillAllowlist"];
     memoriesMaxAgeDays: ComposerOptions["memoriesMaxAgeDays"];
     memoryCurrentProjectOnly?: ComposerOptions["memoryCurrentProjectOnly"];
+    disableInstructions?: ComposerOptions["disableInstructions"];
+    disableMemoryContext?: ComposerOptions["disableMemoryContext"];
+    disableCapabilityContext?: ComposerOptions["disableCapabilityContext"];
+    disableSourcesContext?: ComposerOptions["disableSourcesContext"];
     goalToolState: ComposerOptions["goalToolState"];
     capabilityPromptSections: ComposerOptions["capabilityPromptSections"];
     dynamicContextProviders: ComposerOptions["dynamicContextProviders"];

package/dist/engine/run-setup.js

@@ -23,7 +23,7 @@ export function resolveRunProfileState(args) {
 }
 /** Build the prompt-composer options for a run without capturing the Engine facade. */
 export function buildPromptComposerConfig(args) {
-    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, memoryCurrentProjectOnly, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
+    const { cwd, model, preset, customSystemPrompt, appendSystemPrompt, responseLanguage, userProfile, workspaceProfile, sessionBrief, profileMemoryDir, instructionCompatFileNames, instructionBoundaryFinder, disabledSkills, disabledPlugins, skillAllowlist, memoriesMaxAgeDays, memoryCurrentProjectOnly, disableInstructions, disableMemoryContext, disableCapabilityContext, disableSourcesContext, goalToolState, capabilityPromptSections, dynamicContextProviders, getSettingsManager, toolCatalog, } = args;
     return {
         cwd,
         model,
@@ -50,6 +50,10 @@ export function buildPromptComposerConfig(args) {
         skillAllowlist,
         memoriesMaxAgeDays,
         memoryCurrentProjectOnly,
+        disableInstructions,
+        disableMemoryContext,
+        disableCapabilityContext,
+        disableSourcesContext,
         goalToolState,
         capabilityPromptSections,
         dynamicContextProviders,

package/dist/engine/run-tooling.js

@@ -51,8 +51,14 @@ export function buildRunToolContext(args) {
                 return reason;
             },
         },
+        skillAllowlist: options?.skillAllowlist !== undefined
+            ? [...options.skillAllowlist]
+            : args.base.skillAllowlist,
     };
-    if (profile?.allowedToolNames) {
+    if (options?.toolAllowlist !== undefined) {
+        toolCtx.allowedToolNames = new Set(options.toolAllowlist);
+    }
+    else if (profile?.allowedToolNames) {
         toolCtx.allowedToolNames = profile.allowedToolNames;
     }
     if (profile?.createRunServices) {

package/dist/engine/run-types.d.ts

@@ -32,6 +32,20 @@ export interface RunBehaviorProfile {
     disablePlanMode?: boolean;
     /** When true, MCP servers are neither connected nor exposed for the run. */
     disableMcp?: boolean;
+    /** Skip repository/user instruction discovery for this run. */
+    disableInstructions?: boolean;
+    /** Skip persistent-memory injection for this run. */
+    disableMemoryContext?: boolean;
+    /** Skip capability-owned volatile context providers for this run. */
+    disableCapabilityContext?: boolean;
+    /** Skip bound-source metadata injection for this run. */
+    disableSourcesContext?: boolean;
+    /** Ignore the project's default digital-human profile for this run. */
+    disableWorkspaceProfile?: boolean;
+    /** Skip SessionStart/UserPromptSubmit/SessionEnd hooks for this run. */
+    disableHooks?: boolean;
+    /** Skip auxiliary title generation for this run. */
+    disableSessionTitle?: boolean;
     /**
      * When true, the injected persistent-memory index is trimmed to this run's
      * project: global-layer project-type / dream-scope records tied to other
@@ -67,6 +81,10 @@ export interface RunBehaviorProfile {
 export declare const QUICK_CHAT_RESTRICTED_SYSTEM_PROMPT = "# Side Conversation Boundary\n\nThis is a side conversation, not the main-thread task execution environment.\n- Treat all content before this boundary as reference history only. Do not proactively continue any earlier plan, task, or modification.\n- Default to answering the user's question directly. Use lightweight read-only exploration only when needed.\n- Do not modify files, git state, configuration, or permissions unless the user explicitly asks after this boundary (for example, \"Allow you to modify files, please help me...\" or \"Please directly edit...\"). When explicitly requested, use the normally available tools subject to the current permission and approval mode.\n- Sub-agents are disabled for this side conversation. Do not create or invoke sub-agents.";
 /** The side-conversation restriction expressed as a generic behavior profile. */
 export declare const QUICK_CHAT_RESTRICTED_PROFILE: RunBehaviorProfile;
+export declare const ISOLATED_TASK_BEHAVIOR_MODE: "isolatedTask";
+export declare const ISOLATED_TASK_SYSTEM_PROMPT = "# Isolated Task Boundary\n\nThis is a bounded Task, not a continuation of any user conversation.\n- Use only the explicit Task input, the visible tool surface, and the selected Skill when one is available.\n- Do not infer or search for prior Session history, persistent memory, unrelated Skills, or other projects.\n- Do not create sub-agents or start unrelated work.\n- Finish the requested outcome, then return a concise result suitable for the owning application.";
+/** Minimal, process-local run profile used by host-owned Tasks. */
+export declare const ISOLATED_TASK_PROFILE: RunBehaviorProfile;
 export interface EngineRunOptions {
     cwd?: string;
     onStream?: StreamCallback;
@@ -83,6 +101,12 @@ export interface EngineRunOptions {
     attachments?: InputAttachmentMeta[];
     /** Named per-run behavior profile supplied by interactive product surfaces. */
     behaviorMode?: RunBehaviorMode;
+    /** Per-run hard tool allowlist. An empty list exposes no tools. */
+    toolAllowlist?: readonly string[];
+    /** Per-run hard Skill allowlist. An empty list exposes no Skills. */
+    skillAllowlist?: readonly string[];
+    /** Keep a fresh Session in process memory only and omit it from Session pickers. */
+    ephemeral?: boolean;
     /**
      * Generic per-run parameters consumed by the active behavior profile
      * (createRunServices / buildVisibilityMeta / runtime-context injection).

package/dist/engine/run-types.js

@@ -10,3 +10,24 @@ export const QUICK_CHAT_RESTRICTED_PROFILE = {
     id: "quickChatRestricted",
     systemPromptAppend: QUICK_CHAT_RESTRICTED_SYSTEM_PROMPT,
 };
+export const ISOLATED_TASK_BEHAVIOR_MODE = "isolatedTask";
+export const ISOLATED_TASK_SYSTEM_PROMPT = `# Isolated Task Boundary
+
+This is a bounded Task, not a continuation of any user conversation.
+- Use only the explicit Task input, the visible tool surface, and the selected Skill when one is available.
+- Do not infer or search for prior Session history, persistent memory, unrelated Skills, or other projects.
+- Do not create sub-agents or start unrelated work.
+- Finish the requested outcome, then return a concise result suitable for the owning application.`;
+/** Minimal, process-local run profile used by host-owned Tasks. */
+export const ISOLATED_TASK_PROFILE = {
+    id: ISOLATED_TASK_BEHAVIOR_MODE,
+    systemPromptAppend: ISOLATED_TASK_SYSTEM_PROMPT,
+    disableMcp: true,
+    disableInstructions: true,
+    disableMemoryContext: true,
+    disableCapabilityContext: true,
+    disableSourcesContext: true,
+    disableWorkspaceProfile: true,
+    disableHooks: true,
+    disableSessionTitle: true,
+};

package/dist/engine/run-workspace.js

@@ -93,11 +93,17 @@ export async function resolveRunWorkspace(args) {
             configCwd: args.configCwd,
             processCwd: args.processCwd,
         });
-    const profileState = resolveRunProfileState({
-        sessionWorkspaceProfile,
-        cwd,
-        settings: args.settings,
-    });
+    const profileState = profile?.disableWorkspaceProfile
+        ? {
+            workspaceProfile: undefined,
+            sessionProfileOverrides: undefined,
+            profileMemoryDir: undefined,
+        }
+        : resolveRunProfileState({
+            sessionWorkspaceProfile,
+            cwd,
+            settings: args.settings,
+        });
     return {
         ok: true,
         resolution: {

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export declare const VERSION = "0.8.8";
+export declare const VERSION = "0.8.9";
 export type { Message, ContentBlock, ToolDefinition, ToolCall, ToolResult, RegisteredTool, TranscriptEvent, TranscriptEventType, SessionState, SessionKind, SessionWorkspace, SessionForkLineage, ContextUsageAnchor, SessionStatus, TokenUsage, CompiledInput, PermissionDecision, PermissionMode, PermissionRule, TurnPhase, TurnResult, TerminalReason, TurnCompletionKind, StreamEvent, StreamCallback, LLMConfig, ClientDefaults, LLMResponse, Settings, MCPServerConfig, } from "./types.js";
 export type { GoalConfig, GoalLifecycleConfig, GoalLifecyclePhase, GoalLifecycleTerminalReason, GoalLifecycleV1, } from "./goal/lifecycle.js";
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";

package/dist/index.js

@@ -3,7 +3,7 @@
  *
  * Public API exports.
  */
-export const VERSION = "0.8.8";
+export const VERSION = "0.8.9";
 // ─── Exceptions ──────────────────────────────────────────────────
 export { FrameworkError, LLMError, LLMRateLimitError, ContextLimitError, ToolError, ToolNotFoundError, ToolExecutionError, ToolTimeoutError, PermissionDeniedError, SessionError, TranscriptError, ConfigError, SandboxUnavailableError, } from "./exceptions.js";
 // ─── Engine (primary API) ────────────────────────────────────────

package/dist/panel-apps/manifest.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const PANEL_APP_MANIFEST_FILE = ".codeshell-panel/panel.json";
-export declare const PANEL_APP_PERMISSIONS: readonly ["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"];
+export declare const PANEL_APP_PERMISSIONS: readonly ["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"];
 export declare const PANEL_APP_ICONS: readonly ["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"];
 export declare const PanelAppAgentTool: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -116,12 +116,12 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     icon: z.ZodDefault<z.ZodEnum<["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"]>>;
     placement: z.ZodDefault<z.ZodLiteral<"right-dock">>;
     singleton: z.ZodDefault<z.ZodBoolean>;
-    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"]>, "many">>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"]>, "many">>;
     schemaVersion: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -144,7 +144,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     };
     schemaVersion: 1;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
@@ -230,12 +230,12 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     icon: z.ZodDefault<z.ZodEnum<["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"]>>;
     placement: z.ZodDefault<z.ZodLiteral<"right-dock">>;
     singleton: z.ZodDefault<z.ZodBoolean>;
-    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"]>, "many">>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"]>, "many">>;
     schemaVersion: z.ZodLiteral<2>;
 }, "strict", z.ZodTypeAny, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -276,14 +276,14 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
         }[] | undefined;
     } | undefined;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
 }>]>, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -298,7 +298,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
 } | {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -330,7 +330,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     };
     schemaVersion: 1;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
@@ -354,7 +354,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
         }[] | undefined;
     } | undefined;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;

package/dist/panel-apps/manifest.js

@@ -7,6 +7,7 @@ export const PANEL_APP_PERMISSIONS = [
     "storage",
     "external.open",
     "agent.submitPrompt",
+    "agent.task",
     "workspace.info",
     "workspace.read",
     "workspace.write",
@@ -14,6 +15,7 @@ export const PANEL_APP_PERMISSIONS = [
     "audio.transcribe",
     "credentials.cookies",
     "automations.manage",
+    "process",
 ];
 export const PANEL_APP_ICONS = [
     "panel",
@@ -139,7 +141,7 @@ const PanelAppManifestFields = {
     icon: z.enum(PANEL_APP_ICONS).default("panel"),
     placement: z.literal("right-dock").default("right-dock"),
     singleton: z.boolean().default(true),
-    permissions: z.array(z.enum(PANEL_APP_PERMISSIONS)).max(12).default([]),
+    permissions: z.array(z.enum(PANEL_APP_PERMISSIONS)).max(16).default([]),
 };
 /**
  * Schema v2 keeps one installable Panel App identity while allowing it to

package/dist/prompt/composer.d.ts

@@ -96,6 +96,14 @@ export interface ComposerOptions {
      * See MemoryManager.buildInjectionIndex(currentProjectOnly).
      */
     memoryCurrentProjectOnly?: boolean;
+    /** Isolated runs can omit repository/user instruction discovery entirely. */
+    disableInstructions?: boolean;
+    /** Isolated runs can omit persistent-memory context entirely. */
+    disableMemoryContext?: boolean;
+    /** Isolated runs can omit capability-owned volatile context providers. */
+    disableCapabilityContext?: boolean;
+    /** Isolated runs can omit bound-source metadata. */
+    disableSourcesContext?: boolean;
 }
 export declare class PromptComposer {
     private readonly options;

package/dist/prompt/composer.js

@@ -30,6 +30,8 @@ export class PromptComposer {
      * Build the userContext prefix message (CLAUDE.md content as <system-reminder>).
      */
     buildUserContextMessage() {
+        if (this.options.disableInstructions === true)
+            return null;
         const instructions = this.getInstructions();
         // NOTE: memory is intentionally NOT here. It used to be, but memory mutates
         // constantly (extraction, recall usage++/lastUsed, approve/demote), and this
@@ -51,6 +53,8 @@ export class PromptComposer {
     }
     /** Build volatile context contributed by installed capability modules. */
     async buildSystemContext() {
+        if (this.options.disableCapabilityContext === true)
+            return "";
         const preset = this.options.preset ?? resolveAgentPreset();
         const parts = await Promise.all((this.options.dynamicContextProviders ?? []).map(async (provider) => {
             try {
@@ -107,6 +111,8 @@ export class PromptComposer {
         const [capabilityContext, sourcesContext] = await Promise.all([
             this.buildSystemContext(),
             (async () => {
+                if (this.options.disableSourcesContext === true)
+                    return "";
                 try {
                     return (await this.options.sourcesContextProvider?.()) ?? "";
                 }
@@ -265,6 +271,8 @@ export class PromptComposer {
         return this.cachedInstructions;
     }
     getMemoryContext() {
+        if (this.options.disableMemoryContext === true)
+            return "";
         try {
             // Three-layer injection (用户拍板): a compact index merging GLOBAL +
             // DIGITAL-HUMAN + PROJECT memories. Global memories are surfaced every

package/dist/protocol/chat-session-manager.js

@@ -168,6 +168,9 @@ export class ChatSessionManager {
     getLiveSessionSnapshot() {
         const sessions = [];
         this.forEachSession((session) => {
+            const sessionManager = this.engineSessionManager(session.engine);
+            if (sessionManager?.isEphemeralSession?.(session.id))
+                return;
             sessions.push({
                 sessionId: session.id,
                 busy: session.isBusy(),
@@ -280,6 +283,12 @@ export class ChatSessionManager {
     sweepIdle() {
         const cutoff = Date.now() - this.idleTtlMs;
         for (const [id, s] of [...this.sessions]) {
+            // Quick Chat transcripts are process-local by design. Closing one from
+            // the generic idle sweeper destroys its inherited context while the
+            // renderer still owns (and displays) the panel. Its explicit claim/
+            // panel lifecycle is the sole authority that may close it.
+            if (id.startsWith("qchat-"))
+                continue;
             if (s.lastActivityAt >= cutoff)
                 continue;
             if (s.isBusy())

package/dist/protocol/server.js

@@ -58,10 +58,39 @@ function runInputError(params) {
     if (params.injected !== undefined && typeof params.injected !== "boolean") {
         return "injected must be a boolean";
     }
+    if (params.quickChatClaimId !== undefined &&
+        (typeof params.quickChatClaimId !== "string" || params.quickChatClaimId.length === 0)) {
+        return "quickChatClaimId must be a non-empty string";
+    }
     if (params.behaviorMode !== undefined &&
         (typeof params.behaviorMode !== "string" || params.behaviorMode.length === 0)) {
         return `invalid behavior mode: ${String(params.behaviorMode)}`;
     }
+    for (const [field, value, maxItems] of [
+        ["toolAllowlist", params.toolAllowlist, 32],
+        ["skillAllowlist", params.skillAllowlist, 8],
+    ]) {
+        if (value === undefined)
+            continue;
+        if (!Array.isArray(value) ||
+            value.length > maxItems ||
+            value.some((name) => typeof name !== "string" || name.length === 0 || name.length > 128 || /[\r\n]/.test(name))) {
+            return `${field} must be an array of at most ${maxItems} bounded names`;
+        }
+    }
+    if (params.ephemeral !== undefined && typeof params.ephemeral !== "boolean") {
+        return "ephemeral must be a boolean";
+    }
+    if (params.maxTurns !== undefined &&
+        (!Number.isInteger(params.maxTurns) || params.maxTurns < 1 || params.maxTurns > 30)) {
+        return "maxTurns must be an integer from 1 to 30";
+    }
+    if (params.maxContextTokens !== undefined &&
+        (!Number.isInteger(params.maxContextTokens) ||
+            params.maxContextTokens < 4_096 ||
+            params.maxContextTokens > 131_072)) {
+        return "maxContextTokens must be an integer from 4096 to 131072";
+    }
     if (params.kind !== undefined && (typeof params.kind !== "string" || params.kind.length === 0)) {
         return `invalid session kind: ${String(params.kind)}`;
     }
@@ -1080,6 +1109,8 @@ export class AgentServer {
         const sessionConfig = {
             cwd: params.cwd,
             projectTrusted: params.projectTrusted,
+            maxTurns: params.maxTurns,
+            maxContextTokens: params.maxContextTokens,
             goal: typeof params.goal === "string" || (params.goal != null && typeof params.goal === "object")
                 ? params.goal
                 : undefined,
@@ -1163,6 +1194,9 @@ export class AgentServer {
                 permissionMode: params.permissionMode,
                 planMode: params.planMode,
                 behaviorMode: params.behaviorMode,
+                toolAllowlist: params.toolAllowlist,
+                skillAllowlist: params.skillAllowlist,
+                ephemeral: params.ephemeral,
                 profileParams: params.profileParams,
                 workspaceProfile: params.workspaceProfile,
                 sessionBrief: params.sessionBrief,
@@ -1290,6 +1324,9 @@ export class AgentServer {
                 permissionMode: params.permissionMode,
                 planMode: params.planMode,
                 behaviorMode: params.behaviorMode,
+                toolAllowlist: params.toolAllowlist,
+                skillAllowlist: params.skillAllowlist,
+                ephemeral: params.ephemeral,
                 profileParams: params.profileParams,
                 workspaceProfile: params.workspaceProfile,
                 sessionBrief: params.sessionBrief,

package/dist/protocol/types.d.ts

@@ -80,6 +80,8 @@ export interface RunParams {
     attachments?: InputAttachmentMeta[];
     /** Stable id for the user's submit intent; duplicate ids are idempotent. */
     clientMessageId?: string;
+    /** Desktop host ownership generation for process-local Quick Chat runs. */
+    quickChatClaimId?: string;
     /**
      * Host-generated system reminder. Persisted with an injected marker so disk
      * transcript readers hide it as a user bubble while retaining the assistant reply.
@@ -116,6 +118,16 @@ export interface RunParams {
     planMode?: boolean;
     /** Named behavior profile for a product-specific per-run interaction mode. */
     behaviorMode?: RunBehaviorMode;
+    /** Host-authorized per-run hard tool allowlist. Empty means no tools. */
+    toolAllowlist?: string[];
+    /** Host-authorized per-run hard Skill allowlist. Empty means no Skills. */
+    skillAllowlist?: string[];
+    /** Keep a fresh run Session process-local and out of normal Session pickers. */
+    ephemeral?: boolean;
+    /** Optional fresh-session turn ceiling used by bounded host Tasks. */
+    maxTurns?: number;
+    /** Optional fresh-session context ceiling used by bounded host Tasks. */
+    maxContextTokens?: number;
     /**
      * Generic per-run parameters consumed by the active behavior profile
      * (delivered as non-durable run context; never appended to the task or

package/dist/session/session-manager.d.ts

@@ -108,7 +108,7 @@ export declare class SessionManager {
      * Create a session. `qchat-` sessions stay process-local; ordinary sessions
      * materialize state.json + transcript.jsonl before return.
      */
-    create(cwd: string, model: string, provider: string, explicitSessionId?: string, parentSessionId?: string | null, origin?: import("../types.js").SessionOrigin, kind?: SessionKind): SessionBundle;
+    create(cwd: string, model: string, provider: string, explicitSessionId?: string, parentSessionId?: string | null, origin?: import("../types.js").SessionOrigin, kind?: SessionKind, ephemeral?: boolean): SessionBundle;
     /** Whether a persisted or process-local session exists. */
     exists(sessionId: string): boolean;
     /**
@@ -236,6 +236,8 @@ export declare class SessionManager {
      * workspace/profile metadata.
      */
     readSessionState(sessionId: string): SessionState | undefined;
+    /** Whether a live or persisted Session is explicitly process-local. */
+    isEphemeralSession(sessionId: string): boolean;
     /**
      * Merge a field-level state update into the latest persisted snapshot.
      *

package/dist/session/session-manager.js

@@ -148,26 +148,34 @@ function adoptCompatibilityGoalMutation(state) {
 // disk. The storage root remains part of the key to preserve identity/data-root
 // isolation.
 const processLocalSessionBundles = new Map();
-const FORK_COPY_EVENT_TYPES = new Set([
-    "message",
-    "tool_use",
-    "tool_result",
-    "summary",
-    "context_transfer",
-    "range_archive",
-    "content_replace",
-    "subagent",
-    "external_file_changes",
-    "goal_progress",
-    "turn_boundary",
-    "turn_stopped",
-    "error",
-]);
-const FORK_SKIP_EVENT_TYPES = new Set([
-    "session_meta",
-    "file_history",
-    "plan_operation",
-]);
+/**
+ * Every known transcript event must make an explicit fork decision. The
+ * `satisfies` constraint turns new TranscriptEventType additions into a
+ * compile-time error instead of a quick-chat failure discovered at runtime.
+ * The runtime fallback below still rejects unknown events from newer or
+ * malformed persisted transcripts.
+ */
+const FORK_EVENT_POLICY = {
+    message: "copy",
+    tool_use: "copy",
+    tool_result: "copy",
+    summary: "copy",
+    context_transfer: "copy",
+    range_archive: "copy",
+    content_replace: "copy",
+    file_history: "skip",
+    plan_operation: "skip",
+    session_meta: "skip",
+    subagent: "copy",
+    external_file_changes: "copy",
+    turn_boundary: "copy",
+    // Idempotency receipts belong to the source session and never contribute to
+    // model context. Copying them could replay a source response in the child.
+    run_result: "skip",
+    goal_progress: "copy",
+    turn_stopped: "copy",
+    error: "copy",
+};
 const FORK_STAGING_NAME = /^\.pending-fork-[A-Za-z0-9_.-]+-[A-Za-z0-9_-]{8}$/;
 const FORK_STAGING_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const FORK_STAGING_CLEANUP_LIMIT = 32;
@@ -366,7 +374,7 @@ export class SessionManager {
      * Create a session. `qchat-` sessions stay process-local; ordinary sessions
      * materialize state.json + transcript.jsonl before return.
      */
-    create(cwd, model, provider, explicitSessionId, parentSessionId, origin, kind = "work") {
+    create(cwd, model, provider, explicitSessionId, parentSessionId, origin, kind = "work", ephemeral = false) {
         // External callers may pass any string; nanoid output is trusted. Either
         // way the ID gets joined into a filesystem path, so the public entry
         // point validates before that join.
@@ -394,7 +402,7 @@ export class SessionManager {
             // new top-level session (key present, null) apart from a legacy session
             // (key absent) and from a sub-agent (key present, non-empty string).
             parentSessionId: parentSessionId ?? null,
-            ...(sessionId.startsWith("qchat-") ? { ephemeral: true } : {}),
+            ...(ephemeral || sessionId.startsWith("qchat-") ? { ephemeral: true } : {}),
             ...(origin ? { origin } : {}),
         };
         if (isEphemeralSessionState(state)) {
@@ -1049,6 +1057,10 @@ export class SessionManager {
             return undefined;
         }
     }
+    /** Whether a live or persisted Session is explicitly process-local. */
+    isEphemeralSession(sessionId) {
+        return this.readSessionState(sessionId)?.ephemeral === true;
+    }
     /**
      * Merge a field-level state update into the latest persisted snapshot.
      *
@@ -1569,7 +1581,10 @@ export class SessionManager {
         return this.freezeForkSnapshot(sourceSessionId, sourceState, parsed.events, throughEventId, snapshotMode);
     }
     freezeForkSnapshot(sourceSessionId, sourceState, events, throughEventId, snapshotMode) {
-        const sourceEvents = structuredClone([...events]);
+        // Both process-local and disk readers provide a snapshot array. Fork
+        // selection is synchronous, so keep event references here and clone once
+        // when the independently-owned target transcript is constructed below.
+        const sourceEvents = [...events];
         let frozen = sourceEvents;
         const effectiveCursor = snapshotMode === "completed" ? sourceState.completedThroughEventId : throughEventId;
         if (snapshotMode === "completed" && effectiveCursor === undefined) {
@@ -1600,12 +1615,13 @@ export class SessionManager {
         }
         const copiedEvents = [];
         for (const event of frozen) {
-            if (FORK_SKIP_EVENT_TYPES.has(event.type))
+            const policy = FORK_EVENT_POLICY[event.type];
+            if (policy === "skip")
                 continue;
-            if (!FORK_COPY_EVENT_TYPES.has(event.type)) {
+            if (policy !== "copy") {
                 throw new SessionError(`Unsupported transcript event in fork: ${String(event.type)}`);
             }
-            copiedEvents.push(structuredClone(event));
+            copiedEvents.push(event);
         }
         validateForkToolPairs(copiedEvents);
         return { sourceState: structuredClone(sourceState), copiedEvents };

package/dist/tool-system/builtin/index.js

@@ -310,7 +310,10 @@ const BUILTIN_CONTRIBUTIONS = [
             timeoutMs: 1_800_000, // 30min — sub-agent runs may execute many tool calls
         },
         execute: agentTool,
-        exposure: expose(HARNESS_TAGS, { defaultPermissionRules: allow(agentToolDef.name) }),
+        exposure: expose(HARNESS_TAGS, {
+            defaultPermissionRules: allow(agentToolDef.name),
+            availability: (ctx) => ctx.behaviorProfile !== "quickChatRestricted",
+        }),
     },
     {
         definition: {

package/dist/tool-system/path-policy.js

@@ -449,8 +449,6 @@ function isRegisteredSkillResourceRead(resolved) {
         return false;
     if (isSkillTreeResource(resolved, join(codeShellRoot, "skills")))
         return true;
-    if (isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot))
-        return true;
     let cacheRoot;
     try {
         cacheRoot = realpathSync(join(codeShellRoot, "plugins", "cache"));
@@ -479,20 +477,26 @@ function isRegisteredSkillResourceRead(resolved) {
     return false;
 }
 /**
- * Panel App Skills live under the otherwise-sensitive
- * `~/.code-shell/panel-apps` tree. Installation already reviews and copies the
- * package, and the Skill scanner exposes only entries declared by the app
- * manifest. Mirror that exact boundary here so reading a Skill reference does
- * not trigger a second approval prompt.
+ * Installed Panel Apps live under the otherwise-sensitive
+ * `~/.code-shell/panel-apps` tree. Their package contents are reviewed and
+ * copied by the installer, so ordinary source, manifests, assets and declared
+ * Agent resources should not require a second approval merely because their
+ * parent directory is `~/.code-shell`.
  *
- * Registry, app root, manifest, declared SKILL.md and target are all
- * realpathed and containment-checked. This deliberately does not trust an
- * undeclared Skill directory or a symlink escaping the installed app.
+ * Keep the exception read-only at the call site and require a valid installed
+ * registry entry plus a matching V2 manifest. Registry, app root, manifest and
+ * target are all realpathed and containment-checked. Credential-shaped files
+ * are still caught by `SENSITIVE_FILE_PATTERNS` before this exception, and a
+ * symlink escaping the installed package never inherits its read authority.
  */
-function isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot) {
+function isInstalledPanelAppResourceRead(resolved) {
+    let codeShellRoot;
     let appsRoot;
     let registryPath;
     try {
+        codeShellRoot = realpathSync(join(configuredUserHome(), ".code-shell"));
+        if (!isInsideDir(resolved, codeShellRoot))
+            return false;
         appsRoot = realpathSync(join(codeShellRoot, "panel-apps"));
         if (!isInsideDir(appsRoot, codeShellRoot))
             return false;
@@ -526,29 +530,10 @@ function isInstalledPanelAppSkillResourceRead(resolved, codeShellRoot) {
             if (!isInsideDir(manifestPath, appRoot) || !statSync(manifestPath).isFile())
                 continue;
             const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-            if (manifest.schemaVersion !== 2 ||
-                manifest.id !== id ||
-                !Array.isArray(manifest.agent?.skills)) {
+            if (manifest.schemaVersion !== 2 || manifest.id !== id)
                 continue;
-            }
-            for (const skillEntry of manifest.agent.skills) {
-                if (typeof skillEntry !== "string")
-                    continue;
-                const segments = skillEntry.split("/");
-                if (segments.length !== 4 ||
-                    segments[0] !== "agent" ||
-                    segments[1] !== "skills" ||
-                    !/^[a-z][a-z0-9-]{0,63}$/.test(segments[2] ?? "") ||
-                    segments[3] !== "SKILL.md") {
-                    continue;
-                }
-                const skillManifest = realpathSync(join(appRoot, ...segments));
-                if (!isInsideDir(skillManifest, appRoot) || !statSync(skillManifest).isFile())
-                    continue;
-                const skillRoot = dirname(skillManifest);
-                if (isInsideDir(resolved, skillRoot))
-                    return true;
-            }
+            if (isInsideDir(resolved, appRoot))
+                return true;
         }
         catch {
             // A stale, malformed, or tampered Panel App entry grants no read access.
@@ -652,6 +637,13 @@ export function classifyPath(rawPath, opts) {
             resolvedPath: resolved,
         };
     }
+    if (opts.operation === "read" && !sensitiveFile && isInstalledPanelAppResourceRead(resolved)) {
+        return {
+            decision: "allow",
+            reason: "installed Panel App resource read",
+            resolvedPath: resolved,
+        };
+    }
     // Sensitive: write is always denied, read always asks. Workspace placement
     // doesn't soften the rule — an `.env` in the project still asks on read.
     if (sensitiveLabel) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.8",
+  "version": "0.8.9",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",