@codex-ultra/cxu 0.1.0

package/dist/shared-types.d.ts

@@ -0,0 +1,99 @@
+export type SaVmDeletePolicy = "deny" | "rename" | "move";
+export type SaVmFsAccess = "read" | "write" | "deny";
+export interface SaVmFsEntry {
+    path: string;
+    access: SaVmFsAccess;
+}
+export interface SaVmProcessExecRule {
+    path: string;
+    args?: string[];
+}
+export type SaVmBunProfile = "shared-typecheck" | "protocol-typecheck" | "server-typecheck" | "web-typecheck" | "free-key-typecheck" | "root-typecheck" | "shared-build" | "web-build" | "server-test-file" | "web-test-file" | "shared-test-file";
+export declare const ALL_SA_VM_BUN_PROFILES: readonly SaVmBunProfile[];
+export type SaVmBunSubcommand = "test" | "run" | "build" | "--filter" | "filter";
+export declare const ALL_SA_VM_BUN_SUBCOMMANDS: readonly SaVmBunSubcommand[];
+export declare const ALL_SA_VM_BUN_FILTER_SCRIPTS: readonly ["typecheck", "build", "test", "lint"];
+export type SaVmBunFilterScript = typeof ALL_SA_VM_BUN_FILTER_SCRIPTS[number];
+export declare const SA_VM_BUN_DENIED_SUBCOMMANDS: readonly string[];
+export interface SaVmBunPolicyConfig {
+    enabled?: boolean;
+    allowedSubcommands?: SaVmBunSubcommand[];
+}
+export interface SaVmHttpAllowRule {
+    host: string;
+    methods?: string[];
+    paths?: string[];
+}
+export type SaVmRuntimeEngine = "native" | "vm";
+export interface SaVmPolicyConfig {
+    engine?: SaVmRuntimeEngine;
+    fs?: {
+        entries?: SaVmFsEntry[];
+        read?: string[];
+        write?: string[];
+        transfer?: string[];
+        delete?: SaVmDeletePolicy;
+        backupDir?: string | null;
+        salaRoot?: string;
+    };
+    http?: {
+        allow?: SaVmHttpAllowRule[];
+    };
+    env?: {
+        allow?: string[];
+    };
+    process?: {
+        spawn?: boolean;
+        exec?: SaVmProcessExecRule[];
+        bunProfiles?: SaVmBunProfile[];
+        bun?: boolean | SaVmBunPolicyConfig;
+    };
+    execution?: {
+        javascript?: boolean;
+        python?: boolean;
+    };
+    tools?: SaVmToolsConfig;
+    contextSavings?: SaVmContextSavingsConfig;
+}
+export interface SaVmContextSavingsConfig {
+    locateBeforeRead?: boolean;
+    maxReadFileBytes?: number;
+    grepCircuitBreaker?: boolean;
+    grepMaxResults?: number;
+    grepMaxTokens?: number;
+    slimRunnerOutput?: boolean;
+    parallelBudget?: boolean;
+    parallelMaxTotalBytes?: number;
+    parallelMaxReadFiles?: number;
+    parallelDeduplication?: boolean;
+    tieredSkillInjection?: boolean;
+    foldWaterfallEvents?: boolean;
+    foldHistoryReadSummaries?: boolean;
+    historyReadFoldTurns?: number;
+}
+export interface SaVmToolsConfig {
+    replaceRead?: boolean;
+    replaceWrite?: boolean;
+    replaceApplyPatch?: boolean;
+    replaceExec?: boolean;
+    readFiles?: boolean;
+    editFiles?: boolean;
+    applyPatch?: boolean;
+    fastSearch?: boolean;
+    clearToolHistory?: boolean;
+    findReferences?: boolean;
+    renameSymbol?: boolean;
+    fileOutline?: boolean;
+    moveWithImports?: boolean;
+    findDefinition?: boolean;
+    extractToFile?: boolean;
+    addImport?: boolean;
+    getDiagnostics?: boolean;
+    organizeImports?: boolean;
+    analyzeScope?: boolean;
+}
+export declare const ENHANCE_TOOLS_KEYS: readonly ["readFiles", "fastSearch", "editFiles", "applyPatch", "fileOutline", "findDefinition", "renameSymbol", "extractToFile", "moveWithImports", "addImport", "getDiagnostics", "organizeImports", "analyzeScope", "findReferences", "clearToolHistory"];
+export type EnhanceToolKey = typeof ENHANCE_TOOLS_KEYS[number];
+export declare function hasEnhanceToolsEnabled(tools?: SaVmToolsConfig | null): boolean;
+export declare function countActiveEnhanceTools(tools?: SaVmToolsConfig | null): number;
+export declare function createDefaultSaVmPolicyConfig(): SaVmPolicyConfig;

package/dist/vendor/saVmApplyPatch.d.ts

@@ -0,0 +1,29 @@
+import type { SaVmPolicyConfig } from "../shared-types.js";
+type PatchOp = {
+    kind: "write";
+    path: string;
+    contents: string;
+} | {
+    kind: "edit";
+    path: string;
+    oldContents: string;
+    newContents: string;
+} | {
+    kind: "delete";
+    path: string;
+    backupPath?: string;
+} | {
+    kind: "rename";
+    from: string;
+    to: string;
+};
+export type SaVmPatchOperation = PatchOp;
+export type SaVmPatchResult = {
+    ok: true;
+    operations: PatchOp[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function parseAndCheckSaVmPatch(patch: string, cwd: string, policyConfig: SaVmPolicyConfig | undefined, additionalRoots?: string[]): SaVmPatchResult;
+export {};

package/dist/vendor/saVmPolicy.d.ts

@@ -0,0 +1,112 @@
+import type { SaVmBunSubcommand, SaVmContextSavingsConfig, SaVmDeletePolicy, SaVmHttpAllowRule, SaVmPolicyConfig, SaVmProcessExecRule } from "../shared-types.js";
+export type SaVmPathOperation = "read" | "write" | "transfer";
+/**
+ * Enhanced tools should have efficient access to external paths for read operations.
+ * The original design coupled enhancement with sandbox restrictions, causing models
+ * to fall back to inefficient terminal commands like Get-Content/Select-String.
+ *
+ * Fix: Read operations (read_file, read_lines, grep_search, list_dir, find_files)
+ * should allow external paths by default for efficiency. Write operations remain
+ * restricted to workspace + additionalRoots for safety.
+ */
+export declare const ENHANCED_TOOLS_READ_ONLY: Set<string>;
+export type SaVmPolicyDecision = {
+    allowed: true;
+    path: string;
+} | {
+    allowed: false;
+    reason: string;
+    path?: string;
+};
+export type NormalizedSaVmPolicy = {
+    engine: "native" | "vm";
+    fs: {
+        entries: Array<{
+            path: string;
+            access: "read" | "write" | "deny";
+        }>;
+        read: string[];
+        write: string[];
+        transfer: string[];
+        delete: SaVmDeletePolicy;
+        backupDir: string | null;
+    };
+    http: {
+        allow: SaVmHttpAllowRule[];
+    };
+    env: {
+        allow: string[];
+    };
+    process: {
+        spawn: boolean;
+        exec: SaVmProcessExecRule[];
+        bunProfiles?: string[];
+        bun?: {
+            enabled: boolean;
+            allowedSubcommands: SaVmBunSubcommand[];
+        };
+    };
+    execution: {
+        javascript: boolean;
+        python: boolean;
+    };
+    tools: {
+        replaceRead: boolean;
+        replaceWrite: boolean;
+        replaceApplyPatch: boolean;
+        replaceExec: boolean;
+        readFiles?: boolean;
+        editFiles?: boolean;
+        applyPatch?: boolean;
+        fastSearch?: boolean;
+        clearToolHistory: boolean;
+        findReferences: boolean;
+        renameSymbol?: boolean;
+        fileOutline?: boolean;
+        moveWithImports?: boolean;
+        findDefinition?: boolean;
+        extractToFile?: boolean;
+        addImport?: boolean;
+        getDiagnostics?: boolean;
+        organizeImports?: boolean;
+        analyzeScope?: boolean;
+    };
+    contextSavings?: SaVmContextSavingsConfig;
+};
+export declare function normalizeSaVmPolicy(config: SaVmPolicyConfig | undefined, cwd: string, additionalRoots?: string[]): NormalizedSaVmPolicy;
+export declare function checkSaVmPath(policy: NormalizedSaVmPolicy, operation: SaVmPathOperation, candidate: string, cwd: string): SaVmPolicyDecision;
+export declare function checkSaVmDelete(policy: NormalizedSaVmPolicy, candidate: string, cwd: string): SaVmPolicyDecision;
+export declare function checkSaVmHttp(policy: NormalizedSaVmPolicy, urlValue: string, methodValue?: string): SaVmPolicyDecision;
+export declare function checkSaVmEnv(policy: NormalizedSaVmPolicy, name: string): SaVmPolicyDecision;
+export declare function checkSaVmProcess(policy: NormalizedSaVmPolicy, executable: string, args?: string[]): SaVmPolicyDecision;
+export declare function checkSaVmBunProfile(policy: NormalizedSaVmPolicy, profile: string): SaVmPolicyDecision;
+export declare function checkSaVmBunExecution(policy: NormalizedSaVmPolicy, bunBinary: string, subcommand: string, args?: string[]): SaVmPolicyDecision;
+export declare function isSaVmScriptExecutionAllowed(policy: NormalizedSaVmPolicy, executable: string): boolean;
+export type SaVmExecutionRequestKind = "bun" | "javascript" | "python" | "other";
+export declare function classifySaVmExecutionRequest(input: {
+    action?: unknown;
+    language?: unknown;
+    subcommand?: unknown;
+    args?: unknown;
+    test_file?: unknown;
+    filter?: unknown;
+    profile?: unknown;
+}): {
+    kind: SaVmExecutionRequestKind;
+    isBun: boolean;
+    isJs: boolean;
+    isPy: boolean;
+};
+export declare function classifyBunRequest(input: {
+    action?: unknown;
+    subcommand?: unknown;
+    args?: unknown;
+    test_file?: unknown;
+    filter?: unknown;
+    profile?: unknown;
+}): boolean;
+export declare function extractCommandArgv(value: unknown): {
+    executable: string;
+    args: string[];
+} | null;
+export declare function pathWithin(root: string, candidate: string): boolean;

package/dist/vendor/saVmProcess.d.ts

@@ -0,0 +1 @@
+export declare function killProcessTree(pid: number | undefined): void;

package/dist/vendor/saVmRequest.d.ts

@@ -0,0 +1,9 @@
+export type SaVmRequestValidation = {
+    ok: true;
+    isParallel: boolean;
+} | {
+    ok: false;
+    error: string;
+    code: "CUX-SA-VM-SLA-REQUIRED" | "CUX-SA-VM-INVALID-INPUT";
+};
+export declare function validateSaVmRequestBody(body: Record<string, unknown>): SaVmRequestValidation;

package/dist/vendor/saVmResultKind.d.ts

@@ -0,0 +1,12 @@
+export type SaVmRunResult = {
+    ok: boolean;
+    kind: "success" | "sa_error" | "capability_denied" | "fuel_exhausted" | "timeout" | "mem_quota" | "policy_invalid" | "stack_overflow" | "crashed" | "unavailable";
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    saVmEvents: Array<Record<string, unknown>>;
+    saVmViolation: Record<string, unknown> | null;
+    durationMs: number;
+};
+export type SaVmRunResultKind = "success" | "sa_error" | "capability_denied" | "fuel_exhausted" | "timeout" | "mem_quota" | "policy_invalid" | "stack_overflow" | "crashed" | "unavailable";
+export declare function resultKind(exitCode: number | null, stderr?: string): SaVmRunResultKind;

package/dist/vendor/saVmTool.d.ts

@@ -0,0 +1,353 @@
+import type { SaVmPolicyConfig } from "../shared-types.js";
+import { type SaVmBunProfile } from "../shared-types.js";
+export type SaVmFsCapability = {
+    op: "read" | "write" | "append" | "edit" | "create" | "delete" | "rename" | "metadata";
+    path: string;
+};
+export type SaVmNetCapability = {
+    url: string;
+    methods?: string[];
+};
+export type SaVmActionType = "read" | "read_file" | "read_lines" | "read_file_tail" | "tail_file" | "tail" | "find" | "find_files" | "list_files" | "write" | "write_file" | "edit" | "edit_file" | "apply_patch" | "patch" | "delete" | "delete_file" | "remove_file" | "safe_delete" | "move" | "move_file" | "rename" | "rename_file" | "copy" | "copy_file" | "stat" | "file_info" | "test_path" | "file_exists" | "exists" | "ensure_dir" | "mkdir" | "vm-read" | "vm_read" | "count_lines" | "line_count" | "list_dir" | "grep" | "grep_search" | "grep_async" | "grep_search_async" | "async_grep" | "http_fetch" | "fetch" | "run_js" | "exec_js" | "run_py" | "run_python" | "exec_py" | "clear_tool_history" | "prune_tool_history" | "find_references" | "find_all_references" | "find_implementations" | "find_impl" | "implementations" | "file_outline" | "outline" | "rename_symbol" | "symbol_rename" | "move_file_with_imports" | "move_with_imports" | "find_definition" | "goto_definition" | "def" | "extract_to_file" | "extract_file" | "extract_module" | "add_import" | "insert_import" | "get_diagnostics" | "diagnostics" | "check_syntax" | "workspace_diagnostics" | "project_diagnostics" | "all_diagnostics" | "organize_imports" | "clean_unused_imports" | "sort_imports" | "analyze_scope" | "scope_analysis" | "run_bun" | "run_bun_profile" | "run_project_check" | "project_check" | "run_host" | "exec_host" | "host";
+export declare const SA_VM_BUN_PROFILES: readonly SaVmBunProfile[];
+export type { SaVmBunProfile };
+export type SaVmRunInput = {
+    /** Built-in action shortcut. Automatically expands to standard native operations or SLA. */
+    action?: SaVmActionType | string;
+    path?: string;
+    file?: string;
+    dest?: string;
+    target?: string;
+    content?: string;
+    profile?: string;
+    subcommand?: string;
+    filter?: string;
+    test_file?: string;
+    keep_last_n_turns?: number;
+    filter_tools?: string[];
+    reason?: string;
+    symbol?: string;
+    old_name?: string;
+    new_name?: string;
+    statement?: string;
+    import_statement?: string;
+    symbols?: string[] | string;
+    exported_symbols?: string[] | string;
+    component_name?: string;
+    sort?: boolean;
+    remove_unused?: boolean;
+    merge_duplicates?: boolean;
+    module?: string;
+    include_body?: boolean;
+    is_type?: boolean;
+    dry_run?: boolean;
+    check_references?: boolean;
+    force?: boolean;
+    name?: string;
+    max_files?: number;
+    max_errors?: number;
+    detail?: boolean;
+    max_results?: number;
+    limit?: number;
+    candidate_files?: string[];
+    files?: string[];
+    exclude_comments?: boolean;
+    include_declarations?: boolean;
+    old_text?: string;
+    new_text?: string;
+    start_line?: number;
+    end_line?: number;
+    offset?: number;
+    max_tokens?: number;
+    max_token?: number;
+    maxtoken?: number;
+    remaining_tokens?: number;
+    tokens_remaining?: number;
+    tokens_left?: number;
+    max_lines?: number;
+    max_line_length?: number;
+    numbered?: boolean;
+    dir?: string;
+    pattern?: string;
+    type?: "all" | "file" | "directory" | string;
+    max_bytes?: number;
+    max_entries?: number;
+    max_depth?: number;
+    depth?: number;
+    recursive?: boolean;
+    patch?: string;
+    from?: string;
+    to?: string;
+    query?: string;
+    queries?: string[];
+    path_pattern?: string;
+    is_regex?: boolean;
+    regex?: boolean;
+    case_sensitive?: boolean;
+    lines?: number;
+    tail?: boolean;
+    max_matches?: number;
+    url?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    timeout_ms?: number;
+    timeout?: number;
+    source?: string;
+    language?: "js" | "javascript" | "bun" | "ts" | "typescript" | "node" | "py" | "python" | "sa" | "sla";
+    exe?: string;
+    args?: string[];
+    env?: Record<string, string>;
+    head_lines?: number;
+    tail_lines?: number;
+    requested_caps?: {
+        fs?: Array<string | SaVmFsCapability>;
+        net?: SaVmNetCapability[];
+        env?: string[];
+        process?: boolean;
+    };
+    limits?: {
+        fuel?: number;
+        deadline_ms?: number;
+        mem_cap_bytes?: number;
+        max_call_depth?: number;
+    };
+    cwd?: string;
+    additionalRoots?: string[];
+    policy?: SaVmPolicyConfig;
+    parallel?: Array<Omit<SaVmRunInput, "parallel">>;
+    concurrency?: number;
+};
+export declare function expandSaVmActionInput(input: SaVmRunInput): SaVmRunInput;
+export type SaVmRunResult = {
+    ok: boolean;
+    kind: "success" | "sa_error" | "capability_denied" | "fuel_exhausted" | "timeout" | "mem_quota" | "policy_invalid" | "stack_overflow" | "crashed" | "unavailable";
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    saVmEvents: Array<Record<string, unknown>>;
+    saVmViolation: Record<string, unknown> | null;
+    durationMs: number;
+};
+declare const DEFAULT_LIMITS: {
+    fuel: number;
+    deadline_ms: number;
+    mem_cap_bytes: number;
+    max_call_depth: number;
+};
+export declare function resolveTimeoutMs(input: {
+    timeout_ms?: number;
+    timeout?: number;
+} | undefined, defaultMs?: number): number;
+interface GitIgnoreRule {
+    negated: boolean;
+    dirOnly: boolean;
+    hasSlash: boolean;
+    anchored: boolean;
+    regex: RegExp;
+}
+export declare function loadGitIgnoreRules(dir: string): GitIgnoreRule[];
+export declare function isGitIgnored(name: string, isDir: boolean, rules: GitIgnoreRule[], relativePath?: string): boolean;
+export interface NativeReadFileOptions {
+    startLine?: number;
+    endLine?: number;
+    offset?: number;
+    maxTokens?: number;
+    remainingTokens?: number;
+    maxBytes?: number;
+    maxLines?: number;
+    maxLineLength?: number;
+    numbered?: boolean;
+}
+export declare function compileSearchMatcher(query: string, isRegex?: boolean, caseSensitive?: boolean): (content: string) => boolean;
+export declare function matchesFilePattern(fileName: string, relPath: string, pattern: string, pathPattern?: string, isRegex?: boolean): boolean;
+export declare function nativeDeleteFile(filePath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeSafeDelete(rawPath: string | undefined, options: {
+    path?: string;
+    file?: string;
+    target?: string;
+    check_references?: boolean;
+    force?: boolean;
+    max_results?: number;
+    timeout_ms?: number;
+    timeout?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeMoveFile(fromPath: string, toPath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeEnsureDir(dirPath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeListDir(dirPath: string | undefined, maxEntries: number | undefined, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number, timeoutOpts?: {
+    timeout_ms?: number;
+    timeout?: number;
+}, extraOpts?: {
+    depth?: number;
+    max_depth?: number;
+    recursive?: boolean;
+    type?: "all" | "file" | "directory" | string;
+}): Promise<SaVmRunResult>;
+export declare function nativeGrepSearch(query: string, searchDir: string | undefined, pattern: string | undefined, maxMatches: number | undefined, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number, timeoutOpts?: {
+    timeout_ms?: number;
+    timeout?: number;
+}, extraOpts?: {
+    is_regex?: boolean;
+    regex?: boolean;
+    case_sensitive?: boolean;
+    path_pattern?: string;
+}): Promise<SaVmRunResult>;
+export declare function nativeGrepSearchAsync(query: string | string[], searchDir: string | undefined, pattern: string | undefined, maxMatches: number | undefined, concurrency: number | undefined, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number, timeoutOpts?: {
+    timeout_ms?: number;
+    timeout?: number;
+}, extraOpts?: {
+    is_regex?: boolean;
+    regex?: boolean;
+    case_sensitive?: boolean;
+    path_pattern?: string;
+}): Promise<SaVmRunResult>;
+export declare function nativeFindReferences(rawSymbol: string | undefined, options: {
+    detail?: boolean;
+    candidate_files?: string[];
+    files?: string[];
+    max_results?: number;
+    limit?: number;
+    max_tokens?: number;
+    dir?: string;
+    pattern?: string;
+    exclude_comments?: boolean;
+    include_declarations?: boolean;
+    timeout_ms?: number;
+    timeout?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeFindImplementations(rawSymbol: string | undefined, options: {
+    symbol?: string;
+    target?: string;
+    name?: string;
+    query?: string;
+    content?: string;
+    dir?: string;
+    pattern?: string;
+    candidate_files?: string[];
+    files?: string[];
+    include_body?: boolean;
+    detail?: boolean;
+    max_results?: number;
+    limit?: number;
+    max_tokens?: number;
+    timeout_ms?: number;
+    timeout?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeFileOutline(rawPath: string, options: {
+    detail?: boolean;
+    max_tokens?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeRenameSymbol(rawSymbol: string, rawNewName: string, options: {
+    path?: string;
+    dir?: string;
+    candidate_files?: string[];
+    files?: string[];
+    dry_run?: boolean;
+    detail?: boolean;
+    timeout_ms?: number;
+    timeout?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeMoveFileWithImports(rawFrom: string, rawTo: string, options: {
+    dry_run?: boolean;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeFindDefinition(rawSymbol: string, rawPath: string | undefined, options: {
+    include_body?: boolean;
+    max_lines?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeExtractToFile(rawSource: string, rawTarget: string, startLine: number | undefined, endLine: number | undefined, options: {
+    symbols?: string[] | string;
+    component_name?: string;
+    dry_run?: boolean;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeAddImport(rawPath: string, options: {
+    statement?: string;
+    symbol?: string;
+    module?: string;
+    is_type?: boolean;
+    dry_run?: boolean;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeGetDiagnostics(rawPath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeWorkspaceDiagnostics(rawDir: string | undefined, options: {
+    pattern?: string;
+    max_files?: number;
+    max_errors?: number;
+    max_tokens?: number;
+    detail?: boolean;
+    timeout_ms?: number;
+    timeout?: number;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeOrganizeImports(rawPath: string, options: {
+    sort?: boolean;
+    remove_unused?: boolean;
+    merge_duplicates?: boolean;
+    dry_run?: boolean;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeAnalyzeScope(rawPath: string, startLine: number | undefined, endLine: number | undefined, options: {
+    component_name?: string;
+}, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeApplyPatch(patchText: string, policy: SaVmPolicyConfig | undefined, cwd: string, additionalRoots: string[] | undefined, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeCopyFile(fromPath: string, toPath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeFileInfo(filePath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeCountLines(filePath: string, policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function nativeHttpFetch(url: string, method?: string, headers?: Record<string, string>, body?: string, policy?: SaVmPolicyConfig, cwd?: string, startedAt?: number, timeoutOpts?: {
+    timeout_ms?: number;
+    timeout?: number;
+}): Promise<SaVmRunResult>;
+export declare const ALLOWED_HOST_SHORT_NAMES: Set<string>;
+export declare const FORBIDDEN_HOST_SUBCOMMANDS: Set<string>;
+export declare const ALLOWED_HOST_ENV_KEYS: Set<string>;
+interface RunHostCacheEntry {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    mtimeMs: number;
+}
+export declare const runHostHelpCache: Map<string, RunHostCacheEntry>;
+export declare let runHostProcessSpawnCount: number;
+export declare let runHostCacheHitCount: number;
+export declare function resetRunHostCacheForTest(): void;
+export declare function resolveHostExecutable(exe: string, cwd: string): {
+    ok: true;
+    path: string;
+    isAllowlist: boolean;
+} | {
+    ok: false;
+    reason: string;
+    kind: "capability_denied" | "unavailable";
+};
+export declare function sliceAndFilterOutput(rawStdout: string, options: {
+    filter?: string;
+    head_lines?: number;
+    tail_lines?: number;
+    max_tokens?: number;
+    max_token?: number;
+}): string;
+export declare function nativeRunHost(rawInput: SaVmRunInput, _policy: SaVmPolicyConfig | undefined, cwd: string, startedAt: number): Promise<SaVmRunResult>;
+export declare function detectBatchDependencyViolation(tasks: SaVmRunInput[], cwd: string): {
+    conflictedPath: string;
+    writeTaskIndex: number;
+    readTaskIndex: number;
+} | null;
+export declare function runSaVmTool(rawInput: SaVmRunInput, policyOverrideOrOptions?: SaVmPolicyConfig | {
+    cwd?: string;
+    policy?: SaVmPolicyConfig;
+    additionalRoots?: string[];
+}, cwdOverride?: string): Promise<SaVmRunResult>;
+export declare class SaVmInputError extends Error {
+}
+export declare class SaVmCapabilityDeniedError extends Error {
+    readonly exitCode = 228;
+}
+export declare function killProcessTree(pid: number | undefined): void;
+export declare function resolvePythonBinary(): string;
+export type SaVmExecutableLanguage = "js" | "py";
+export declare function normalizeSaVmRunInput(rawInput: SaVmRunInput): {
+    source: string;
+    language: SaVmExecutableLanguage;
+    args: string[];
+    cwd: string;
+    limits: typeof DEFAULT_LIMITS;
+    policy: Record<string, unknown>;
+};
+export declare function resultKind(exitCode: number | null, stderr?: string): SaVmRunResult["kind"];
+export declare function isSaVmBlockedToolName(value: unknown): boolean;