@cjhyy/code-shell-core 0.8.9 → 0.8.10

package/dist/credentials/store.js

@@ -1,11 +1,88 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { credentialAllowsEnvExposure, credentialSecretHint, } from "./types.js";
 import { getDefaultCredentialCipher } from "./cipher.js";
 import { logger } from "../logging/logger.js";
 import { summarizeOAuthCredentialSecret } from "./oauth.js";
 import { isBrowserOAuthLinkCredential } from "./oauth.js";
+import { acquireFileLock, writeFileAtomic } from "../utils/file-mutex.js";
+const MAX_CREDENTIALS = 4_096;
+const MAX_CREDENTIAL_FILE_BYTES = 32 * 1024 * 1024;
+const MAX_CREDENTIAL_SECRET_BYTES = 16 * 1024 * 1024;
+const MAX_CREDENTIAL_META_BYTES = 1024 * 1024;
+const MAX_CREDENTIAL_ID_CHARS = 512;
+const MAX_CREDENTIAL_LABEL_CHARS = 4_096;
+function normalizeCredential(value, strict) {
+    const invalid = (message) => {
+        if (strict)
+            throw new Error(`invalid credential: ${message}`);
+        return undefined;
+    };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return invalid("object");
+    const raw = value;
+    if (typeof raw.id !== "string" ||
+        !raw.id ||
+        raw.id.length > MAX_CREDENTIAL_ID_CHARS ||
+        raw.id.includes("\0")) {
+        return invalid("id");
+    }
+    if (raw.type !== "token" &&
+        raw.type !== "link" &&
+        raw.type !== "cookie" &&
+        raw.type !== "oauth") {
+        return invalid("type");
+    }
+    if (typeof raw.label !== "string" ||
+        raw.label.length > MAX_CREDENTIAL_LABEL_CHARS ||
+        raw.label.includes("\0")) {
+        return invalid("label");
+    }
+    if (raw.secret !== undefined &&
+        (typeof raw.secret !== "string" || Buffer.byteLength(raw.secret) > MAX_CREDENTIAL_SECRET_BYTES)) {
+        return invalid("secret");
+    }
+    if (raw.exposeAsEnv !== undefined &&
+        (typeof raw.exposeAsEnv !== "string" ||
+            raw.exposeAsEnv.length > 512 ||
+            raw.exposeAsEnv.includes("\0"))) {
+        return invalid("exposeAsEnv");
+    }
+    if (raw.autoUseByAI !== undefined && typeof raw.autoUseByAI !== "boolean") {
+        return invalid("autoUseByAI");
+    }
+    if (raw.autoInjectByAI !== undefined && typeof raw.autoInjectByAI !== "boolean") {
+        return invalid("autoInjectByAI");
+    }
+    let meta;
+    if (raw.meta !== undefined) {
+        if (!raw.meta || typeof raw.meta !== "object" || Array.isArray(raw.meta)) {
+            return invalid("meta");
+        }
+        try {
+            const encoded = JSON.stringify(raw.meta);
+            if (Buffer.byteLength(encoded) > MAX_CREDENTIAL_META_BYTES)
+                return invalid("meta");
+            // Clone through JSON so callers cannot retain a mutable/cyclic object or
+            // smuggle a surprising prototype into later credential consumers.
+            meta = JSON.parse(encoded);
+        }
+        catch {
+            return invalid("meta");
+        }
+    }
+    return {
+        id: raw.id,
+        type: raw.type,
+        label: raw.label,
+        ...(typeof raw.secret === "string" ? { secret: raw.secret } : {}),
+        ...(typeof raw.exposeAsEnv === "string" ? { exposeAsEnv: raw.exposeAsEnv } : {}),
+        ...(typeof raw.autoUseByAI === "boolean" ? { autoUseByAI: raw.autoUseByAI } : {}),
+        ...(typeof raw.autoInjectByAI === "boolean" ? { autoInjectByAI: raw.autoInjectByAI } : {}),
+        ...(meta ? { meta } : {}),
+    };
+}
 /** 测试可经 process.env.HOME 覆盖(镜像 settings/manager.ts userHome)。 */
 function userHome() {
     return process.env.HOME ?? homedir();
@@ -40,6 +117,9 @@ export class CredentialStore {
         this.cipher = cipher ?? getDefaultCredentialCipher();
     }
     pathFor(scope) {
+        if (scope !== "user" && scope !== "project") {
+            throw new Error(`invalid credential scope: ${String(scope)}`);
+        }
         if (scope === "user") {
             return join(this.userDirOverride ?? join(userHome(), ".code-shell"), "credentials.json");
         }
@@ -66,54 +146,165 @@ export class CredentialStore {
         }
     }
     read(scope) {
+        return this.readGuarded(scope).file;
+    }
+    /**
+     * Read the store, reporting whether the on-disk state was fully understood.
+     *
+     * `readable: false` means "there is a file here but this build could not
+     * parse it" — NOT "there are no credentials". The distinction matters because
+     * mutate() commits whatever this returns: treating an unreadable file as an
+     * empty list turns any later save() into a wipe of every stored credential.
+     *
+     * `unknown` carries entries this build's schema rejects (for example a
+     * credential type added by a newer version). They are kept verbatim so a
+     * round-trip through an older build preserves rather than deletes them.
+     */
+    readGuarded(scope) {
+        const empty = { ...EMPTY, credentials: [] };
         const p = this.pathFor(scope);
-        if (!p || !existsSync(p))
-            return { ...EMPTY, credentials: [] };
+        if (!p)
+            return { file: empty, readable: true, unknown: [] };
+        let descriptor;
         try {
-            const raw = JSON.parse(readFileSync(p, "utf8"));
-            const creds = Array.isArray(raw.credentials) ? raw.credentials : [];
+            const parent = lstatSync(dirname(p));
+            if (parent.isSymbolicLink() || !parent.isDirectory()) {
+                logger.warn("credentials.invalid_parent", { path: p });
+                return { file: empty, readable: false, unknown: [] };
+            }
+            const metadata = lstatSync(p);
+            if (metadata.isSymbolicLink() ||
+                !metadata.isFile() ||
+                metadata.size > MAX_CREDENTIAL_FILE_BYTES) {
+                logger.warn("credentials.file_too_large", { path: p });
+                return { file: empty, readable: false, unknown: [] };
+            }
+            descriptor = openSync(p, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(descriptor);
+            if (!opened.isFile() || opened.size > MAX_CREDENTIAL_FILE_BYTES) {
+                return { file: empty, readable: false, unknown: [] };
+            }
+            const raw = JSON.parse(readFileSync(descriptor, "utf8"));
+            const values = Array.isArray(raw.credentials)
+                ? raw.credentials.slice(0, MAX_CREDENTIALS)
+                : [];
+            const creds = [];
+            const unknown = [];
             // Decrypt secrets at the disk boundary so all callers see plaintext.
-            for (const c of creds) {
+            for (const value of values) {
+                const c = normalizeCredential(value, false);
+                if (!c) {
+                    unknown.push(value);
+                    continue;
+                }
                 if (typeof c.secret === "string" && c.secret.length > 0) {
                     c.secret = this.decryptSecret(c.secret);
                 }
+                creds.push(c);
             }
-            return { version: 1, credentials: creds };
+            return { file: { version: 1, credentials: creds }, readable: true, unknown };
         }
-        catch {
-            return { ...EMPTY, credentials: [] };
+        catch (error) {
+            // A missing file is genuinely empty; anything else (torn JSON, EACCES)
+            // is unreadable and must not be committed over.
+            if (error.code === "ENOENT") {
+                return { file: empty, readable: true, unknown: [] };
+            }
+            logger.warn("credentials.unreadable", { path: p, error: error.message });
+            return { file: empty, readable: false, unknown: [] };
+        }
+        finally {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
         }
     }
-    write(scope, file) {
+    write(scope, file, 
+    /** Entries this build's schema rejected; re-emitted verbatim so an older
+     *  build cannot delete a newer build's credential types. */
+    preserved = []) {
         const p = this.pathFor(scope);
         if (!p)
             return;
-        mkdirSync(dirname(p), { recursive: true });
         // Encrypt secrets at the disk boundary. `file` carries plaintext secrets
         // (read() decrypted them); serialize a copy with each secret encrypted so
         // we never persist plaintext under an encrypting cipher.
         const onDisk = {
             version: file.version,
-            credentials: file.credentials.map((c) => typeof c.secret === "string" && c.secret.length > 0
-                ? { ...c, secret: this.cipher.encrypt(c.secret) }
-                : c),
+            credentials: [
+                ...file.credentials.map((c) => typeof c.secret === "string" && c.secret.length > 0
+                    ? { ...c, secret: this.cipher.encrypt(c.secret) }
+                    : c),
+                ...preserved,
+            ],
         };
-        const tmp = `${p}.${process.pid}.${String(performance.now()).replace(".", "")}.tmp`;
-        writeFileSync(tmp, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
-        renameSync(tmp, p);
+        const encoded = JSON.stringify(onDisk, null, 2);
+        if (Buffer.byteLength(encoded) > MAX_CREDENTIAL_FILE_BYTES) {
+            throw new Error("credential store exceeds the maximum file size");
+        }
+        const parentPath = dirname(p);
+        mkdirSync(parentPath, { recursive: true, mode: 0o700 });
+        const parent = lstatSync(parentPath);
+        if (parent.isSymbolicLink() || !parent.isDirectory()) {
+            throw new Error("credential store parent must be a real directory");
+        }
+        try {
+            const target = lstatSync(p);
+            if (target.isSymbolicLink() || !target.isFile()) {
+                throw new Error("credential store target must be a regular file");
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        writeFileAtomic(p, encoded, 0o600);
+    }
+    mutate(scope, change) {
+        const p = this.pathFor(scope);
+        if (!p)
+            return;
+        const parent = dirname(p);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const parentInfo = lstatSync(parent);
+        if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+            throw new Error("credential store parent must be a real directory");
+        }
+        const release = acquireFileLock(p);
+        try {
+            // Reload only after acquiring the cross-process lock; otherwise two app
+            // instances can each write back a stale snapshot and silently lose one.
+            const { file, readable, unknown } = this.readGuarded(scope);
+            // Refuse to commit over state we could not parse. Writing here would
+            // replace every existing credential with whatever this mutation adds.
+            if (!readable) {
+                throw new Error("refusing to modify an unreadable credential store; " +
+                    "move the corrupt file aside to start a new one");
+            }
+            if (change(file))
+                this.write(scope, file, unknown);
+        }
+        finally {
+            release();
+        }
     }
     /** Upsert by id within a scope. */
     save(scope, cred) {
-        const file = this.read(scope);
-        const safeCredential = credentialAllowsEnvExposure(cred.type)
-            ? cred
-            : { ...cred, exposeAsEnv: undefined };
-        const idx = file.credentials.findIndex((c) => c.id === cred.id);
-        if (idx >= 0)
-            file.credentials[idx] = safeCredential;
-        else
-            file.credentials.push(safeCredential);
-        this.write(scope, file);
+        const normalized = normalizeCredential(cred, true);
+        const safeCredential = credentialAllowsEnvExposure(normalized.type)
+            ? normalized
+            : { ...normalized, exposeAsEnv: undefined };
+        this.mutate(scope, (file) => {
+            const idx = file.credentials.findIndex((c) => c.id === safeCredential.id);
+            if (idx >= 0)
+                file.credentials[idx] = safeCredential;
+            else {
+                if (file.credentials.length >= MAX_CREDENTIALS) {
+                    throw new Error("credential store has reached its maximum entry count");
+                }
+                file.credentials.push(safeCredential);
+            }
+            return true;
+        });
     }
     /**
      * 只改元数据(label / exposeAsEnv / autoUseByAI / meta),保留 secret 原样。
@@ -121,22 +312,34 @@ export class CredentialStore {
      * id 不存在则 no-op。
      */
     patch(scope, id, fields) {
-        const file = this.read(scope);
-        const idx = file.credentials.findIndex((c) => c.id === id);
-        if (idx < 0)
-            return;
-        const current = file.credentials[idx];
-        file.credentials[idx] = {
-            ...current,
-            ...fields,
-            ...(credentialAllowsEnvExposure(current.type) ? {} : { exposeAsEnv: undefined }),
-        };
-        this.write(scope, file);
+        if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
+            throw new Error("invalid credential id");
+        }
+        this.mutate(scope, (file) => {
+            const idx = file.credentials.findIndex((c) => c.id === id);
+            if (idx < 0)
+                return false;
+            const current = file.credentials[idx];
+            const updated = normalizeCredential({
+                ...current,
+                ...fields,
+                ...(credentialAllowsEnvExposure(current.type) ? {} : { exposeAsEnv: undefined }),
+            }, true);
+            file.credentials[idx] = updated;
+            return true;
+        });
     }
     remove(scope, id) {
-        const file = this.read(scope);
-        file.credentials = file.credentials.filter((c) => c.id !== id);
-        this.write(scope, file);
+        if (typeof id !== "string" || !id || id.length > MAX_CREDENTIAL_ID_CHARS || id.includes("\0")) {
+            throw new Error("invalid credential id");
+        }
+        this.mutate(scope, (file) => {
+            const next = file.credentials.filter((c) => c.id !== id);
+            if (next.length === file.credentials.length)
+                return false;
+            file.credentials = next;
+            return true;
+        });
     }
     /**
      * List credentials visible to an engine of the given settings scope.

package/dist/engine/engine.js

@@ -1070,10 +1070,6 @@ export class Engine {
         // surfacing as `[-32603] Session not found: <sid>` on the very first
         // TUI turn. Detection now uses `sessionManager.exists()` (one stat
         // call) instead of a try/catch on resume.
-        // wrappedOnStream (defined before the session opens, executed only after)
-        // closes over `session`, so keep the declaration here and assign from the
-        // opener's result.
-        let session;
         const openedResult = openRunSession({
             sessionManager: this.sessionManager,
             options,
@@ -1096,8 +1092,51 @@ export class Engine {
         });
         if (!openedResult.ok)
             return openedResult.result;
-        const { messages, freshImageMessage, resumedFromDisk, claimClientMessageId, releaseClientMessageId, } = openedResult.opened;
-        session = openedResult.opened.session;
+        const { messages: openedMessages, freshImageMessage, resumedFromDisk, claimClientMessageId, releaseClientMessageId, } = openedResult.opened;
+        const session = openedResult.opened.session;
+        let messages = openedMessages;
+        // A host-owned time/topic boundary must be applied only after the current
+        // user message exists in the transcript (it is the exclusive end anchor),
+        // yet before this turn assembles prompts or calls the model. Doing this as
+        // a separate host query races both sides of that boundary: too early and
+        // the anchor is dead; too late and the first new-topic prompt still sees
+        // the entire old topic. Fail open to full history if summarization fails.
+        if (options?.archiveBeforeCurrentTurn && options.clientMessageId) {
+            try {
+                const archived = await this.archiveTurnRange(session.state.sessionId, { start: 0, end: 0 }, {
+                    toClientMessageId: options.clientMessageId,
+                    ...(options.archiveBeforeCurrentTurn.fromClientMessageId
+                        ? {
+                            fromClientMessageId: options.archiveBeforeCurrentTurn.fromClientMessageId,
+                        }
+                        : {}),
+                    ...(options.archiveBeforeCurrentTurn.segmentId
+                        ? { segmentId: options.archiveBeforeCurrentTurn.segmentId }
+                        : {}),
+                });
+                if (archived.before > archived.after) {
+                    options.onStream?.({
+                        type: "context_compact",
+                        strategy: "range",
+                        before: archived.before,
+                        after: archived.after,
+                    });
+                }
+                // openRunSession captured the pre-marker replay. Rebuild from the
+                // persisted marker so this very first post-boundary model call gets
+                // the archived view rather than waiting until the following turn.
+                messages =
+                    this.compactedMessagesBySession.get(session.state.sessionId) ??
+                        this.sessionManager.resume(session.state.sessionId).transcript.toMessages();
+            }
+            catch (error) {
+                logger.warn("engine.pre_run_archive.failed", {
+                    sessionId: session.state.sessionId,
+                    segmentId: options.archiveBeforeCurrentTurn.segmentId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         this.stampRunToolContext(toolCtx, session, options);
         const sessionRun = runWithSid(session.state.sessionId, async () => {
             const hookMessages = profile?.disableHooks

package/dist/engine/file-history-hook.js

@@ -1,13 +1,19 @@
 import { FileHistory } from "../session/file-history.js";
 export function registerFileHistoryHook(options) {
     const history = FileHistory.loadFromDir(options.sessionDir);
-    const handler = async (context) => {
+    const pendingCreates = new Map();
+    const startHandler = async (context) => {
         const toolName = context.data?.toolName;
         const args = context.data?.args;
+        const toolCallId = context.data?.toolCallId;
         const turnSeq = options.getTurnSeq();
         if ((toolName === "Write" || toolName === "Edit") && typeof args?.file_path === "string") {
-            if (history.saveSnapshot(args.file_path, turnSeq) === null && turnSeq !== undefined) {
-                history.recordCreated(args.file_path, turnSeq);
+            const marker = turnSeq === undefined ? null : history.prepareCreated(args.file_path, turnSeq);
+            if (marker && typeof toolCallId === "string") {
+                pendingCreates.set(toolCallId, marker);
+            }
+            else {
+                history.saveSnapshot(args.file_path, turnSeq);
             }
         }
         else if (args) {
@@ -18,14 +24,27 @@ export function registerFileHistoryHook(options) {
         }
         return {};
     };
-    options.hooks.register("on_tool_start", handler, 100, "file_history_backup");
+    const endHandler = async (context) => {
+        const toolCallId = context.data?.toolCallId;
+        if (typeof toolCallId !== "string")
+            return {};
+        const marker = pendingCreates.get(toolCallId);
+        pendingCreates.delete(toolCallId);
+        if (marker && context.data?.isError !== true)
+            history.commitCreated(marker);
+        return {};
+    };
+    options.hooks.register("on_tool_start", startHandler, 100, "file_history_backup");
+    options.hooks.register("on_tool_end", endHandler, 100, "file_history_backup");
     let disposed = false;
     return {
         dispose() {
             if (disposed)
                 return;
             disposed = true;
-            options.hooks.unregister("on_tool_start", handler);
+            pendingCreates.clear();
+            options.hooks.unregister("on_tool_start", startHandler);
+            options.hooks.unregister("on_tool_end", endHandler);
         },
     };
 }

package/dist/engine/run-types.d.ts

@@ -98,6 +98,15 @@ export interface EngineRunOptions {
     goal?: string | GoalConfig;
     injected?: boolean;
     clientMessageId?: string;
+    /**
+     * Host-requested history boundary to archive after this run's user message
+     * has been appended, but before the first model call. The current
+     * `clientMessageId` is the exclusive end anchor.
+     */
+    archiveBeforeCurrentTurn?: {
+        fromClientMessageId?: string;
+        segmentId?: string;
+    };
     attachments?: InputAttachmentMeta[];
     /** Named per-run behavior profile supplied by interactive product surfaces. */
     behaviorMode?: RunBehaviorMode;

package/dist/engine/turn-loop.js

@@ -22,7 +22,7 @@ import { COMPLETE_GOAL_TOOL_NAME } from "../tool-system/builtin/complete-goal.js
 import { CANCEL_GOAL_TOOL_NAME } from "../tool-system/builtin/cancel-goal.js";
 import { redactSensitiveToolResultsInMessages, SENSITIVE_TOOL_RESULT_PLACEHOLDER, toolResultForDisplay, toolResultTranscriptText, toolResultsForDisplay, } from "../tool-system/tool-result-redaction.js";
 import { addTokenUsage, cacheHitRateFromUsage, cumulativeCacheHitRate, } from "../session/usage.js";
-import { createGoalBudgetTracker, recordGoalUsage, goalBudgetTerminationReason, applyGoalExtension, limitProximity, isSameGoalVersion, normalizeGoal, GOAL_DEFAULT_MAX_STOP_BLOCKS, } from "../goal/lifecycle.js";
+import { createGoalBudgetTracker, recordGoalUsage, goalBudgetTerminationReason, applyGoalExtension, extendGoalLimit, limitProximity, isSameGoalVersion, normalizeGoal, GOAL_DEFAULT_MAX_STOP_BLOCKS, } from "../goal/lifecycle.js";
 /**
  * 把一个 ToolResult 映射成发给 LLM 的 tool_result ContentBlock。
  * 有 contentBlocks(view_image 的图片块)就原样用作 content;否则
@@ -148,6 +148,9 @@ export class TurnLoop {
      * effective limits.
      */
     extend(opts) {
+        const previousMaxTurns = this.config.maxTurns;
+        const previousTokenBudget = this.goalTracker?.goal.tokenBudget;
+        const previousTimeBudgetMs = this.goalTracker?.goal.timeBudgetMs;
         const elapsedMs = this.goalTracker ? Date.now() - this.goalTracker.startedAtMs : 0;
         const next = applyGoalExtension(this.config.maxTurns, this.goalTracker?.goal, this.goalTracker?.tokensUsed ?? 0, elapsedMs, opts);
         this.config = { ...this.config, maxTurns: next.maxTurns };
@@ -166,18 +169,16 @@ export class TurnLoop {
         // limit that actually bites, so an extend that only bumped maxTurns/budgets
         // couldn't keep it going. Resolve the current cap the same way the loop does.
         const curCap = this.config.maxStopBlocks ?? GOAL_DEFAULT_MAX_STOP_BLOCKS;
-        const nextCap = typeof opts.addStopBlocks === "number" && opts.addStopBlocks > 0
-            ? curCap + Math.floor(opts.addStopBlocks)
-            : curCap;
+        const nextCap = extendGoalLimit(curCap, opts.addStopBlocks);
         this.config = { ...this.config, maxStopBlocks: nextCap };
         // ANY extension resets the consecutive stop-block streak: the user just
         // asked to keep going, so a goal that was repeatedly re-blocked shouldn't be
         // immediately re-capped. (Previously only addTurns reset it, leaving a
         // budget-only extension unable to un-stick a capped goal.)
-        const extended = (opts.addTurns ?? 0) > 0 ||
-            (opts.addStopBlocks ?? 0) > 0 ||
-            (opts.addTokenBudget ?? 0) > 0 ||
-            (opts.addTimeBudgetMs ?? 0) > 0;
+        const extended = next.maxTurns !== previousMaxTurns ||
+            nextCap !== curCap ||
+            next.tokenBudget !== previousTokenBudget ||
+            next.timeBudgetMs !== previousTimeBudgetMs;
         if (extended) {
             this.stopBlockCount = 0;
             // Let the next approach re-announce against the raised ceilings.

package/dist/goal/lifecycle.d.ts

@@ -83,6 +83,8 @@ export type GoalLifecycleV1 = (GoalLifecycleBaseV1 & {
     };
 });
 export type GoalLifecyclePhase = GoalLifecycleV1["phase"];
+/** Add a user-controlled positive integer delta without producing Infinity or an unsafe integer. */
+export declare function extendGoalLimit(current: number, addition: unknown): number;
 /** Build one canonical lifecycle record from the compatibility GoalConfig view. */
 export declare function createGoalLifecycle(goal: GoalConfig, phase?: Exclude<GoalLifecyclePhase, "terminal" | "waiting">, nowMs?: number): GoalLifecycleV1;
 /** Compatibility view consumed by Engine/protocol while persistence uses the union. */