@epoch-agent/core 0.11.0 → 0.12.0

package/README.md

@@ -14,34 +14,34 @@ Agent 引擎。ReAct 循环、Provider 路由、权限、记忆、技能、Hook
 
 ## 模块
 
-| 目录          | 职责                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `agent/`      | ReAct 循环（`loop.ts`）、工具执行、实时输出泵、prompt 组装、Nudge / Stall 检测、消息编解码、plan 模式状态、**运行前 token 估算**（`run-estimate.ts`）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `provider/`   | 多 provider 路由 + 降级、模型元数据探测、AI SDK 适配、**token 估算**（`tokenizer.ts`，全仓唯一口径）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `config/`     | 10 层配置解析链 + 迁移 + 设置来源分层（`sources.ts`）+ **「为什么是这个值」**（`provenance.ts`，每个键赢在哪一层）+ **「我现在写、写完谁说了算」**（`write.ts`）+ JSON Schema 导出。`schema.ts` 是配置形状的**唯一**真源                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `session/`    | SQLite 会话持久化 + FTS5 搜索，落盘完整 `EpochMessage`（工具调用 / artifact 引用）+ 逐轮真实用量（`recordUsage`）+ 已批准的计划 + **那一次工作区决定**（v7 两列，见下）。开给模型那一侧的检索 / 前后文窗口 / 血缘在 `query.ts` + `trace.ts`，开给人那一侧的 `@:` 引用（候选 / 解析 / 当前面）在 `reference.ts`，「哪些会话我能读」**两边共用** `authorization.ts` 那一份，索引体检在 `fts-health.ts`（`epoch doctor` 用）                                                                                                                                                                                                                                                                                                                    |
-| `memory/`     | 文件 + SQLite 双存储 + 后台审查（`reviewer.ts`）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `skill/`      | `SKILL.md` 文件系统 + 自动学习（`learner.ts`）。**读正文有两条路，别混**：`view()` 是模型那条（会 `matchCount++`，而那个数喂着有效性评分、也就是模型下次看得见哪些技能），`body()` 是「人点开看一眼」那条（**一个字都不动统计**）—— 一次浏览不是一次命中，判据写在 `SkillSystem.body` 上。**写口只有两个导出**（`previewSkillImport` / `importSkills`，方案 42 §六）：从本机目录导入技能，收路径不收字节，staging 那一层刻意不导出 —— 判据在 `skill/import.ts` 文件头                                                                                                                                                                                                                                                                        |
-| `hook/`       | Hook 匹配与执行、命令执行；`sources.ts` 定「读哪几份配置」（两级 `hooks.json` + **Claude Code 的三份 `settings.json`**，方案 50），`config-loader.ts` 只管解析我们自己的格式，`claude-settings.ts` / `claude-matcher.ts` 只管翻 Claude Code 的方言                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `permission/` | 5 级权限（`default` / `acceptEdits` / `plan` / `auto` / `bypass`）+ 审批缓存（`approval-cache.ts`：记弹窗答案；**逐条撤销**走 `revoke(id)` / `PermissionManager.revokeApproval()`，2026-08-27 补 —— 在那之前一次点错的「拒绝」只在内存里、永不过期，除了重启进程收不回来）+ 无头策略 + 紧凑规则 `Tool(content)` + **审计流水**（`audit.ts`：权限层每一次裁决的定长流水，`getAudit()` 取，**只在进程内、永不进遥测**）                                                                                                                                                                                                                                                                                                                        |
-| `workspace/`  | 这次会话的地盘：主根 + `--add-dir` 的额外根、目录体检、「哪些指令文件没被加载」，外加「已知工作区」最近使用清单（`~/.epoch/workspaces.json`，**本机文件不是服务**）。判据本身在 infra 的 `isInWorkspace`，这里是壳                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `compliance/` | **内容合规闸门**：本地词表 + 正则。**缺省只拦用户输入**（送进模型之前，命中 block 时请求不发也不计费）；模型输出那一侧同一套东西都在（`agent/turn.ts` 那个唯一出口 + 句子级 holdback），一行配置就能开，但缺省关 —— 它是误伤和流式延迟的大头，判据在 `settings.ts`。变体归一化（全角 / 零宽 / 分隔符 / leet / 繁简，**带 offset 映射**因为 `mask` 要打回原文）、Aho-Corasick 多模式匹配、豁免表（治「`台独` 命中『平**台独**立部署』」那一类）、句子级 holdback 的流式 guard。**缺省跳过代码**（围栏块与行内 code）—— 这是个写代码的 agent，那一格决定这层能不能用。类别 / 动作两个联合住 [protocol](../protocol)（它们同时是配置键名、词库文件名、遥测属性值）。**内置词表是种子不是生产词库**，正式部署挂 `~/.epoch/compliance/<类别>.txt` |
-| `policy/`     | 策略文件加载与校验；`sources.ts` 定「扫哪几个 policies 目录」                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `context/`    | 上下文压缩（工具结果裁剪是**摘要之前的独立一步**，头中尾保留，裁完够了就不调模型；2026-08-16 起认 `compression.*` 两个配置项，见下）、项目发现、指令文件与它的 `@import` 展开 + 项目外放行闸门、artifact 闸门与清理、图片 token 估算、`@` 提及的候选清单与解析（**文件和 `@:` 会话共享同一本 200KB 的账**，方案 53）                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `sandbox/`    | `CodeSandbox`（`code_exec` 的执行器）+ 隔离能力的**对外说法**：`describeIsolation()` 那句中文、以及「哪些工具走沙箱」两份清单。**机制那一半 2026-08-16 搬去了 [infra](../infra) 的 `sandbox/`**（消费者不止 core 一个了，`plugin-terminal` 够不着 core）；既有 import 路径靠再导出保住                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `delegate/`   | 子 agent 任务委托（`delegate_task` 的后端）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `agent-role/` | agent 角色定义、注册与工具作用域收窄（子 agent 和**顶层会话**两条来路走同一个 `roleScopedProvider`）；`createRoleScope` 把它包成**可变槽** —— 身份行和工具表从同一个变量读，好让「这一条消息换个专家」有地方落。⚠️ 2026-08-18 起这里多了一条**写**的路（`create.ts`，全仓第一条建角色的路）：它和读口共用同一份 frontmatter schema、同一个解析器，写完**先读回来验一遍**再落盘。那道「什么样的客户端才准写」的闸门**不在这儿**，在 `@epoch-agent/server`（判据见那个文件头第三节）                                                                                                                                                                                                                                                           |
-| `extensions/` | 项目级扩展：自定义斜杠命令的发现 / 加载 / 插值 / 按轮次收窄工具表；三种扩展物共用的 frontmatter 解析                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `plugin/`     | 插件：清单校验、四种来源的安装、安装记录（带跨进程锁）、市场、加载成「六类扩展物的来源」（`PLUGIN_LAYOUT` 那七个约定子路径）。见 [docs/PLUGINS.md](../../docs/PLUGINS.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `tools/`      | `ToolRegistry` + `builtin/` 下那批内置工具（`todo` / `memory` / `goal` / `code_exec` / `run_code` / `delegate_task` / `ask_user_question` / `skill_view` / **技能写入那四个** / `tool_search` / `schedule_draft` / plan 模式那两个 / 会话检索那**四个**）。**清单与边界的唯一真源是 [docs/TOOLS.md](../../docs/TOOLS.md)** —— 这里不再抄一个会过期的条数（原来写的「13 个」漏了 `tool_search`）                                                                                                                                                                                                                                                                                                                                              |
-| `code-mode/`  | `run_code` 的 worker 运行时（方案 51）：线程入口、宿主 ↔ worker 的工具绑定协议、四道上限、只读闸门。⚠️ **和 `sandbox/` 是两回事，隔离模型正好相反** —— 那一个的边界是沙箱，这一个的边界是权限管线（子调用通道本身在 `agent/tool-executor.ts`）。**默认关**，`tools.mode: both` 才注册那个工具                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `checkpoint/` | 写类工具动手前的文件快照 + 回退（两阶段原子、不覆盖手工改动）。见 [docs/CHECKPOINTS.md](../../docs/CHECKPOINTS.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `tracker/`    | 待办追踪的 SQLite 表                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `schedule/`   | 定时任务（方案 45）：store / 单实例锁 / 触发器算术 / 保存期校验 / 录像与留存 / 注册器 / `doctor`，外加 `os/` 下的两个 OS 后端（`schtasks` / `launchd`）和 `draft.ts`（对话里那份草稿的解析与判定，**不是写入路**）。**不含执行器** —— 跑一次要 `buildRuntime()`，那在 [runtime](../runtime) 的 `fireSchedule()`                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `cost/`       | 计价表、预算守卫、花费状态。缓存命中单独计价，口径见 `pricing.ts` 文件头                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `compat/`     | 竞品词汇表。今天只有 `claude-tool-names.ts`（Claude Code 工具名 ↔ 我们的，双向从同一份数据推出来）—— 放在 `hook/` 之外是因为方案 50 §八 点名的第二个消费者（兼容它的权限规则）不住在 hook 里                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `trust/`      | 工作区信任判定与闸门                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `telemetry/`  | span 属性脱敏                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| 目录          | 职责                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `agent/`      | ReAct 循环（`loop.ts`）、工具执行、实时输出泵、prompt 组装、Nudge / Stall 检测、消息编解码、plan 模式状态、**运行前 token 估算**（`run-estimate.ts`）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `provider/`   | 多 provider 路由 + 降级、模型元数据探测、AI SDK 适配、**token 估算**（`tokenizer.ts`，全仓唯一口径）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `config/`     | 10 层配置解析链 + 迁移 + 设置来源分层（`sources.ts`）+ **「为什么是这个值」**（`provenance.ts`，每个键赢在哪一层）+ **「我现在写、写完谁说了算」**（`write.ts`）+ JSON Schema 导出。`schema.ts` 是配置形状的**唯一**真源                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `session/`    | SQLite 会话持久化 + FTS5 搜索，落盘完整 `EpochMessage`（工具调用 / artifact 引用）+ 逐轮真实用量（`recordUsage`）+ 已批准的计划 + **那一次工作区决定**（v7 两列，见下）。开给模型那一侧的检索 / 前后文窗口 / 血缘在 `query.ts` + `trace.ts`，开给人那一侧的 `@:` 引用（候选 / 解析 / 当前面）在 `reference.ts`，「哪些会话我能读」**两边共用** `authorization.ts` 那一份，索引体检在 `fts-health.ts`（`epoch doctor` 用）                                                                                                                                                                                                                                                                                                                                         |
+| `memory/`     | 文件 + SQLite 双存储 + 后台审查（`reviewer.ts`）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `skill/`      | `SKILL.md` 文件系统 + 自动学习（`learner.ts`）。**读正文有两条路，别混**：`view()` 是模型那条（会 `matchCount++`，而那个数喂着有效性评分、也就是模型下次看得见哪些技能），`body()` 是「人点开看一眼」那条（**一个字都不动统计**）—— 一次浏览不是一次命中，判据写在 `SkillSystem.body` 上。**写口只有两个导出**（`previewSkillImport` / `importSkills`，方案 42 §六）：从本机目录导入技能，收路径不收字节，staging 那一层刻意不导出 —— 判据在 `skill/import.ts` 文件头                                                                                                                                                                                                                                                                                             |
+| `hook/`       | Hook 匹配与执行、命令执行；`sources.ts` 定「读哪几份配置」（两级 `hooks.json` + **Claude Code 的三份 `settings.json`**，方案 50），`config-loader.ts` 只管解析我们自己的格式，`claude-settings.ts` / `claude-matcher.ts` 只管翻 Claude Code 的方言                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `permission/` | 5 级权限（`default` / `acceptEdits` / `plan` / `auto` / `bypass`）+ 审批缓存（`approval-cache.ts`：记弹窗答案；**逐条撤销**走 `revoke(id)` / `PermissionManager.revokeApproval()`，2026-08-27 补 —— 在那之前一次点错的「拒绝」只在内存里、永不过期，除了重启进程收不回来）+ 无头策略 + 紧凑规则 `Tool(content)` + **审计流水**（`audit.ts`：权限层每一次裁决的定长流水，`getAudit()` 取，**只在进程内、永不进遥测**）                                                                                                                                                                                                                                                                                                                                             |
+| `workspace/`  | 这次会话的地盘：主根 + `--add-dir` 的额外根、目录体检、「哪些指令文件没被加载」，外加「已知工作区」最近使用清单（`~/.epoch/workspaces.json`，**本机文件不是服务**）。判据本身在 infra 的 `isInWorkspace`，这里是壳                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `compliance/` | **内容合规闸门**：本地词表 + 正则。**缺省只拦用户输入**（送进模型之前，命中 block 时请求不发也不计费）；模型输出那一侧同一套东西都在（`agent/turn.ts` 那个唯一出口 + 句子级 holdback），一行配置就能开，但缺省关 —— 它是误伤和流式延迟的大头，判据在 `settings.ts`。变体归一化（全角 / 零宽 / 分隔符 / leet / 繁简，**带 offset 映射**因为 `mask` 要打回原文）、Aho-Corasick 多模式匹配、豁免表（治「`台独` 命中『平**台独**立部署』」那一类）、句子级 holdback 的流式 guard。**缺省跳过代码**（围栏块与行内 code）—— 这是个写代码的 agent，那一格决定这层能不能用。类别 / 动作两个联合住 [protocol](../protocol)（它们同时是配置键名、词库文件名、遥测属性值）。**内置词表是种子不是生产词库**，正式部署挂 `~/.epoch/compliance/<类别>.txt`                      |
+| `policy/`     | 策略文件加载与校验；`sources.ts` 定「扫哪几个 policies 目录」                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `context/`    | 上下文压缩（工具结果裁剪是**摘要之前的独立一步**，头中尾保留，裁完够了就不调模型；2026-08-16 起认 `compression.*` 两个配置项，见下）、项目发现、指令文件与它的 `@import` 展开 + 项目外放行闸门、artifact 闸门与清理、图片 token 估算、`@` 提及的候选清单与解析（**文件和 `@:` 会话共享同一本 200KB 的账**，方案 53）                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `sandbox/`    | `CodeSandbox`（`code_exec` 的执行器）+ 隔离能力的**对外说法**：`describeIsolation()` 那句中文、以及「哪些工具走沙箱」两份清单。**机制那一半 2026-08-16 搬去了 [infra](../infra) 的 `sandbox/`**（消费者不止 core 一个了，`plugin-terminal` 够不着 core）；既有 import 路径靠再导出保住                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `delegate/`   | 子 agent 任务委托（`delegate_task` 的后端）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `agent-role/` | agent 角色定义、注册与工具作用域收窄（子 agent 和**顶层会话**两条来路走同一个 `roleScopedProvider`）；`createRoleScope` 把它包成**可变槽** —— 身份行和工具表从同一个变量读，好让「这一条消息换个专家」有地方落。⚠️ 2026-08-18 起这里多了一条**写**的路（`create.ts`，全仓第一条建角色的路）：它和读口共用同一份 frontmatter schema、同一个解析器，写完**先读回来验一遍**再落盘。⚠️ 2026-09-16 又多了它的反面（`remove.ts`，「能加就得能删」）：**落点靠读口解析出来的 `name` 找，不是拿名字拼路径** —— frontmatter 的 `name` 优先于文件名，拼路径要么删不到一份界面上明明列着的身份，要么删掉另一个，而两种错法都不报错；同名两份时**一个字节都不删**。那道「什么样的客户端才准写」的闸门**两条都不在这儿**，在 `@epoch-agent/server`（判据见那两个文件头第三节） |
+| `extensions/` | 项目级扩展：自定义斜杠命令的发现 / 加载 / 插值 / 按轮次收窄工具表；三种扩展物共用的 frontmatter 解析                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `plugin/`     | 插件：清单校验、四种来源的安装、安装记录（带跨进程锁）、市场、加载成「六类扩展物的来源」（`PLUGIN_LAYOUT` 那七个约定子路径）。见 [docs/PLUGINS.md](../../docs/PLUGINS.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `tools/`      | `ToolRegistry` + `builtin/` 下那批内置工具（`todo` / `memory` / `goal` / `code_exec` / `run_code` / `delegate_task` / `ask_user_question` / `skill_view` / **技能写入那四个** / `tool_search` / `schedule_draft` / plan 模式那两个 / 会话检索那**四个**）。**清单与边界的唯一真源是 [docs/TOOLS.md](../../docs/TOOLS.md)** —— 这里不再抄一个会过期的条数（原来写的「13 个」漏了 `tool_search`）                                                                                                                                                                                                                                                                                                                                                                   |
+| `code-mode/`  | `run_code` 的 worker 运行时（方案 51）：线程入口、宿主 ↔ worker 的工具绑定协议、四道上限、只读闸门。⚠️ **和 `sandbox/` 是两回事，隔离模型正好相反** —— 那一个的边界是沙箱，这一个的边界是权限管线（子调用通道本身在 `agent/tool-executor.ts`）。**默认关**，`tools.mode: both` 才注册那个工具                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `checkpoint/` | 写类工具动手前的文件快照 + 回退（两阶段原子、不覆盖手工改动）。见 [docs/CHECKPOINTS.md](../../docs/CHECKPOINTS.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `tracker/`    | 待办追踪的 SQLite 表                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `schedule/`   | 定时任务（方案 45）：store / 单实例锁 / 触发器算术 / 保存期校验 / 录像与留存 / 注册器 / `doctor`，外加 `os/` 下的两个 OS 后端（`schtasks` / `launchd`）和 `draft.ts`（对话里那份草稿的解析与判定，**不是写入路**）。**不含执行器** —— 跑一次要 `buildRuntime()`，那在 [runtime](../runtime) 的 `fireSchedule()`                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `cost/`       | 计价表、预算守卫、花费状态。缓存命中单独计价，口径见 `pricing.ts` 文件头                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `compat/`     | 竞品词汇表。今天只有 `claude-tool-names.ts`（Claude Code 工具名 ↔ 我们的，双向从同一份数据推出来）—— 放在 `hook/` 之外是因为方案 50 §八 点名的第二个消费者（兼容它的权限规则）不住在 hook 里                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `trust/`      | 工作区信任判定与闸门                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `telemetry/`  | span 属性脱敏                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 
 另外 10 个工具在四个 plugin 里，不在这里：见
 [plugin-file](../plugins/plugin-file) / [plugin-terminal](../plugins/plugin-terminal) /

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, AgentRole, PermissionLevel, PermissionManager as PermissionManager$1, PlanProposal, ApprovalRequest, ApprovalReply, ScheduleDefinition, DiagnosticSink, AgentRoleSource, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, BackgroundTaskInfo, ContextBreakdown, EpochMessage, AgentRoleScope, Lang, WireMcpConnector, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, ProviderType, JsonSchema, ModelSelection, EpochToolCall, Telemetry, HookManager as HookManager$1, EpochUserContent, EpochContentPart, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
+import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, AgentRole, PermissionLevel, PermissionManager as PermissionManager$1, PlanProposal, ApprovalRequest, ApprovalReply, ScheduleDefinition, DiagnosticSink, AgentRoleSource, Lang, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, BackgroundTaskInfo, ContextBreakdown, EpochMessage, AgentRoleScope, WireMcpConnector, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, ProviderType, JsonSchema, ModelSelection, EpochToolCall, Telemetry, HookManager as HookManager$1, EpochUserContent, EpochContentPart, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
 export { API_KEY_ENV_VARS, AgentEvent, AgentEventOf, AgentEventType, ApprovalAnswer, ApprovalOutcome, ApprovalReply, ApprovalRequest, BudgetBreach, COMPLIANCE_ACTIONS, COMPLIANCE_CATEGORIES, ComplianceAction, ComplianceCategory, DecidedTrustLevel, EpochConfig, EpochHook, EpochPlugin, EpochSkill, EpochTool, FinishReason, HookContext, HookEvent, HookHandler, HookRegistration, HookType, HookManager as IHookManager, PermissionManager as IPermissionManager, TrustManager as ITrustManager, JsonSchema, MAX_ATTACH_BYTES, MAX_ATTACH_FILES, MAX_ATTACH_TOTAL_BYTES, MAX_SESSION_ATTACH_BYTES, MAX_SESSION_REFS, OPERATION_TYPES, Operation, OperationType, PERMISSION_LEVELS, PLAN_OUTCOMES, PROVIDER_INFOS, PROVIDER_TYPES, PermissionDecision, PermissionLevel, PlanApprovalOutcome, PlanProposal, PluginContext, ProviderInfo, ProviderType, TokenUsage, ToolContext, ToolDefinition, ToolExposure, ToolResult, TrustExecGrant, TrustGrant, TrustLevel, TrustRecord, TrustScope, TrustTier, VerifyResult, apiKeyEnvVar, extractAllMentions, extractMentions, extractSessionMentions, getProviderInfo, isOperationType, isPermissionLevel, isPlanOutcome, isProviderType, normalizeApproval } from '@epoch-agent/protocol';
 import { IsolationBackend, SqliteDatabase, ParseIssue, ShellFlavor } from '@epoch-agent/infra';
 export { BubblewrapOptions, DangerMatch, IS_WINDOWS, IsolationBackend, IsolationOptions, LogLevel, SeatbeltOptions, WINDOWS_HIDE_FLAGS, buildBwrapArgs, buildProfile, checkDangerousCommand, checkObfuscation, createLogger, detectBackend, getDefaultShell, getPythonCommand, isInWorkspace, isReadOnlyCommand, isolate, maskApiKey, probeBubblewrap, probeSeatbelt, complianceDir as resolveComplianceDir, policiesDir as resolvePoliciesDir, setLogLevel } from '@epoch-agent/infra';
@@ -3730,6 +3730,110 @@ interface RoleCreateOptions {
  */
 declare function createRoleFile(input: RoleCreateInput, opts: RoleCreateOptions): RoleCreateOutcome;
 
+/**
+ * 删掉一份用户级角色定义文件 —— [create.ts](./create.ts) 的反向那一条。
+ *
+ * ```
+ * removeRoleFile('reviewer', {dir})
+ *   →  ~/.epoch/agents/<那一份>.md 没了   （或者一句「为什么一个字节都没删」）
+ * ```
+ *
+ * 起因和技能那条逐字相同：**能加就得能删**。能力页身份那一栏 2026-08-18 长出了
+ * 「新建」，而拿掉一个建错的身份得让用户自己去 `~/.epoch/agents/` 里翻目录 ——
+ * 而那一份里的 `description` 是**无条件进每一轮** `delegate_task` 工具描述的
+ * （判据在 protocol 的 `wire-agent-role.ts` 文件头第一节）。
+ *
+ * ## 一、⚠️ 落点靠**读口解析出来的 `name`** 找，不是 `join(dir, name + '.md')`
+ *
+ * 这是这一层唯一守得住、也唯一会说谎的那一道。
+ *
+ * [loader.ts](./loader.ts) 里那行逐字写着「没写 name 就用文件名（`explore.md` →
+ * `explore`）」—— **反过来说，写了 `name` 的那一份，文件叫什么都行**。
+ * `my-helper.md` 里写一句 `name: reviewer`，界面上那一行就叫 `reviewer`，
+ * 而盘上没有任何一个 `reviewer.md`。
+ *
+ * 于是按名字拼路径有两种错法，**两种都不会报错**：
+ *
+ * | 盘上 | 拼出来的 `reviewer.md` | 结果 |
+ * | ---- | ---------------------- | ---- |
+ * | 只有 `my-helper.md`（`name: reviewer`） | 不存在 | 删不掉一份界面上明明列着的身份 |
+ * | 还有一个 `reviewer.md`（`name: 别的`）  | 存在   | **删掉了另一个身份**，而屏幕上说「已删除 reviewer」 |
+ *
+ * 所以这里扫目录 → 逐份走**读口自己那份解析器**（`parseRoleDefinition`，
+ * 不碰 fs，`create.ts` 落盘前用的也是它）→ 按**解析出来的 name** 匹配。
+ * 精神同 `create.ts` 第二节那条「写下去的一定读得回来」：**不猜，问读口**。
+ *
+ * ## 二、匹配到两份就一个字节都不删
+ *
+ * 同一个目录里两份 md 都写着 `name: reviewer` 是合法的（loader 不拦，
+ * 后读到的那份赢）。这时候「删掉 reviewer」没有唯一答案：
+ *
+ * - 删生效的那一份 → 另一份浮上来，界面上那一行**还在**，看着像没删掉；
+ * - 两份都删 → 删掉了一份用户没提过的文件。
+ *
+ * 所以报 `ambiguous` 并把那几条路径列出来，让用户自己去目录里处理。
+ * 这一档**极罕见**，但它的两种错法都是静默的，而「不动」是唯一可恢复的那一支。
+ *
+ * ## 三、⚠️ 「这个名字是不是用户级的」不在这一层判
+ *
+ * 那要查**合并之后那张表**（内置 / 插件 / 宿主 / 项目四层这一层都够不着），
+ * 落点在 `runtime/src/role-write.ts`。判据同 `create.ts` 第三节那条撞名：
+ * 谁知道答案谁回答，不知道的那一层不许猜一个。
+ *
+ * 这一层守的是另外两样，**每一样都只有它守得住**：落点是解析出来的那一份、
+ * 以及落点唯一。
+ */
+
+/**
+ * 一次删除为什么没成。
+ *
+ * - `not-found` —— 这个目录里没有哪一份定义着这个名字。**它和「界面上那一行
+ *   是别的层来的」不是同一件事**，后者由调用方先拦（见文件头第三节）；
+ * - `ambiguous` —— 两份以上都叫这个名字，一个字节都没删（文件头第二节）；
+ * - `failed` —— 真的删不动（权限 / 只读盘）。分出来是因为下一步不同：
+ *   前两档改的是「删哪一个」，这一档得去那个目录那儿看一眼。
+ */
+type RoleRemoveFailure = 'not-found' | 'ambiguous' | 'failed';
+/**
+ * 删掉之后的结局。
+ *
+ * ⚠️ `path` 是**刚被销毁的那一份**，不是拿名字拼出来的 —— 不可撤销的动作，
+ * 回执得说得出销毁的是盘上哪一处（判据同 `SkillSystem.delete` 为什么改成回
+ * 一个 string）。而在这条路上它还多一层意思：文件名可以和身份名不一样，
+ * 用户看到的那条路径是他**唯一**能核对「我删的是不是那一份」的东西。
+ */
+type RoleRemoveOutcome = {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    reason: RoleRemoveFailure;
+    detail: string;
+};
+interface RoleRemoveOptions {
+    /**
+     * 在哪个目录里找。**调用方给，这一层不去算** —— 判据逐字同
+     * `RoleCreateOptions.dir`：`EPOCH_HOME` / profile 两档下它不是 `~/.epoch/agents`。
+     */
+    dir: string;
+    /**
+     * 三句 `detail` 用哪个语言说（方案 58）。不给 = 进程语言。
+     *
+     * ⚠️ **必须能从网线那一侧递进来**：这三句（找不到 / 两份都叫这个 / 删不动）
+     * 全在这一层渲染，而它们会原样上屏。不透这一格的话，英文界面上按一次删除
+     * 拿到的是一句中文 —— 这条病 2026-08-18 在导入那一屏上实测见过一次。
+     */
+    lang?: Lang;
+}
+/**
+ * 按身份名删掉那一份定义文件。
+ *
+ * 目录不存在 = 这台机器上一个用户级身份都没有，走 `not-found` 那一支 ——
+ * 和「目录在、里头没有这一份」是同一句话，因为用户的下一步一样
+ * （判据同 `loadRoleDir` 里「目录不存在不是错误」那一条）。
+ */
+declare function removeRoleFile(name: string, opts: RoleRemoveOptions): RoleRemoveOutcome;
+
 /**
  * 角色作用域 —— 把一个角色收窄成它自己的 `ToolProvider`。
  *
@@ -8685,6 +8789,18 @@ interface AgentConfig {
     workDir?: string;
     /** 模型上下文窗口（用于压缩判定）。默认 128k。 */
     contextLength?: number;
+    /**
+     * 单次模型请求的输出上限，原样递给 provider 的 `maxOutputTokens`。
+     *
+     * **缺省 = 整格不发**，由各家服务端自己的默认值兜底 —— 行为与这一格加进来
+     * 之前逐字节相同。判据全文（以及「为什么不默认套用能力表里那个数」）在
+     * `config/schema.ts` 的同名字段上。
+     *
+     * ⚠️ 别和 `budget.maxTokens` 弄混：那个是**整个会话**的成本闸门
+     * （`cost/budget-guard.ts`），这个是**单次请求**能生成多长。两者量纲不同，
+     * 而它们同名的那半个词已经让人查错过一次方向。
+     */
+    maxOutputTokens?: number;
     /**
      * 预先算好的项目上下文（含工作区信任判定和已加载的指令文件）。
      *
@@ -9101,6 +9217,47 @@ interface RunInput {
      * 伪造的 0；代价是 DB 里的数字口径是「至少这么多」，见 `SessionMeta` 的说明。
      */
     onTurnUsage?: (usage: TokenUsage) => void;
+    /**
+     * 跑到一半时用户插进来的话从哪儿取（2026-09-16）。
+     *
+     * 不给就是今天的行为：这一轮跑完才轮到下一条消息。
+     */
+    steer?: SteerSource;
+}
+/**
+ * 「正在跑的这一轮里，用户又说话了吗」——**由宿主实现，引擎只来拉**。
+ *
+ * ## 为什么是回调而不是让 core 自己持有队列
+ *
+ * 队列的主人是宿主，而且**每个宿主的队列规矩都不一样**：`SessionHub` 的队列
+ * 有容量上限、有「所有标签页都断了就丢掉」那条规矩（判据在它的 `drainQueue()`
+ * 上）；TUI 的 `queueRef` 两条都没有。把队列搬进 core 就等于把这些规矩也搬进来，
+ * 而 core 够不着「还有没有人在场」这种问题。
+ *
+ * 分层上也只有这一条路走得通：`core` 只许依赖 `protocol` + `infra`
+ * （`check:layers` 守着），它**认不得** `SessionHub`。样板是同一个接口上的
+ * {@link RunInput.onTurnUsage} —— 也是「引擎逐轮回头找宿主」的形状。
+ *
+ * ## 两个方法问的不是同一件事
+ *
+ * `pending()` 只问「该不该多跑一圈」，**不取走**；`take()` 才取。分开是因为
+ * 这一轮已经到 `maxTurns` 时，引擎要的是「知道有，但别取」—— 取走了却不跑，
+ * 那句话就凭空蒸发了（宿主的队列里已经没有它，而引擎也没把它拌进上下文）。
+ * 不取走的话它原样留在队列里，由宿主原来那条「一轮跑完接上下一条」的路接走。
+ *
+ * codex 的同一对方法叫 `has_pending_input()` / `get_pending_input()`
+ * （`codex-rs/core/src/session/turn.rs`），分开的理由逐字相同。
+ */
+interface SteerSource {
+    /** 有没有人插了话。**不取走** */
+    pending(): boolean;
+    /**
+     * 取走全部待插入的内容，按用户发送的先后。取完之后 {@link pending} 为 `false`。
+     *
+     * 一次取干净而不是一条一条取：两条消息之间没有模型的回答，分两轮送进去
+     * 等于让模型对着第一句先答一遍 —— 而用户连发两条时想要的是「一起看」。
+     */
+    take(): EpochUserContent[];
 }
 interface RunResult {
     response: string;
@@ -9235,6 +9392,32 @@ declare class AgentLoop {
     private rateOf;
     /** 是否已被中止（内部 + 外部 signal 合并判断） */
     private isAborted;
+    /**
+     * 把用户插进来的话取走，拌进 `messages`，并**逐条**发一帧回执
+     * （2026-09-16，判据全文在 `SteerSource` 和 protocol 的 `steer` 事件上）。
+     *
+     * ## 一条消息一帧，不合并
+     *
+     * 合并成一条的话，模型看到的是一段拼起来的文本、而宿主落盘和上屏的是两条 ——
+     * 两侧从此对不上。这个仓库对这种分叉的态度写在 `AgentSession.reloadHistory`
+     * 上（「屏幕上和模型看到的对不上」）。1:1 就没有这个问题。
+     *
+     * 连着两条 `role:'user'` 是这个文件里**已有**的形状 —— 上面那条任务通知在
+     * 第一轮就会紧跟在用户消息后面。
+     *
+     * ## 事件在 push **之后**发
+     *
+     * 这一帧的含义是「模型下一次请求会看见这句话」（protocol 那条注释的原话）。
+     * 先发后 push 的话，中间任何一次抛出都会让那句承诺变成假话 —— 宿主已经把它
+     * 写进库、画上屏，而它根本没进上下文。
+     *
+     * ## `content` 是文本投影，`parts` 才喂模型
+     *
+     * 同这个文件里用户那条消息的装法：`contentToText()` 出来的那份进 `content`
+     * （压缩器 / 审计 / 落盘只看它），原始部件整个挂 `parts`。**base64 绝不进
+     * `content`** —— 它会一路进 sessions.db。
+     */
+    private drainSteer;
     /**
      * 当前上下文预算的构成（方案 25 §2.5 的 `/context`）。
      *
@@ -11241,6 +11424,7 @@ declare const EpochConfigSchema: z.ZodObject<{
     }>>;
     maxTurns: z.ZodDefault<z.ZodInt>;
     contextLength: z.ZodDefault<z.ZodInt>;
+    maxOutputTokens: z.ZodOptional<z.ZodInt>;
     homeDir: z.ZodDefault<z.ZodString>;
     dbPath: z.ZodDefault<z.ZodString>;
     permission: z.ZodDefault<z.ZodEnum<{
@@ -11674,7 +11858,7 @@ declare function isSettingWriteLayer(value: string): value is SettingWriteLayer;
  * 安全中心指两件事（「新会话从哪一档起」vs「这个会话此刻哪一档」），
  * 而那正是决定 20 ④ 拆开的那个歧义 —— 记住上一次那一档没有把这个歧义请回来。
  */
-declare const SETTING_WRITE_KEYS: readonly ["model", "maxTurns", "models.utility", "fallback.model", "contextLength", "compression.enabled", "compression.threshold", "memory.memoryCharLimit", "memory.userCharLimit", "memory.indexCharLimit", "budget.maxCostUsd", "budget.maxTokens", "budget.warnAtPercent", "budget.onUnknownPricing", "sessions.autoPrune", "sessions.retentionDays", "sessions.vacuumAfterPrune", "permission"];
+declare const SETTING_WRITE_KEYS: readonly ["model", "maxTurns", "models.utility", "fallback.model", "contextLength", "maxOutputTokens", "compression.enabled", "compression.threshold", "memory.memoryCharLimit", "memory.userCharLimit", "memory.indexCharLimit", "budget.maxCostUsd", "budget.maxTokens", "budget.warnAtPercent", "budget.onUnknownPricing", "sessions.autoPrune", "sessions.retentionDays", "sessions.vacuumAfterPrune", "permission"];
 type SettingWriteKey = (typeof SETTING_WRITE_KEYS)[number];
 /** 这个键写得进去吗。名单就是 {@link SETTING_WRITE_KEYS} 本身，别在别处抄一份字面量 */
 declare function isWritableSettingKey(value: string): value is SettingWriteKey;
@@ -13026,6 +13210,20 @@ interface SessionMeta {
      * ⚠️ 它**只许往前走**（写侧一律 `max()`）。见 `SessionDB.insertMessage`。
      */
     updatedAt: Date;
+    /**
+     * 「这一轮开着」的标记 —— 在飞那一轮的**首条消息 id**（会话库 v13，2026-09-16）。
+     *
+     * 轮开始那一刻立起来，收尾时擦掉。所以读到一个非空值只有两种可能：那一轮**此刻
+     * 真在跑**，或者**它没能收尾**（进程被杀 / 崩了 / 机器睡了）。两者由「这个进程
+     * 手上有没有它」区分，而那个问题只有宿主答得出，不是这一层的事。
+     *
+     * ⚠️ 它存在的理由是**没有任何代码来得及跑**的那一档：`kill -9` 之后收尾逻辑
+     * 一行都不执行，所以「中断了」只能在开始那一刻先写下来。判据全文在
+     * `sessions-open-turn-from` 那条迁移上。
+     *
+     * 缺席 = 这段会话没有开着的轮（正常态），以及 v13 之前的所有老库。
+     */
+    openTurnFrom?: number | null;
     endedAt?: Date;
     endReason?: string;
 }
@@ -13214,9 +13412,14 @@ interface SessionManager$1 {
     endSession(id: string, reason?: string): void;
     list(input?: ListSessionsInput): ListSessionsOutput;
     search(input: SearchInput): SearchOutput;
-    appendMessage(sessionId: string, msg: AppendMessageInput): void;
+    /** @returns 这条消息的 DB id（按步增量落盘要它，见实现处） */
+    appendMessage(sessionId: string, msg: AppendMessageInput): number;
     /** 累加一轮模型请求的真实用量（方案 42 PR-0）。口径见 `SessionMeta` 的五个 token 列 */
     recordUsage(sessionId: string, usage: TokenUsage): void;
+    /** 把这一轮的账 / 收尾原因挂到已经写下去的那一行上（按步增量落盘，2026-09-16） */
+    attachTurnFacts(sessionId: string, messageId: number, input: Pick<AppendMessageInput, 'turnFacts' | 'finishReason'>): void;
+    /** 立起 / 擦掉「这一轮开着」的标记。见 `SessionMeta.openTurnFrom` */
+    setOpenTurn(sessionId: string, from: number | null): void;
     markObserved(sessionId: string, messageId: number): void;
     /** 最后一条消息的 id（方案 27：检查点开轮时记的水位线） */
     lastMessageId(sessionId: string): number;
@@ -13425,9 +13628,24 @@ declare class SessionManager implements SessionManager$1 {
     delete(id: string): boolean;
     /** 标记会话结束，记录结束时间和原因 */
     endSession(id: string, reason?: SessionMeta['endReason']): void;
+    /**
+     * @returns 这条消息的 DB id。按步增量落盘（2026-09-16）之后两处要它：
+     *   「在飞那一轮从哪条起」的水位线，以及收尾时把这一轮的账挂到**最后一条
+     *   assistant 行**上（`attachTurnFacts`）。老调用方忽略返回值即可。
+     */
     appendMessage(sessionId: string, msg: AppendMessageInput & {
         tokenCount?: number;
-    }): void;
+    }): number;
+    /**
+     * 把这一轮的账和收尾原因挂到已经写下去的那一行上。口径与「为什么需要一条
+     * UPDATE」全文在 {@link SessionDB.attachTurnFacts} 上，这一层只是转发。
+     */
+    attachTurnFacts(sessionId: string, messageId: number, input: Pick<AppendMessageInput, 'turnFacts' | 'finishReason'>): void;
+    /**
+     * 立起 / 擦掉「这一轮开着」的标记。判据在 {@link SessionMeta.openTurnFrom} 上，
+     * 一句话：**留着的是异常，清掉的才是正常**。
+     */
+    setOpenTurn(sessionId: string, from: number | null): void;
     /**
      * 累加一轮模型请求的真实用量（方案 42 PR-0）。
      *
@@ -14691,6 +14909,21 @@ declare class PermissionManager implements PermissionManager$1 {
      *
      * 走到这儿的 ask 是规则表判的，所以它和 {@link approvalCacheActive} 同一个答案；
      * 底线那条路不经过这里（它的答复一律记得住）。
+     *
+     * ## ⚠️ 2026-09-16 起它**今天没有产出点**了 —— 留着是有理由的
+     *
+     * `false` 那一侧只在 `bypass` 下出现，而那一档的规则 ask 现在整族塌成放行
+     * （{@link ruleAskActive}），于是走不到这里。`bypass` 下唯一还会弹的是底线的
+     * tier-2 危险命令，而那条路**查缓存**（{@link settleUnaskable} 第 3 条），
+     * 它的答复记得住、本来就不经过这个方法。
+     *
+     * 不顺手把 `rememberable` 整条管线拆掉（协议字段 + CLI / TUI / web 三处分支），
+     * 是因为它说的事**没有过时**：「这条判定路径不查缓存，所以那两个出口是空头
+     * 支票」。哪天再长出一条这样的路径（比如某一档只塌一半），它拿来即用；
+     * 而重新发明它的成本是三个宿主各画一遍那两个不该画的出口。
+     *
+     * ⚠️ 所以**别把这个方法删成 `return {}`**：那会让上面那句判据消失，
+     * 下一个人加路径时不会知道这里本来就该问一句。
      */
     private rememberFlag;
     /**
@@ -14743,6 +14976,14 @@ declare class PermissionManager implements PermissionManager$1 {
      * 它们是**配置文件里写下来的策略**，不是弹窗答案，`bypass` 说的是「别问我」
      * 而不是「作废我写下的规则」。
      *
+     * ## ⚠️ 2026-09-16：上一段最后那半句**只对 `deny` 成立**，`ask` 这一族塌了
+     *
+     * 「别问我」和「作废我写下的规则」之间还有第三种东西：一条 `ask` 规则写下来的
+     * 内容**就是「问我」**，所以在这一档下兑现它和作废它是同一件事。塌的判据全文
+     * 在 {@link ruleAskActive} 上（连同「为什么 deny 不跟着塌」）。
+     *
+     * ⚠️ 这不和上一段矛盾，两段管的是同一张表的两个桶：**deny 拦，ask 放**。
+     *
      * ⚠️ **别把这一条推广到别的档位。** `auto` / `default` 下缓存照旧要查：
      * 那几档本来就会弹窗，而缓存存在的全部理由就是别把同一个问题问第二遍。
      *
@@ -14907,7 +15148,8 @@ declare function ruleToString(value: RuleValue): string;
  *
  * 1. **规则轴** —— 三张列表里有没有一条**不带括号**的规则罩着这个工具。
  *    不带括号 = 整个工具、无条件（`RuleValue.content` 的 JSDoc），所以它是
- *    唯一一种「不看参数就能定」的规则；
+ *    唯一一种「不看参数就能定」的规则。
+ *    ⚠️ 这一轴**要先看档位**：`bypass` 下 `ask` 桶整个不算数（{@link effectiveRules}）；
  * 2. **档位轴** —— 没有规则命中时 {@link decideByLevel} 怎么判。五档里只有
  *    `plan` 和 `bypass` 对所有类型都定得死，其余几档有一半要看参数；
  * 3. **沙箱轴** —— `code_exec` 那一格由 OS 级隔离在与不在拍板，不由档位。
@@ -15807,6 +16049,45 @@ declare function pruneRecordings(dir: string, opts?: {
     maxBytes?: number;
     keep?: string;
 }): PruneResult;
+/**
+ * 整个删掉一个任务的录像目录 —— **任务本身被删掉时**调（2026-09-15）。
+ *
+ * ## 和 {@link pruneRecordings} 的分工
+ *
+ * 那一条是**活着的任务**的留存上限（留最近 20 次 / 64 MB），由执行器每轮跑完时调；
+ * 这一条是**任务没了**之后的收尾，一份不留。
+ *
+ * ## 为什么删，而不是「留着」
+ *
+ * 2026-09-15 之前两条删除路径都把它留着，而「留着」在两个意义上都不成立：
+ *
+ * 1. **看不到。** 录像按 run 行上的 `logPath` 找，而 `schedule_runs` 的外键挂着
+ *    `ON DELETE CASCADE`（见 `store.ts` 建表那一段）—— 任务一删那些行跟着没，
+ *    于是磁盘上的文件再也没有任何入口指得到它；
+ * 2. **也不释放。** 上面那条留存上限是**跑完时**按任务目录清的，而删掉的任务
+ *    再也不会跑，那个目录就此原地躺着。`doctor --prune` 也不管它 ——
+ *    那一条只撤 OS 侧的孤儿注册。
+ *
+ * CLI 那侧原来还多一句「录像留在 `<dir>/`，要清自己删」，判据写的是
+ * 「一条被误删的任务至少还能从录像里看出它当时在干什么」。那条判据**站不住**：
+ * 级联已经把状态、花费、轮次、欠条全带走了，剩下的是一堆没有索引、没有任务名的
+ * 裸 ndjson。为那个留一个永远不会被回收的目录，代价大于收益。
+ *
+ * ## ⚠️ 删的是录像目录，**调用方别把工作区传进来**
+ *
+ * `~/.epoch/automation/logs/<id>/`（录像）和 `~/.epoch/automation/<id>/`（工作区）
+ * 只差一层，而后者装的是这条任务**跑出来的东西** —— 报告、改过的文件，那是用户的。
+ * 删任务是「以后别再跑了」，不是「把它干过的活也抹掉」。这一条写在这儿是因为
+ * 两个路径长得太像，而删错那个不可逆。
+ *
+ * ## ⚠️ 失败不抛
+ *
+ * 调用方走到这一步时库里那行**已经删掉了**，任务在任何界面上都不存在了。这时候
+ * 抛出去会让它以为「没删成」而去重试一件已经做完的事。而失败有真实成因：
+ * Windows 上正被执行器写着的那个 `.ndjson` 删不动（EBUSY）—— 那时剩一个孤儿目录，
+ * 代价是磁盘上几十 MB，比一句假的「删除失败」轻。
+ */
+declare function removeRecordings(dir: string): void;
 /**
  * 读回一份录像。坏行**跳过**而不是让整份读不出来 ——
  * NDJSON 按行分帧，跳一行不会失步（同 headless 那条输入路径的处置）。
@@ -19223,4 +19504,4 @@ declare function resolveCodeModeWorker(baseDir: string, exists?: typeof existsSy
  */
 declare function codeModeWorkerPath(): string | undefined;
 
-export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ApprovalScope, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportNode, type ImportSkipReason, ImportTrustStore, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, MemoryReviewer, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type ReviewIssue, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };
+export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ApprovalScope, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportNode, type ImportSkipReason, ImportTrustStore, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, MemoryReviewer, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type ReviewIssue, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleRemoveFailure, type RoleRemoveOptions, type RoleRemoveOutcome, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SteerSource, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeRecordings, removeRoleFile, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };