codemini-cli 0.5.7 → 0.5.9

package/src/core/command-loader.js

@@ -11,6 +11,8 @@ import { readSkillRegistry } from './skill-registry.js';
 
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const BUNDLED_SKILLS_DIR = path.resolve(MODULE_DIR, '..', '..', 'skills');
+const SKILL_CATALOG_FILE = 'codemini.skills.json';
+const FRONTMATTER_READ_BYTES = 16 * 1024;
 
 function parseArrayText(value) {
   const inner = value.slice(1, -1).trim();
@@ -46,6 +48,79 @@ function parseFrontmatter(raw) {
   return { metadata, content };
 }
 
+function readFrontmatterMetadata(filePath) {
+  let fd;
+  try {
+    fd = fs.openSync(filePath, 'r');
+    const buffer = Buffer.alloc(FRONTMATTER_READ_BYTES);
+    const bytesRead = fs.readSync(fd, buffer, 0, buffer.length, 0);
+    const raw = buffer.subarray(0, bytesRead).toString('utf8');
+    if (!raw.startsWith('---\n')) return {};
+    const end = raw.indexOf('\n---\n', 4);
+    if (end === -1) return {};
+    return parseFrontmatter(raw.slice(0, end + 5)).metadata;
+  } catch {
+    return {};
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch {}
+    }
+  }
+}
+
+function readSkillCatalog(baseDir) {
+  const catalogPath = path.join(baseDir, SKILL_CATALOG_FILE);
+  try {
+    const parsed = JSON.parse(fs.readFileSync(catalogPath, 'utf8'));
+    return parsed && typeof parsed === 'object' && parsed.skills && typeof parsed.skills === 'object'
+      ? parsed.skills
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+function normalizeStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => String(item || '').trim()).filter(Boolean);
+  }
+  const single = String(value || '').trim();
+  return single ? [single] : [];
+}
+
+function catalogMetadata(catalog, name) {
+  const entry = catalog?.[name];
+  if (!entry || typeof entry !== 'object') return {};
+  return {
+    ...(entry.description ? { description: String(entry.description) } : {}),
+    ...(entry.mode ? { mode: String(entry.mode) } : {}),
+    ...(entry.enabled !== undefined ? { enabled: entry.enabled !== false } : {}),
+    ...(entry.priority !== undefined ? { priority: Number(entry.priority) } : {}),
+    triggers: normalizeStringArray(entry.triggers)
+  };
+}
+
+function commandWithContent(command, parsedContent) {
+  if (parsedContent !== undefined) {
+    return { ...command, content: parsedContent };
+  }
+
+  let cached;
+  let loaded = false;
+  return Object.defineProperty({ ...command }, 'content', {
+    enumerable: true,
+    configurable: true,
+    get() {
+      if (!loaded) {
+        const raw = fs.readFileSync(command.path, 'utf8');
+        cached = parseFrontmatter(raw).content;
+        loaded = true;
+      }
+      return cached;
+    }
+  });
+}
+
 function safeEntries(dir) {
   try {
     return fs.readdirSync(dir);
@@ -104,77 +179,95 @@ function loadMarkdownCommandsFromDir(baseDir, source, out) {
 
 function loadLegacySkillsFromDir(baseDir, source, out) {
   if (!fs.existsSync(baseDir)) return;
+  const catalog = readSkillCatalog(baseDir);
   for (const entry of safeEntries(baseDir)) {
     if (!isSafeEntry(entry)) continue;
     const full = path.join(baseDir, entry);
     const stat = fs.statSync(full);
     if (!stat.isDirectory()) continue;
+    const catalogMeta = catalogMetadata(catalog, entry);
     const skillFile = path.join(full, 'SKILL.md');
     if (!fs.existsSync(skillFile)) continue;
-    const raw = fs.readFileSync(skillFile, 'utf8');
-    const parsed = parseFrontmatter(raw);
-    setCommand(out, entry, {
+    const frontmatter = readFrontmatterMetadata(skillFile);
+    setCommand(out, entry, commandWithContent({
       name: entry,
       source: `${source}-skill`,
       path: skillFile,
       metadata: {
-        description: parsed.metadata.description || 'Legacy skill',
+        ...frontmatter,
+        ...catalogMeta,
+        description: catalogMeta.description || frontmatter.description || 'Legacy skill',
         type: 'skill'
-      },
-      content: parsed.content
-    });
+      }
+    }));
   }
 }
 
 function loadBundledSkillsFromDir(baseDir, out) {
   if (!fs.existsSync(baseDir)) return;
+  const catalog = readSkillCatalog(baseDir);
   for (const entry of safeEntries(baseDir)) {
     if (!isSafeEntry(entry)) continue;
     const full = path.join(baseDir, entry);
     const stat = fs.statSync(full);
     if (!stat.isDirectory()) continue;
+    const catalogMeta = catalogMetadata(catalog, entry);
     const skillFile = path.join(full, 'SKILL.md');
     if (!fs.existsSync(skillFile)) continue;
-    const raw = fs.readFileSync(skillFile, 'utf8');
-    const parsed = parseFrontmatter(raw);
-    setCommand(out, entry, {
+    const frontmatter = readFrontmatterMetadata(skillFile);
+    setCommand(out, entry, commandWithContent({
       name: entry,
       source: 'bundled-skill',
       path: skillFile,
       metadata: {
-        ...parsed.metadata,
+        ...frontmatter,
+        ...catalogMeta,
         type: 'skill',
-        version: parsed.metadata.version || '0.1.0',
-        description: parsed.metadata.description || 'Bundled skill'
-      },
-      content: parsed.content
-    });
+        version: frontmatter.version || '0.1.0',
+        description: catalogMeta.description || frontmatter.description || 'Bundled skill'
+      }
+    }));
+  }
+}
+
+function applySkillCatalogPatches(baseDir, out) {
+  const catalog = readSkillCatalog(baseDir);
+  for (const name of Object.keys(catalog)) {
+    const existing = out.get(name);
+    if (!existing || existing.metadata?.type !== 'skill') continue;
+    const meta = catalogMetadata(catalog, name);
+    existing.metadata = {
+      ...existing.metadata,
+      ...meta,
+      description: meta.description || existing.metadata.description || ''
+    };
   }
 }
 
 function loadInstalledSkillsFromRegistry(baseDir, registry, out) {
   if (!registry || !Array.isArray(registry.skills)) return;
+  const catalog = readSkillCatalog(baseDir);
   for (const skill of registry.skills) {
     if (skill.enabled === false) continue;
     const name = skill.name;
     if (out.has(name)) continue;
+    const catalogMeta = catalogMetadata(catalog, name);
     const entry = skill.entryFile || 'SKILL.md';
     const full = path.join(baseDir, name, entry);
     if (!fs.existsSync(full)) continue;
-    const raw = fs.readFileSync(full, 'utf8');
-    const parsed = parseFrontmatter(raw);
-    setCommand(out, name, {
+    const frontmatter = readFrontmatterMetadata(full);
+    setCommand(out, name, commandWithContent({
       name,
       source: 'registry-skill',
       path: full,
       metadata: {
-        ...parsed.metadata,
+        ...frontmatter,
+        ...catalogMeta,
         type: 'skill',
-        version: skill.version || parsed.metadata.version || '0.0.0',
-        description: skill.description || parsed.metadata.description || 'Installed skill'
-      },
-      content: parsed.content
-    });
+        version: skill.version || frontmatter.version || '0.0.0',
+        description: catalogMeta.description || skill.description || frontmatter.description || 'Installed skill'
+      }
+    }));
   }
 }
 
@@ -201,10 +294,12 @@ export async function loadCommandsAndSkills(cwd = process.cwd()) {
   const commands = new Map();
 
   loadBundledSkillsFromDir(BUNDLED_SKILLS_DIR, commands);
+  applySkillCatalogPatches(getProjectSkillsDir(cwd), commands);
   loadMarkdownCommandsFromDir(getCommandsDir(), 'global', commands);
   loadMarkdownCommandsFromDir(getProjectCommandsDir(cwd), 'project', commands);
   loadLegacySkillsFromDir(getSkillsDir(), 'global', commands);
   loadLegacySkillsFromDir(getProjectSkillsDir(cwd), 'project', commands);
+  applySkillCatalogPatches(getProjectSkillsDir(cwd), commands);
   const registry = await readSkillRegistry();
   loadInstalledSkillsFromRegistry(getSkillsDir(), registry, commands);
 

package/src/core/command-policy.js

@@ -196,7 +196,25 @@ function suggestionForToken(token, config) {
   return 'Prefer structured tools like read, edit, write, grep, glob, and list first. If you need shell fallback, use allowed shell commands for search and local context such as rg, find, grep, sed, cat, or ls.';
 }
 
-function validateCdSegment(command, workspaceRoot) {
+function allowedPathRoots(workspaceRoot, config = {}) {
+  return [
+    workspaceRoot,
+    ...(Array.isArray(config?.policy?.allowed_paths) ? config.policy.allowed_paths : [])
+  ]
+    .map((item) => String(item || '').trim())
+    .filter(Boolean)
+    .map((item) => path.resolve(item));
+}
+
+function isWithinAnyRoot(candidatePath, roots = []) {
+  const resolvedCandidate = path.resolve(candidatePath);
+  return roots.some((root) => {
+    const relative = path.relative(root, resolvedCandidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+  });
+}
+
+function validateCdSegment(command, workspaceRoot, config = {}) {
   const tokens = tokenizeTopLevel(command);
   if (tokens.length === 1) {
     return { allowed: false, reason: 'cd requires a target path in safe mode' };
@@ -210,11 +228,9 @@ function validateCdSegment(command, workspaceRoot) {
     return { allowed: false, reason: 'cd target is not allowed in safe mode' };
   }
 
-  const resolvedRoot = path.resolve(workspaceRoot);
-  const resolvedTarget = path.resolve(resolvedRoot, rawTarget);
-  const relative = path.relative(resolvedRoot, resolvedTarget);
-  if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    return { allowed: false, reason: `cd escapes workspace: ${rawTarget}` };
+  const resolvedTarget = path.resolve(path.resolve(workspaceRoot), rawTarget);
+  if (!isWithinAnyRoot(resolvedTarget, allowedPathRoots(workspaceRoot, config))) {
+    return { allowed: false, reason: `cd escapes workspace or allowed paths: ${rawTarget}` };
   }
 
   return { allowed: true };
@@ -246,7 +262,7 @@ export function evaluateCommandPolicy(command, config, workspaceRoot = process.c
   for (const item of inspectedTokens) {
     if (SHELL_KEYWORDS.has(item.token)) continue;
     if (item.token === 'cd') {
-      const cdCheck = validateCdSegment(item.raw, workspaceRoot);
+      const cdCheck = validateCdSegment(item.raw, workspaceRoot, config);
       if (!cdCheck.allowed) {
         return { allowed: false, reason: cdCheck.reason, suggestion: suggestionForToken(item.token, config) };
       }
@@ -263,11 +279,19 @@ export function evaluateCommandPolicy(command, config, workspaceRoot = process.c
     }
   }
 
-  const workspaceLower = String(workspaceRoot).toLowerCase().replace(/\//g, '\\');
+  const allowedLower = allowedPathRoots(workspaceRoot, config).map((item) => item.toLowerCase().replace(/\//g, '\\'));
   const windowsAbsPath = lower.match(/[a-z]:\\[^\s'"]+/g) || [];
   for (const p of windowsAbsPath) {
-    if (!p.startsWith(workspaceLower)) {
-      return { allowed: false, reason: `absolute path outside workspace: ${p}`, suggestion: suggestionForToken(token, config) };
+    if (!allowedLower.some((root) => p === root || p.startsWith(`${root}\\`))) {
+      return { allowed: false, reason: `absolute path outside workspace or allowed paths: ${p}`, suggestion: suggestionForToken(token, config) };
+    }
+  }
+
+  const posixAbsPath = cmd.match(/(?<![:/\w])\/(?!\/)[^\s'"]+/g) || [];
+  const allowedResolved = allowedPathRoots(workspaceRoot, config);
+  for (const p of posixAbsPath) {
+    if (!isWithinAnyRoot(p, allowedResolved)) {
+      return { allowed: false, reason: `absolute path outside workspace or allowed paths: ${p}`, suggestion: suggestionForToken(token, config) };
     }
   }
 

package/src/core/config-store.js

@@ -89,6 +89,7 @@ const DEFAULT_CONFIG = {
   policy: {
     safe_mode: true,
     allow_dangerous_commands: false,
+    allowed_paths: [],
     command_allowlist: [],
     blocked_commands: [],
     blocked_path_patterns: [],
@@ -195,6 +196,9 @@ function normalizePolicyLists(config) {
   next.policy.command_allowlist = uniqueStrings(
     Array.isArray(next.policy.command_allowlist) ? next.policy.command_allowlist : []
   );
+  next.policy.allowed_paths = uniqueStrings(
+    Array.isArray(next.policy.allowed_paths) ? next.policy.allowed_paths : []
+  );
   next.policy.blocked_commands = uniqueStrings(
     Array.isArray(next.policy.blocked_commands) ? next.policy.blocked_commands : []
   );
@@ -212,6 +216,13 @@ function parseValue(input) {
   if (input === 'true') return true;
   if (input === 'false') return false;
   if (input === 'null') return null;
+  if ((input.startsWith('[') && input.endsWith(']')) || (input.startsWith('{') && input.endsWith('}'))) {
+    try {
+      return JSON.parse(input);
+    } catch {
+      return input;
+    }
+  }
   if (!Number.isNaN(Number(input)) && input.trim() !== '') return Number(input);
   return input;
 }

package/src/core/provider/anthropic.js

@@ -12,6 +12,72 @@ function extractTextContent(content) {
   return '';
 }
 
+function cloneAnthropicContentBlock(block) {
+  if (!block || typeof block !== 'object') return null;
+  if (block.type === 'thinking') {
+    const thinking = String(block.thinking || block.text || '');
+    if (!thinking) return null;
+    return {
+      type: 'thinking',
+      thinking,
+      ...(block.signature ? { signature: String(block.signature) } : {})
+    };
+  }
+  if (block.type === 'redacted_thinking') {
+    const data = block.data != null ? String(block.data) : '';
+    if (!data) return null;
+    return { type: 'redacted_thinking', data };
+  }
+  if (block.type === 'text') {
+    const text = String(block.text || '');
+    return text ? { type: 'text', text } : null;
+  }
+  if (block.type === 'tool_use') {
+    const name = String(block.name || '').trim();
+    if (!name) return null;
+    return {
+      type: 'tool_use',
+      id: String(block.id || ''),
+      name,
+      input: block.input && typeof block.input === 'object' && !Array.isArray(block.input) ? block.input : {}
+    };
+  }
+  return null;
+}
+
+function extractThinkingBlocks(message) {
+  const source = [
+    ...(Array.isArray(message?.reasoning_details) ? message.reasoning_details : []),
+    ...(Array.isArray(message?.content) ? message.content : [])
+  ];
+  return source
+    .filter((block) => block?.type === 'thinking' || block?.type === 'redacted_thinking')
+    .map(cloneAnthropicContentBlock)
+    .filter(Boolean);
+}
+
+function buildAssistantMessage({ text = '', toolCalls = [], thinkingBlocks = [] }) {
+  const assistantMessage = {
+    role: 'assistant',
+    content: text
+  };
+  const reasoningDetails = Array.isArray(thinkingBlocks)
+    ? thinkingBlocks.map(cloneAnthropicContentBlock).filter(Boolean)
+    : [];
+  if (reasoningDetails.length > 0) assistantMessage.reasoning_details = reasoningDetails;
+  if (Array.isArray(toolCalls) && toolCalls.length > 0) {
+    assistantMessage.tool_calls = toolCalls.map((tc) => ({
+      id: tc.id,
+      type: 'function',
+      function: {
+        name: tc.name,
+        arguments: tc.arguments || '{}'
+      }
+    }));
+  }
+  return assistantMessage;
+}
+
 function normalizeIncomingToolCallArguments(argumentsValue) {
   if (typeof argumentsValue === 'string') return argumentsValue;
   if (argumentsValue == null) return '{}';
@@ -41,7 +107,8 @@ function normalizeMessages(messages) {
   const systemParts = [];
   const out = [];
 
-  for (const message of source) {
+  for (let i = 0; i < source.length; i += 1) {
+    const message = source[i];
     if (!message || typeof message !== 'object') continue;
     if (message.role === 'system') {
       const text = extractTextContent(message.content);
@@ -50,35 +117,45 @@ function normalizeMessages(messages) {
     }
 
     if (message.role === 'tool') {
+      const toolResults = [];
+      while (i < source.length) {
+        const toolMessage = source[i];
+        if (!toolMessage || typeof toolMessage !== 'object' || toolMessage.role !== 'tool') break;
+        toolResults.push({
+          type: 'tool_result',
+          tool_use_id: String(toolMessage.tool_call_id || ''),
+          content: extractTextContent(toolMessage.content)
+        });
+        i += 1;
+      }
+      i -= 1;
       out.push({
         role: 'user',
-        content: [
-          {
-            type: 'tool_result',
-            tool_use_id: String(message.tool_call_id || ''),
-            content: extractTextContent(message.content)
-          }
-        ]
+        content: toolResults
       });
       continue;
     }
 
-    const contentBlocks = [];
+    const contentBlocks = message.role === 'assistant' ? extractThinkingBlocks(message) : [];
     const text = extractTextContent(message.content);
     if (text) {
       contentBlocks.push({ type: 'text', text });
     }
 
+    const hasContentToolUse = Array.isArray(message.content)
+      && message.content.some((block) => block?.type === 'tool_use');
     if (message.role === 'assistant' && Array.isArray(message.tool_calls)) {
-      for (const toolCall of message.tool_calls) {
-        const name = String(toolCall?.function?.name || toolCall?.name || '').trim();
-        if (!name) continue;
-        contentBlocks.push({
-          type: 'tool_use',
-          id: String(toolCall?.id || ''),
-          name,
-          input: tryParseJsonObject(toolCall?.function?.arguments ?? toolCall?.arguments)
-        });
+      if (!hasContentToolUse) {
+        for (const toolCall of message.tool_calls) {
+          const name = String(toolCall?.function?.name || toolCall?.name || '').trim();
+          if (!name) continue;
+          contentBlocks.push({
+            type: 'tool_use',
+            id: String(toolCall?.id || ''),
+            name,
+            input: tryParseJsonObject(toolCall?.function?.arguments ?? toolCall?.arguments)
+          });
+        }
       }
     }
 
@@ -142,6 +219,10 @@ function hasTrailingToolContext(messages) {
 
 function extractAssistantResult(data, messages) {
   const content = Array.isArray(data?.content) ? data.content : [];
+  const thinkingBlocks = content
+    .filter((block) => block?.type === 'thinking' || block?.type === 'redacted_thinking')
+    .map(cloneAnthropicContentBlock)
+    .filter(Boolean);
   const text = content
     .filter((block) => block?.type === 'text')
     .map((block) => block.text || '')
@@ -163,7 +244,8 @@ function extractAssistantResult(data, messages) {
         toolCalls: [],
         usage: data?.usage || null,
         incomplete: true,
-        content
+        content,
+        assistantMessage: buildAssistantMessage({ text: '', toolCalls: [], thinkingBlocks })
       };
     }
     throw new Error('Anthropic gateway returned empty assistant response');
@@ -173,7 +255,8 @@ function extractAssistantResult(data, messages) {
     text,
     toolCalls,
     usage: data?.usage || null,
-    content
+    content,
+    assistantMessage: buildAssistantMessage({ text, toolCalls, thinkingBlocks })
   };
 }
 
@@ -214,7 +297,7 @@ function emptyToolCall(index) {
   };
 }
 
-function buildFinalStreamResult(text, toolCallsByIndex, usage, messages) {
+function buildFinalStreamResult(text, toolCallsByIndex, usage, messages, thinkingBlocks = []) {
   const toolCalls = Array.from(toolCallsByIndex.entries())
     .sort((a, b) => a[0] - b[0])
     .map(([, tc], i) => ({
@@ -225,6 +308,10 @@ function buildFinalStreamResult(text, toolCallsByIndex, usage, messages) {
     .filter((tc) => tc.name);
   const normalizedText = String(text || '').trim();
   const content = [];
+  for (const block of thinkingBlocks) {
+    const cloned = cloneAnthropicContentBlock(block);
+    if (cloned) content.push(cloned);
+  }
   if (text) content.push({ type: 'text', text });
   for (const toolCall of toolCalls) {
     content.push({
@@ -242,7 +329,8 @@ function buildFinalStreamResult(text, toolCallsByIndex, usage, messages) {
         toolCalls: [],
         usage,
         incomplete: true,
-        content: []
+        content: [],
+        assistantMessage: buildAssistantMessage({ text: '', toolCalls: [], thinkingBlocks })
       };
     }
     throw new Error('Anthropic gateway stream returned empty assistant response');
@@ -253,7 +341,8 @@ function buildFinalStreamResult(text, toolCallsByIndex, usage, messages) {
     toolCalls,
     usage,
     incomplete: false,
-    content
+    content,
+    assistantMessage: buildAssistantMessage({ text, toolCalls, thinkingBlocks })
   };
 }
 
@@ -349,6 +438,7 @@ export async function createChatCompletionStream({
   let text = '';
   let usage = null;
   const toolCallsByIndex = new Map();
+  const thinkingBlocksByIndex = new Map();
 
   for await (const chunk of iterateSseEvents(response.body)) {
     usage = mergeUsage(usage, chunk?.data?.usage);
@@ -366,6 +456,10 @@ export async function createChatCompletionStream({
           : '';
         current.arguments = current.arguments || initialInput;
         toolCallsByIndex.set(index, current);
+      } else if (contentBlock.type === 'thinking' || contentBlock.type === 'redacted_thinking') {
+        const current = cloneAnthropicContentBlock(contentBlock) || { type: contentBlock.type };
+        if (current.type === 'thinking' && current.thinking == null) current.thinking = '';
+        thinkingBlocksByIndex.set(index, current);
       }
       continue;
     }
@@ -382,6 +476,20 @@ export async function createChatCompletionStream({
       continue;
     }
 
+    if (delta.type === 'thinking_delta') {
+      const current = thinkingBlocksByIndex.get(index) || { type: 'thinking', thinking: '' };
+      current.thinking = `${current.thinking || ''}${String(delta.thinking || '')}`;
+      thinkingBlocksByIndex.set(index, current);
+      continue;
+    }
+
+    if (delta.type === 'signature_delta') {
+      const current = thinkingBlocksByIndex.get(index) || { type: 'thinking', thinking: '' };
+      current.signature = String(delta.signature || '');
+      thinkingBlocksByIndex.set(index, current);
+      continue;
+    }
+
     if (delta.type === 'input_json_delta') {
       const current = toolCallsByIndex.get(index) || emptyToolCall(index);
       current.arguments = `${current.arguments || ''}${String(delta.partial_json || '')}`;
@@ -397,5 +505,10 @@ export async function createChatCompletionStream({
     }
   }
 
-  return buildFinalStreamResult(text, toolCallsByIndex, usage, messages);
+  const thinkingBlocks = Array.from(thinkingBlocksByIndex.entries())
+    .sort((a, b) => a[0] - b[0])
+    .map(([, block]) => cloneAnthropicContentBlock(block))
+    .filter(Boolean);
+
+  return buildFinalStreamResult(text, toolCallsByIndex, usage, messages, thinkingBlocks);
 }