@epoch-agent/core 0.18.0 → 0.19.0

package/README.md

@@ -20,8 +20,8 @@ Agent 引擎。ReAct 循环、Provider 路由、权限、记忆、技能、Hook
 | `provider/`   | 多 provider 路由 + 降级、模型元数据探测、AI SDK 适配、**token 估算**（`tokenizer.ts`，全仓唯一口径）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `config/`     | 10 层配置解析链 + 迁移 + 设置来源分层（`sources.ts`）+ **「为什么是这个值」**（`provenance.ts`，每个键赢在哪一层）+ **「我现在写、写完谁说了算」**（`write.ts`）+ JSON Schema 导出。`schema.ts` 是配置形状的**唯一**真源                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `session/`    | SQLite 会话持久化 + FTS5 搜索，落盘完整 `EpochMessage`（工具调用 / artifact 引用）+ 逐轮真实用量（`recordUsage`）+ 已批准的计划 + **那一次工作区决定**（v7 两列，见下）。开给模型那一侧的检索 / 前后文窗口 / 血缘在 `query.ts` + `trace.ts`，开给人那一侧的 `@:` 引用（候选 / 解析 / 当前面）在 `reference.ts`，「哪些会话我能读」**两边共用** `authorization.ts` 那一份，索引体检在 `fts-health.ts`（`epoch doctor` 用）                                                                                                                                                                                                                                                                                                                                         |
-| `memory/`     | 文件 + SQLite 双存储 + 后台审查（`reviewer.ts`）                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `skill/`      | `SKILL.md` 文件系统 + 自动学习（`learner.ts`）。**读正文有两条路，别混**：`view()` 是模型那条（会 `matchCount++`，而那个数喂着有效性评分、也就是模型下次看得见哪些技能），`body()` 是「人点开看一眼」那条（**一个字都不动统计**）—— 一次浏览不是一次命中，判据写在 `SkillSystem.body` 上。**写口只有两个导出**（`previewSkillImport` / `importSkills`，方案 42 §六）：从本机目录导入技能，收路径不收字节，staging 那一层刻意不导出 —— 判据在 `skill/import.ts` 文件头                                                                                                                                                                                                                                                                                             |
+| `memory/`     | 文件 + SQLite 双存储。**命中注入模式的条目原文照留、只在渲染给模型时遮罩**（索引块 / `prefetch` / `search` / `read` 四条通道回占位符；文件一个字节不动），写前则直接拒 —— 判据在 `manager.ts` 的 `classifyEntry` / `blockedPlaceholder` 上。配额到九成的提醒走 `takeNotices()` → 那一帧 `notice`（2026-09-28 之前是 `reviewer.ts` 的 5 分钟后台审查，结论没人读，已删）                                                                                                                                                                                                                                                                                                                                                                                           |
+| `skill/`      | `SKILL.md` 文件系统 + 自动学习（`learner.ts`）。**读正文有两条路，别混**：`view()` 是模型那条（会 `matchCount++`，而那个数喂着有效性评分、也就是模型下次看得见哪些技能），`body()` 是「人点开看一眼」那条（**一个字都不动统计**）—— 一次浏览不是一次命中，判据写在 `SkillSystem.body` 上。**`create()` 建的目录名取 frontmatter 的 `name`**（不是参数那个，2026-09-28）：索引取的也是它，不对齐的话 learner 那条通知会报一个查不到的名字。**写口只有两个导出**（`previewSkillImport` / `importSkills`，方案 42 §六）：从本机目录导入技能，收路径不收字节，staging 那一层刻意不导出 —— 判据在 `skill/import.ts` 文件头                                                                                                                                             |
 | `hook/`       | Hook 匹配与执行、命令执行；`sources.ts` 定「读哪几份配置」（两级 `hooks.json` + **Claude Code 的三份 `settings.json`**，方案 50），`config-loader.ts` 只管解析我们自己的格式，`claude-settings.ts` / `claude-matcher.ts` 只管翻 Claude Code 的方言                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `permission/` | 5 级权限（`default` / `acceptEdits` / `plan` / `auto` / `bypass`）+ 审批缓存（`approval-cache.ts`：记弹窗答案；**逐条撤销**走 `revoke(id)` / `PermissionManager.revokeApproval()`，2026-08-27 补 —— 在那之前一次点错的「拒绝」只在内存里、永不过期，除了重启进程收不回来）+ 无头策略 + 紧凑规则 `Tool(content)` + **审计流水**（`audit.ts`：权限层每一次裁决的定长流水，`getAudit()` 取，**只在进程内、永不进遥测**）                                                                                                                                                                                                                                                                                                                                             |
 | `workspace/`  | 这次会话的地盘：主根 + `--add-dir` 的额外根、目录体检、「哪些指令文件没被加载」，外加「已知工作区」最近使用清单（`~/.epoch/workspaces.json`，**本机文件不是服务**）。判据本身在 infra 的 `isInWorkspace`，这里是壳                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, ProviderType, EpochMessage, JsonSchema, ModelSelection, BackgroundTaskInfo, EpochToolCall, Telemetry, HookManager as HookManager$1, Lang, PermissionManager as PermissionManager$1, ApprovalRequest, ApprovalReply, AgentRoleScope, AgentRoleSource, EpochUserContent, EpochContentPart, AgentRole, PermissionLevel, PlanProposal, ScheduleDefinition, DiagnosticSink, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, ContextBreakdown, WireMcpConnector, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
+import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, NoticeCode, ProviderType, EpochMessage, JsonSchema, ModelSelection, BackgroundTaskInfo, EpochToolCall, Telemetry, HookManager as HookManager$1, Lang, PermissionManager as PermissionManager$1, ApprovalRequest, ApprovalReply, AgentRoleScope, AgentRoleSource, EpochUserContent, EpochContentPart, AgentRole, PermissionLevel, PlanProposal, ScheduleDefinition, DiagnosticSink, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, ContextBreakdown, WireMcpConnector, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
 export { API_KEY_ENV_VARS, AgentEvent, AgentEventOf, AgentEventType, ApprovalAnswer, ApprovalOutcome, ApprovalReply, ApprovalRequest, BudgetBreach, COMPLIANCE_ACTIONS, COMPLIANCE_CATEGORIES, ComplianceAction, ComplianceCategory, DecidedTrustLevel, EpochConfig, EpochHook, EpochPlugin, EpochSkill, EpochTool, FinishReason, HookContext, HookEvent, HookHandler, HookRegistration, HookType, HookManager as IHookManager, PermissionManager as IPermissionManager, TrustManager as ITrustManager, JsonSchema, MAX_ATTACH_BYTES, MAX_ATTACH_FILES, MAX_ATTACH_TOTAL_BYTES, MAX_SESSION_ATTACH_BYTES, MAX_SESSION_REFS, OPERATION_TYPES, Operation, OperationType, PERMISSION_LEVELS, PLAN_OUTCOMES, PROVIDER_INFOS, PROVIDER_TYPES, PermissionDecision, PermissionLevel, PlanApprovalOutcome, PlanProposal, PluginContext, ProviderInfo, ProviderType, TokenUsage, ToolContext, ToolDefinition, ToolExposure, ToolResult, TrustExecGrant, TrustGrant, TrustLevel, TrustRecord, TrustScope, TrustTier, VerifyResult, apiKeyEnvVar, extractAllMentions, extractMentions, extractSessionMentions, getProviderInfo, isOperationType, isPermissionLevel, isPlanOutcome, isProviderType, normalizeApproval } from '@epoch-agent/protocol';
 import { IsolationBackend, SqliteDatabase, ParseIssue, ShellFlavor } from '@epoch-agent/infra';
 export { BubblewrapOptions, DangerMatch, IS_WINDOWS, IsolationBackend, IsolationOptions, LogLevel, SeatbeltOptions, WINDOWS_HIDE_FLAGS, buildBwrapArgs, buildProfile, checkDangerousCommand, checkObfuscation, createLogger, detectBackend, getDefaultShell, getPythonCommand, isInWorkspace, isReadOnlyCommand, isolate, maskApiKey, probeBubblewrap, probeSeatbelt, complianceDir as resolveComplianceDir, policiesDir as resolvePoliciesDir, setLogLevel } from '@epoch-agent/infra';
@@ -1983,6 +1983,7 @@ interface BudgetStatus {
  * `5bbf3c8c` 删掉 —— 今天面向用户那半边在
  * [TOOLS.md](../../../../docs/TOOLS.md) 的「待办、目标、记忆、沙箱、委托」一节。）
  */
+
 type MemoryTarget = 'memory' | 'user';
 /** 配额信息 */
 interface BudgetInfo {
@@ -2027,6 +2028,26 @@ interface MemoryEntry {
     updatedAt: Date;
     accessCount: number;
     lastAccessedAt: Date;
+    /**
+     * 命中注入模式（2026-09-28）。
+     *
+     * **原文照留、只遮渲染**：这一行的 `content` 还是用户写的那份，
+     * `flushToDisk()` 也照旧把它写回文件 —— 变的只是四条模型通道
+     * （索引块 / `prefetch` / `search` / `read`）把它换成占位符。
+     * 判据全文在 `MemoryManager.blockedPlaceholder()` 上。
+     */
+    blocked: boolean;
+}
+/**
+ * 后台攒下来的一条「给用户看一眼」的通知（2026-09-28）。
+ *
+ * `code` 的取值真源在 protocol 的 `NoticeCode`，这里只挑出记忆这一族的两条 ——
+ * **不重抄那份联合**（判据同 `Diagnostic.module`：契约不是文案）。
+ * 发射方是 `AgentLoop`（在下一轮开头），承载它的那一帧是 `AgentEvent['notice']`。
+ */
+interface MemoryNotice {
+    code: Extract<NoticeCode, 'memory-blocked' | 'memory-quota'>;
+    text: string;
 }
 interface MemoryConfig {
     /** `MEMORY.md` 能存多少字符。**存储**配额，不进 prompt，抬它几乎不花钱 */
@@ -2064,6 +2085,28 @@ interface MemoryManager$1 {
         memory: BudgetInfo;
         user: BudgetInfo;
     };
+    /**
+     * 取走后台攒下来的通知（{@link MemoryNotice}），**出队即清空**（2026-09-28）。
+     *
+     * 发射方是 `AgentLoop`：它每一轮开头发完 `run-start` 之后取一次，把每一条
+     * 折成一帧 `notice` —— 和 `skill-learned` 那一帧同一处（判据在
+     * `loop.ts` 的 `maybeLearn()` 上）。攒的那一步在 `reloadFromDisk()` 里，
+     * 也就是这个会话第一次建 system prompt 时，所以同一轮就发得出去。
+     *
+     * ⚠️ **实现里那句「出队即清空」是有代价的**：被预算闸门拦下的那一轮取不到它，
+     * 于是它留到下一轮 —— 这是对的（那一轮压根没有上下文送出去，
+     * 说「有东西没进上下文」是句空话）；但**宿主自己调这个方法**就等于把话吃掉。
+     *
+     * ## ⚠️ 它是**可选**方法，而且是刻意可选的（2026-09-28 当天改的）
+     *
+     * 通知是**尽力而为的旁路**：没实现就等于这个宿主不收那两句话，而模型那一侧的
+     * 遮罩、文件那一侧的原文照旧。让它必填换来的不是安全，是把一批已经存在的宿主
+     * 桩打崩 —— 本仓自己的用例就是这么暴露的：`prompt-rebuild-signature.test.ts`
+     * 那个桩写成 `{ initialize, prefetch, sync } as unknown as MemoryManager`，
+     * 必填的话 `loop.ts` 那一行当场抛 `takeNotices is not a function`，
+     * **整轮跑不动**。拿一轮的可用性去换一句话，代价不成比例。
+     */
+    takeNotices?(): MemoryNotice[];
     reloadFromDisk(): Promise<void>;
     flushToDisk(): Promise<void>;
     close(): void;
@@ -12530,13 +12573,43 @@ declare class MemoryManager {
      * 什么都没干 —— 才是它要拦的。
      */
     private consolidationFailures;
-    /** 上次审查发现的问题（由 MemoryReviewer 写入） */
+    /**
+     * 加载 / 写入时发现的问题。
+     *
+     * ⚠️ **写入者是 `classifyEntry()`（注入命中）与 `add()` / `replace()`（写前拒绝），
+     * 不是那个后台审查器** —— 2026-09-28 之前这一行的 JSDoc 写的是「由
+     * MemoryReviewer 写入」，而那个类从来没有碰过它（它写的是自己那份 `issues`），
+     * 那是一句假话。审查器本身在这同一天删掉了：它的三类结论一个出口都没有。
+     */
     reviewIssues: Array<{
         type: string;
         severity: string;
         message: string;
         suggestion?: string;
     }>;
+    /**
+     * 攒着要发给用户的通知（{@link MemoryNotice}）。出队的是
+     * {@link takeNotices}，发射方是 `AgentLoop` 下一轮开头那一帧 `notice`。
+     *
+     * 为什么是「攒着等下一轮」而不是当场发：这一层是个普通类，**没有一条能
+     * `yield` 的流**（`AgentEvent` 要由生成器吐出去，而它手上一个都没有）——
+     * 所以只能是 loop 每一轮开头来问一次，和 `SkillLearner` 那条路同一个形状，
+     * 判据在 `loop.ts` 的 `maybeLearn()` 上。
+     */
+    private notices;
+    /**
+     * 「注入命中」与「配额告警」这两句话**每个进程只说一次**。
+     *
+     * 判据来自参考实现（Hermes 的 `AgentNotice.key` 是一次性闩）：`reloadFromDisk()`
+     * 每次会话开头都跑，不闩的话用户每个会话都会重看同一句「有 2 条被隔离」——
+     * 而**重复的通知等于训练用户忽略通知**。这一条不是省事，是让那一帧保持有效。
+     *
+     * ⚠️ 代价说清楚：一个长期驻留的进程里，会话中途新出现的命中不会再说第二遍
+     * （模型那一侧仍然看得到占位符，用户去翻文件也看得到）。要更细的粒度就得
+     * 把闩挂到「计数变了」上，那是另一笔改动。
+     */
+    private notifiedBlocked;
+    private notifiedQuota;
     /**
      * @param config 三个配额，来自 `EpochConfig.memory`（runtime 的 `services.ts` 递进来）。
      *   **按字段合并到默认值上**，不是整份替换 —— 用户只在 yaml 里写了
@@ -12553,6 +12626,48 @@ declare class MemoryManager {
     sync(_userMessage: string, _assistantResponse: string): Promise<void>;
     finalize(): Promise<void>;
     reloadFromDisk(): Promise<void>;
+    /**
+     * 命中注入模式的那一条**回给模型**长什么样。
+     *
+     * 三条决定，每条都有出处：
+     *
+     * 1. **是占位符不是原文** —— 这一层的全部意义。原文还在 `MEMORY.md` 里、
+     *    还在数据库里，只是不进模型；
+     * 2. **带处置指引** —— 模型看得见「这里有一条」，才可能替用户清掉它。
+     *    参考实现 [Hermes `tools/memory_tool_store.py`] 的占位符就写着
+     *    「use memory(action=remove) to delete the original」，这一步是它买的。
+     *    （id 不在这句里，在**印它的那一行**上：索引行本来就是
+     *    `- <id> [target] <摘要>`，摘要位换成了这句话）
+     * 3. **说得出命中的是哪条模式** —— 用户排查「为什么这条没进上下文」时，
+     *    「role injection」比「疑似注入」有用得多（原始出处是同一个文件的
+     *    `first_threat_message()`）。
+     */
+    private blockedPlaceholder;
+    /**
+     * 写前拒绝那一条：内容**根本不进文件**。
+     *
+     * `done: true` 是刻意的 —— 重试同一段内容没有意义，要改的是话本身，
+     * 不是时机（`done: false` + `consolidateHint` 那一档说的是「腾点地方再试」）。
+     */
+    private refuseInjection;
+    /**
+     * 取走攒着的通知（{@link notices}）。**出队即清空** —— 发射方是 loop，
+     * 一次取走一次发完；被预算闸门拦下的那一轮压根走不到发射那一步，
+     * 于是它原样留到下一轮（判据同 `loop.ts` 里 `learnedSkills` 那一段）。
+     */
+    takeNotices(): MemoryNotice[];
+    /**
+     * 配额到线了没有 —— 到线就在下一轮开头说一句。
+     *
+     * ⚠️ **它替代的是那个 5 分钟的后台定时器**（`MemoryReviewer`，2026-09-28 删）：
+     * 阈值一个字没改（{@link QUOTA_WARN_PCT}），改的是「什么时候算」——
+     * 会话开头算一次，没有常驻定时器，也不再算那些没人看的重复 / 矛盾报告。
+     *
+     * ⚠️ 只报 `memory` 那一档：`user` 那份配额只有它的三分之一，而用户画像满了
+     * 时的处置与项目知识完全不同（前者要合并、后者多半该删）—— 一句话说不清两件事，
+     * 说不清就别硬塞进同一帧。
+     */
+    private checkQuota;
     /**
      * 重建 短 id → 条目 的映射。
      *
@@ -12610,9 +12725,25 @@ declare class MemoryManager {
      * 它更靠前（判据在 {@link renderIndexBlock} 的排序那一段）。
      */
     read(ids: readonly string[]): Promise<MemoryReadResult>;
-    /** 获取所有条目（供后台审查使用） */
+    /**
+     * 获取所有条目 —— **给人看的那一份，原文照给**。
+     *
+     * ## 为什么它和四条模型通道不一样
+     *
+     * 命中注入模式的条目在模型那侧是占位符，在这一份里是**原文**：用户得看得见，
+     * 才谈得上把它删掉。参考实现的判据在这个类型上写着（Hermes
+     * `tools/memory_tool_store.py`：「live lists keep the raw text so the user can
+     * see and remove poisoned entries」）。
+     *
+     * `target` 是 2026-09-28 加的：用户侧的删除入口（`buildMemoryControl.remove`）
+     * 原来**拿不到条目记在哪个库**，于是把 target 硬编码成 `'memory'` ——
+     * 删一条 `user` 级记忆时底层回 `false`、而界面上写着「已删除」
+     * （实测：条目还在）。`blocked` 一起带出来是给界面留一个标记的位置。
+     */
     getAllEntries(): Array<{
         content: string;
+        target: MemoryTarget;
+        blocked: boolean;
     }>;
     /**
      * 语义检索。
@@ -12674,13 +12805,26 @@ declare class MemoryManager {
      */
     private readFile;
     /**
-     * 注入扫描。
+     * 一条从盘上读来的条目该怎么进库 —— **命中注入模式的原文照留，只打标记**。
+     *
+     * ## ⚠️ 2026-09-28 改过，改的是「命中之后拿它怎么办」
+     *
+     * 原来是：命中 → 返回空串 → 调用方过滤掉 → 下一次 `flushToDisk()` 把
+     * `MEMORY.md` 重写成不含它的版本 —— 也就是说**用户手写的记忆被我们悄悄删掉**，
+     * 唯一记录进了一个没有任何读者的数组。实测：三条里两条消失。
      *
-     * 命中注入模式的条目丢弃（返回空串，由调用方过滤掉）；
-     * 超长条目**截断**而不是整条替换成 [BLOCKED] —— 1000 字符对一条正常的
-     * 项目约定来说并不宽裕，原来的做法会把合法长条目直接吞掉。
+     * 现在是：命中 → **原文一个字节不动**（照旧进库、照旧写回文件），只把
+     * `blocked` 标上；四条模型通道（索引块 / `prefetch` / `search` / `read`）
+     * 把它换成 {@link blockedPlaceholder}。参考实现的判据
+     * [Hermes `tools/memory_tool_store.py`]：「Threat hits are replaced by a
+     * `[BLOCKED: …]` placeholder in the **SNAPSHOT only**; live lists keep the raw
+     * text so the user can see and remove poisoned entries (**dropping them
+     * silently would hide the attack**).」—— 既不能喂给模型，也不能瞒着人。
+     *
+     * ⚠️ 为什么命中那一档**不截断**：截断会跟着落盘，那就又改了用户的文件。
+     * 它反正不进 prompt（占位符替掉了它），长度不花任何人的钱。
      */
-    private scanInjection;
+    private classifyEntry;
     /**
      * 一条条目在索引里长什么样。摘要取**首行**并截断到
      * {@link INDEX_SUMMARY_CHARS}。
@@ -12748,44 +12892,6 @@ declare class MemoryManager {
     private buildConsolidateHint;
 }
 
-/**
- * 记忆后台审查器 [Hermes background_review.py]。
- *
- * 后台线程定期扫描记忆条目，检测：
- * - 重复/高度相似条目
- * - 矛盾条目（如 "用户用 pnpm" vs "用户用 npm"）
- * - 配额告警（> 90%）
- */
-
-/** 审查发现的问题 */
-interface ReviewIssue {
-    type: 'duplicate' | 'contradiction' | 'quota_warning';
-    severity: 'low' | 'medium' | 'high';
-    message: string;
-    entries?: string[];
-    suggestion?: string;
-}
-declare class MemoryReviewer {
-    private manager;
-    private timer;
-    private issues;
-    private interval;
-    constructor(manager: MemoryManager, interval?: number);
-    /** 启动后台审查 [Hermes spawn_background_review_thread] */
-    start(): void;
-    /** 停止后台审查 */
-    stop(): void;
-    /** 获取最近发现的问题 */
-    getIssues(): ReviewIssue[];
-    /** 清除已知问题 */
-    clearIssues(): void;
-    /** 手动触发一次扫描 */
-    scanForIssues(): Promise<ReviewIssue[]>;
-    private checkDuplicates;
-    private checkContradictions;
-    private checkQuota;
-}
-
 /**
  * FTS5 索引的体检与空间回收（方案 48 PR-4 / 2026-08-21 那一笔）。
  *
@@ -18339,6 +18445,23 @@ declare class SkillSystem implements SkillSystem$1 {
      * 用「resolve 之后还在不在里面」而不是再抄一遍那条正则：两处各一份正则迟早
      * 只改一处，而路径包含判定对**所有**逃逸写法（`..`、绝对路径、分隔符、
      * Windows 的 `C:\`）都是对的。
+     *
+     * ## ⚠️ 目录名取的是 **frontmatter 里的 `name`**，不是参数那个（2026-09-28）
+     *
+     * 索引一个技能时取的名字是 `fm.name ?? 目录名`（[scan.ts](scan.ts) 的 `loadOne`），
+     * 也就是说**文件夹叫什么，不影响它进索引之后叫什么**。这里原来按参数建目录，
+     * 两边于是能写岔，而唯一全自动的调用方（`SkillLearner`，名字由 LLM 生成）
+     * 没有门面那两道检查。后果是实测出来的：learner 回
+     * `{ created: true, skillName: 'deploy-site' }`，索引里却是 `Deploy Site` ——
+     * 那条唯一对用户可见的通知说的是一个查不到的名字；而 `skills.has(name)`
+     * 这道去重闸按参数名查、**永远不命中**，同一个话题可以反复学、每次都把上一个
+     * 目录静默覆盖掉。
+     *
+     * 选**对齐**而不是拒，判据同导入那条路的 `renameStaged()`：learner 是一次性的
+     * fire-and-forget（`agent/loop.ts` 的 `maybeLearn()`），拒了这次纠正就白学，
+     * 而 `LearningSkipReason` 那个码今天没有出口。对齐之后「通知里说的名字」就是
+     * 「索引里的名字」。模型侧门面（`skill-write.ts` 的 `checkFrontmatter`）
+     * 本来就要求两者一字不差，所以这条对它是 no-op。
      */
     create(name: string, content: string, category?: string): Promise<string>;
     edit(name: string, content: string): Promise<void>;
@@ -18346,6 +18469,42 @@ declare class SkillSystem implements SkillSystem$1 {
     delete(name: string, _absorbedInto?: string): Promise<string>;
     writeFile(name: string, filePath: string, content: string): Promise<void>;
     removeFile(name: string, filePath: string): Promise<void>;
+    /**
+     * 把一个技能目录下的相对路径解析成绝对路径，**结果必须落在技能目录里**。
+     *
+     * ## 为什么这一道在这儿，不只在门面上
+     *
+     * 判据是「断言要落在会说谎的那一层」—— 会说谎的是这个产地。门面
+     * （`skill-write.ts`）另有一条**字符集**检查，为的是给模型一句说得清的话，
+     * 那一条不是这一条的替代：今天已经有三个调用方（`skill_write_file` /
+     * `skill_patch`，以及将来可能接上的 `removeFile` 转出）。
+     *
+     * ## 为什么是 `base + sep` 而不是裸 `base`（2026-09-02 修）
+     *
+     * 裸前缀比较把**兄弟目录**判成「在里面」：`references/../../foo-evil/x` 解析出来
+     * 是 `<skills>/general/foo-evil/x`，它确实以 `<skills>/general/foo` 开头。
+     * 用「resolve 之后还在不在里面」而不是再抄一遍字符集正则：路径包含判定对
+     * **所有**逃逸写法（`..`、绝对路径、分隔符、Windows 的 `C:\`）都是对的。
+     *
+     * ## 为什么还要 realpath（2026-09-28 补）
+     *
+     * 词法过了不等于落地还在里面：技能目录里放一个 `references/x -> /etc/hosts`
+     * 的软链，写下去就出了目录。**两侧都 realpath 之后再比一次** —— 只 realpath
+     * 一侧会把「`~/.epoch/skills` 本身是软链」这种完全合法的布局判成逃逸。
+     * 目标不存在时 realpath 它最近的已存在祖先，再把剩下的段拼回去。
+     * 参考实现是同一个共识的两份：[Hermes `tools/path_security.py::validate_within_dir`]
+     * （resolve 后 `relative_to`）与 [Codex `ext/memories/src/local.rs::resolve_scoped_path`]
+     * （逐组件拒 `ParentDir`/`RootDir` + 每步拒软链）。
+     *
+     * ⚠️ **两条已知边界**，写下来免得下一个人以为它盖全了：
+     *
+     * 1. **悬空软链**（`references/x -> /tmp/不存在`）过得了这一道 —— 目标不存在时
+     *    我们 realpath 的是它的父目录。要造出这种软链得先有技能目录的写权限
+     *    （模型走 `terminal`、或者用户自己），那时它本来就能直接改那些文件；
+     * 2. **hard link** 与**检查/写入之间的 TOCTOU** 同理，都不在威胁模型里 ——
+     *    Codex 在 [`core/src/safety.rs`] 的同一处也留了这条自觉。
+     */
+    private resolveInsideSkill;
     /**
      * 取一个**可写**的技能，否则抛。
      *
@@ -18795,8 +18954,17 @@ type LearningSkipReason =
  | 'invalid-json'
 /** JSON 合法但缺 `name` 或 `content` */
  | 'missing-name-or-content'
-/** 有 content 但没有 YAML frontmatter，写下去也是一份读不出来的 SKILL.md */
+/** content 的 frontmatter 里没有 `name:`（或压根没有 frontmatter）。
+ *  ⚠️ 2026-09-28 之前这一档判的是 `content.includes('---')` —— 一个**子串**检查：
+ *  正文里任何一个 `---` 都能骗过它，而真正没 frontmatter 的那份写下去之后
+ *  进索引是「目录名 + 空描述」，模型从此选不中它 */
  | 'missing-frontmatter'
+/** frontmatter 的 `description` 是空的。判据同模型侧的 `skill_create`：
+ *  索引里只进那一行，空的等于这条技能不可被发现，而没有任何地方会报 */
+ | 'missing-description'
+/** 名字（或分类）当不了目录名 —— 分隔符、`..`、`:`、控制字符、结尾的点/空格。
+ *  判据复用导入那条路的 {@link skillSegmentIssue}，不再写第三条正则 */
+ | 'invalid-name'
 /** 前面都过了，落盘那一步失败，细节在 `error` 里 */
  | 'create-failed';
 /**
@@ -20166,4 +20334,4 @@ declare function resolveCodeModeWorker(baseDir: string, exists?: typeof existsSy
  */
 declare function codeModeWorkerPath(): string | undefined;
 
-export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ApprovalScope, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportMessage, type ImportNode, type ImportPartsResult, type ImportSessionInput, type ImportSessionMeta, type ImportSessionResult, type ImportSkipReason, ImportTrustStore, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceCategory, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, MemoryReviewer, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistFailureKind, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type ReviewIssue, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleRemoveFailure, type RoleRemoveOptions, type RoleRemoveOutcome, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_FORM_BUDGET_USD, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SteerSource, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyPersistFailure, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayAllows, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importParts, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isTransientPersistFailure, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistFailureCode, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeRecordings, removeRoleFile, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };
+export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ApprovalScope, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportMessage, type ImportNode, type ImportPartsResult, type ImportSessionInput, type ImportSessionMeta, type ImportSessionResult, type ImportSkipReason, ImportTrustStore, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceCategory, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, type MemoryNotice, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistFailureKind, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleRemoveFailure, type RoleRemoveOptions, type RoleRemoveOutcome, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_FORM_BUDGET_USD, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SteerSource, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyPersistFailure, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayAllows, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importParts, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isTransientPersistFailure, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistFailureCode, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeRecordings, removeRoleFile, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };