@cjhyy/code-shell-core 0.8.9 → 0.8.10

package/dist/tool-system/builtin/skill.js

@@ -70,7 +70,9 @@ export async function skillTool(args, ctx) {
     });
     const found = skills.find((s) => s.name === skillName);
     if (!found) {
-        return `Skill "${skillName}" not found. Run /skills to list available skills.`;
+        return (`Skill "${skillName}" not found. Run /skills to list available skills. ` +
+            "If the user asked to add it and you know its trusted GitHub source, use " +
+            "InstallCapability with kind='skill' instead of constructing a shell command.");
     }
     const skillDir = dirname(found.filePath);
     const body = found.content

package/dist/tool-system/executor.js

@@ -502,6 +502,7 @@ export class ToolExecutor {
             toolCallId: call.id,
             result: observerResult,
             error: result.error,
+            isError: result.isError,
             signal: this.signal ?? this.toolCtx?.signal,
         });
         // 5. Post-tool-use hook (after execution, can observe/modify result)

package/dist/tool-system/registry.js

@@ -57,6 +57,11 @@ export class ToolRegistry {
         const fork = new ToolRegistry({ builtinTools: [] });
         fork.tools = new Map(this.tools);
         fork.builtinExecutors = new Map(this.builtinExecutors);
+        // Availability is part of the executable tool contract, not just prompt
+        // decoration. Engine instances run against this fork, so dropping the
+        // guards here lets a model invoke a tool that was correctly hidden from
+        // its current turn (for example GatewayReply in a desktop Mimi chat).
+        fork.availabilityGuards = new Map(this.availabilityGuards);
         return fork;
     }
     unregisterTool(name) {

package/dist/utils/file-mutex.d.ts

@@ -62,4 +62,6 @@ export declare function mutateJsonFile<T, R = void>(file: string, options: {
         result?: R;
     };
     mode?: number;
+    /** Bounds both the current file and newly serialized state. */
+    maxBytes?: number;
 }): R | undefined;

package/dist/utils/file-mutex.js

@@ -19,7 +19,7 @@
  * `<dir>.lock`), matching CronStore. Locking the directory rather than the file
  * means a writer that creates the file for the first time is still serialized.
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { lockSync } from "./lockfile.js";
@@ -39,6 +39,7 @@ const LOCK_STALE_MS = 10_000;
 /** Backoff bounds for the retry loop (see acquireLockOn). */
 const LOCK_RETRY_MIN_MS = 5;
 const LOCK_RETRY_MAX_MS = 50;
+const DEFAULT_JSON_FILE_MAX_BYTES = 16 * 1024 * 1024;
 // Atomics.wait only ever reads slot 0, which stays 0, so one shared buffer is
 // safe and avoids allocating per retry.
 const SLEEP_SIGNAL = new Int32Array(new SharedArrayBuffer(4));
@@ -123,19 +124,43 @@ export function writeFileAtomic(file, contents, mode) {
  * skips the write entirely (no-op mutations should not rewrite the file).
  */
 export function mutateJsonFile(file, options) {
+    const maxBytes = options.maxBytes ?? DEFAULT_JSON_FILE_MAX_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("JSON state maxBytes must be a positive safe integer");
+    }
     const release = acquireFileLock(file);
     try {
         let raw;
         try {
-            raw = readFileSync(file, "utf-8");
+            const pathInfo = lstatSync(file);
+            if (pathInfo.isSymbolicLink() || !pathInfo.isFile() || pathInfo.size > maxBytes) {
+                throw new Error(`JSON state is not a bounded regular file: ${file}`);
+            }
+            const descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            try {
+                const opened = fstatSync(descriptor);
+                if (!opened.isFile() || opened.size > maxBytes) {
+                    throw new Error(`JSON state is not a bounded regular file: ${file}`);
+                }
+                raw = readFileSync(descriptor, "utf-8");
+            }
+            finally {
+                closeSync(descriptor);
+            }
         }
-        catch {
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
             raw = undefined;
         }
         const current = options.parse(raw);
         const { value, result } = options.mutation(current);
         if (value !== undefined) {
-            writeFileAtomic(file, options.serialize(value), options.mode);
+            const serialized = options.serialize(value);
+            if (Buffer.byteLength(serialized, "utf8") > maxBytes) {
+                throw new Error(`JSON state exceeds ${maxBytes} bytes`);
+            }
+            writeFileAtomic(file, serialized, options.mode);
         }
         return result;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,6 +38,7 @@
   ],
   "scripts": {
     "build": "bun run clean && tsc -p tsconfig.json && bun run copy-assets",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
     "copy-assets": "node ../../scripts/copy-assets.mjs dist/prompt/sections src/prompt/sections/*.md && node ../../scripts/copy-assets.mjs dist/data src/data/*.json",
     "dev": "bun run copy-assets && tsc -p tsconfig.json --watch --preserveWatchOutput",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""