@epoch-agent/core 0.21.0 → 0.23.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, NoticeCode, ProviderType, EpochMessage, JsonSchema, ModelSelection, BackgroundTaskInfo, EpochToolCall, Telemetry, HookManager as HookManager$1, Lang, PermissionManager as PermissionManager$1, ApprovalRequest, ApprovalReply, AgentRoleScope, AgentRoleSource, EpochUserContent, EpochContentPart, AgentRole, PermissionLevel, PlanProposal, ScheduleDefinition, DiagnosticSink, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, ContextBreakdown, WireMcpConnector, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
-export { API_KEY_ENV_VARS, AgentEvent, AgentEventOf, AgentEventType, ApprovalAnswer, ApprovalOutcome, ApprovalReply, ApprovalRequest, BudgetBreach, COMPLIANCE_ACTIONS, COMPLIANCE_CATEGORIES, ComplianceAction, ComplianceCategory, DecidedTrustLevel, EpochConfig, EpochHook, EpochPlugin, EpochSkill, EpochTool, FinishReason, HookContext, HookEvent, HookHandler, HookRegistration, HookType, HookManager as IHookManager, PermissionManager as IPermissionManager, TrustManager as ITrustManager, JsonSchema, MAX_ATTACH_BYTES, MAX_ATTACH_FILES, MAX_ATTACH_TOTAL_BYTES, MAX_SESSION_ATTACH_BYTES, MAX_SESSION_REFS, OPERATION_TYPES, Operation, OperationType, PERMISSION_LEVELS, PLAN_OUTCOMES, PROVIDER_INFOS, PROVIDER_TYPES, PermissionDecision, PermissionLevel, PlanApprovalOutcome, PlanProposal, PluginContext, ProviderInfo, ProviderType, TokenUsage, ToolContext, ToolDefinition, ToolExposure, ToolResult, TrustExecGrant, TrustGrant, TrustLevel, TrustRecord, TrustScope, TrustTier, VerifyResult, apiKeyEnvVar, extractAllMentions, extractMentions, extractSessionMentions, getProviderInfo, isOperationType, isPermissionLevel, isPlanOutcome, isProviderType, normalizeApproval } from '@epoch-agent/protocol';
+import { ToolProvider, EpochTool, EpochPlugin, ToolExposure, EpochSkill, HookType, EpochHook, PluginContext, QuestionRequest, QuestionAnswer, ComplianceCategory, ComplianceAction, ToolArtifactInput, ToolArtifact, TrustLevel, TrustManager as TrustManager$1, TokenUsage, EpochConfig, BudgetBreach, NoticeCode, ProviderType, EpochMessage, JsonSchema, ModelSelection, BackgroundTaskInfo, EpochToolCall, Telemetry, HookManager as HookManager$1, Lang, PermissionManager as PermissionManager$1, ApprovalRequest, ApprovalReply, AgentRoleScope, AgentRoleSource, EpochUserContent, EpochContentPart, AgentRole, PermissionLevel, PlanProposal, ScheduleDefinition, DiagnosticSink, CustomCommandDef, ModelRef, ExpandedCommand, CustomCommandSource, ContextBreakdown, WireMcpConnector, AgentEvent, SelectionContext, SetSelectionResult, MoneyDigits, CurrencyDisplay, PermissionRuleLists, KeybindingTable, Diagnostic, KeybindingReport, FileOmitReason, SessionOmitReason, EpochToolResult, EpochTurnFacts, LocalizedDetail, ApprovalScope, OperationType, RuleValue, Operation, ApprovalOutcome, PermissionDecision, ScheduleTrigger, ScheduleAllowlist, ScheduleBackendKind, ScheduleRunStatus, ScheduleRun, SchedulePendingApproval, ScheduleDraft, ScheduleWideningKind, WireAgentEvent, WireAgentEnvelope, ScheduleRunnerSpec, HookEvent, LogFn, HookRegistration, HookHandler, HookContext, VerifyResult, EpochFilePart, EpochSessionPart, MentionSet, EpochImagePart, TrustExecGrant, DecidedTrustLevel, TrustScope, TrustGrant, TrustRecord } from '@epoch-agent/protocol';
+export { API_KEY_ENV_VARS, AgentEvent, AgentEventOf, AgentEventType, ApprovalAnswer, ApprovalOutcome, ApprovalReply, ApprovalRequest, ApprovalScope, BudgetBreach, COMPLIANCE_ACTIONS, COMPLIANCE_CATEGORIES, ComplianceAction, ComplianceCategory, DecidedTrustLevel, EpochConfig, EpochHook, EpochPlugin, EpochSkill, EpochTool, FinishReason, HookContext, HookEvent, HookHandler, HookRegistration, HookType, HookManager as IHookManager, PermissionManager as IPermissionManager, TrustManager as ITrustManager, JsonSchema, MAX_ATTACH_BYTES, MAX_ATTACH_FILES, MAX_ATTACH_TOTAL_BYTES, MAX_SESSION_ATTACH_BYTES, MAX_SESSION_REFS, OPERATION_TYPES, Operation, OperationType, PERMISSION_LEVELS, PLAN_OUTCOMES, PROVIDER_INFOS, PROVIDER_TYPES, PermissionDecision, PermissionLevel, PlanApprovalOutcome, PlanProposal, PluginContext, ProviderInfo, ProviderType, TokenUsage, ToolContext, ToolDefinition, ToolExposure, ToolResult, TrustExecGrant, TrustGrant, TrustLevel, TrustRecord, TrustScope, TrustTier, VerifyResult, apiKeyEnvVar, extractAllMentions, extractMentions, extractSessionMentions, getProviderInfo, isOperationType, isPermissionLevel, isPlanOutcome, isProviderType, normalizeApproval } from '@epoch-agent/protocol';
 import { IsolationBackend, SqliteDatabase, ParseIssue, ShellFlavor } from '@epoch-agent/infra';
 export { BubblewrapOptions, DangerMatch, IS_WINDOWS, IsolationBackend, IsolationOptions, LogLevel, SeatbeltOptions, WINDOWS_HIDE_FLAGS, buildBwrapArgs, buildProfile, checkDangerousCommand, checkObfuscation, createLogger, detectBackend, getDefaultShell, getPythonCommand, isInWorkspace, isReadOnlyCommand, isolate, maskApiKey, probeBubblewrap, probeSeatbelt, complianceDir as resolveComplianceDir, policiesDir as resolvePoliciesDir, setLogLevel } from '@epoch-agent/infra';
 import { z } from 'zod';
@@ -3020,6 +3020,22 @@ interface AgentConfig {
      */
     role?: () => {
         name: string;
+        /**
+         * 给人看的称呼（`AgentRole.displayName`，2026-10-08）。**缺省回落
+         * `name`**（判据在 protocol 的 `AgentRole.displayName` 上）。
+         *
+         * 消费点只有两个，都在这一格的叙述半径内：身份行那一句
+         * （`message-utils.ts` 的 `identityLine()`）和 `run-start` 那枚徽标。
+         *
+         * ⚠️ **同下面 `source`：纯展示，引擎一处都不许据此分叉。** 它当不了
+         * 标识 —— `delegate_task` 的取值、同名合并的 key、`--agent` 的取值
+         * 用的全是 `name`，这一格换了它们一个都不动。
+         *
+         * 拿不到就不给（没写过 `displayName` 的角色）。**别在这一层拿 `name`
+         * 兜底**：填一个等于 `name` 的值会让「他有没有自己的称呼」这件事在
+         * 这一格上消失，而 `run-start` 那边的投影正是按有没有来分叉的。
+         */
+        displayName?: string;
         prompt?: string;
         /**
          * 这一份角色是谁在扮演。**缺省 `'delegate'`** —— 那是这个字段出现之前
@@ -5907,6 +5923,7 @@ declare function createTodoTool(db: TrackerDB): EpochTool;
  * ```markdown
  * ---
  * name: explore
+ * displayName: 检索
  * description: 只读检索。找文件、找符号、回答"X 在哪实现的"
  * tools: [file_read, file_multi_read, file_list, file_search]
  * maxTurns: 8
@@ -5971,6 +5988,7 @@ declare const AGENT_ROLE_DIAG_MODULE = "AgentRole";
  */
 declare const ROLE_FRONTMATTER_SCHEMA: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
+    displayName: z.ZodOptional<z.ZodString>;
     description: z.ZodString;
     tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -6103,8 +6121,15 @@ interface RoleMergeResult {
  * 就换个名字（换了名字也仍然受 `roleScopedProvider` 的父可用集约束，
  * 所以这不是一个绕过口子，只是让「叫 explore 的东西一定只读」成立）。
  *
- * `prompt` / `description` / `maxTurns` 允许整体替换 —— 它们是文案和预算，
- * 不是边界。
+ * `prompt` / `description` / `maxTurns` / `displayName` 允许整体替换 —— 它们是文案、
+ * 预算和称呼，不是边界。
+ *
+ * ⚠️ **`displayName` 不写就沿用被覆盖的那一份**（下面 `...existing` 那个展开）。
+ * 内置三个现在都带展示名，所以一份只改了 prompt 的 `explore.md` 在屏幕上仍然是
+ * 「检索」。这是**刻意**的，和 `description` 一条口径：同名就是同一个角色，
+ * 覆盖方只改它关心的那几格，其余的跟着原样；要换称呼就自己写一行 `displayName:`。
+ * （反过来的代价是：一个项目级 `explore` 如果完全是另一回事，屏幕上仍然叫
+ * 「检索」—— 那种情况正确动作是换个名字，不是靠展示名区分。）
  *
  * @param overrides 外部定义，按优先级**从低到高**排列（user 在前，project 在后）
  */
@@ -6183,18 +6208,34 @@ declare function roleSourceLabel(source: AgentRoleSource): string;
  */
 
 /**
- * 要建的那一份。**六格和 frontmatter 逐格对上**（`name` / `description` /
- * `tools` / `skills` / `maxTurns` 五个键 + 正文就是 `prompt`），一格不多。
+ * 要建的那一份。**和 frontmatter 逐格对上，一格不多**（`name` / `description` /
+ * `displayName` / `tools` / `skills` / `maxTurns` 六个键 + 正文就是 `prompt`）。
  *
  * > ⚠️ **`skills` 是 2026-08-27 补的，而补它的那一轮同时补了界面上那一格。**
  * > 2026-08-26 加 `AgentRole.skills` 时这里刻意没加，理由逐字是「加了就是一个
  * > 界面写得出、引擎读得到、但**没有一张表单会填它**的字段」——
- * > 那条理由现在被满足了，不是被推翻了。往这里加第七格的人照旧受它约束：
+ * > 那条理由现在被满足了，不是被推翻了。往这里加一格的人照旧受它约束：
  * > 要么连写口一路加到界面，要么别加。
+ * >
+ * > 📮 **2026-10-08 的 `displayName` 是照那条规矩加的第三例**：读口、
+ * > 这一份、wire 请求体、`role-add.tsx` 那张表单、两条 catalog 文案，同一天一起落。
+ * > 「六个键」这个数是那天起的，**别拿它当门禁** —— 真源是
+ * > `ROLE_FRONTMATTER_SCHEMA` 的 `shape`。
  */
 interface RoleCreateInput {
     /** slug，`[a-z0-9-]`。同时是文件名（`<name>.md`）和 `delegate_task` 的 `role` 取值 */
     name: string;
+    /**
+     * 给人看的称呼（2026-10-08）。**不给 = 回落 `name`**。
+     *
+     * ⚠️ 它**不参与任何标识语义**：不改文件名、不进 `delegate_task` 的取值、
+     * 不参与同名合并。判据和分工在 protocol 的 `AgentRole.displayName` 上。
+     *
+     * 空串 / 全空白 = 没写这一格（整个不发）—— 判据同下面 `tools` 那一格：
+     * 写一个空串进去是替他做了一个他没做过的表态，而读口那边 `min(1)` 会**整份
+     * 拒掉这个角色**，两份口径在这儿劈叉的表现是「建好了但列表里没有它」。
+     */
+    displayName?: string;
     /** 给**主 agent** 看的「什么时候该派给我」。缺了它读口会整份跳过这个角色 */
     description: string;
     /** 角色段正文。空着 = 这份 md 只有 frontmatter，那是合法的一档 */
@@ -7172,6 +7213,7 @@ declare function loadPlugins(opts: PluginLoadOptions): PluginArtifacts;
  * | `name` / `version` / `epochVersion` / `author`  | **epoch 自己** —— 装不装得上、叫什么     |
  * | `displayName` / `category` / `icon` / `visibility` / `changelog` | **上传那一屏的预填**，epoch 一个字不读 |
  * | `description` / `homepage` / `keywords`         | 两边都读                                 |
+ * | `dependencies`                                  | **epoch 自己** —— 装它时要一起装谁       |
  *
  * 第二族 2026-09-15 加的，判据在它们自己那几格上。要紧的一条：它们是**预填**，
  * 用户在那一屏上改得动，改了之后发出去的是改后的 —— 包里这一份原地不动。
@@ -7261,6 +7303,7 @@ declare const ManifestSchema: z.ZodObject<{
     epochVersion: z.ZodOptional<z.ZodString>;
     homepage: z.ZodOptional<z.ZodString>;
     keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    dependencies: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     displayName: z.ZodOptional<z.ZodString>;
     category: z.ZodOptional<z.ZodString>;
     icon: z.ZodOptional<z.ZodString>;
@@ -7937,6 +7980,17 @@ interface InstallOptions {
     pluginsDir: string;
     /** `pluginsStatePath(homeDir)` */
     statePath: string;
+    /**
+     * `marketplacesPath(homeDir)` —— 依赖解析**第二段**读的那一份（2026-09-30）。
+     *
+     * ⚠️ **和 {@link statePath} 是两个文件**（`plugins.json` / `marketplaces.json`），
+     * 而这个区别第一次写必然踩：拿 `statePath` 去当市场目录读，`parseLenient` 会把
+     * 一份插件记录当成一份没市场的目录 —— 于是症状是「市场里明明有它，
+     * 那一屏却说没有」（2026-09-30 在真 CLI 上撞到，e2e 抓出来的）。
+     *
+     * **不给 = 跳过那一段**：依赖解析还剩「已装」和「宿主」两段。
+     */
+    marketplacesStatePath?: string;
     /** 从市场装的话记下市场名 */
     marketplace?: string;
     /**
@@ -7991,6 +8045,27 @@ interface InstallOptions {
         ok: false;
         reason?: string;
     }>;
+    /**
+     * 把一个**依赖的名字**解析成一个安装来源（2026-09-30）。
+     *
+     * 宿主这一档存在的理由和 {@link InstallOptions.fetchFromHost} **逐字同**：有些包
+     * 的地址只有宿主手上有（它的 `plugin_key` 和 sha256 躺在它自己那份目录里），
+     * 而这一层看不见那份目录 —— 引擎只知道「清单里写了 `b-kit`」这一个字符串。
+     *
+     * 引擎自己会先把**能自己答的那一段**试完（已加的市场目录，见
+     * `findMarketplaceEntryByName`），答不上来才问这一格。所以：
+     *
+     * - **不给它 = `host:` 那批依赖解不出来**，其余照旧；
+     * - 它回一个 `installPlugin` 认得的 source 字符串（`host:…` / `github:…` /
+     *   一条 https / 一条本地路径），回 `undefined` 就是「这个我也不知道在哪」；
+     * - **回一个看不懂的字符串不算错**：那一条会以「解析出来的来源不合法」出现在
+     *   预览里（判据在 {@link InstallDependency} 的 `unresolved` 那一格）。
+     *
+     * ⚠️ **它答不上来不拦安装** —— 处置是「照装 + 当着用户的面点名」，判据在
+     * `resolveClosure` 上那段：一个依赖解不出来是**一句关于这台机器的话**，
+     * 不该让用户连根插件都装不上。
+     */
+    resolveDependency?: (name: string) => Promise<string | undefined>;
 }
 /** 安装前预览（§2.8）。宿主拿它画那张「将安装什么」的表 */
 interface InstallPreview {
@@ -8020,6 +8095,69 @@ interface InstallPreview {
         current: string;
         reason: string;
     };
+    /**
+     * 清单里写了 `dependencies` 时才有这一格：**每一个依赖这次怎么处置**。
+     *
+     * 缺席 = 这个插件不依赖别人（存量那一批全部走这一支，预览一个字不变）。
+     * 空数组**不会**出现 —— 一个都不依赖和一格都没有是同一件事。
+     */
+    dependencies?: InstallDependency[];
+}
+/**
+ * 闭包里**一个依赖**的处置（2026-09-30）。
+ *
+ * 三档各答一个不同的问题，也是那一屏上三种不同的画法：
+ *
+ * | 档           | 说的是                              | 那一屏上        |
+ * | ------------ | ----------------------------------- | --------------- |
+ * | `installed`  | 已经在场了，这次不动它              | 一行灰字        |
+ * | `plan`       | 这次一起装（`manifest` / `inventory` 有值） | 完整的一段 |
+ * | `unresolved` | 三条解析路都试过，解不出（`reason`）| 点名 + 照装     |
+ *
+ * ⚠️ **`unresolved` 不是失败**，这次安装照常进行 —— 判据在 `resolveClosure` 上。
+ *
+ * ⚠️ 这一格**不写版本范围**：`installed` 那一档只按名字判在场，不校验版本。
+ * 判据在 `ManifestSchema.dependencies` 那一格的文档上（「只写名字」）。
+ */
+interface InstallDependency {
+    /** 清单里写的那个名字，**原样**（不合法也照留，见 manifest.ts 那一格） */
+    name: string;
+    status: 'installed' | 'plan' | 'unresolved';
+    /**
+     * 谁要的它：根的名字，或者闭包里上一层那个依赖的名字。
+     *
+     * ⚠️ **一个依赖只报一行**（同一个名字在多条路上被要时取**第一条**），所以这一格
+     * 是「谁第一个把它拖进来的」，不是「谁都要它」—— 后者要一张图，而那一屏上
+     * 一张图换不来任何动作。
+     */
+    requiredBy: string;
+    /** `plan` 是解析出来的 source 原文；`unresolved` 时它是**试过的那一条**（可能没有） */
+    source?: string;
+    /** `unresolved` 的原因，给人看 */
+    reason?: string;
+    /**
+     * 给人看的名字（清单里的 `displayName`）。
+     *
+     * ⚠️ **两档有、一档没有**：`plan` 从刚取回来的那份清单里拿，`installed` 从那个
+     * 已装目录现读一份；`unresolved` 那个包压根没取到，所以那一档没有。
+     * ⚠️ 它是**可选**的（`ManifestSchema.displayName` 本来就可选），所以界面得分开
+     * 「没有」和「有」—— 拿标识串顶上去假装有，用户看到的是「b-kit（b-kit）」。
+     */
+    displayName?: string;
+    /** `plan` 专有：这个包自己的清单 */
+    manifest?: PluginManifest;
+    /** `plan` 专有：它会带来什么（那一屏照根那一份的画法画） */
+    inventory?: PluginInventory;
+    /**
+     * `plan` 专有：它自己那份 `epochVersion` 和当前引擎不匹配 —— **装得上，但加载器
+     * 会跳过它**。口径逐字同 {@link InstallPreview.versionUnmet}：它**不拒绝**这次
+     * 安装，只是「你刚装进来的这个依赖，这个引擎加载不了」这件事得在那一屏上说清。
+     */
+    versionUnmet?: {
+        required: string;
+        current: string;
+        reason: string;
+    };
 }
 type InstallOutcome = {
     ok: true;
@@ -9136,6 +9274,7 @@ interface SystemPromptParams {
     date: string;
     role?: {
         name: string;
+        displayName?: string;
         prompt?: string;
         scope?: AgentRoleScope;
     };
@@ -11757,6 +11896,10 @@ declare const EpochConfigSchema: z.ZodObject<{
             groq: "groq";
             mistral: "mistral";
             moonshotai: "moonshotai";
+            zhipu: "zhipu";
+            dashscope: "dashscope";
+            bytedance: "bytedance";
+            qianfan: "qianfan";
             cohere: "cohere";
             xai: "xai";
             perplexity: "perplexity";
@@ -11820,6 +11963,10 @@ declare const EpochConfigSchema: z.ZodObject<{
             groq: "groq";
             mistral: "mistral";
             moonshotai: "moonshotai";
+            zhipu: "zhipu";
+            dashscope: "dashscope";
+            bytedance: "bytedance";
+            qianfan: "qianfan";
             cohere: "cohere";
             xai: "xai";
             perplexity: "perplexity";
@@ -15143,12 +15290,7 @@ type ApprovalDecision = 'deny' | 'allow-once' | 'allow-always' | 'allow-session'
  * 变的只有「**存下来之后**那一格可能是什么」。
  */
 type CachedDecision = Exclude<ApprovalDecision, 'allow-once'>;
-/** 授权范围 */
-type ApprovalScope = 
-/** 只对这一个目标生效（默认） */
-'exact'
-/** 对该目录及其子树生效——只有用户明确选择时才用 */
- | 'prefix';
+
 /** 单条审批缓存储存 */
 interface CachedApproval {
     id: string;
@@ -15383,9 +15525,15 @@ declare const MAX_AUDIT_ENTRIES = 500;
  * | ------------- | -------------------------------------------------- |
  * | `bypass`      | 全放行 —— 但**挡不住第 1 层那两条 deny**，那层在前面 |
  * | `auto`        | 信任 agent：这一档自己不拦，边界全在第 1 层         |
- * | `plan`        | 只读：写入 / 命令 / 网络 / 执行代码一律拒           |
+ * | `plan`        | 只读：写入 / 命令 / 网络 / 执行代码一律拒；区外**读**要问 |
  * | `acceptEdits` | 同 `auto`，但**工作区外的文件**要确认               |
- * | `default`     | 只读操作免确认，其余一律确认                       |
+ * | `default`     | 只读操作免确认（**工作区外的读除外**），其余一律确认 |
+ *
+ * ⚠️ **「工作区外」那一格是 `plan` / `default` / `acceptEdits` 三档共用的**
+ * （2026-10-08）：`auto` / `bypass` 放行，其余三档问一句，判据在
+ * {@link outsideWorkspace} 上。**档位管的是「问了之后算不算数」，不是「要不要问」**
+ * —— 而「算不算数」由权限层算出来的 `grantedPaths` 兑现，工具层照它放行
+ * （判据在 protocol 的 `ToolContext.grantedPaths` 上）。
  *
  * ⚠️ 这一层**只负责「没有规则命中时怎么办」**。它给出的 allow 不是最终答案 ——
  * 回到 `check()` 之后还要过第 3 层 headless 预授权。
@@ -16018,6 +16166,100 @@ declare class PermissionManager implements PermissionManager$1 {
 type OperationSource = Pick<EpochTool, 'name'> & Partial<Pick<EpochTool, 'operation' | 'annotations'>>;
 declare function mapOperationType(toolName: string): OperationType;
 
+/**
+ * 「这一次放行了工作区外的哪些路径」—— 权限层给工具层的那**唯一一个答案**
+ * （2026-10-08）。
+ *
+ * ## 它要解决的是哪一件事
+ *
+ * 边界这回事在 2026-10-08 之前有三处各说各话：
+ *
+ *   - 权限层按档位判「要不要问」（`by-level.ts`）；
+ *   - 工具层（`plugin-file` / `plugin-terminal`）自己判「越界就拒」；
+ *   - 两者**互相看不见**，于是 `acceptEdits` 下用户点了「允许」，工具层照旧
+ *     抛 `PathEscapeError` —— 那次批准批的是权限层，管不到工具层那道闸。
+ *
+ * 治法不是让工具层也去读档位（那是第二张档位表，分叉了同样没人抓得到），
+ * 而是**权限层把结论算出来交下去**：这个函数算出「这次操作涉及、且在工作区外
+ * 的路径」，`tool-executor` 把它填进 `ToolContext.grantedPaths`，工具层拿它当
+ * 额外的根用（判据在 protocol 的 `ToolContext.grantedPaths` 上）。
+ *
+ * ## ⚠️ 它是纯计算，但**不是纯函数** —— 它读文件系统
+ *
+ * {@link approvalRootFor} 要 `statSync` 一下才知道某个目标是目录还是文件，
+ * 而这一下决定放开的范围差一整层。所以别把它塞进 `by-level.ts`（那个文件的
+ * 文件头写着「纯函数：只看级别 + 这次操作 + 沙箱」，而且它自己已经很长）。
+ *
+ * ## 为什么按「目录」放行，而不是精确到那一个文件
+ *
+ * 2026-10-08 用户拍的：**批准一次 = 打开这个目标所在的那一层**。理由是一次点击
+ * 换来的是「这个目录别再问了」，而精确到文件的话，同一个目录读第二个文件要再点
+ * 一次 —— 那正是弹窗疲劳的成因（`ruleAskActive` 的 JSDoc 里那句「会让用户学会
+ * 闭眼点允许」是同一个判据）。
+ *
+ * 规则的形状**不按工具名写死**，只问一句「这个目标是不是一个已经存在的目录」：
+ *
+ * | 目标                        | 放开的根        |
+ * | --------------------------- | --------------- |
+ * | `file_write('/out/a.txt')`  | `/out`          |
+ * | `file_list('/out')`         | `/out`（不是 `/`） |
+ * | `file_read('/out/a/b.txt')` | `/out/a`        |
+ *
+ * 按工具名写死（「`file_list` 的目标是目录、`file_write` 的是文件」）会漏掉
+ * `file_read` 读目录里任何一个文件这一族，而漏掉的表现是**静默地少放一格**。
+ */
+/**
+ * 这次调用要放行的工作区外路径 —— 已经按「目录」展开过，供
+ * `ToolContext.grantedPaths` 直接使用。
+ *
+ * @param args 工具参数原文。路径从 `affectedPaths()` 抽（`path` / `paths` /
+ *   `files` / V4A 补丁头），**和检查点快照用的是同一份抽取** —— 「这次调用会碰
+ *   哪些文件」只该有一个答案，两份分头实现的下场是「快照覆盖到 3 个、
+ *   放行的却是另外 5 个」
+ * @param workDir 主根
+ * @param extraRoots `--add-dir` 的额外根。**它们里的路径不算「工作区外」**，
+ *   所以不进 grantedPaths（进了也不出错，但会让这个字段名不副实）
+ * @returns 去重后的绝对路径列表。**在工作区内、或抽不出路径时是空数组** ——
+ *   空数组和 undefined 在 `ToolContext` 上是两回事（后者 = 宿主没实现这一格）
+ */
+declare function grantedPathsFor(args: Record<string, unknown>, workDir: string, extraRoots?: readonly string[]): readonly string[];
+/**
+ * 放开的根：**目标本身是目录就用它，否则用它的父目录**。
+ *
+ * `statSync` 失败（路径不存在）时按文件处理 —— 那是绝大多数写类调用的形状
+ * （`file_write` 的目标常常还不存在），而把它当目录会放开一个不存在的路径，
+ * 等于什么都没放开，下一次照样弹窗。
+ */
+declare function approvalRootFor(target: string, workDir: string): string;
+/**
+ * 一次批准**该往缓存里记什么** —— 记哪个 target、管多大范围。
+ *
+ * ## ⚠️ 这个函数存在的唯一理由：别的目标不许被「路径化」
+ *
+ * 直觉写法是「用户批准了，就把 `approvalRootFor(opTarget)` 记进去」。它错在
+ * `opTarget` **不一定是路径** —— `terminal` 的 target 是整条命令串，
+ * 猜不出目标的 MCP 工具给的是参数 JSON（`argsKey()` 的产物）。把那些东西喂给
+ * `approvalRootFor`，`toAbsolute` 会把它们当成相对路径 resolve 到主工作目录下，
+ * 于是：
+ *
+ *   - `recordApproval` 记下的 target 与下一次 `check()` 查的 target **不是同一个
+ *     值**，那条缓存永远命不中 —— 症状是「同一个问题问不完」，读起来像缓存坏了；
+ *   - 更糟的是它顺手产出一条 `scope: 'prefix'`、target 是**整个工作目录**的
+ *     条目 —— 批准一条 `ls` 等于给整个工作区开了一张通行证。
+ *
+ * 2026-10-08 抓到的就是前者（`tool-executor.test.ts` 的「批准过的 target 与下次
+ * 查询的 target 是同一个值」）。后者当时还没发生，但它离前者只差一个
+ * `scope` 参数，所以判据写成一条：**只有真的落在某个放行根里的目标才记成
+ * 目录**，其余一律原样记、`exact`。
+ *
+ * @param opTarget `resolveTarget()` 给的那个值（命令串 / 路径 / 参数 JSON）
+ * @param grantedRoots {@link grantedPathsFor} 这次算出来的放行根
+ */
+declare function approvalEntryFor(opTarget: string, workDir: string, grantedRoots: readonly string[]): {
+    target: string;
+    scope: 'exact' | 'prefix';
+};
+
 /**
  * 紧凑权限规则的字符串语法 —— `Tool(content)`（方案 22 §2.1）。
  *
@@ -20599,4 +20841,4 @@ declare function resolveCodeModeWorker(baseDir: string, exists?: typeof existsSy
  */
 declare function codeModeWorkerPath(): string | undefined;
 
-export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, AppearanceStore, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ApprovalScope, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportMessage, type ImportNode, type ImportPartsResult, type ImportSessionInput, type ImportSessionMeta, type ImportSessionResult, type ImportSkipReason, ImportTrustStore, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceCategory, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, type MemoryNotice, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistFailureKind, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleRemoveFailure, type RoleRemoveOptions, type RoleRemoveOutcome, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_FORM_BUDGET_USD, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SteerSource, type StoredAppearance, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyPersistFailure, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayAllows, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importParts, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isTransientPersistFailure, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistFailureCode, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeRecordings, removeRoleFile, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };
+export { AGENT_ROLE_DIAG_MODULE, ARTIFACT_MAX_TOTAL_BYTES, ARTIFACT_RETENTION_DEFAULTS, ATTACHMENT_MAX_TOTAL_BYTES, ATTACHMENT_RETENTION_DEFAULTS, type AcquireResult, type AgentConfig, AgentLoop, type AgentProvider, type AgentSite, type AgentSiteRef, AppearanceStore, type AppendMessageInput, ApprovalCache, type ApprovalDecision, type ArtifactOpenRefusal, type ArtifactRetention, type AskQuestionDeps, type AttachmentRetention, BLOCKED_TOOLS, type BackendOptions, type BackendOutcome, type BackgroundTaskSource, type BaseOrigin, type BaseSlot, type BeginTurnInput, type BreakdownInput, BudgetGuard, type BudgetGuardOptions, type BudgetInfo, type BudgetLevel, type BudgetOptions, type BudgetStatus, BudgetStore, type BudgetStoreOptions, type BuildFireArgvInput, type BuildIndexOptions, CHECKPOINT_MAX_TOTAL_BYTES, CLAUDE_EVENT_NAMES, CLAUDE_TOOL_NAMES, CODE_MODE_LIMITS, CODE_MODE_SDK_TAG, CONFIG_KEYS, CURRENT_CONFIG_VERSION, type CachedApproval, type CachedDecision, type CheckpointCapture, type CheckpointFile, CheckpointManager, type CheckpointManagerOptions, type CheckpointManifest, CheckpointStore, type CheckpointStoreOptions, type CheckpointSummary, type ClaudeHooksParseOptions, type CodeModeLimits, type CodeRequest, type CodeResult, CodeSandbox, type CommandHookConfig, type CommandHookResult, type CommandLoadOutcome, type CommandLoadSummary, type CommandResult, type CommandRunner, type CompactionResult, type CompiledRules, type ComplianceDirSpec, type ComplianceDirsSummary, ComplianceEngine, type ComplianceEngineInput, type ComplianceGate, type ComplianceHit, type ComplianceRule, type ComplianceRuleSource, type ComplianceSettings, type ComplianceVerdict, type CompressConfig, type CompressResult, type ConfigMigration, type ConfigOrigins, ContextCompressor, type ContextEngine, type CreateScheduleInput, type CreateSessionInput, DEFAULT_COMPLIANCE_ACTIONS, DEFAULT_COMPLIANCE_SETTINGS, DEFAULT_COMPRESSION_THRESHOLD, DEFAULT_GOAL_MAX_ROUNDS, DEFAULT_MAX_HOLD_CHARS, type DelegateArgs, type DelegateConfig, DelegateManager, type DelegateTaskResult, type DiagnoseOptions, type DiscoverOutcome, type DiscoveredFile, type DoctorReport, type DraftParse, EMPTY_RULES, EPOCH_DISK_LEDGER, EpochConfigSchema, type ExpandOptions, type ExtractOutcome, FTS_TABLES, FTS_TRIGGERS, type FallbackEvent, type FileSlots, type FileSourceKind, type ForkInput, type FrontmatterParse, type FrontmatterSplit, type FtsHealth, type FtsReclaim, type FtsSpace, type FtsTableHealth, GOAL_BLOCK_CODES, type GateAxis, type GateVerdict, type GenerateInput, type GenerateOutput, type Goal, type GoalBlockReason, type GoalClear, type GoalPhase, type GoalPromptView, type GoalRefusal, type GoalRoundResult, GoalService, GoalStore, type GoalToolDeps, type GoalWrite, HEADLESS_AUDIT_CODES, type HeadlessPolicy, type HookConfigEntry, HookManager, type HookManagerOptions, type HookMatcher, type HookSourceKind, type HookSourceStatus, type HookSourcesOptions, type HookSourcesSummary, type HooksParseOutcome, type MemoryManager$1 as IMemoryManager, INSTRUCTION_BUDGET_CHARS, INSTRUCTION_FILES, type SessionManager$1 as ISessionManager, type SkillSystem$1 as ISkillSystem, ImageLoadError, type ImageSize, type ImportDecision, type ImportGate, type ImportMessage, type ImportNode, type ImportPartsResult, type ImportSessionInput, type ImportSessionMeta, type ImportSessionResult, type ImportSkipReason, ImportTrustStore, type InstallDependency, type InstallOptions, type InstallOutcome, type InstallPreview, type InstructionScan, type InstructionSource, type IsolationReason, type IsolationReport, type JsonSchemaDocument, LAUNCHD_LABEL_PREFIX, LOCK_HEARTBEAT_MS, LOCK_STALE_MS, type LastOpenSession, LastOpenSessions, type LayerOutcome, type LayerScalars, type LayerStatus, type LearningContext, type LearningResult, type LearningSkipReason, type LexiconLoadOutcome, type LifecycleOutcome, type ListCandidatesInput, type ListSessionsInput, type ListSessionsOutput, type LoadCommandsOptions, type LoadConfigOptions, type LoadKeybindingsOptions, type LoadKeybindingsResult, type LoadRolesOptions, type LoadedPlugin, type LockHolder, MARKETPLACE_DISPLAY_FIELDS, MARKETPLACE_FILE, MAX_AUDIT_ENTRIES, MAX_COMMAND_DEPTH, MAX_GOAL_MAX_ROUNDS, MAX_IMPORT_DEPTH, MAX_LAST_OPEN_SESSIONS, MAX_OBJECTIVE_CHARS, MAX_REASON_CHARS, MAX_RECENT_WORKSPACES, MODEL_GIVE_UP_THRESHOLD, MULTIMODAL_DEFAULTS, type ManagedPolicy, ManagedPolicyError, type ManagedSettings, ManagedSettingsSchema, type MarketplaceCatalog, type MarketplaceCategory, type MarketplaceDisplay, type MarketplaceDisplayField, type MarketplaceEntry, type MarketplaceOutcome, type MarketplaceRecord, type MarketplaceStatus, type MemoryConfig, type MemoryEntry, MemoryManager, type MemoryNotice, type MemorySearchResult, type MemoryTarget, type MemoryWriteResult, type MentionPart, type MentionResolution, type Message, type MessageHit, type MessageRecord, type MessageSurface, type ModelCapability, ModelFailureTracker, type ModelMetaEntry, type ModelPricing, type MultimodalPolicy, NOMINAL_TOTAL_BYTES, NO_REVEALED_TOOLS, type NonInteractiveProbe, type OsTaskSnapshot, type OutputGuard, PACK_EXCLUDES, PACK_MAX_BYTES, PACK_MAX_FILES, PERMISSION_AUDIT_CODES, PLUGIN_LAYOUT, PLUGIN_MANIFEST_FILE, PLUGIN_MANIFEST_KEYS, PLUGIN_NAME_PATTERN, PLUGIN_ROOT_ENV, PLUGIN_ROOT_TOKEN, PLUGIN_VISIBILITY, POLICY_DECISIONS, PROBE_VERSION, PROJECT_AGENTS_SUBDIR, PROVIDER_NO_CREDENTIAL, type PackFile, type PackLimits, type PackOutcome, type PackPlan, type PackPlanOutcome, type PermissionAuditCode, type PermissionAuditEntry, type PermissionAuditOutcome, type PermissionAuditScope, type PermissionAuditSnapshot, PermissionManager, type PersistFailureKind, type PersistedBudget, type PersistedPart, type PlanApprovalFn, type PlanEnterResult, type PlanModeDeps, PlanModeState, type PlanSettlement, type PluginArtifacts, type PluginAuthor, PluginAuthorSchema, type PluginCommandDir, type PluginCounts, type PluginHookFile, type PluginInventory, type PluginLoadOptions, type PluginManifest, type PluginPathRef, type PluginRecord, type PluginSettingsFile, type PluginSourceType, type PluginStateReadOutcome, PluginStore, type PluginVisibility, type PolicyDirSpec, type PolicyDirsSummary, type PolicyLoadOutcome, type PolicyRule, PolicyRuleSchema, type PricingAt, type PricingOverride, type ProjectContext, type ProjectExtensionInventory, ProviderError, ProviderRouter, type ProviderStreamChunk, type ProviderToolCall$1 as ProviderToolCall, type ProviderWarning, type PruneResult, type QuestionAskFn, RECORDING_KEEP_RUNS, RECORDING_MAX_BYTES, ROLE_FRONTMATTER_SCHEMA, RUN_CODE_TOOL, type ReadMessagesInput, type ReadMessagesOutput, type RecentWorkspace, RecentWorkspaces, type RecordRunInput, type RecorderOptions, type RecoveryAction, type RegisterInput, type RegisterOutcome, type RegistrarOptions, type RegistrationPatch, type RepairOutcome, type ResolveMentionsOptions, type ResolveReferenceInput, type ResolveSettingsOptions, type ResolvedCompression, type ResolvedReference, type ResolvedSource, type ResponseFormat, type RestorePartsOptions, type RewindAction, type RewindDrift, type RewindFilePlan, type RewindOptions, type RewindOutcome, type RewindPreview, type RoleCreateFailure, type RoleCreateInput, type RoleCreateOptions, type RoleCreateOutcome, type RoleLoadOutcome, type RoleLoadSummary, type RoleMergeNotice, type RoleMergeResult, type RoleRemoveFailure, type RoleRemoveOptions, type RoleRemoveOutcome, type RoleScope, type RuleMatch, type RuleSuggestion, type RuleVerdict, type RunCodeFailure, type RunCodeInput, type RunCodeOutcome, type RunCodeToolDeps, type RunEstimateInput, type RunInput, type RunResult, type RunningSchedule, SANDBOX_COVERS, SANDBOX_EXCLUDES, SCALAR_KEYS, SCHEDULE_DEFAULTS, SCHEDULE_DEFAULT_ALLOWLIST, SCHEDULE_FORM_BUDGET_USD, SCHEDULE_ISSUE_CODES, SCHTASKS_FOLDER, SESSION_MESSAGES_READ_TOOL, SESSION_MESSAGES_SEARCH_TOOL, SESSION_QUERY_TOOLS, SESSION_SEARCH_TOOL, SESSION_TRACE_TOOL, SETTINGS_LAYER_ORDER, SETTING_WRITE_KEYS, SETTING_WRITE_LAYERS, SKILL_CREATE_TOOL, SKILL_EDIT_TOOL, SKILL_PATCH_TOOL, SKILL_VIEW_TOOL, SKILL_WRITE_FILE_TOOL, SLASH_COMMANDS_DIAG_MODULE, type ScalarKey, type ScanInstructionsOptions, type ScheduleArgvRefusal, type ScheduleArgvResult, type ScheduleArgvWarning, type ScheduleBackend, type ScheduleCliEntry, type ScheduleDraftDeps, type ScheduleDrift, type ScheduleDriftKind, type ScheduleInstallForm, type ScheduleIssue, type ScheduleIssueCode, type ScheduleLock, ScheduleRecorder, ScheduleRegistrar, ScheduleStore, type ScheduleValidation, type SchemaExport, type SearchHit, type SearchInput, type SearchMessagesInput, type SearchMessagesOutput, type SearchOutput, type SearchSessionsInput, type SelectionDeps, type SelfConnector, type SelfIndexInput, type SelfSettings, type Session, type SessionCandidate, type SessionHit, SessionManager, type SessionMentionDeps, type SessionMeta, SessionQueries, SessionReferences, type SessionSearchDeps, type SessionStats, type SessionSurface, type SessionTrace, type SessionVisibility, type SessionVisibilityInput, type SettingApply, type SettingApplyFacts, type SettingChain, type SettingFutile, type SettingLayer, type SettingStep, type SettingValue, type SettingValueKind, type SettingWriteFailure, type SettingWriteKey, type SettingWriteLayer, type SettingWriteOutcome, type SettingWriteRequest, type SettingWriteTarget, type SettingWriteTargetsOptions, type SettingsFile, SettingsFileError, SettingsFileSchema, type SettingsLayer, type SettingsResolution, type ShadowFinding, type ShadowKind, type Skill, type SkillDirSource, type SkillDirSpec, type SkillDirsSummary, type SkillImportConflict, type SkillImportDone, type SkillImportEntry, type SkillImportFailure, type SkillImportForm, type SkillImportOptions, type SkillImportPreview, type SkillImportResult, type SkillIndexEntry, type SkillIndexOptions, type SkillIndexResidency, type SkillIndexStats, SkillLearner, type SkillLearningProvider, type SkillMeta, type SkillStats, SkillSystem, type SkillSystemOptions, type SkillViewDeps, type SkillWriteDeps, type SteerSource, type StoredAppearance, type SubAgentRunner, type SubTask, type SubToolCaller, type SummarizeOutput, type SurfaceMessage, type SystemPromptParams, type SystemPromptSegments, TOOL_SEARCH_TOOL, TaskNoticeTracker, type TodoItem, type ToolCall, type ToolConflict, type ToolGate, type ToolNameFidelity, type ToolNameLookup, ToolRegistry, type ToolRevealState, type ToolScope, type ToolSearchDeps, type ToolTableCost, type TraceInput, type TraceNode, TrackerDB, type TrustDecision, type TrustGate, type TrustGateOptions, TrustManager, type TurnRecord, type TurnTiming, type UpdateScheduleInput, type UtilityModelInfo, type ValidateScheduleInput, type VersionCheck, Workspace, type WorkspaceFiles, type WorkspaceIssue, type WorkspaceIssueKind, acquireScheduleLock, addMarketplace, addUsage, admitArtifact, admitArtifacts, affectedPaths, approvalEntryFor, approvalRootFor, artifactLaunchArgv, artifactOpenRefusal, assertLevelAllowed, blockedRoleTools, buildContextBreakdown, buildFireArgv, buildFtsMatchQuery, buildSchemaExports, buildSystemPrompt, buildTrigramMatchQuery, builtinRoles, checkEpochVersion, checkFtsHealth, checkShadowing, classifyPersistFailure, classifyProviderError, clearModelCache, coalesceRecording, codeModeWorkerPath, commandNameFromRelPath, compileRuleLists, compressionOptions, computeCost, computeCostMicros, computeExecHash, countRules, createAllowAllGate, createAllowAllImportGate, createAskQuestionTool, createCodeExecTool, createDelegateTool, createDenyAllGate, createDenyAllImportGate, createGoalTool, createImportGate, createMemoryTool, createPlanModeTools, createRoleFile, createRoleScope, createRunCodeTool, createScheduleDraftTool, createSessionMessagesReadTool, createSessionMessagesSearchTool, createSessionSearchTool, createSessionSearchTools, createSessionTraceTool, createSkillViewTool, createSkillWriteTools, createTodoTool, createToolRevealState, createToolScope, createToolSearchTool, createTrustGate, currentEpochVersion, decideImport, decideTrust, defaultConfig, defaultModelOf, describeArtifactRefusal, describeBackgroundTask, describeHeadlessPolicy, describeIsolation, describeJsonError, diagnoseSchedules, discoverMarkdown, discoverModels, discoverProject, displayAllows, displayCurrency, draftCommandLine, draftWidening, escapeRuleContent, estimateImageTokens, estimateRunTokens, estimateTokens, evaluateSelection, expandCommand, expandImports, explainSetting, extractArchive, findInstructionFiles, findProjectInstructions, findRole, formatBytes, formatSkillIndex, formatUsd, gateForTool, getCapability, getConfigIssues, getConfigOrigins, getImportGate, getTrustGate, grantedPathsFor, hasDedicatedExecContent, hasExecTierContent, hasPromptCaching, hasProviderCredentials, hasReadTierContent, imageFromBase64, imageFromPath, imagePartTokens, importParts, importSkills, installPlugin, instructionDirs, instructionNotices, intervalSlots, inventoryProjectExtensions, inventoryTotal, isBlockCode, isCodeModeDeferred, isEmptyRules, isGoalPhase, isNonInteractive, isReadOnlySubCall, isSettingWriteLayer, isTransientPersistFailure, isValidPluginName, isWithinWindow, isWritableSettingKey, labelSlug, layerRank, listRunningSchedules, listSessionCandidates, listWorkspaceFiles, loadCommandDefinitions, loadCommandFile, loadCommands, loadConfig, loadHookSources, loadKeybindings, loadLexiconDir, loadLexiconFiles, loadPlugins, loadPolicyFiles, loadPolicyRules, loadRoleDefinitions, loadRoleDir, loadedImports, localDateString, managedSwitchNotes, mapClaudeToolName, mapEpochToolName, mapOperationType, matchPreauthorization, matchRuleLists, matchesHook, mentionsPluginRoot, mergeHeadlessPolicy, mergeRoles, mergeSchedulePatch, microsToUsd, modelListCandidates, needsAllowlist, nextFallbackModel, nextRunAt, noConfigOrigins, noManagedPolicy, noPlugins, openArtifact, originOf, packFileName, packPlugin, parseClaudeSettingsHooks, parseClock, parseDate, parseFrontmatter, parseHooksConfig, parseHooksConfigVerbose, parseImportLine, parseModelList, parseRoleDefinition, parseScheduleDraft, parseSkillFrontmatter, parseTrigger, pendingImageTokens, persistFailureCode, persistParts, persistToolResults, persistedUsage, planPack, previewSkillImport, pricingFor, projectEntryForDisplay, pruneArtifacts, pruneAttachments, pruneRecordings, pruneSchedules, readImageSize, readMarketplaces, readPluginManifest, readPluginRecords, readProviderKeyEnv, readRecording, readSessionSurface, reclaimFtsSpace, redactLine, refreshOpenRouterMetadata, removeMarketplace, removeRecordings, removeRoleFile, removeSessionArtifacts, removeSessionAttachments, renderImportTree, renderProjectContext, renderSdkDeclaration, renderSelfIndex, repairSchedules, resolveArtifactRetention, resolveCodeModeWorker, resolveComplianceDirs, resolveEntrySource, resolveInWorkspace, resolveMarketplaceRef, resolveMentions, resolveMultimodalPolicy, resolvePolicyDirs, resolvePricingAt, resolveProjectRoot, resolveScheduleBackend, resolveSessionReference, resolveSessionVisibility, resolveSettings, resolveSkillDirs, resolveSource, resolveTar, resolveWorkspace, restoreParts, revealScopedProvider, roleScopedProvider, roleSourceLabel, ruleCovers, ruleFromString, ruleToString, runCode, runCommand, sanitizeArgNames, sanitizeCommand, sanitizeFtsQuery, sanitizePath, sanitizeToolOutput, scanInstructions, scanPluginDir, scanSkillDirs, searchMarketplaces, setDisplayCurrency, setImportGate, setPluginEnabled, setTrustGate, settingValueChoices, settingValueKind, settingWriteApply, settingWriteLayers, settingWriteTargets, skillIndexDescription, skillIndexResidency, skillIndexStats, sniffMediaType, splitFrontmatter, staticToolProvider, stripArtifactData, substitutePluginRoot, suggestRuleFromApproval, systemOpenArgv, systemPromptSegments, toPosix, toolDefinitionTokens, toolMatches, toolTableTokens, totalTokens, traceSession, triggerPeriodMs, unescapeRuleContent, uninstallPlugin, unknownRoleSkills, unknownRoleTools, unloadedInstructionFiles, updateMarketplace, updatePlugin, usdToMicros, validateSchedule, validateTrigger, validateWindow, withGoalCompression, withGoalPrompt, workspaceDisplayPath, writeSettingValue };