@gajae-code/coding-agent 0.16.4 → 0.16.6

package/src/extensibility/extensions/types.ts

@@ -49,6 +49,7 @@ import type { ExecOptions, ExecResult } from "../../exec/exec";
 import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
+import type { AgentSessionEventListener } from "../../session/agent-session";
 import type {
 	ClientBridge,
 	ClientBridgePermissionOption,
@@ -103,6 +104,12 @@ import type {
 	TurnStartEvent,
 } from "../shared-events";
 import type { SlashCommandInfo } from "../slash-commands";
+import type {
+	FunctionHook,
+	FunctionHookEventType,
+	FunctionHookPayloadFor,
+	FunctionHookRegistrationOptions,
+} from "./function-hooks";
 
 export type { AppKeybinding, KeybindingsManager } from "../../config/keybindings";
 export type { ExecOptions, ExecResult } from "../../exec/exec";
@@ -530,6 +537,8 @@ export interface ExtensionContext {
 	getJobs(): unknown;
 	/** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
 	onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
+	/** Observe session events synchronously in producer order. Returns an unsubscribe function. */
+	onSessionEvent?(listener: AgentSessionEventListener): () => void;
 	/** Typed skill and mode controls exposed to the SDK host. */
 	invokeSkill?(
 		name: string,
@@ -750,6 +759,8 @@ export type { AgentEndEvent, TurnEndEvent, TurnStartEvent } from "../shared-even
 /** Fired when an agent loop starts. `sdkRunToken` is an internal SDK queue-owner binding. */
 export interface AgentStartEvent extends SharedAgentStartEvent {
 	sdkRunToken?: string;
+	/** Complete set of SDK queue owners consumed together by this run. */
+	sdkRunTokens?: string[];
 }
 
 /** Fired when an agent run fails before emitting agent_end. The error is the
@@ -1234,6 +1245,18 @@ export interface ExtensionAPI {
 	on(event: "user_bash", handler: ExtensionHandler<UserBashEvent, UserBashEventResult>): void;
 	on(event: "user_python", handler: ExtensionHandler<UserPythonEvent, UserPythonEventResult>): void;
 
+	/**
+	 * Register capability-scoped middleware on the authoritative ExtensionRunner.
+	 * The host supplies grants; an extension cannot self-grant capabilities.
+	 * Wildcard registrations receive a redacted payload unless the host explicitly
+	 * grants a tool inspection/transform capability.
+	 */
+	registerFunctionHook<T extends FunctionHookEventType>(
+		event: T,
+		handler: FunctionHook<FunctionHookPayloadFor<T>>,
+		options?: FunctionHookRegistrationOptions,
+	): void;
+
 	// =========================================================================
 	// Tool Registration
 	// =========================================================================
@@ -1692,6 +1715,8 @@ export interface ExtensionContextActions {
 	getJobs?: () => unknown;
 	/** Subscribe to foreground-wait folds so the SDK host can publish `bash_folded`. Returns an unsubscribe. */
 	onJobFold?: (listener: (event: JobFoldEvent) => void) => () => void;
+	/** Ordered, synchronous AgentSession subscription, independent of async extension hooks. */
+	onSessionEvent?: (listener: AgentSessionEventListener) => () => void;
 	setSdkPermissionProvider?: (
 		provider:
 			| ((
@@ -1752,6 +1777,23 @@ export interface Extension {
 	shortcuts: Map<KeyId, ExtensionShortcut>;
 }
 
+export type {
+	FunctionHook,
+	FunctionHookAuditRecord,
+	FunctionHookCapabilities,
+	FunctionHookCapability,
+	FunctionHookEventType,
+	FunctionHookGrant,
+	FunctionHookGrantInput,
+	FunctionHookNext,
+	FunctionHookOperation,
+	FunctionHookPayloadFor,
+	FunctionHookProvenance,
+	FunctionHookRegistration,
+	FunctionHookRegistrationOptions,
+	FunctionHookResult,
+} from "./function-hooks";
+
 /** Result of loading extensions. */
 export interface LoadExtensionsResult {
 	extensions: Extension[];

package/src/extensibility/extensions/wrapper.ts

@@ -2,12 +2,24 @@
  * Tool wrappers for extensions.
  */
 import type { AgentTool, AgentToolContext, AgentToolUpdateCallback } from "@gajae-code/agent-core";
-import type { ImageContent, Static, TextContent, TSchema } from "@gajae-code/ai/core";
+import {
+	type ImageContent,
+	type Static,
+	type TextContent,
+	type ToolCall,
+	type TSchema,
+	validateToolArguments,
+} from "@gajae-code/ai/core";
 import type { Theme } from "../../modes/theme/theme";
+import { ToolAbortError } from "../../tools/tool-errors";
 import { applyToolProxy } from "../tool-proxy";
 import type { ExtensionRunner } from "./runner";
 import type { RegisteredTool, ToolCallEventResult } from "./types";
 
+function toolAbortReason(signal: AbortSignal | undefined, fallback: string): Error {
+	return signal?.reason instanceof Error ? signal.reason : new ToolAbortError(fallback);
+}
+
 /**
  * Adapts a RegisteredTool into an AgentTool.
  */
@@ -92,6 +104,11 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		applyToolProxy(tool, this);
 	}
 
+	/** Host composition hook: guards must run inside Function Hook preflight. */
+	getInnerTool(): AgentTool<TParameters, TDetails> {
+		return this.tool;
+	}
+
 	/**
 	 * Forward browser mode changes when available.
 	 */
@@ -109,19 +126,21 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		context?: AgentToolContext,
 	) {
 		const scope = context?.attemptScope;
+		const toolCallEvent = {
+			type: "tool_call" as const,
+			toolName: this.tool.name,
+			toolCallId,
+			input: params as Record<string, unknown>,
+		};
 		// Emit tool_call event - extensions can block execution
 		if (this.runner.hasHandlers("tool_call")) {
 			try {
-				const callResult = (await this.runner.emitToolCall(
-					{
-						type: "tool_call",
-						toolName: this.tool.name,
-						toolCallId,
-						input: params as Record<string, unknown>,
-					},
-					scope,
-				)) as ToolCallEventResult | undefined;
+				const callResult = (await this.runner.emitToolCall(toolCallEvent, scope, {
+					signal,
+					correlationId: toolCallId,
+				})) as ToolCallEventResult | undefined;
 
+				if (signal?.aborted) throw toolAbortReason(signal, "Tool call aborted during Function Hook mediation");
 				if (callResult?.block) {
 					const reason = callResult.reason || "Tool execution was blocked by an extension";
 					throw new Error(reason);
@@ -133,14 +152,28 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				throw new Error(`Extension failed, blocking execution: ${String(err)}`);
 			}
 		}
+		if (toolCallEvent.input !== params || !this.tool.lenientArgValidation) {
+			params = validateToolArguments(this.tool, {
+				type: "toolCall",
+				id: toolCallId,
+				name: this.tool.name,
+				arguments: toolCallEvent.input,
+			} satisfies ToolCall) as Static<TParameters>;
+		}
 
 		// Execute the actual tool
 		let result: { content: any; details?: TDetails };
 		let executionError: Error | undefined;
+		const mediatesToolResult = this.runner.hasToolResultMediation(this.tool.name);
+		const deliversToolResult = this.runner.hasHandlers("tool_result");
+		const effectiveOnUpdate = mediatesToolResult ? undefined : onUpdate;
 
 		try {
-			result = await this.tool.execute(toolCallId, params, signal, onUpdate, context);
+			result = await this.tool.execute(toolCallId, params, signal, effectiveOnUpdate, context);
 		} catch (err) {
+			if (err instanceof ToolAbortError || signal?.aborted) {
+				throw err instanceof ToolAbortError ? err : toolAbortReason(signal, "Tool execution aborted");
+			}
 			executionError = err instanceof Error ? err : new Error(String(err));
 			result = {
 				content: [{ type: "text", text: executionError.message }],
@@ -149,7 +182,8 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		}
 
 		// Emit tool_result event - extensions can modify the result and error status
-		if (this.runner.hasHandlers("tool_result")) {
+		if (signal?.aborted) throw toolAbortReason(signal, "Tool execution aborted");
+		if (deliversToolResult) {
 			const resultResult = await this.runner.emitToolResult(
 				{
 					type: "tool_result",
@@ -161,11 +195,17 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 					isError: !!executionError,
 				},
 				scope,
+				{ signal, correlationId: toolCallId },
 			);
+			if (signal?.aborted) throw toolAbortReason(signal, "Tool result mediation aborted");
 
 			if (resultResult) {
-				const modifiedContent: (TextContent | ImageContent)[] = resultResult.content ?? result.content;
-				const modifiedDetails = (resultResult.details ?? result.details) as TDetails;
+				const modifiedContent: (TextContent | ImageContent)[] = Object.hasOwn(resultResult, "content")
+					? (resultResult.content ?? [])
+					: result.content;
+				const modifiedDetails = (
+					Object.hasOwn(resultResult, "details") ? resultResult.details : result.details
+				) as TDetails;
 
 				// Extension can override error status
 				if (resultResult.isError === true && !executionError) {
@@ -181,7 +221,8 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 
 				// Error status unchanged, but content/details may be modified
 				if (executionError) {
-					throw executionError;
+					const textBlocks = modifiedContent.filter((content): content is TextContent => content.type === "text");
+					throw new Error(textBlocks.map(content => content.text).join("\n") || "Tool execution failed");
 				}
 				return { content: modifiedContent, details: modifiedDetails };
 			}

package/src/extensibility/gjc-plugins/compiler.ts

@@ -3,6 +3,7 @@ import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseFrontmatter, pathIsWithin } from "@gajae-code/utils";
+import { functionHookGrantHash, normalizeFunctionHookGrant } from "../extensions/function-hooks";
 import { classifyStdioInvocation } from "./mcp-policy";
 import { canonicalizeJsonSchema, extractDeclaredToolSchema, schemaHash } from "./metadata";
 import { resolveWithinRoot } from "./paths";
@@ -447,7 +448,16 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 				`GJC plugin hook "${hook.name}": tool_result requires the after phase`,
 			);
 		}
-		hooks.push({
+		const grant = normalizeFunctionHookGrant({
+			capabilities: hook.capabilities,
+			networkDestinations: hook.networkDestinations,
+			filesystemRoots: hook.filesystemRoots,
+		});
+		const functionHook =
+			hook.capabilities !== undefined ||
+			hook.networkDestinations !== undefined ||
+			hook.filesystemRoots !== undefined;
+		const normalizedHook: NormalizedHookSurface = {
 			extensionId: surfaceIds.hook(hook.event, hook.phase, hook.target, hook.name),
 			name: hook.name,
 			event: hook.event,
@@ -456,7 +466,15 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 			relativePath: hook.path,
 			sha256: digest,
 			implementationHash: digest,
-		});
+		};
+		if (functionHook) {
+			normalizedHook.capabilities = [...grant.capabilities];
+			normalizedHook.networkDestinations = [...grant.networkDestinations];
+			normalizedHook.filesystemRoots = [...grant.filesystemRoots];
+			normalizedHook.capabilityHash = functionHookGrantHash(grant);
+			normalizedHook.functionHook = true;
+		}
+		hooks.push(normalizedHook);
 	}
 
 	const mcps: NormalizedMcpSurface[] = [];