@quolu/aishell 0.3.1 → 0.3.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.ja.md

@@ -0,0 +1,163 @@
+<p align="center">
+  <img src=".github/og.png" alt="AIShell — AI開発へDirect OS contextを提供" width="100%">
+</p>
+
+# AIShell
+
+[![CI](https://github.com/kitepon-rgb/aishell/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon-rgb/aishell/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/@quolu/aishell)](https://www.npmjs.com/package/@quolu/aishell)
+![macOS 15+](https://img.shields.io/badge/macOS-15%2B-111827)
+![Swift 6](https://img.shields.io/badge/Swift-6-F05138)
+
+> AI開発hostへfreshなworkspace state、budget付きcontext、保持された実行証拠を渡すmacOS-native MCP runtime。すべての操作をshell文字列へ潰さず、OSに面する状態をモデルより下で所有する。
+
+[English](README.md)
+
+AIShellは許可root、file identity、filesystem照合state、直接起動したprocess、完全log、artifactを所有する。reasoning、thread、compaction、sub-agent、汎用terminalはAI hostの責務として残す。
+
+## 30秒で試す
+
+Apple Silicon Mac、macOS 15以降が必要。
+
+```sh
+npm install -g @quolu/aishell
+aishell-open
+codex mcp add aishell -- /opt/homebrew/bin/aishell-mcp
+```
+
+管理アプリでAIに許可するfolderを追加し、新しいCodex taskで次のように頼む。
+
+```text
+初回workspace contextはworkspace_snapshotで取得して。focused testはrun_checkで実行し、
+summaryから省略された証拠だけartifact_readで読んで。
+```
+
+既定development profileは5本の高密度toolを提供する。
+
+| Tool | 役割 |
+|---|---|
+| `workspace_snapshot` | boundedな初回preview、照合済み変更delta、Git状態、主要context |
+| `read_context` | SHA-256 identityとcontinuationを持つbudget付き複数file read |
+| `search_context` | 直接起動した`rg` workerによるbudget付き検索context |
+| `run_check` | 直接process実行、主要diagnostic、完全stdout/stderr artifact |
+| `artifact_read` | 保持artifactのrange、tail、pattern周辺read |
+
+## なぜAIShellか
+
+statelessな連携では、モデルがworkspaceを何度もscanし、command出力から状態を再構成しやすい。AIShellは状態を持つOS側の仕事をモデルより下へ置き、後続turnが全再scanではなくdeltaと一次証拠を要求できるようにする。
+
+| 論点 | AIShell | 一般的なshell-first連携 |
+|---|---|---|
+| Workspace state | file identity＋filesystem観測と照合 | commandを再実行してtextから再構成 |
+| Context | budget・cursor付きstructured result | stdoutを手動または暗黙に切り詰める |
+| Execution | executable URL、引数、cwd、lifecycleを分離 | shellが1本のcommand文字列を評価 |
+| Evidence | 完全stdout/stderrを期限付きhandleで保持 | response truncation時に証拠が失われやすい |
+| Scope | 人が管理する許可rootと明示的stop状態 | 周囲のshellとhost policyに依存 |
+
+AIShellはsandboxではなく、任意code実行を安全化しない。process railの目的はtyped executionと観測可能なlifecycleを維持することであり、改名binaryや許可workerが起動する子processを阻止することではない。
+
+## Architecture
+
+```mermaid
+flowchart LR
+    Host[AI host<br/>reasoning · threads · compaction] --> MCP[AIShellMCP<br/>MCP 2025-11-25]
+    MCP --> Core[AIShellCore]
+    Core --> State[Allowed roots · file identity<br/>FSEvents + reconciliation]
+    Core --> Process[Direct process lifecycle<br/>stdout · stderr · timeout]
+    Core --> Evidence[Retained evidence<br/>artifacts · freshness]
+    Process --> Workers[git · rg · compiler · tests]
+    State --> macOS[macOS APIs]
+    Evidence --> Host
+```
+
+`AIShellCore`がdomain挙動を所有し、`AIShellMCP`はprotocol request/resultだけを変換する。Git、ripgrep、compiler、test、SourceKit-LSPは新しいstate ownerにせず、直接起動するworkerとして再利用する。
+
+## npmからinstall
+
+global packageは`aishell-mcp`と`aishell-open`を`PATH`へ追加する。`aishell-open`は同梱された管理アプリをLaunchServicesで開く。install scriptは実行しない。
+
+```sh
+npm install -g @quolu/aishell
+aishell-open
+```
+
+現在の実験版はDeveloper ID署名・notarization前である。
+
+## Sourceからbuild
+
+```sh
+git clone https://github.com/kitepon-rgb/aishell.git
+cd aishell
+swift test
+scripts/package-app.sh release
+open build/AIShell.app
+```
+
+MCP実行ファイルは`build/AIShell.app/Contents/Helpers/aishell-mcp`へ同梱される。
+
+管理アプリの「許可rootを追加」でAIに操作させるfolderを選ぶ。許可済みGit repositoryの`.git/worktrees`へ正式登録され、双方の管理情報が一致するworktreeは自動的に実効rootへ加わる。
+
+## 別のAI hostへ接続
+
+Homebrew prefixへnpm installした場合は絶対pathを登録する。
+
+```sh
+codex mcp add aishell -- /opt/homebrew/bin/aishell-mcp
+codex mcp get aishell
+```
+
+解除:
+
+```sh
+codex mcp remove aishell
+```
+
+互換用full profileは既存20 primitiveと5本のdevelopment toolを合わせた25 toolを提供する。
+
+```sh
+AISHELL_TOOL_PROFILE=full /opt/homebrew/bin/aishell-mcp
+```
+
+full profileにはfile一覧・read、SHA-256競合検出付きatomic update、copy/move/rename/Trash、直接process実行、app discovery/launch、runtime status、管理アプリの前面化が含まれる。
+
+## 実行と安全性の境界
+
+- shell command文字列を評価しない。開発programを`PATH`からexecutable URLへ解決し、arguments、environment、working directoryと分離する。
+- `sh`、`bash`、`zsh`、`env`、`osascript`等のbasename直接起動を製品上のrailとして拒否する。security boundaryとして宣伝しない。
+- `run_check`はopen-world capabilityであり、許可workerはfile更新・子process・network accessを行い得る。AI hostによっては実行承認が必要になる。
+- text更新はSHA-256または旧textを事前条件にできる。削除はTrashへ送る。
+- 管理アプリから通常操作を一括停止できる。停止中もruntime statusと管理アプリの前面化は利用できる。
+
+## 現在の制限
+
+- stdio serverは1 requestずつ処理する。
+- MCP cancellationと並列run pollingは未実装。
+- timeout時は直接所有するprocess treeを終了するが、終了までに許可workerがopen-worldな副作用を起こし得る。
+- 初回workspace entryはbounded previewで、後続deltaはcursor pageになる。
+- Developer ID署名とnotarizationは未設定。
+
+## 開発検証
+
+```sh
+swift test
+scripts/package-app.sh release
+```
+
+`xcodegen generate`で`AIShell.xcodeproj`を再生成できる。実装の正本は`Sources/AIShellCore`、`Sources/AIShellMCP`、`Sources/AIShellApp`、focused testは`Tests/`に置く。
+
+<details>
+<summary>ローカルXcode検証時の注記</summary>
+
+初回検証機ではXcode 26.6とCoreSimulatorのbuild versionが一致せず、`xcodebuild`はXCBuild開始前に停止した。同じSwift 6.3.3 toolchainを使うSwiftPMは通過した。このhost問題はsourceの成功扱いへ混ぜていない。
+
+</details>
+
+## ContributionとSecurity
+
+変更提案前に[CONTRIBUTING.md](CONTRIBUTING.md)を確認してほしい。脆弱性はpublic issueへ書かず、[SECURITY.md](SECURITY.md)のprivate経路で報告する。
+
+release notesは[`docs/`](docs/)に置き、GitHub Releasesを公開済みversionの正本とする。
+
+## License
+
+AIShellは[Apache License 2.0](LICENSE)で公開している。

package/README.md

@@ -1,89 +1,163 @@
+<p align="center">
+  <img src=".github/og.png" alt="AIShell — Direct OS context for AI development" width="100%">
+</p>
+
 # AIShell
 
-AIの要求を汎用shell文字列へ潰さず、SwiftのmacOS APIと指定された開発workerを通してOS状態を直接扱う実験プロジェクト。
+[![CI](https://github.com/kitepon-rgb/aishell/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon-rgb/aishell/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/@quolu/aishell)](https://www.npmjs.com/package/@quolu/aishell)
+![macOS 15+](https://img.shields.io/badge/macOS-15%2B-111827)
+![Swift 6](https://img.shields.io/badge/Swift-6-F05138)
 
-## 現在できること
+> A macOS-native MCP runtime that gives AI development hosts fresh workspace state, bounded context, and retained execution evidence—without collapsing every operation into a shell string.
 
-- 既定のdevelopment profileから、OS状態を束ねた5本の高密度toolを提供
-  - `workspace_snapshot`: 初回scanのbounded previewとFSEvents由来の変更delta、Git状態、主要context
-  - `read_context`: 複数fileのbudget付きread、SHA-256、continuation
-  - `search_context`: `rg` workerによるbudget付き検索context
-  - `run_check`: 直接process実行、主要診断、完全stdout/stderr artifact
-  - `artifact_read`: artifactのrange、tail、pattern周辺read
-- 許可フォルダ内の一覧、検索、UTF-8テキスト読取
-- フォルダ／テキスト作成、copy、move、rename、Trash
-- stat、SHA-256、再帰tree
-- SHA-256競合検出付き原子的更新、旧テキストを事前条件にした部分置換
-- executable URLと引数配列による開発プログラムの直接実行
-- working directory、環境変数、timeout、stdout、stderr、終了コードの取得
-- 実行中／インストール済みアプリの一覧
-- bundle identifierによるアプリ起動・前面化
-- 管理アプリから複数の許可rootを追加・削除、全停止、操作履歴確認
-- 停止中でも状態確認と管理アプリ起動が可能
-- 許可済みGitリポジトリに登録されたworktreeを追加操作なしで自動認識
-- MCP 2025-11-25 stdio接続
+[日本語](README.ja.md)
 
-## 起動
+AIShell owns the OS-facing state below the model: allowed roots, file identity, filesystem reconciliation, directly launched processes, complete logs, and retained artifacts. The AI host remains responsible for reasoning, threads, compaction, sub-agents, and general-purpose terminal work.
 
-### npmからインストール
+## Try it in 30 seconds
 
-対応環境はApple Silicon Mac、macOS 15以降。
+Requires an Apple Silicon Mac running macOS 15 or later.
 
-```text
+```sh
 npm install -g @quolu/aishell
 aishell-open
+codex mcp add aishell -- /opt/homebrew/bin/aishell-mcp
 ```
 
-global installは `aishell-mcp` と `aishell-open` をPATHへ追加する。`aishell-open` はnpm package内の管理アプリをLaunchServicesで開く。install scriptは実行しない。現在はDeveloper ID署名・notarization前の実験版である。
+In the manager app, add the folders the AI may access. Start a new Codex task and try:
 
-### ソースから起動
+```text
+Use workspace_snapshot for the initial workspace context. Run the focused tests with
+run_check, and read retained output with artifact_read only if the summary omits evidence.
+```
 
-ローカル成果物は `build/AIShell.app`。Finderから通常のMacアプリとして起動できる。
+The default development profile exposes five high-density tools:
+
+| Tool | Purpose |
+|---|---|
+| `workspace_snapshot` | Bounded initial workspace preview, reconciled change delta, Git state, and primary context |
+| `read_context` | Budgeted multi-file reads with SHA-256 identity and continuation |
+| `search_context` | Budgeted search context produced by a directly launched `rg` worker |
+| `run_check` | Direct process execution, primary diagnostics, and complete stdout/stderr artifacts |
+| `artifact_read` | Range, tail, and pattern-centered reads from retained artifacts |
+
+## Why AIShell
+
+Typical stateless integrations repeatedly ask the model to rediscover workspace state and interpret command output. AIShell keeps the stateful, OS-facing part below the model so later turns can ask for deltas and primary evidence instead of rescanning everything.
+
+| Concern | AIShell | Typical shell-first integration |
+|---|---|---|
+| Workspace state | File identity plus filesystem observation and reconciliation | Re-run commands and reconstruct state from text |
+| Context | Bounded, cursor-based structured results | Unbounded or manually truncated stdout |
+| Execution | Executable URL, arguments, working directory, and lifecycle remain separate | A shell evaluates one command string |
+| Evidence | Complete stdout/stderr retained behind expiring handles | Evidence often disappears when the response is truncated |
+| Scope | Human-managed allowed roots and explicit stop state | Depends on the surrounding shell and host policy |
+
+AIShell is not a sandbox and does not make arbitrary code execution safe. Its process rails exist to preserve typed execution and observable lifecycle—not to stop renamed binaries or child processes launched by an allowed worker.
+
+## Architecture
+
+```mermaid
+flowchart LR
+    Host[AI host<br/>reasoning · threads · compaction] --> MCP[AIShellMCP<br/>MCP 2025-11-25]
+    MCP --> Core[AIShellCore]
+    Core --> State[Allowed roots · file identity<br/>FSEvents + reconciliation]
+    Core --> Process[Direct process lifecycle<br/>stdout · stderr · timeout]
+    Core --> Evidence[Retained evidence<br/>artifacts · freshness]
+    Process --> Workers[git · rg · compiler · tests]
+    State --> macOS[macOS APIs]
+    Evidence --> Host
+```
 
-最初に「許可rootを追加」でAIに操作させる範囲を選ぶ。絶対パスはいずれかのrootへ自動的に対応し、相対パスは一覧の先頭rootを基準にする。許可済みGitリポジトリの `.git/worktrees` に正式登録され、双方の管理情報が一致するworktreeは自動的に実効rootへ加わる。worktreeごとの手動追加は不要。停止中は通常のファイル・アプリ・process操作を拒否するが、`runtime_status` と `runtime_open_manager` は利用できる。
+`AIShellCore` owns domain behavior. `AIShellMCP` only translates protocol requests and results. Git, ripgrep, compilers, tests, and SourceKit-LSP remain directly launched workers rather than becoming new state owners.
 
-MCP実行ファイルはアプリ内に同梱される。
+## Install from npm
 
-```text
-/Users/kite/Developer/aishell/build/AIShell.app/Contents/Helpers/aishell-mcp
+The global package adds `aishell-mcp` and `aishell-open` to `PATH`. `aishell-open` opens the bundled manager app through LaunchServices. The package runs no install script.
+
+```sh
+npm install -g @quolu/aishell
+aishell-open
 ```
 
-## 別のCodexタスクから使う
+The current experimental build is not yet Developer ID signed or notarized.
 
-個人用のグローバルMCPとして登録する。npm版ではPATH上の絶対パスを指定する。
+## Build from source
 
-```text
-codex mcp add aishell -- /opt/homebrew/bin/aishell-mcp
+```sh
+git clone https://github.com/kitepon-rgb/aishell.git
+cd aishell
+swift test
+scripts/package-app.sh release
+open build/AIShell.app
 ```
 
-新しく開始したCodexタスクでは、既定で上記5本のdevelopment toolを利用できる。従来のprimitiveを含む25 toolが必要な互換利用では、server環境へ`AISHELL_TOOL_PROFILE=full`を設定する。
+The MCP executable is bundled at `build/AIShell.app/Contents/Helpers/aishell-mcp`.
 
-```text
-複数file・反復workspace観測ではworkspace_snapshotを使い、返されたcursorでdeltaを取って。32 KiBを超え得るbuild/test出力はrun_checkを使い、通常responseにない証拠だけartifact_readで読む。小さな単一file作業はCodex標準toolを使ってよい。
-```
+After opening the app, use **Add Allowed Root** to select the folders AIShell may access. A Git worktree registered under an allowed repository is recognized automatically when both sides of the worktree metadata agree.
 
-full profileの`runtime_status`は設定root、自動認識したGit worktree、実効root、相対パスの基準、停止状態、次の操作を返す。停止中でも`runtime_open_manager`で管理アプリを前面化できる。許可root変更と再開は管理画面で人が行い、停止中の通常操作は引き続き拒否される。
+## Connect another AI host
 
-`run_check`は指定workerがfile更新・子process・network accessを行い得るため、MCPへdestructive/open-world capabilityとして掲示する。host設定によっては実行承認が必要になる。0.3のstdio serverは1 requestずつ処理し、timeout時のprocess tree終了は行うが、MCP cancellationと並列pollingは未実装である。
+For a Homebrew-prefix npm installation, register the absolute executable path:
 
-登録確認と解除は次のとおり。
-
-```text
+```sh
+codex mcp add aishell -- /opt/homebrew/bin/aishell-mcp
 codex mcp get aishell
+```
+
+Remove the registration with:
+
+```sh
 codex mcp remove aishell
 ```
 
-## 開発検証
+The compatibility profile retains the original 20 primitives alongside the five development tools:
 
-```text
+```sh
+AISHELL_TOOL_PROFILE=full /opt/homebrew/bin/aishell-mcp
+```
+
+The full profile includes file listing and reads, atomic SHA-256-guarded updates, copy/move/rename/Trash, direct process execution, app discovery and launch, runtime status, and manager activation.
+
+## Execution and safety boundaries
+
+- AIShell never evaluates a shell command string. It resolves a development program from `PATH` to an executable URL and keeps arguments, environment, and working directory separate.
+- Direct launch of shell and wrapper basenames such as `sh`, `bash`, `zsh`, `env`, and `osascript` is rejected as a product rail, not advertised as a security boundary.
+- `run_check` is an open-world capability: an allowed worker may update files, launch child processes, or access the network. AI hosts may require approval before execution.
+- Text updates may use SHA-256 or expected old text as a precondition. Deletes go to Trash.
+- The manager app can stop normal operations globally. Runtime status and manager activation remain available while stopped.
+
+## Current limitations
+
+- The stdio server handles one request at a time.
+- MCP cancellation and concurrent run polling are not implemented.
+- A timeout terminates the directly owned process tree, but an allowed worker remains capable of open-world side effects before termination.
+- Initial workspace entries are a bounded preview; later deltas are cursor-paged.
+- Developer ID signing and notarization are not yet configured.
+
+## Development
+
+```sh
 swift test
 scripts/package-app.sh release
 ```
 
-`xcodegen generate` で `AIShell.xcodeproj` を再生成できる。現在の検証機ではXcode 26.6とCoreSimulatorのbuild versionが一致せず、`xcodebuild` はXCBuild開始待ちで停止するため、同じSwift 6.3.3 toolchainを使うSwiftPMでビルド・テストした。この環境問題はソースの成功扱いへ混ぜていない。
+Run `xcodegen generate` to regenerate `AIShell.xcodeproj`. The authoritative implementation lives under `Sources/AIShellCore`, `Sources/AIShellMCP`, and `Sources/AIShellApp`; focused tests live under `Tests/`.
+
+<details>
+<summary>Local Xcode verification note</summary>
+
+On the original verification machine, Xcode 26.6 and the installed CoreSimulator build version did not match, so `xcodebuild` stalled before XCBuild began. The same Swift 6.3.3 toolchain passed through SwiftPM. That host issue was not counted as source success.
+
+</details>
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) before proposing a change. Please report vulnerabilities through the private process in [SECURITY.md](SECURITY.md), not through a public issue.
 
-## 高密度runtimeの設計制約
+Release notes are kept in [`docs/`](docs/). GitHub Releases are the public record for shipped versions.
 
-`AIShellCore` と `AIShellMCP` はshellやAppleScript/JXAの文字列を解釈せず、開発プログラム名を`PATH`から実行ファイルURLへ解決し、引数配列と分離したままmacOSのprocess APIへ渡す。`sh`、`bash`、`zsh`、`dash`、`ksh`、`csh`、`tcsh`、`fish`、`env`、`osascript`というbasenameの直接起動と、パイプ、リダイレクト、shell展開は拒否する。
+## License
 
-この拒否listはsecurity boundaryではない。改名したbinaryや、許可されたworkerが内部で起動する子processまでは阻止しない。目的は任意コード実行を安全化することではなく、AIの要求を安易な`zsh -lc`へ戻さず、executable、arguments、working directory、lifecycle、artifactを分離してAIShellが所有する高密度経路へ誘導することである。`env`も環境変数mapとAIShell自身の`PATH`解決で不要なwrapperなので同じ設計レールに含める。MCPは型付き要求をOS-owned runtimeへ渡すアダプターである。
+AIShell is licensed under the [Apache License 2.0](LICENSE).

package/dist/AIShell.app/Contents/Info.plist

@@ -17,9 +17,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.3.1</string>
+    <string>0.3.2</string>
     <key>CFBundleVersion</key>
-    <string>6</string>
+    <string>7</string>
     <key>LSApplicationCategoryType</key>
     <string>public.app-category.utilities</string>
     <key>LSMinimumSystemVersion</key>

package/dist/AIShell.app/Contents/_CodeSignature/CodeResources

@@ -10,10 +10,10 @@
 		<dict>
 			<key>cdhash</key>
 			<data>
-			FLGSmJXEwfXtdPx0sRj6U3C4sCo=
+			JRbqlAClD40Akx/45QsEw19Bp+w=
 			</data>
 			<key>requirement</key>
-			<string>cdhash H"14b1929895c4c1f5ed74fc74b118fa5370b8b02a"</string>
+			<string>cdhash H"2516ea9400a50f8d00931ff8e50b04c35f41a7ec"</string>
 		</dict>
 	</dict>
 	<key>rules</key>

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@quolu/aishell",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A native macOS state runtime with high-density MCP tools for AI development",
-  "license": "UNLICENSED",
+  "license": "Apache-2.0",
   "author": "quolu",
   "repository": {
     "type": "git",