@cjhyy/code-shell-core 0.9.5 → 0.9.7

package/dist/tool-system/permission.d.ts

@@ -100,7 +100,10 @@ export declare class InteractiveApprovalBackend implements ApprovalBackend {
     private promptFn;
     private legacyPromptTurn;
     private legacyContext;
+    private requestGuard?;
     constructor(approvalRouter?: ApprovalRouter);
+    /** Host lifecycle checks apply even to cached grants and queued prompts. */
+    setRequestGuard(guard: (request: ApprovalRequest) => ApprovalResult | undefined): void;
     setPromptFn(fn: (request: ApprovalRequest) => Promise<ApprovalResult>): void;
     clearPromptFn(): void;
     /**
@@ -220,6 +223,9 @@ export declare class PermissionClassifier {
     handleAsk(toolName: string, args: Record<string, unknown>, reason?: string, opts?: {
         sessionId?: string;
     }): Promise<boolean>;
+    handleAskResult(toolName: string, args: Record<string, unknown>, reason?: string, opts?: {
+        sessionId?: string;
+    }): Promise<ApprovalResult>;
     /** Get denial warning message if the model keeps getting denied. */
     getDenialWarning(toolName: string): string | undefined;
     private matchesRule;

package/dist/tool-system/permission.js

@@ -106,12 +106,16 @@ export class HeadlessApprovalBackend {
             case "approve-all":
                 return { approved: true };
             case "deny-all":
-                return { approved: false, reason: "headless deny-all mode" };
+                return { approved: false, failure: "policy_denied", reason: "headless deny-all mode" };
             case "approve-read-only": {
                 if (READ_ONLY_TOOLS.has(req.toolName)) {
                     return { approved: true };
                 }
-                return { approved: false, reason: "read-only mode: write operations denied" };
+                return {
+                    approved: false,
+                    failure: "policy_denied",
+                    reason: "read-only mode: write operations denied",
+                };
             }
         }
     }
@@ -140,6 +144,7 @@ export class AutoApprovalBackend {
             }
             return {
                 approved: false,
+                failure: "unavailable",
                 reason: "auto mode: high-risk operation denied (no interactive approval available)",
             };
         }
@@ -157,6 +162,7 @@ export class AutoApprovalBackend {
         }
         return {
             approved: false,
+            failure: "unavailable",
             reason: "auto mode: medium-risk operation denied (no interactive approval available)",
         };
     }
@@ -223,9 +229,14 @@ export class InteractiveApprovalBackend {
         savedProjectRules: [],
         onProjectRules: null,
     };
+    requestGuard;
     constructor(approvalRouter = new ApprovalRouter()) {
         this.approvalRouter = approvalRouter;
     }
+    /** Host lifecycle checks apply even to cached grants and queued prompts. */
+    setRequestGuard(guard) {
+        this.requestGuard = guard;
+    }
     setPromptFn(fn) {
         this.promptFn = fn;
     }
@@ -313,13 +324,20 @@ export class InteractiveApprovalBackend {
             this.sessionStateById.get(sessionId) === state);
     }
     async requestApproval(req) {
+        const unavailable = this.requestGuard?.(req);
+        if (unavailable)
+            return unavailable;
         const state = this.getSessionState(req.sessionId, true);
         // Fast path: the operation may already be covered by a session rule.
         const cached = state ? this.checkSessionRules(req, state) : null;
         if (cached)
             return cached;
         if (!this.promptFn && !this.approvalRouter.hasConnections()) {
-            return { approved: false, reason: "interactive approval backend has no prompt function" };
+            return {
+                approved: false,
+                failure: "unavailable",
+                reason: "interactive approval backend has no prompt function",
+            };
         }
         // Serialize prompts and re-check rules when our turn comes (see promptTurn
         // field doc): a burst of parallel tool calls all passes the fast path
@@ -336,6 +354,9 @@ export class InteractiveApprovalBackend {
         }
         try {
             await prevTurn;
+            const unavailable = this.requestGuard?.(req);
+            if (unavailable)
+                return unavailable;
             const activeState = this.isActiveSessionState(req.sessionId, state) ? state : null;
             const nowCached = activeState ? this.checkSessionRules(req, activeState) : null;
             if (nowCached)
@@ -374,12 +395,20 @@ export class InteractiveApprovalBackend {
                 ? await fallback
                 : {
                     approved: false,
+                    failure: "owner_lost",
                     reason: `no approval connection owns session ${req.sessionId}`,
                 };
         }
         else {
-            return { approved: false, reason: "interactive approval backend has no prompt function" };
+            return {
+                approved: false,
+                failure: "unavailable",
+                reason: "interactive approval backend has no prompt function",
+            };
         }
+        const unavailable = this.requestGuard?.(req);
+        if (unavailable)
+            return unavailable;
         const scope = result.scope ?? (result.always ? "session" : "once");
         const activeState = this.isActiveSessionState(req.sessionId, state) ? state : null;
         const context = activeState ?? (!req.sessionId ? this.legacyContext : null);
@@ -1322,13 +1351,20 @@ export class PermissionClassifier {
         }
     }
     async handleAsk(toolName, args, reason, opts) {
+        return (await this.handleAskResult(toolName, args, reason, opts)).approved;
+    }
+    async handleAskResult(toolName, args, reason, opts) {
         if (this.defaultMode === "dontAsk") {
             this.log.info("permission.auto_deny", {
                 cat: "permission",
                 tool: toolName,
                 reason: "dontAsk_mode",
             });
-            return false;
+            return {
+                approved: false,
+                failure: "policy_denied",
+                reason: "permission policy does not allow prompting",
+            };
         }
         if (this.defaultMode === "bypassPermissions") {
             this.log.info("permission.auto_allow", {
@@ -1336,7 +1372,7 @@ export class PermissionClassifier {
                 tool: toolName,
                 reason: "bypassPermissions_mode",
             });
-            return true;
+            return { approved: true };
         }
         // Check denial tracker — if too many denials, auto-deny
         if (this.denialTracker.shouldWarn(toolName)) {
@@ -1345,7 +1381,7 @@ export class PermissionClassifier {
                 tool: toolName,
                 reason: "denial_tracker_threshold",
             });
-            return false;
+            return { approved: false, failure: "policy_denied", reason: "repeated user denials" };
         }
         const riskLevel = this.assessRisk(toolName, args);
         const span = this.log.span("permission.ask", {
@@ -1385,7 +1421,7 @@ export class PermissionClassifier {
         if (result.approved) {
             this.denialTracker.recordSuccess(toolName);
         }
-        else {
+        else if (!result.failure || result.failure === "denied") {
             this.denialTracker.record(toolName);
         }
         this.emitApprovalEvent({
@@ -1403,7 +1439,7 @@ export class PermissionClassifier {
             scope: result.scope,
             reason: !result.approved ? result.reason : undefined,
         });
-        return result.approved;
+        return result;
     }
     /** Get denial warning message if the model keeps getting denied. */
     getDenialWarning(toolName) {

package/dist/tool-system/plan-mode-allowlist.js

@@ -35,6 +35,7 @@ export const READ_ONLY_TOOLS = new Set([
     "WebSearch",
     "WebFetch",
     "ToolSearch",
+    "SearchHistory",
 ]);
 export const PLAN_MODE_ALLOWED_TOOLS = new Set([
     // Plan lifecycle
@@ -60,6 +61,10 @@ export const PLAN_MODE_ALLOWED_TOOLS = new Set([
     "TaskUpdate",
     "TaskList",
     "TaskGet",
+    // Session-local working state remains available across planning contexts.
+    "SaveContextNote",
+    "NewContext",
+    "SearchHistory",
     // Bash: visible to the model; executor gates it to read-only commands.
     "Bash",
 ]);

package/dist/tool-system/sandbox/seatbelt.js

@@ -14,9 +14,43 @@
  * sandbox-exec is technically deprecated by Apple but remains the only
  * working OS-level sandbox on macOS and is what Codex CLI / Cursor use today.
  */
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+/**
+ * Per-user MDS (Module Directory Service) scratch directory.
+ *
+ * Security.framework opens the keychain through MDS, which needs to write a
+ * lock file under the per-user Darwin cache dir. Without it *any* keychain
+ * read fails — see the `(allow file-write* …/mds)` clause in buildProfile()
+ * for why that matters and how it presents.
+ *
+ * `getconf DARWIN_USER_CACHE_DIR` reports the `/var/folders/…` form, but
+ * Seatbelt matches subpaths canonically (`/private/var/folders/…`), so the
+ * result is realpath'd — the same footgun expandConfig() handles for
+ * writableRoots. Resolved once per process; the value is stable for a user.
+ */
+let mdsCacheDir;
+function resolveMdsCacheDir() {
+    if (mdsCacheDir !== undefined)
+        return mdsCacheDir;
+    try {
+        const cacheDir = execFileSync("/usr/bin/getconf", ["DARWIN_USER_CACHE_DIR"], {
+            encoding: "utf-8",
+            timeout: 5_000,
+        }).trim();
+        // Bail rather than emit a bogus rule if getconf returns something odd.
+        mdsCacheDir = cacheDir ? realpathSync(join(cacheDir, "mds")) : null;
+    }
+    catch {
+        // getconf missing/failed, or no mds dir yet on this host. Keychain reads
+        // stay broken, but that's strictly the pre-existing behavior — never fail
+        // the whole sandbox over it.
+        mdsCacheDir = null;
+    }
+    return mdsCacheDir;
+}
 export function createSeatbeltBackend(config) {
     return {
         name: "seatbelt",
@@ -44,6 +78,20 @@ export function createSeatbeltBackend(config) {
             };
         },
         hintForBlockedOutput(stderr) {
+            // Keychain denials never say "sandbox" or "Operation not permitted" —
+            // they surface as an MDS error, or as a downstream tool blaming its own
+            // credentials ("token invalid") after silently falling back off the
+            // keyring. Match the MDS string specifically so the model stops
+            // recommending a re-login for what is a sandbox problem. This is a
+            // deterministic error string from Security.framework, not prose.
+            if (/Module Directory Service error/.test(stderr)) {
+                return ("\n[sandbox:seatbelt] A keychain read failed inside the sandbox " +
+                    "(Security.framework/MDS). Any 'invalid token' / 'not logged in' " +
+                    "message above is likely bogus — the credential is in the macOS " +
+                    "keychain and was unreadable, NOT wrong. Do not re-run `auth login`. " +
+                    "If this host has an unusual DARWIN_USER_CACHE_DIR, ask the user to " +
+                    "add its `mds` dir to sandbox.writableRoots in settings.json.");
+            }
             if (/Operation not permitted|sandbox/.test(stderr)) {
                 return ("\n[sandbox:seatbelt] A syscall was blocked by the sandbox. " +
                     "If this path should be writable or this network call legitimate, " +
@@ -57,6 +105,27 @@ function buildProfile(config) {
     const writeAllows = config.writableRoots.map((p) => `  (subpath ${quote(p)})`).join("\n");
     const readDenies = config.deniedReads.map((p) => `  (subpath ${quote(p)})`).join("\n");
     const networkClause = config.network === "deny" ? "(deny network-outbound)" : "(allow network*)";
+    // Keychain access. Tools that store credentials in the macOS keychain
+    // (`gh`, `az`, `docker login`, anything calling /usr/bin/security) shell
+    // out to Security.framework, which reaches the keychain via MDS — and MDS
+    // needs to write a lock file under the per-user Darwin cache dir. That dir
+    // is outside the workspace, so a write-restricted profile blocks it.
+    //
+    // The failure is worth spelling out because it does NOT look like a
+    // sandbox denial: `security` exits 44 with "A Module Directory Service
+    // error has occurred", and callers treat that as "no keychain" and fall
+    // back to their plaintext config. `gh` then reports "The token in default
+    // is invalid" — pointing at the token, which is fine, instead of at the
+    // sandbox. Users burn a lot of time re-running `gh auth login` here.
+    //
+    // Verified empirically: this single clause is the minimal delta that makes
+    // `gh auth status` report `(keyring)` instead of `(default)` under an
+    // otherwise unchanged profile. Reads of ~/.ssh and writes outside the
+    // workspace stay denied — the grant is one scratch dir, not a hole.
+    const mdsDir = resolveMdsCacheDir();
+    const keychainClause = mdsDir
+        ? `\n;; Keychain (Security.framework/MDS scratch)\n(allow file-write* (subpath ${quote(mdsDir)}))\n`
+        : "";
     // SBPL evaluation note: when a broad `(allow file-read*)` and a specific
     // `(deny file-read* (subpath …))` both match, the more specific subpath
     // rule wins — order between the two clauses does not matter. We tested
@@ -88,7 +157,7 @@ ${writeAllows})
   (literal "/dev/random")
   (literal "/dev/urandom")
   (literal "/dev/dtracehelper"))
-
+${keychainClause}
 ;; IPC & system services common tools need
 (allow mach-lookup)
 (allow ipc-posix-shm)

package/dist/tool-system/session-tool-host.js

@@ -87,9 +87,17 @@ export function createSessionToolHost(options) {
         ...options.contextOverrides,
         sessionId: options.businessSessionId,
         externalRuntime: true,
+        // This bridge owns tool calls, not a native model loop that can apply a
+        // context rollover. Never expose native working-memory controls here.
+        contextStrategy: undefined,
+        contextNotes: undefined,
         planMode: options.planMode,
         permissionMode: options.permissionMode,
-        toolVisibility: buildToolVisibility(options.visibility),
+        toolVisibility: buildToolVisibility({
+            ...options.visibility,
+            contextStrategy: undefined,
+            hasBrowserAutomation: options.contextOverrides?.browser !== undefined,
+        }),
         // Belt and braces with the exposure check in execute(): the executor
         // enforces this too, so a future refactor that loses one still fails closed.
         allowedToolNames: new Set(exposure.toolNames),

package/dist/types.d.ts

@@ -145,7 +145,7 @@ export interface RegisteredTool {
      */
     timeoutMs?: number;
 }
-export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "context_transfer" | "range_archive" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "subagent" | "external_file_changes" | "turn_boundary" | "run_result" | "goal_progress" | "turn_stopped" | "error";
+export type TranscriptEventType = "message" | "tool_use" | "tool_result" | "summary" | "context_transfer" | "context_note" | "context_checkpoint" | "range_archive" | "content_replace" | "file_history" | "plan_operation" | "session_meta" | "subagent" | "external_file_changes" | "turn_boundary" | "run_result" | "goal_progress" | "turn_stopped" | "error";
 export interface TranscriptEvent {
     id: string;
     type: TranscriptEventType;
@@ -423,6 +423,8 @@ export type ApprovalResult = {
 } | {
     approved: false;
     reason?: string;
+    /** A host/policy failure is distinct from an explicit user denial. */
+    failure?: "denied" | "cancelled" | "session_closed" | "owner_lost" | "timed_out" | "unavailable" | "policy_denied";
     always?: boolean;
     scope?: ApprovalScope;
 };
@@ -586,7 +588,7 @@ export type StreamEvent = {
     agentId?: string;
 } | {
     type: "context_compact";
-    strategy: "micro" | "summary" | "window" | "snip" | "emergency" | "compacted" | "range";
+    strategy: "micro" | "summary" | "window" | "snip" | "emergency" | "compacted" | "range" | "notes";
     before: number;
     after: number;
     agentId?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-core",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Core engine for code-shell — agent orchestration, tool execution, hooks, protocol. UI-agnostic.",
   "type": "module",
   "main": "./dist/index.js",