@cjhyy/code-shell-core 0.9.6 → 0.9.7

package/dist/protocol/server.js

@@ -21,8 +21,9 @@ import { sessionMessageOutcome, sessionMessageFailure, sessionMessageResultNotif
 import { resolveSessionMessageWorkspace } from "./session-message-workspace.js";
 import { validateWorkspaceContext, workspacePrimaryRoot } from "../workspace/workspace-context.js";
 import { canonicalKey } from "../workspace/canonical-key.js";
-import { getApprovalRouter, getInteractiveApprovalBackend, } from "../tool-system/permission.js";
+import { getApprovalRouter, getInteractiveApprovalBackend, InteractiveApprovalBackend, } from "../tool-system/permission.js";
 import { agentNotificationBus, notificationQueue, notificationEnvelopeToLegacyStreamEvent, } from "../tool-system/builtin/agent-notifications.js";
+import { clearSessionPathApprovals, openSessionPathApprovals } from "../tool-system/path-policy.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js";
 import { listBackgroundWorkForUI } from "../tool-system/builtin/background-work.js";
@@ -172,6 +173,7 @@ const COMPACT_STREAM_STRATEGIES = new Set([
     // Range archival (archive_range query) emits its boundary through this map;
     // without "range" here it would be silently downgraded to "compacted".
     "range",
+    "notes",
 ]);
 function toCompactStreamStrategy(strategy) {
     return COMPACT_STREAM_STRATEGIES.has(strategy)
@@ -322,6 +324,7 @@ export class AgentServer {
     panelBridgeEnabled;
     connectionId;
     strictApprovalRouting;
+    childHostDisposers = new Map();
     approvalRouter;
     approvalConnectionUnregister = null;
     disconnected = false;
@@ -674,6 +677,151 @@ export class AgentServer {
         session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
         session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
         session.engine.setInjectCredential((credentialId, credentialScope) => this.requestCredentialInjectForSession(session, sid, credentialId, credentialScope));
+        session.engine.setChildHostBindings?.((input) => {
+            if (input.parentSessionId !== sid)
+                throw new Error("child host parent identity mismatch");
+            assertSafeSessionId(input.sessionId);
+            const route = this.approvalRouter.current(sid);
+            if (!route || route.connectionId !== this.connectionId) {
+                throw new Error("child host unavailable: parent approval connection no longer owns session");
+            }
+            const backend = new InteractiveApprovalBackend();
+            backend.openSession(input.sessionId);
+            let active = false;
+            let closed = false;
+            let closedFailure = {
+                failure: "cancelled",
+                reason: "child run ended or was cancelled",
+            };
+            const scope = {
+                sourceSessionId: input.sessionId,
+                bindingId: nanoid(),
+                route,
+                pending: new Set(),
+                failure: () => {
+                    if (closed || input.signal?.aborted)
+                        return closedFailure;
+                    if (this.chatManager?.get(sid) !== session)
+                        return { failure: "session_closed", reason: "parent host session closed" };
+                    if (this.disconnected || !this.approvalRouter.matches(route))
+                        return { failure: "owner_lost", reason: "parent host approval ownership changed" };
+                    return undefined;
+                },
+            };
+            backend.setRequestGuard((request) => {
+                const failure = scope.failure();
+                if (failure)
+                    return { approved: false, ...failure };
+                if (request.sessionId !== input.sessionId)
+                    return {
+                        approved: false,
+                        failure: "owner_lost",
+                        reason: "child approval identity mismatch",
+                    };
+                return undefined;
+            });
+            backend.setPromptFn((request) => {
+                const failure = scope.failure();
+                if (failure)
+                    return Promise.resolve({ approved: false, ...failure });
+                if (request.sessionId !== input.sessionId) {
+                    return Promise.resolve({
+                        approved: false,
+                        failure: "owner_lost",
+                        reason: "child approval identity mismatch",
+                    });
+                }
+                return this.requestApprovalFromClient(request, route, scope);
+            });
+            const dispose = () => {
+                if (closed)
+                    return;
+                closed = true;
+                input.signal?.removeEventListener("abort", dispose);
+                this.childHostDisposers.delete(scope.bindingId);
+                backend.clearSession(input.sessionId);
+                if (active)
+                    clearSessionPathApprovals(input.sessionId);
+                for (const id of scope.pending) {
+                    const entry = this.takeSessionApproval(session, id, "cancelled");
+                    this.clearApprovalTimer(id);
+                    this.pendingApprovalTargets.delete(id);
+                    entry?.resolve(entry.metadata.kind === "internal"
+                        ? internalCancellation(closedFailure.failure, closedFailure.reason)
+                        : {
+                            approved: false,
+                            ...closedFailure,
+                        });
+                    try {
+                        this.notify(Methods.ApprovalResolved, { sessionId: sid, requestId: id });
+                    }
+                    catch {
+                        /* transport may already be closed */
+                    }
+                }
+                scope.pending.clear();
+                // One-way release uses the existing private host channel; it is never
+                // a model tool and never inherits a parent tab handoff grant.
+                try {
+                    this.notify(Methods.ApprovalRequest, {
+                        sessionId: sid,
+                        requestId: nanoid(12),
+                        childHost: {
+                            sourceSessionId: input.sessionId,
+                            bindingId: scope.bindingId,
+                            release: true,
+                        },
+                        request: {
+                            toolName: "__browser_action__",
+                            args: { action: "release" },
+                            description: "release child browser",
+                            riskLevel: "low",
+                        },
+                    });
+                }
+                catch {
+                    /* resource owner also closes targets on host teardown */
+                }
+            };
+            this.childHostDisposers.set(scope.bindingId, {
+                route,
+                dispose: (reason) => {
+                    closedFailure = { failure: "owner_lost", reason };
+                    dispose();
+                },
+            });
+            input.signal?.addEventListener("abort", dispose, { once: true });
+            if (input.signal?.aborted)
+                dispose();
+            return {
+                activate: () => {
+                    if (!closed && !active) {
+                        this.notify(Methods.ApprovalRequest, {
+                            sessionId: sid,
+                            requestId: nanoid(12),
+                            childHost: {
+                                sourceSessionId: input.sessionId,
+                                bindingId: scope.bindingId,
+                                activate: true,
+                            },
+                            request: {
+                                toolName: "__browser_action__",
+                                args: { action: "activate" },
+                                description: "bind child browser",
+                                riskLevel: "low",
+                            },
+                        });
+                        active = true;
+                        openSessionPathApprovals(input.sessionId);
+                    }
+                },
+                approvalBackend: backend,
+                browserBridge: this.makeBrowserBridge(session, sid, scope),
+                askUser: (question, opts) => this.requestAskUserForSession(session, sid, question, opts, scope),
+                injectCredentialToBrowser: (id, credentialScope) => this.requestCredentialInjectForSession(session, sid, id, credentialScope, scope),
+                dispose,
+            };
+        });
         session.engine.setSessionMessageRouter((input) => this.routeSessionMessage(input));
         if (this.workspaceBridgeEnabled && typeof session.engine.setWorkspaceBridge === "function") {
             session.engine.setWorkspaceBridge(this.makeWorkspaceBridge(session, sid));
@@ -1591,7 +1739,7 @@ export class AgentServer {
         }
         this.abortController.abort();
         for (const [, resolve] of this.pendingApprovals) {
-            resolve({ approved: false, reason: "cancelled" });
+            resolve({ approved: false, failure: "cancelled", reason: "cancelled" });
         }
         this.pendingApprovals.clear();
         this.clearAllApprovalTimers();
@@ -2795,7 +2943,10 @@ export class AgentServer {
     /**
      * Ask the client to approve a tool operation (legacy single-engine path).
      */
-    requestApprovalFromClient(request, route) {
+    requestApprovalFromClient(request, route, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ approved: false, ...failure });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const effectiveRoute = route ?? {
@@ -2806,7 +2957,11 @@ export class AgentServer {
             const sessionId = effectiveRoute.sessionId;
             const session = this.chatManager && sessionId ? this.chatManager.get(sessionId) : undefined;
             if (this.chatManager && sessionId && !session) {
-                resolve({ approved: false, reason: `session closed: ${sessionId}` });
+                resolve({
+                    approved: false,
+                    failure: "session_closed",
+                    reason: `session closed: ${sessionId}`,
+                });
                 return;
             }
             if (session) {
@@ -2824,7 +2979,7 @@ export class AgentServer {
                     createdAt: Date.now(),
                     expiresAt: Date.now() + AgentServer.APPROVAL_TIMEOUT_MS,
                     surfaceable: !internal,
-                }, (decision) => resolve(decision));
+                }, (decision) => resolve(decision), scope);
             }
             else {
                 this.pendingApprovals.set(requestId, resolve);
@@ -2841,7 +2996,8 @@ export class AgentServer {
                     }
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
-                    resolve({ approved: false, reason: "approval timed out" });
+                    scope?.pending.delete(requestId);
+                    resolve({ approved: false, failure: "timed_out", reason: "approval timed out" });
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
@@ -2869,7 +3025,10 @@ export class AgentServer {
      * renderer routes the question to the right chat tab. This intentionally has
      * no wall-clock timeout; Stop/cancel drains the pending ask.
      */
-    requestAskUserForSession(session, sessionId, question, opts) {
+    requestAskUserForSession(session, sessionId, question, opts, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve(`(question ${failure.failure}: ${failure.reason})`);
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -2894,7 +3053,7 @@ export class AgentServer {
                     // chatManager approve handler resolves with the raw decision value.
                     resolve(typeof decision === "string" ? decision : "");
                 }
-            });
+            }, scope);
             const args = { question };
             if (opts?.header !== undefined)
                 args.header = opts.header;
@@ -2906,6 +3065,7 @@ export class AgentServer {
                 args.optionsOnly = opts.optionsOnly;
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope ? { sourceSessionId: scope.sourceSessionId } : {}),
                 request: {
                     toolName: "__ask_user__",
                     args,
@@ -2953,8 +3113,8 @@ export class AgentServer {
      * result string we parse back into the typed result. On timeout / malformed
      * reply we degrade to a safe error result rather than throwing.
      */
-    makeBrowserBridge(session, sessionId) {
-        const call = (action, payload) => this.requestBrowserActionForSession(session, sessionId, action, payload);
+    makeBrowserBridge(session, sessionId, scope) {
+        const call = (action, payload) => this.requestBrowserActionForSession(session, sessionId, action, payload, scope);
         return {
             requestHumanTakeover: () => call("requestTakeover", {}),
             snapshot: () => call("snapshot", {}),
@@ -2974,7 +3134,10 @@ export class AgentServer {
             switchTab: (tabId) => call("switchTab", { tabId }),
         };
     }
-    requestBrowserActionForSession(session, sessionId, action, payload) {
+    requestBrowserActionForSession(session, sessionId, action, payload, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ ok: false, failure: failure.failure, detail: failure.reason });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -2986,12 +3149,13 @@ export class AgentServer {
                 resolve(parsed.ok
                     ? parsed.value
                     : { ok: false, failure: parsed.failure, detail: parsed.detail });
-            });
+            }, scope);
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
+                    scope?.pending.delete(requestId);
                     resolve({
                         ok: false,
                         failure: "timed_out",
@@ -3002,6 +3166,9 @@ export class AgentServer {
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope
+                    ? { childHost: { sourceSessionId: scope.sourceSessionId, bindingId: scope.bindingId } }
+                    : {}),
                 request: {
                     toolName: "__browser_action__",
                     args: { action, ...payload },
@@ -3017,7 +3184,10 @@ export class AgentServer {
      * calls restoreCookiesToBrowser and replies with a JSON result string we
      * parse into { ok, count?, error? }. Degrades to ok:false on timeout/malformed.
      */
-    requestCredentialInjectForSession(session, sessionId, credentialId, credentialScope = "full") {
+    requestCredentialInjectForSession(session, sessionId, credentialId, credentialScope = "full", scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ ok: false, error: `${failure.failure}: ${failure.reason}` });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -3027,12 +3197,13 @@ export class AgentServer {
                 resolve(parsed.ok
                     ? parsed.value
                     : { ok: false, error: parsed.detail });
-            });
+            }, scope);
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
+                    scope?.pending.delete(requestId);
                     resolve({
                         ok: false,
                         error: `credential inject ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`,
@@ -3042,6 +3213,7 @@ export class AgentServer {
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope ? { sourceSessionId: scope.sourceSessionId } : {}),
                 request: {
                     toolName: "__credential_action__",
                     args: { action: "injectCookie", credentialId, credentialScope },
@@ -3331,7 +3503,7 @@ export class AgentServer {
             }
         }
         for (const [, resolve] of this.pendingApprovals) {
-            resolve({ approved: false, reason: "server closing" });
+            resolve({ approved: false, failure: "session_closed", reason: "server closing" });
         }
         this.pendingApprovals.clear();
         this.clearAllApprovalTimers();
@@ -3364,9 +3536,19 @@ export class AgentServer {
     workerGeneration() {
         return this.chatManager?.getLiveSessionSnapshot().generation ?? 0;
     }
-    registerSessionApproval(session, metadata, resolve) {
+    registerSessionApproval(session, metadata, resolve, scope) {
+        if (scope) {
+            metadata = { ...metadata, sourceSessionId: scope.sourceSessionId };
+            scope.pending.add(metadata.requestId);
+        }
         metadata = this.observeApprovalCreated(metadata);
-        session.pendingApprovals.set(metadata.requestId, { resolve, metadata });
+        session.pendingApprovals.set(metadata.requestId, {
+            resolve: (decision) => {
+                scope?.pending.delete(metadata.requestId);
+                resolve(decision);
+            },
+            metadata,
+        });
     }
     takeSessionApproval(session, requestId, status) {
         const entry = session.pendingApprovals.get(requestId);
@@ -3446,7 +3628,7 @@ export class AgentServer {
                 try {
                     entry.resolve(entry.metadata.kind === "internal"
                         ? internalCancellation(failure, reason)
-                        : { approved: false, reason });
+                        : { approved: false, failure, reason });
                 }
                 catch {
                     /* a resolver must never break cancel cleanup */
@@ -3457,6 +3639,12 @@ export class AgentServer {
     }
     failClosedApprovalTargets(targets, reason) {
         for (const target of targets) {
+            for (const child of this.childHostDisposers.values()) {
+                if (child.route.connectionId === target.connectionId &&
+                    child.route.sessionId === target.sessionId &&
+                    child.route.generation === target.generation)
+                    child.dispose(reason);
+            }
             const session = this.chatManager?.get(target.sessionId);
             if (session) {
                 this.cancelSessionApprovals(session, reason, "owner-lost", "owner_lost");
@@ -3472,7 +3660,7 @@ export class AgentServer {
                 this.pendingApprovals.delete(requestId);
                 this.pendingApprovalTargets.delete(requestId);
                 this.clearApprovalTimer(requestId);
-                resolve?.({ approved: false, reason });
+                resolve?.({ approved: false, failure: "owner_lost", reason });
             }
         }
     }

package/dist/protocol/types.d.ts

@@ -13,6 +13,8 @@ import type { SessionMessageTarget } from "../session/session-message.js";
 export type PendingApprovalKind = "tool_approval" | "ask_user" | "internal";
 /** Resolver-free metadata retained beside a pending approval callback. */
 export interface PendingApprovalMetadata {
+    /** Child task that originated this request; sessionId remains its parent UI route. */
+    sourceSessionId?: string;
     sessionId: string;
     requestId: string;
     routeGeneration?: number;

package/dist/session/session-manager.js

@@ -160,6 +160,8 @@ const FORK_EVENT_POLICY = {
     tool_result: "copy",
     summary: "copy",
     context_transfer: "copy",
+    context_note: "copy",
+    context_checkpoint: "copy",
     range_archive: "copy",
     content_replace: "copy",
     file_history: "skip",
@@ -1922,13 +1924,12 @@ export function buildForkTranscript(sourceEvents, state) {
             forkedFrom: structuredClone(state.forkedFrom),
         },
     };
-    return [
-        meta,
-        ...sourceEvents.map((source) => ({
-            ...structuredClone(source),
-            id: nanoid(12),
-        })),
-    ];
+    const copied = sourceEvents.map((source) => ({
+        ...structuredClone(source),
+        id: nanoid(12),
+    }));
+    Transcript.remapContextForkReferences(sourceEvents, copied);
+    return [meta, ...copied];
 }
 function validateForkToolPairs(events) {
     const projectedUses = [];

package/dist/session/transcript.d.ts

@@ -27,6 +27,16 @@ export interface SelectedContextRange {
     messages: Message[];
     sourceEventCount: number;
 }
+/** Host-generated replay state. Models supply the note text, never this snapshot. */
+export interface ContextCheckpointSnapshot {
+    version: 1;
+    noteId: string;
+    coveredThroughEventId: string;
+    messages: Message[];
+    clientMessageIds: Array<[string, number]>;
+}
+/** Complete, ordered provider pairs are required before a checkpoint can commit. */
+export declare function hasCompleteContextToolPairs(messages: readonly Message[]): boolean;
 export type SummaryAppendMetadata = {
     fromTurn: number;
     toTurn: number;
@@ -59,8 +69,14 @@ export declare class Transcript {
     static inMemory(label: string): Transcript;
     /** Rehydrate a process-local fork without serializing its copied history. */
     static fromMemoryEvents(label: string, events: readonly TranscriptEvent[]): Transcript;
+    /** Preserve checkpoint provenance when a fork assigns fresh event ids. */
+    static remapContextForkReferences(sourceEvents: readonly TranscriptEvent[], copiedEvents: TranscriptEvent[]): void;
     isPersistent(): boolean;
     append(type: TranscriptEventType, data: Record<string, unknown>): TranscriptEvent;
+    /** Failed note/checkpoint writes must never change the active replay. */
+    appendContextNote(text: string, coveredThroughEventId: string): TranscriptEvent | undefined;
+    appendContextCheckpoint(snapshot: ContextCheckpointSnapshot): TranscriptEvent | undefined;
+    private appendDurableContextEvent;
     /**
      * Append a chat message to the transcript.
      *
@@ -148,6 +164,7 @@ export declare class Transcript {
         messages: Message[];
         liveIndexByClientMessageId: Map<string, number>;
     };
+    private contextReplayEvents;
     getEvents(type?: TranscriptEventType): TranscriptEvent[];
     get turnNumber(): number;
     get eventCount(): number;