@cjhyy/code-shell 0.9.42 → 0.9.43

package/CHANGELOG.md

@@ -8,6 +8,72 @@ breaking.
 
 ## [Unreleased]
 
+## [0.9.43] - 2026-10-15
+
+### Added
+
+- Read Figma nodes, exported images and image-fill assets through Link with
+  on-demand content loading, bounded responses and account authorization guidance.
+- Open sub-agent conversations in the side dock while keeping the parent chat
+  available.
+- Add `@cjhyy/code-shell-host`, a Core-only HostRuntime foundation with capability
+  registration, adapter lifecycle and a shared worker request interceptor used by
+  Desktop, serve and Panel task hosts. Larger service migrations remain pending.
+
+### Changed
+
+- Unify themed dropdowns across Desktop and keep theme music local, including
+  imported MP3/WAV tracks and playback that continues outside Appearance settings.
+- Improve Quick Chat layout and composer usability in short panels.
+- Refresh the curated OpenRouter model catalog.
+- Return a reusable `agent_id` with synchronous Agent reports and guide related
+  follow-up work through `AgentSendInput` using saved context and incremental input.
+- Persist sub-agent role scopes for continuation after restart. Legacy sessions
+  without saved scope metadata require a new Agent after restarting.
+- Extract protocol request dispatch and ingress validation without changing the
+  legacy wire contract; reduce the AgentServer architecture budget to 4,949 lines.
+- Reserve tool names beginning with `__` for internal host loopbacks, including
+  extension tool catalogs and late registration.
+- REPL uses the sandboxed-Bash environment allowlist plus explicit project env,
+  including credential env exposures. Proxy variables, `NODE_PATH`, `PYTHONPATH`,
+  `VIRTUAL_ENV` and `CONDA_*` are not inherited. Bash with sandboxing disabled
+  still inherits the full environment. This allowlist does not prevent theft of
+  files or environment data accessible to the same OS user; REPL remains outside
+  the OS sandbox.
+- TypeScript REPL reuses the host's Bun executable under Bun, and requires an
+  already available PATH Bun under Node, with `--no-env-file` in both cases.
+  REPL now advertises the workspace write protocol. Windows shell env overrides
+  merge without case-sensitive PATH/Path duplicates.
+
+### Fixed
+
+- Preserve external runtime output across restarts, adopted cost snapshots and
+  turn timing; keep reopened autocomplete suggestions focused.
+- Make GitHub data access opt-in at sign-in and distinguish local logout from
+  unconfirmed remote revocation.
+- Expose verified Node runtime fallbacks to Panel CLIs.
+- Track resumed sub-agents as running, route further input to their existing
+  runtime, and preserve cancellation until that runtime fully exits, including
+  across the automatic background threshold.
+- Enforce sub-agent role tool allowlists at execution time on both initial and
+  resumed runs, while retaining parent-disabled tools and the flat agent hierarchy.
+- Keep the bundled Host package in Desktop devDependencies, and derive the
+  production workspace packaging guard from predist's actual materialization list.
+- Include a unique JSON-RPC id in Desktop unsupported-loopback replies so Core
+  consumes the pending request immediately; keep known authority notifications private.
+- Enable workspace IPC only when the host explicitly installs it. Desktop keeps
+  its bridge; serve and Panel workers use Core's disk fallback for cross-session
+  messages, asynchronous AskUser and mailbox wakeups.
+- Panel task workers immediately answer unsupported `desktop/*` and internal
+  loopbacks with typed failures instead of timing out or reporting user denial;
+  private loopback IDs are kept out of client approval events. Ordinary approvals
+  and installed Panel callbacks keep their routes. Panel tasks have no text-answer
+  UI: AskUser now returns an explicit host-unavailable failure without displaying
+  a yes/no approval or supplying a fake answer; asynchronous questions retire
+  without injecting an answer or waking a follow-up run.
+- Clear inherited host MCP/IPC switches from serve and Panel workers, and clear
+  the remote Link client secret even when a Panel host supplies a custom env.
+
 ## [0.9.42] - 2026-10-15
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell",
-  "version": "0.9.42",
+  "version": "0.9.43",
   "description": "Code Shell — meta package. Installs @cjhyy/code-shell-core and @cjhyy/code-shell-tui.",
   "type": "module",
   "packageManager": "bun@1.3.11",
@@ -17,8 +17,8 @@
   },
   "scripts": {
     "preinstall": "node scripts/check-node.cjs",
-    "build": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-pet' build && bun run --filter '@cjhyy/code-shell-capability-optimization-lab' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-cdp' build && bun run --filter '@cjhyy/code-shell-browser-devtools' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build && bun run --filter '@cjhyy/code-shell-tui' build && bun run --filter '@cjhyy/code-shell-chat' build && bun run scripts/build-meta.ts",
-    "build:server": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build",
+    "build": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-host' build && bun run --filter '@cjhyy/code-shell-pet' build && bun run --filter '@cjhyy/code-shell-capability-optimization-lab' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-cdp' build && bun run --filter '@cjhyy/code-shell-browser-devtools' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build && bun run --filter '@cjhyy/code-shell-tui' build && bun run --filter '@cjhyy/code-shell-chat' build && bun run scripts/build-meta.ts",
+    "build:server": "bun run --filter '@cjhyy/code-shell-link' build && bun run --filter '@cjhyy/code-shell-core' build && bun run --filter '@cjhyy/code-shell-host' build && bun run --filter '@cjhyy/code-shell-capability-coding' build && bun run --filter '@cjhyy/code-shell-web' build && bun run --filter '@cjhyy/code-shell-server' build",
     "serve:server": "node packages/server/dist/bin/code-shell-serve.js",
     "test:server-panel-recovery": "node scripts/smoke-web-panel-recovery.mjs",
     "test:server-smoke": "node scripts/smoke-hub-server.mjs",
@@ -62,8 +62,8 @@
     "test:task-routing": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-task-capability-routing.mjs"
   },
   "dependencies": {
-    "@cjhyy/code-shell-core": "0.9.42",
-    "@cjhyy/code-shell-tui": "0.9.42"
+    "@cjhyy/code-shell-core": "0.9.43",
+    "@cjhyy/code-shell-tui": "0.9.43"
   },
   "workspaces": [
     "packages/*"