create-walle 0.9.25 → 0.9.26

package/template/wall-e/coding/permission-service.js

@@ -2,8 +2,9 @@
 
 const crypto = require('node:crypto');
 const path = require('node:path');
-const { checkPermission } = require('../tools/permission-checker');
+const { checkPermission, registerEscalation } = require('../tools/permission-checker');
 const { analyzeShellCommand, initParser: initShellParser, bashArityPrefix } = require('../tools/shell-analyzer');
+const shellSandbox = require('./shell-sandbox');
 
 // Shell builtins that only navigate; skipped when choosing the approval card's
 // display pattern so a leading `cd` doesn't label the request as "cd *".
@@ -52,13 +53,14 @@ class PermissionService {
     this.pending = _sharedPending;
   }
 
-  async authorize({ sessionId = '', tool, input = {}, cwd = '', projectRoot = '', mode = '', metadata = {}, timeoutMs, headless = false } = {}) {
+  async authorize({ sessionId = '', tool, input = {}, cwd = '', projectRoot = '', mode = '', goal = '', metadata = {}, timeoutMs, headless = false } = {}) {
     const permissionContextId = metadata.permissionContextId || metadata.permission_context_id || createPermissionContextId();
     const requests = await buildToolPermissionRequests(tool, input, {
       cwd,
       projectRoot: projectRoot || cwd,
       sessionId,
       mode,
+      goal,
       metadata: { ...metadata, permissionContextId },
     });
     if (requests.length === 0) return { decision: 'allow', source: 'default', reason: 'No permission required', permissionContextId };
@@ -82,10 +84,19 @@ class PermissionService {
       }
 
       if (headless || (timeoutMs ?? this.timeoutMs) === 0) {
+        // With the OS shell sandbox on, an unlisted shell command is not a dead-end:
+        // let it through to the runner, which executes it CONTAINED (writes bounded to
+        // the workspace). The hard-denylist already returned 'deny' above, so this only
+        // reaches non-destructive commands.
+        const sandboxableShell = (request.permission === 'bash' || request.tool === 'run_shell')
+          && shellSandbox.shellSandboxEnabled()
+          && shellSandbox.sandboxAvailable();
         return {
-          decision: this.headlessPolicy === 'allow' ? 'allow' : 'deny',
-          source: 'headless',
-          reason: `Permission required for ${request.permission}/${request.pattern}`,
+          decision: (this.headlessPolicy === 'allow' || sandboxableShell) ? 'allow' : 'deny',
+          source: sandboxableShell ? 'sandbox' : 'headless',
+          reason: sandboxableShell
+            ? `Sandboxed run_shell for ${request.permission}/${request.pattern}`
+            : `Permission required for ${request.permission}/${request.pattern}`,
           request,
           permissionContextId,
         };
@@ -93,6 +104,7 @@ class PermissionService {
 
       const reply = await this.ask({
         ...request,
+        check: request.check,
         sessionId,
         metadata: { ...metadata, ...request.metadata, evaluated },
         permissionContextId,
@@ -104,7 +116,7 @@ class PermissionService {
     return { decision: 'allow', source: 'permissions', reason: 'Permission checks passed', permissionContextId };
   }
 
-  ask({ sessionId = '', permission, pattern = '*', patterns = null, tool = '', fingerprint = '', metadata = {}, permissionContextId = '', timeoutMs } = {}) {
+  ask({ sessionId = '', permission, pattern = '*', patterns = null, tool = '', fingerprint = '', metadata = {}, permissionContextId = '', timeoutMs, check = null } = {}) {
     if (!permission) throw new Error('permission is required');
     const id = `perm_${crypto.randomUUID().slice(0, 8)}`;
     const contextId = permissionContextId || metadata.permissionContextId || metadata.permission_context_id || createPermissionContextId();
@@ -124,12 +136,31 @@ class PermissionService {
         fingerprint: fingerprint || metadata.fingerprint || '',
         permissionContextId: contextId,
         metadata: { ...metadata, permissionContextId: contextId },
+        // The original check payload, kept so a later rule change (an "always"
+        // rule added here OR an allow rule added in CTM's Permission Manager) can
+        // RE-EVALUATE this parked request and auto-resolve it — instead of leaving
+        // it hung until timeout. See _reEvaluatePending().
+        check: check || null,
         createdAt: Date.now(),
         timer,
         resolve,
       };
       this.pending.set(id, entry);
       this._emit('permission.asked', publicEntry(entry));
+      // Register the park with CTM (best-effort, non-blocking) so it ALSO appears
+      // in the shared "Pending" tab and survives reload. Resolving it there calls
+      // back this request id to unpark; a failure is harmless (the local ask + the
+      // durable transcript card already surface it).
+      registerEscalation({
+        requestId: id,
+        tool,
+        command: (metadata && metadata.command) || '',
+        pattern,
+        projectPath: (metadata && metadata.projectRoot) || '',
+        sessionId,
+        reason: (metadata && metadata.evaluated && metadata.evaluated.reason) || '',
+        riskLevel: (metadata && metadata.evaluated && metadata.evaluated.riskLevel) || 'medium',
+      }).catch(() => {});
     });
   }
 
@@ -139,7 +170,7 @@ class PermissionService {
     const decision = reply === 'once' || reply === 'always' ? 'allow' : 'deny';
     this._resolveEntry(entry, { decision, reply, message, source: 'user' });
     if (reply === 'always') {
-      const rule = this.rulesStore.addAlways({
+      this.rulesStore.addAlways({
         projectRoot: entry.metadata.projectRoot || '',
         permission: entry.permission,
         pattern: entry.pattern,
@@ -147,11 +178,58 @@ class PermissionService {
         fingerprint: entry.fingerprint || entry.metadata.fingerprint || '',
         metadata: { ...entry.metadata, message },
       });
-      this._resolveCompatibleAlways(entry, rule, message);
+      // Cascade: the new rule may also cover OTHER parked requests in this
+      // session (e.g. a prefix rule `du *` covers every pending `du …`). Re-run
+      // the full decision against each one and auto-resolve the now-allowed ones,
+      // instead of only the exact fingerprint match the old path handled.
+      void this._reEvaluatePending({ sessionId: entry.sessionId });
     }
     return true;
   }
 
+  /**
+   * Re-evaluate every still-parked request (optionally scoped to one session)
+   * and resolve any that a freshly-added rule now allows. This is the self-heal
+   * for the "parked forever even though the approver would allow it" class:
+   * called after a local "always" reply, and exported as reEvaluatePending() so
+   * CTM can call it the instant a matching Permission Manager rule is added.
+   * Each pending entry carries its original `check`, so the decision is the same
+   * one authorize() makes — no duplicated policy logic.
+   */
+  async _reEvaluatePending({ sessionId = '' } = {}) {
+    for (const entry of [...this.pending.values()]) {
+      if (sessionId && entry.sessionId !== sessionId) continue;
+      let allow = false;
+      // (1) An "always" rule now covering this request (prefix-matched, no
+      //     fingerprint filter so it cascades beyond the exact command).
+      try {
+        const rule = this.rulesStore.findAlways({
+          projectRoot: entry.metadata?.projectRoot || '',
+          permission: entry.permission,
+          pattern: entry.pattern,
+          tool: entry.tool,
+        });
+        if (rule) allow = true;
+      } catch { /* store unavailable — fall through to a fresh evaluation */ }
+      // (2) A static/CTM rule now allowing it (e.g. a new Permission Manager
+      //     allow rule, or the read-only allowlist after a config reload).
+      if (!allow && entry.check) {
+        try {
+          const evaluated = await this.evaluatePermission(entry.check);
+          if (evaluated && evaluated.decision === 'allow') allow = true;
+        } catch { /* evaluation failed — leave parked, never auto-deny here */ }
+      }
+      if (allow && this.pending.has(entry.id)) {
+        this._resolveEntry(entry, { decision: 'allow', reply: 'always', source: 'cascade' });
+      }
+    }
+  }
+
+  /** Public trigger for the CTM bridge: a rule was added in CTM; re-check parks. */
+  reEvaluatePending(opts = {}) {
+    return this._reEvaluatePending(opts);
+  }
+
   list({ sessionId = '' } = {}) {
     const out = [];
     for (const entry of this.pending.values()) {
@@ -168,18 +246,6 @@ class PermissionService {
     }
   }
 
-  _resolveCompatibleAlways(sourceEntry, rule, message) {
-    for (const entry of [...this.pending.values()]) {
-      if (entry.id === sourceEntry.id) continue;
-      if (entry.permission !== sourceEntry.permission) continue;
-      if (entry.tool !== sourceEntry.tool) continue;
-      if ((entry.metadata.projectRoot || '') !== (sourceEntry.metadata.projectRoot || '')) continue;
-      if (entry.pattern !== sourceEntry.pattern) continue;
-      if ((entry.fingerprint || '') !== (sourceEntry.fingerprint || '')) continue;
-      this._resolveEntry(entry, { decision: 'allow', reply: 'always', message, source: 'always', rule });
-    }
-  }
-
   _resolveEntry(entry, result) {
     if (entry.timer) clearTimeout(entry.timer);
     this.pending.delete(entry.id);
@@ -204,7 +270,7 @@ class PermissionService {
   }
 }
 
-async function buildToolPermissionRequests(tool, input = {}, { cwd = '', projectRoot = '', sessionId = '', mode = '', metadata = {} } = {}) {
+async function buildToolPermissionRequests(tool, input = {}, { cwd = '', projectRoot = '', sessionId = '', mode = '', goal = '', metadata = {} } = {}) {
   const root = path.resolve(projectRoot || cwd || process.cwd());
   const base = { sessionId, tool, projectRoot: root, metadata: { ...metadata, projectRoot: root } };
   if (!tool) return [];
@@ -225,7 +291,7 @@ async function buildToolPermissionRequests(tool, input = {}, { cwd = '', project
       permission: 'bash',
       pattern,
       metadata: { ...base.metadata, command, commandTokens },
-      check: { tool: 'run_shell', command, commandTokens, commandClauses, projectPath: root, sessionId, mode },
+      check: { tool: 'run_shell', command, commandTokens, commandClauses, projectPath: root, sessionId, mode, goal },
     }], input);
   }
 

package/template/wall-e/coding/session-workspaces.js

@@ -0,0 +1,81 @@
+'use strict';
+
+// Track the set of working directories a single coding session has touched.
+//
+// Wall-E resolves a coding turn's cwd per-request (coding-run-controller), so one
+// long-lived session reused across two unrelated repos silently follows whichever
+// directory it was last pointed at. Asked about a file built earlier in a DIFFERENT
+// directory, the agent globbed its current cwd and missed it (session c3f3af97:
+// built a site in one repo, was later reused for a different app repo, then "show
+// me the web page file path" returned the current repo's files). Mirrors how
+// OpenCode/Claude Code keep a session grounded: surface every root the session has
+// worked in, every turn, instead of relying on a cwd-scoped search.
+//
+// Stored in brain KV (synchronous, survives restarts) keyed by the CTM chat
+// session id — the stable key that groups sequential runTurn calls into one
+// logical coding session (NOT the per-run transcript id).
+
+const KEY_PREFIX = 'coding_session_workspaces:';
+const ANCHOR_KEY_PREFIX = 'coding_session_anchor:';
+const MAX_WORKSPACES = 12;
+
+function readWorkspaces(brain, sessionKey) {
+  if (!brain || !sessionKey || typeof brain.getKv !== 'function') return [];
+  try {
+    const raw = brain.getKv(KEY_PREFIX + sessionKey);
+    if (!raw) return [];
+    const arr = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    return Array.isArray(arr) ? arr.filter((v) => typeof v === 'string' && v) : [];
+  } catch {
+    return [];
+  }
+}
+
+// Append cwd to the session's recorded set (dedup, most-recent-wins cap) and
+// persist. Returns the updated set. Never throws — a brain hiccup must not break a
+// coding turn; the worst case is the prompt missing the extra-directory hint.
+function recordSessionWorkspace(brain, sessionKey, cwd) {
+  const existing = readWorkspaces(brain, sessionKey);
+  if (!cwd) return existing;
+  if (existing.includes(cwd)) return existing;
+  const updated = [...existing, cwd].slice(-MAX_WORKSPACES);
+  if (brain && sessionKey && typeof brain.setKv === 'function') {
+    try { brain.setKv(KEY_PREFIX + sessionKey, JSON.stringify(updated)); } catch { /* best-effort */ }
+  }
+  return updated;
+}
+
+function readSessionAnchor(brain, sessionKey) {
+  if (!brain || !sessionKey || typeof brain.getKv !== 'function') return '';
+  try {
+    const raw = brain.getKv(ANCHOR_KEY_PREFIX + sessionKey);
+    return typeof raw === 'string' ? raw : '';
+  } catch {
+    return '';
+  }
+}
+
+// The session's anchor is the FIRST workspace root it was grounded in — set ONCE and
+// never changed, so a coding session has a stable "home" project (the OpenCode/Claude
+// one-session-per-project model) even when a later turn is pointed at a different
+// directory. Returns the anchor (existing or newly set), or '' when none is available.
+function recordSessionAnchor(brain, sessionKey, root) {
+  const existing = readSessionAnchor(brain, sessionKey);
+  if (existing) return existing;
+  if (!root) return '';
+  const anchor = String(root);
+  if (brain && sessionKey && typeof brain.setKv === 'function') {
+    try { brain.setKv(ANCHOR_KEY_PREFIX + sessionKey, anchor); } catch { /* best-effort */ }
+  }
+  return anchor;
+}
+
+module.exports = {
+  recordSessionWorkspace,
+  readWorkspaces,
+  recordSessionAnchor,
+  readSessionAnchor,
+  KEY_PREFIX,
+  ANCHOR_KEY_PREFIX,
+  MAX_WORKSPACES,
+};

package/template/wall-e/coding/shell-sandbox.js

@@ -0,0 +1,124 @@
+'use strict';
+
+// OS sandbox for the coding agent's run_shell. Wall-E runs shell commands itself
+// (execAsync/spawn '/bin/bash' in tools/local-tools.js), so to run a command CONTAINED
+// — instead of dead-ending an unlisted command at the headless-deny gate — we wrap the
+// spawn with the host's OS sandbox: macOS Seatbelt (`sandbox-exec`) or Linux bubblewrap
+// (`bwrap`). The containment is "auto-allow contained" (Claude Code model): reads,
+// process-exec, and NETWORK are allowed; filesystem WRITES are bounded to the workspace
+// roots. The truly destructive denylist (sudo/dd/mkfs/…) is still hard-denied upstream —
+// a filesystem sandbox can't neutralize privilege/device/system ops.
+//
+// Pure + dependency-free (system binaries only); detection accepts injected platform/probe
+// so it is unit-testable. Returns null when no sandbox backend exists → callers fall back
+// to today's behavior (no false safety).
+
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('node:fs');
+const { execFileSync } = require('node:child_process');
+
+function _hasBin(bin) {
+  if (bin === 'sandbox-exec' && fs.existsSync('/usr/bin/sandbox-exec')) return true;
+  for (const which of ['/usr/bin/which', 'which']) {
+    try {
+      execFileSync(which, [bin], { stdio: 'ignore' });
+      return true;
+    } catch { /* try next */ }
+  }
+  return false;
+}
+
+function detectBackend({ platform = process.platform, hasBin = _hasBin } = {}) {
+  if (platform === 'darwin') return hasBin('sandbox-exec') ? 'seatbelt' : null;
+  if (platform === 'linux') return hasBin('bwrap') ? 'bubblewrap' : null;
+  return null;
+}
+
+function sandboxAvailable(opts = {}) {
+  return detectBackend(opts) !== null;
+}
+
+// Opt-in kill switch (default OFF). When on AND a backend is available, run_shell
+// commands run contained instead of dead-ending at the headless-deny gate.
+function shellSandboxEnabled(env = process.env) {
+  const v = String((env && env.WALLE_SHELL_SANDBOX) || '').toLowerCase();
+  return v === '1' || v === 'true' || v === 'on' || v === 'yes';
+}
+
+// Seatbelt string literals are double-quoted; escape backslash and quote so a path can
+// never break out of the profile.
+function _seatbeltQuote(p) {
+  return String(p).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function buildSeatbeltProfile({ writableRoots = [] } = {}) {
+  const roots = (Array.isArray(writableRoots) ? writableRoots : [])
+    .filter(Boolean)
+    .map((r) => path.resolve(String(r)));
+  const writeAllows = roots.map((r) => `(allow file-write* (subpath "${_seatbeltQuote(r)}"))`);
+  return [
+    '(version 1)',
+    '(allow default)',                         // reads, process-exec, network all allowed
+    '(deny file-write*)',                       // ...writes denied by default
+    ...writeAllows,                             // ...except under the workspace roots
+    '(allow file-write* (regex #"^/dev/"))',    // tty / null / stdout / stderr
+  ].join('\n');
+}
+
+function defaultWritableRoots(cwd) {
+  const roots = [];
+  if (cwd) roots.push(path.resolve(String(cwd)));
+  roots.push(os.tmpdir());
+  return roots;
+}
+
+// Add the canonical (realpath) form of each root. macOS symlinks /var -> /private/var
+// and /tmp -> /private/tmp; Seatbelt matches the REAL path, so a subpath of /var/folders
+// would deny a write whose canonical path is /private/var/folders. Include both.
+function _expandRootsWithRealpath(roots) {
+  const out = [];
+  const seen = new Set();
+  for (const r of roots) {
+    const abs = path.resolve(String(r));
+    if (!seen.has(abs)) { seen.add(abs); out.push(abs); }
+    try {
+      const real = fs.realpathSync(abs);
+      if (real && real !== abs && !seen.has(real)) { seen.add(real); out.push(real); }
+    } catch { /* root may not exist yet — keep the resolved form */ }
+  }
+  return out;
+}
+
+// Build the argv that runs `command` (a /bin/bash -c string) inside the sandbox. Returns
+// null when no backend is available so the caller can fall back to an unsandboxed spawn.
+function wrapShellArgv({ command, cwd, writableRoots, platform = process.platform, hasBin = _hasBin } = {}) {
+  const backend = detectBackend({ platform, hasBin });
+  if (!backend) return null;
+  const requested = Array.isArray(writableRoots) && writableRoots.length
+    ? writableRoots.filter(Boolean)
+    : defaultWritableRoots(cwd);
+  const roots = _expandRootsWithRealpath(requested);
+  const cmd = String(command || '');
+
+  if (backend === 'seatbelt') {
+    const profile = buildSeatbeltProfile({ writableRoots: roots });
+    return ['sandbox-exec', '-p', profile, '/bin/bash', '-c', cmd];
+  }
+
+  // bubblewrap: read-only root, the workspace roots bound read-write, /dev + /proc, and
+  // a shared network namespace (writes contained, network allowed).
+  const argv = ['bwrap', '--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc'];
+  for (const r of roots) argv.push('--bind', r, r);
+  argv.push('--share-net', '--die-with-parent', '/bin/bash', '-c', cmd);
+  return argv;
+}
+
+module.exports = {
+  detectBackend,
+  sandboxAvailable,
+  shellSandboxEnabled,
+  buildSeatbeltProfile,
+  defaultWritableRoots,
+  wrapShellArgv,
+};

package/template/wall-e/coding/stream-processor.js

@@ -93,15 +93,19 @@ async function* streamFromChat(provider, request) {
 }
 
 class StreamProcessor extends EventEmitter {
-  constructor({ provider, model, transcript, toolExecutor, snapshotService, permissionService, artifactStore, now, emitLaneEvents = true, headless = false } = {}) {
+  constructor({ provider, model, transcript, toolExecutor, prepareToolCall, snapshotService, permissionService, artifactStore, now, emitLaneEvents = true, headless = false, goal = '' } = {}) {
     super();
     if (!provider) throw new Error('provider is required');
     this.provider = provider;
     this.model = model;
     this.transcript = transcript || null;
     this.toolExecutor = toolExecutor || null;
+    this.prepareToolCall = typeof prepareToolCall === 'function' ? prepareToolCall : null;
     this.snapshotService = snapshotService || null;
     this.permissionService = permissionService || null;
+    // Coding task forwarded to the permission layer for CTM's goal-aligned
+    // auto-approver (best-effort context, never a gate on its own).
+    this.goal = goal || '';
     this.now = now || (() => new Date().toISOString());
     this.artifactStore = artifactStore === false ? null : (artifactStore || new ArtifactStore({ now: this.now }));
     this.emitLaneEvents = emitLaneEvents !== false;
@@ -149,6 +153,9 @@ class StreamProcessor extends EventEmitter {
       hadEdit: false,
       verified: false,
       events: [],
+      // Turn abort signal — forwarded to tool execution so user Stop kills an
+      // in-flight run_shell child instead of just abandoning the promise.
+      signal,
     };
 
     await this._runtimeThread(sessionId, cwd, {
@@ -415,6 +422,7 @@ class StreamProcessor extends EventEmitter {
   async _runTool(call, state, { sessionId, cwd }) {
     const toolStartedAt = Date.now();
     try {
+      call = await this._prepareToolCall(call, state, { sessionId, cwd });
       await this._runtimeItem(sessionId, cwd, {
         threadId: state.threadId,
         turnId: state.turnId,
@@ -533,6 +541,10 @@ class StreamProcessor extends EventEmitter {
             type: 'permission_request',
             sessionId,
             permId: entry.id,
+            // toolCallId correlates this approval to the exact tool task in the
+            // CTM WORK-bar registry, so it flips THAT tool to awaiting_permission
+            // (not a racy "most-recent pending" guess).
+            toolCallId: call.id,
             tool: call.name,
             command: (call.input && call.input.command) || '',
             args: Array.isArray(call.input && call.input.args) ? call.input.args : [],
@@ -549,6 +561,7 @@ class StreamProcessor extends EventEmitter {
             input: call.input,
             cwd,
             projectRoot: cwd,
+            goal: this.goal,
             headless: this.headless,
             metadata: { toolCallId: call.id },
           });
@@ -578,6 +591,7 @@ class StreamProcessor extends EventEmitter {
             type: 'permission_resolved',
             sessionId,
             permId: askedPermId,
+            toolCallId: call.id,
             tool: call.name,
             decision: permission.decision,
             source: permission.source || '',
@@ -623,7 +637,7 @@ class StreamProcessor extends EventEmitter {
         confidence: Confidence.HIGH,
         data: { toolCallId: call.id, name: call.name },
       });
-      let result = await this.toolExecutor(call, { sessionId, cwd, model: state.model, provider: state.provider });
+      let result = await this.toolExecutor(call, { sessionId, cwd, model: state.model, provider: state.provider, signal: state.signal });
       await this._recordDiagnostics(sessionId, cwd, call, result);
       const typedArtifacts = this._storeTypedArtifacts(result, { sessionId, cwd, call });
       const routed = this._routeToolOutput(result, { sessionId, cwd, call });
@@ -742,6 +756,53 @@ class StreamProcessor extends EventEmitter {
     }
   }
 
+  async _prepareToolCall(call, state, { sessionId, cwd }) {
+    if (!this.prepareToolCall) return call;
+    try {
+      const prepared = await this.prepareToolCall(call, { sessionId, cwd, model: state.model, provider: state.provider });
+      const nextCall = normalizeToolCall(prepared?.call || call);
+      if (!nextCall.id) nextCall.id = call.id;
+      const index = state.toolCalls.findIndex((item) => String(item.id) === String(call.id));
+      if (index >= 0) state.toolCalls[index] = nextCall;
+      if (prepared?.decision && prepared.decision.action && prepared.decision.action !== 'skip') {
+        await this._record(sessionId, cwd, 'tool', {
+          state: 'prepared',
+          toolCallId: nextCall.id,
+          name: nextCall.name,
+          input: nextCall.input,
+          actionMemory: {
+            decision: prepared.decision,
+            candidateCount: prepared.candidateCount || 0,
+          },
+        });
+        this._emit({
+          type: 'action_memory',
+          sessionId,
+          toolCallId: nextCall.id,
+          tool: nextCall.name,
+          decision: prepared.decision,
+          candidateCount: prepared.candidateCount || 0,
+        });
+      }
+      return nextCall;
+    } catch (err) {
+      await this._record(sessionId, cwd, 'tool', {
+        state: 'prepare_failed',
+        toolCallId: call.id,
+        name: call.name,
+        error: err.message,
+      });
+      this._emit({
+        type: 'action_memory',
+        sessionId,
+        toolCallId: call.id,
+        tool: call.name,
+        error: err.message,
+      });
+      return call;
+    }
+  }
+
   _routeToolOutput(result, { sessionId, call }) {
     if (!this.artifactStore?.routeToolOutput) return { result, artifact: null };
     return this.artifactStore.routeToolOutput(result, {

package/template/wall-e/coding/tool-execution-controller.js

@@ -23,6 +23,7 @@ class ToolExecutionController {
     model = '',
     mode = '',
     runtimeMode = '',
+    goal = '',
     headless = false,
     benchmark = false,
     handlePermissions = true,
@@ -43,6 +44,9 @@ class ToolExecutionController {
     this.model = model;
     this.mode = mode;
     this.runtimeMode = runtimeMode;
+    // The coding task / user request — forwarded to the permission layer so CTM's
+    // goal-aligned auto-approver can judge by goal-alignment. Best-effort context.
+    this.goal = goal || '';
     this.headless = Boolean(headless);
     this.benchmark = Boolean(benchmark);
     this.handlePermissions = handlePermissions !== false;
@@ -85,6 +89,7 @@ class ToolExecutionController {
           cwd: input.cwd || base.cwd,
           projectRoot: base.projectRoot,
           mode: base.mode,
+          goal: base.goal || this.goal,
           headless: this.headless || this.benchmark,
           metadata: { toolCallId },
         });
@@ -167,6 +172,7 @@ class ToolExecutionController {
       model: ctx.model || this.model,
       mode: ctx.mode || this.mode,
       runtimeMode: ctx.runtimeMode || this.runtimeMode,
+      goal: ctx.goal || this.goal,
       llmCtx: ctx.llmCtx || {
         sessionId: ctx.sessionId || this.sessionId,
         cwd: ctx.cwd || this.cwd,
@@ -177,6 +183,11 @@ class ToolExecutionController {
       },
       interactive: ctx.interactive,
       onTodos: ctx.onTodos,
+      // Abort signal (user Stop / turn cancel) + progress heartbeat, forwarded to
+      // long-running tools (run_shell) so Stop kills the child and a slow command
+      // shows live motion. Best-effort; both may be undefined.
+      signal: ctx.signal,
+      onProgress: ctx.onProgress,
     };
   }
 
@@ -192,7 +203,7 @@ class ToolExecutionController {
     if (name === 'glob' && !input.directory) input.directory = base.cwd;
     if (name === 'grep_files' && !input.directory) input.directory = base.cwd;
     if (name === 'run_shell') {
-      input.timeout_ms = input.timeout_ms || 30000;
+      input.timeout_ms = input.timeout_ms || Number(process.env.WALLE_SHELL_TIMEOUT_MS) || 30000;
       input.cwd = input.cwd || base.cwd;
     }
     return input;
@@ -244,6 +255,8 @@ class ToolExecutionController {
       provider: base.provider,
       llmCtx: base.llmCtx,
       lifecycleHooks: this.lifecycleHooks,
+      signal: base.signal,
+      onProgress: base.onProgress,
     });
   }
 

package/template/wall-e/coding/tool-registry.js

@@ -163,7 +163,7 @@ class ToolRegistry {
 
     const local = this.localTools || safeLocalTools();
     if (local?.executeLocalTool) {
-      const result = await local.executeLocalTool(name, args);
+      const result = await local.executeLocalTool(name, args, ctx);
       if (result !== null && result !== undefined) return result;
     }
     return invalidTool(name, `Unknown tool: ${name}`);

package/template/wall-e/coding/transcript-writer.js

@@ -100,6 +100,9 @@ class CodingTranscript {
     record.modelId = opts.model || opts.modelId || this.defaults.modelId || '';
     record.modelProvider = opts.provider || opts.modelProvider || this.defaults.modelProvider || '';
     record.tokens = opts.tokens || {};
+    // Claude-Code-parity per-message usage breakdown (input/output/cache_* tokens),
+    // mirroring its JSONL `message.usage`. `tokens` stays for backward compat.
+    record.usage = opts.usage || null;
     record.cost = Number.isFinite(opts.cost) ? opts.cost : null;
     return this.append(record);
   }