@cjhyy/code-shell 0.9.41 → 0.9.43

package/CHANGELOG.md

@@ -8,6 +8,106 @@ breaking.
 
 ## [Unreleased]
 
+## [0.9.43] - 2026-10-15
+
+### Added
+
+- Read Figma nodes, exported images and image-fill assets through Link with
+  on-demand content loading, bounded responses and account authorization guidance.
+- Open sub-agent conversations in the side dock while keeping the parent chat
+  available.
+- Add `@cjhyy/code-shell-host`, a Core-only HostRuntime foundation with capability
+  registration, adapter lifecycle and a shared worker request interceptor used by
+  Desktop, serve and Panel task hosts. Larger service migrations remain pending.
+
+### Changed
+
+- Unify themed dropdowns across Desktop and keep theme music local, including
+  imported MP3/WAV tracks and playback that continues outside Appearance settings.
+- Improve Quick Chat layout and composer usability in short panels.
+- Refresh the curated OpenRouter model catalog.
+- Return a reusable `agent_id` with synchronous Agent reports and guide related
+  follow-up work through `AgentSendInput` using saved context and incremental input.
+- Persist sub-agent role scopes for continuation after restart. Legacy sessions
+  without saved scope metadata require a new Agent after restarting.
+- Extract protocol request dispatch and ingress validation without changing the
+  legacy wire contract; reduce the AgentServer architecture budget to 4,949 lines.
+- Reserve tool names beginning with `__` for internal host loopbacks, including
+  extension tool catalogs and late registration.
+- REPL uses the sandboxed-Bash environment allowlist plus explicit project env,
+  including credential env exposures. Proxy variables, `NODE_PATH`, `PYTHONPATH`,
+  `VIRTUAL_ENV` and `CONDA_*` are not inherited. Bash with sandboxing disabled
+  still inherits the full environment. This allowlist does not prevent theft of
+  files or environment data accessible to the same OS user; REPL remains outside
+  the OS sandbox.
+- TypeScript REPL reuses the host's Bun executable under Bun, and requires an
+  already available PATH Bun under Node, with `--no-env-file` in both cases.
+  REPL now advertises the workspace write protocol. Windows shell env overrides
+  merge without case-sensitive PATH/Path duplicates.
+
+### Fixed
+
+- Preserve external runtime output across restarts, adopted cost snapshots and
+  turn timing; keep reopened autocomplete suggestions focused.
+- Make GitHub data access opt-in at sign-in and distinguish local logout from
+  unconfirmed remote revocation.
+- Expose verified Node runtime fallbacks to Panel CLIs.
+- Track resumed sub-agents as running, route further input to their existing
+  runtime, and preserve cancellation until that runtime fully exits, including
+  across the automatic background threshold.
+- Enforce sub-agent role tool allowlists at execution time on both initial and
+  resumed runs, while retaining parent-disabled tools and the flat agent hierarchy.
+- Keep the bundled Host package in Desktop devDependencies, and derive the
+  production workspace packaging guard from predist's actual materialization list.
+- Include a unique JSON-RPC id in Desktop unsupported-loopback replies so Core
+  consumes the pending request immediately; keep known authority notifications private.
+- Enable workspace IPC only when the host explicitly installs it. Desktop keeps
+  its bridge; serve and Panel workers use Core's disk fallback for cross-session
+  messages, asynchronous AskUser and mailbox wakeups.
+- Panel task workers immediately answer unsupported `desktop/*` and internal
+  loopbacks with typed failures instead of timing out or reporting user denial;
+  private loopback IDs are kept out of client approval events. Ordinary approvals
+  and installed Panel callbacks keep their routes. Panel tasks have no text-answer
+  UI: AskUser now returns an explicit host-unavailable failure without displaying
+  a yes/no approval or supplying a fake answer; asynchronous questions retire
+  without injecting an answer or waking a follow-up run.
+- Clear inherited host MCP/IPC switches from serve and Panel workers, and clear
+  the remote Link client secret even when a Panel host supplies a custom env.
+
+## [0.9.42] - 2026-10-15
+
+### Added
+
+- Add a minimal `initialize` handshake to AgentServer that returns the protocol
+  version and the contract table, and export `CONTRACTS` from core.
+- Include `contracts` in the serve `/health` response.
+- Combine account actions and Settings in a grouped sidebar menu with direct
+  access to common settings pages.
+- Make the shared source library and each project's selected sources separate
+  destinations, with a project chooser and a return path between them.
+
+### Changed
+
+- Run REPL with the sandboxed-Bash environment allowlist plus project env.
+  Proxy variables, `NODE_PATH`, `PYTHONPATH`, `VIRTUAL_ENV`, `CONDA_*` and the
+  cwd `.env` no longer reach REPL; set them in project env instead.
+- Add Windows and CA-certificate variables to the shared shell allowlist.
+- Explicit project env, including configured credential env exposures, also
+  reaches REPL. REPL remains unsandboxed; Bash with sandboxing disabled still
+  inherits the full host environment.
+- Retire demonstration data sources from production and provide an opt-in
+  cleanup script for legacy source mock data.
+
+### Fixed
+
+- Serve now answers Desktop-only host requests with `unsupported` immediately
+  instead of hanging, and no longer broadcasts worker `desktop/*` requests to
+  Web tabs.
+- Keep account, settings, source dialogs and context menus usable in narrow
+  windows and themed surfaces, including focus, scrolling and menu handoff.
+- Improve source-add forms with generated identifiers, and open the Link account
+  page from the source settings destination.
+
 ## [0.9.40] - 2026-10-13
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell",
-  "version": "0.9.41",
+  "version": "0.9.43",
   "description": "Code Shell — meta package. Installs @cjhyy/code-shell-core and @cjhyy/code-shell-tui.",
   "type": "module",
   "packageManager": "bun@1.3.11",
@@ -17,8 +17,8 @@
   },
   "scripts": {
     "preinstall": "node scripts/check-node.cjs",
-    "build": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-pet' build && bun run --filter '@cjhyy/code-shell-capability-optimization-lab' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-cdp' build && bun run --filter '@cjhyy/code-shell-browser-devtools' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build && bun run --filter '@cjhyy/code-shell-tui' build && bun run --filter '@cjhyy/code-shell-chat' build && bun run scripts/build-meta.ts",
-    "build:server": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build",
+    "build": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-host' build && bun run --filter '@cjhyy/code-shell-pet' build && bun run --filter '@cjhyy/code-shell-capability-optimization-lab' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-cdp' build && bun run --filter '@cjhyy/code-shell-browser-devtools' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build && bun run --filter '@cjhyy/code-shell-tui' build && bun run --filter '@cjhyy/code-shell-chat' build && bun run scripts/build-meta.ts",
+    "build:server": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-host' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build",
     "serve:server": "node packages/server/dist/bin/code-shell-serve.js",
     "test:server-panel-recovery": "node scripts/smoke-web-panel-recovery.mjs",
     "test:server-smoke": "node scripts/smoke-hub-server.mjs",
@@ -62,8 +62,8 @@
     "test:task-routing": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-task-capability-routing.mjs"
   },
   "dependencies": {
-    "@cjhyy/code-shell-core": "0.9.41",
-    "@cjhyy/code-shell-tui": "0.9.41"
+    "@cjhyy/code-shell-core": "0.9.43",
+    "@cjhyy/code-shell-tui": "0.9.43"
   },
   "workspaces": [
     "packages/*"