@epoch-agent/plugin-terminal 0.1.0

package/dist/index.js

@@ -0,0 +1,1002 @@
+// src/index.ts
+import { isAbsolute, resolve } from "path";
+import {
+  checkDangerousCommand,
+  isInWorkspace,
+  sandboxModeForLevel
+} from "@epoch-agent/infra";
+
+// src/background.ts
+import {
+  artifactsDir,
+  killTrackedProcess,
+  openArtifact,
+  shellSpawnArgs,
+  startLongLivedProcess
+} from "@epoch-agent/infra";
+
+// src/sandbox.ts
+import {
+  classifyFailure,
+  confine
+} from "@epoch-agent/infra";
+function unconfined(skipped) {
+  return { mode: null, backend: "none", enforcement: null, skipped, failure: null };
+}
+function confineShell(sh, policy, cwd) {
+  const bare = (outcome2) => ({
+    ...sh,
+    outcome: outcome2,
+    classify: () => outcome2
+  });
+  if (!policy) {
+    return bare(unconfined("not-requested"));
+  }
+  const result = confine(sh.file, sh.args, { ...policy, ...cwd ? { cwd } : {} });
+  if (!result.confined) {
+    return bare({
+      mode: result.mode,
+      backend: result.backend,
+      enforcement: null,
+      skipped: result.reason,
+      failure: null
+    });
+  }
+  const outcome = {
+    mode: result.mode,
+    backend: result.backend,
+    enforcement: result.enforcement,
+    skipped: null,
+    failure: null
+  };
+  return {
+    file: result.command,
+    args: result.args,
+    outcome,
+    classify: (exitCode, stderr) => ({
+      ...outcome,
+      failure: classifyFailure({
+        exitCode,
+        stderr,
+        denialSignatures: result.denialSignatures,
+        runnerFailureRules: result.runnerFailureRules
+      })
+    })
+  };
+}
+
+// src/background.ts
+var MAX_TASKS = 8;
+var MAX_TASK_OUTPUT = 256 * 1024;
+var MAX_OUTPUT_CHUNK = 8 * 1024;
+var bySession = /* @__PURE__ */ new Map();
+var counter = 0;
+function nextId() {
+  counter += 1;
+  return `t${counter}`;
+}
+function bucketOf(sessionId) {
+  const existing = bySession.get(sessionId);
+  if (existing) return existing;
+  const fresh = /* @__PURE__ */ new Map();
+  bySession.set(sessionId, fresh);
+  return fresh;
+}
+function taskIn(sessionId, id) {
+  return bySession.get(sessionId)?.get(id);
+}
+function startTask(sessionId, command, cwd, homeDir, sandbox) {
+  const bucket = bucketOf(sessionId);
+  const running = [...bucket.values()].filter((t) => t.status === "running");
+  if (running.length >= MAX_TASKS) {
+    const list = running.map((t) => `${t.id} (${t.command})`).join("\u3001");
+    return {
+      error: `\u540E\u53F0\u4EFB\u52A1\u5DF2\u8FBE\u4E0A\u9650 ${MAX_TASKS} \u4E2A\uFF0C\u5148\u7528 task_stop \u505C\u6389\u4E00\u4E2A\u3002\u5728\u8DD1\u7684\uFF1A${list}`
+    };
+  }
+  const id = nextId();
+  let finish;
+  const done2 = new Promise((resolve2) => {
+    finish = resolve2;
+  });
+  const raw = shellSpawnArgs(command);
+  const sh = confineShell({ file: raw.file, args: raw.args }, sandbox, cwd);
+  const task = {
+    id,
+    command,
+    ...cwd ? { cwd } : {},
+    pid: 0,
+    status: "running",
+    startedAt: Date.now(),
+    buffer: "",
+    totalBytes: 0,
+    droppedBytes: 0,
+    artifactsDir: artifactsDir(sessionId, homeDir),
+    sandbox: sh.outcome,
+    done: done2,
+    finish
+  };
+  bucket.set(id, task);
+  const started = startLongLivedProcess({
+    file: sh.file,
+    args: sh.args,
+    ...cwd ? { cwd } : {},
+    ...raw.options ? { spawnOptions: raw.options } : {},
+    onOutput: (chunk) => append(task, chunk),
+    onExit: (code) => {
+      if (task.status === "running") {
+        task.status = code === null ? "failed" : "exited";
+        if (code !== null) task.exitCode = code;
+      }
+      task.endedAt = Date.now();
+      if (task.status === "exited" && code !== null && code !== 0) {
+        task.sandbox = sh.classify(code, task.buffer);
+      }
+      task.spill?.close();
+      task.finish();
+    }
+  });
+  task.pid = started.pid;
+  return { task: toInfo(task), sandbox: sh.outcome };
+}
+function taskSandbox(sessionId, id) {
+  return taskIn(sessionId, id)?.sandbox;
+}
+function append(task, chunk) {
+  task.totalBytes += chunk.length;
+  task.buffer += chunk;
+  if (task.buffer.length <= MAX_TASK_OUTPUT) return;
+  if (task.spill === void 0) {
+    task.spill = openArtifact(task.artifactsDir, `task-${task.id}`, ".txt") ?? null;
+    task.spill?.append(task.buffer);
+  } else {
+    task.spill?.append(chunk);
+  }
+  const drop = task.buffer.length - MAX_TASK_OUTPUT;
+  task.buffer = task.buffer.slice(drop);
+  task.droppedBytes += drop;
+}
+function listTasks(sessionId) {
+  const bucket = bySession.get(sessionId);
+  return bucket ? [...bucket.values()].map(toInfo) : [];
+}
+function taskOutput(sessionId, id, since = 0) {
+  const task = taskIn(sessionId, id);
+  if (!task) return void 0;
+  const from = Math.max(since, task.droppedBytes);
+  const missed = Math.max(0, task.droppedBytes - since);
+  const slice = task.buffer.slice(from - task.droppedBytes);
+  const output = slice.slice(0, MAX_OUTPUT_CHUNK);
+  return {
+    info: toInfo(task),
+    output,
+    nextCursor: from + output.length,
+    missed,
+    hasMore: output.length < slice.length
+  };
+}
+async function stopTask(sessionId, id) {
+  const task = taskIn(sessionId, id);
+  if (!task || task.status !== "running") return false;
+  task.status = "killed";
+  task.endedAt = Date.now();
+  await killTrackedProcess(task.pid);
+  task.spill?.close();
+  task.finish();
+  return true;
+}
+async function waitTask(sessionId, id, timeoutMs) {
+  const task = taskIn(sessionId, id);
+  if (!task) return void 0;
+  if (task.status !== "running") return { info: toInfo(task), timedOut: false };
+  let timer;
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2("timeout"), timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    const winner = await Promise.race([task.done.then(() => "done"), timeout]);
+    return { info: toInfo(task), timedOut: winner === "timeout" };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function rekeyTasks(from, to) {
+  if (from === to) return;
+  const moving = bySession.get(from);
+  if (!moving) return;
+  bySession.delete(from);
+  const target = bySession.get(to);
+  if (!target) {
+    bySession.set(to, moving);
+    return;
+  }
+  for (const [id, task] of moving) target.set(id, task);
+}
+function clearAllTasks() {
+  for (const bucket of bySession.values()) {
+    for (const task of bucket.values()) task.spill?.close();
+  }
+  bySession.clear();
+  counter = 0;
+}
+function toInfo(task) {
+  return {
+    id: task.id,
+    command: task.command,
+    ...task.cwd ? { cwd: task.cwd } : {},
+    pid: task.pid,
+    status: task.status,
+    ...task.exitCode === void 0 ? {} : { exitCode: task.exitCode },
+    startedAt: task.startedAt,
+    ...task.endedAt === void 0 ? {} : { endedAt: task.endedAt },
+    outputBytes: task.totalBytes,
+    truncated: task.droppedBytes > 0,
+    ...task.spill ? { artifact: task.spill.path } : {}
+  };
+}
+function describeTask(info) {
+  const dur = Math.round(((info.endedAt ?? Date.now()) - info.startedAt) / 1e3);
+  const state = info.status === "running" ? `\u8FD0\u884C\u4E2D ${dur}s` : info.status === "exited" ? `\u5DF2\u7ED3\u675F\uFF0C\u9000\u51FA\u7801 ${info.exitCode}` : info.status === "killed" ? "\u5DF2\u505C\u6B62" : "\u542F\u52A8\u5931\u8D25";
+  const trunc = info.truncated ? "\uFF0C\u5F00\u5934\u5DF2\u6EDA\u51FA\u7F13\u51B2" : "";
+  return `${info.id}  ${state}\uFF08${info.outputBytes} \u5B57\u8282\u8F93\u51FA${trunc}\uFF09  ${info.command}`;
+}
+
+// src/exec.ts
+import { spawn } from "child_process";
+import {
+  createStreamDecoder,
+  killAllTrackedProcesses,
+  killProcessTree as killProcessTree2,
+  shellSpawnArgs as shellSpawnArgs2
+} from "@epoch-agent/infra";
+
+// src/limits.ts
+var MAX_CAPTURE_BYTES = 10 * 1024 * 1024;
+var OVER_CAPTURE_NOTICE = `
+[\u8F93\u51FA\u8D85\u8FC7 ${MAX_CAPTURE_BYTES / 1024 / 1024} MB\uFF0C\u5DF2\u622A\u65AD\u5E76\u7EC8\u6B62\u8FDB\u7A0B\uFF1A\u8FD9\u4E0D\u662F\u4E00\u6B21\u6B63\u5E38\u7684\u547D\u4EE4\u8F93\u51FA\uFF08\u591A\u534A\u662F cat \u4E86\u4E8C\u8FDB\u5236\u6587\u4EF6\u6216\u8FDB\u4E86\u6B7B\u5FAA\u73AF\uFF09\u3002\u8BF7\u7F29\u5C0F\u8F93\u51FA\u8303\u56F4\u91CD\u8BD5\uFF0C\u6BD4\u5982\u52A0 head / tail / grep\u3002]`;
+var NO_OUTPUT = "(\u65E0\u8F93\u51FA)";
+
+// src/pty.ts
+import { spawn as spawnPty } from "node-pty";
+import { IS_WINDOWS, killProcessTree, shellPtyArgs } from "@epoch-agent/infra";
+
+// src/pty-helper.ts
+import { accessSync, chmodSync, constants, existsSync } from "fs";
+import { createRequire } from "module";
+import { arch, platform } from "os";
+import { dirname, join } from "path";
+function helperCandidates() {
+  let packageDir;
+  try {
+    packageDir = dirname(dirname(createRequire(import.meta.url).resolve("node-pty")));
+  } catch {
+    return [];
+  }
+  return [
+    join(packageDir, "build", "Release", "spawn-helper"),
+    join(packageDir, "prebuilds", `${platform()}-${arch()}`, "spawn-helper")
+  ];
+}
+var failure;
+var done = false;
+function ensurePtyHelperExecutable() {
+  if (done || platform() === "win32") return;
+  done = true;
+  for (const candidate of helperCandidates()) {
+    if (!existsSync(candidate)) continue;
+    try {
+      accessSync(candidate, constants.X_OK);
+    } catch {
+      try {
+        chmodSync(candidate, 493);
+      } catch (err) {
+        failure = `${candidate}: ${err instanceof Error ? err.message : String(err)}`;
+      }
+    }
+  }
+}
+function ptyHelperHint() {
+  if (failure === void 0) return "";
+  return `
+node-pty \u7684 spawn-helper \u6CA1\u6709\u6267\u884C\u6743\u9650\uFF0C\u4E14\u81EA\u52A8\u4FEE\u590D\u5931\u8D25\uFF08${failure}\uFF09\u3002
+\u624B\u52A8\u4FEE\uFF1Achmod +x <\u4E0A\u9762\u8FD9\u4E2A\u8DEF\u5F84>`;
+}
+
+// src/pty.ts
+var PTY_IS_GROUP_LEADER = !IS_WINDOWS;
+var ptySessions = /* @__PURE__ */ new Map();
+function killPtyTree(pty) {
+  void killProcessTree({ pid: pty.pid, detached: PTY_IS_GROUP_LEADER, escalate: true, pty });
+}
+function confinePty(raw, policy, cwd) {
+  if (!Array.isArray(raw.args)) {
+    const outcome = unconfined(policy ? "no-backend" : "not-requested");
+    return { ...raw, outcome, classify: () => outcome };
+  }
+  const sh = confineShell({ file: raw.file, args: raw.args }, policy, cwd);
+  return { file: sh.file, args: sh.args, outcome: sh.outcome, classify: sh.classify };
+}
+function runCommandPty(command, options) {
+  return new Promise((resolve2) => {
+    const previous = ptySessions.get(options.tag);
+    if (previous) {
+      killPtyTree(previous);
+      ptySessions.delete(options.tag);
+    }
+    const raw = shellPtyArgs(command);
+    const sh = confinePty(raw, options.sandbox, options.cwd);
+    let pty;
+    try {
+      ensurePtyHelperExecutable();
+      pty = spawnPty(sh.file, sh.args, {
+        name: "xterm-256color",
+        cwd: options.cwd ?? process.cwd(),
+        env: { ...process.env, TERM: "xterm-256color", FORCE_COLOR: "1" },
+        cols: 120,
+        rows: 40
+      });
+    } catch (err) {
+      resolve2({
+        stdout: `PTY \u542F\u52A8\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}${ptyHelperHint()}`,
+        exitCode: 1,
+        sandbox: sh.outcome
+      });
+      return;
+    }
+    ptySessions.set(options.tag, pty);
+    let output = "";
+    let truncated = false;
+    let settled = false;
+    const releaseSlot = () => {
+      if (ptySessions.get(options.tag) === pty) ptySessions.delete(options.tag);
+    };
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearInterval(abortCheck);
+      releaseSlot();
+      resolve2(result);
+    };
+    const timer = setTimeout(() => {
+      killPtyTree(pty);
+      finish({ stdout: output.trimEnd() || "(\u8D85\u65F6\uFF0C\u65E0\u8F93\u51FA)", exitCode: -1, sandbox: sh.outcome });
+    }, options.timeout);
+    const abortCheck = setInterval(() => {
+      if (!options.signal?.aborted) return;
+      killPtyTree(pty);
+      finish({ stdout: output.trimEnd(), exitCode: -1, aborted: true, sandbox: sh.outcome });
+    }, 100);
+    if (options.stdin) {
+      setTimeout(() => {
+        try {
+          pty.write((options.stdin ?? "") + "\n");
+        } catch {
+        }
+      }, 200);
+    }
+    pty.onData((data) => {
+      if (truncated) return;
+      output += data;
+      options.onOutput?.(data);
+      if (output.length > MAX_CAPTURE_BYTES) {
+        truncated = true;
+        output = output.slice(0, MAX_CAPTURE_BYTES) + OVER_CAPTURE_NOTICE;
+        killPtyTree(pty);
+      }
+    });
+    pty.onExit(({ exitCode }) => {
+      finish({
+        stdout: output.trimEnd() || NO_OUTPUT,
+        exitCode,
+        // PTY 只有一股流，**没有独立的 stderr** —— 而拒绝方言和 runner
+        // 致命行都是 runner 往 stderr 打的。这里把整股流当 stderr 喂进去是
+        // 对的：那两组正则都锚在行首的后端自称上（`sandbox-exec:`），
+        // 混进来的 stdout 不会把它们撞出假阳性
+        sandbox: sh.classify(exitCode, output)
+      });
+    });
+  });
+}
+function killAllPtySessions() {
+  const pending = [];
+  for (const [tag, pty] of ptySessions) {
+    pending.push(
+      killProcessTree({ pid: pty.pid, detached: PTY_IS_GROUP_LEADER, escalate: true, pty })
+    );
+    ptySessions.delete(tag);
+  }
+  return pending;
+}
+
+// src/exec.ts
+var FORCE_SETTLE_MS = 3e3;
+function killChildTree(child) {
+  void killProcessTree2({
+    pid: child.pid ?? 0,
+    detached: false,
+    escalate: true,
+    isExited: () => child.exitCode !== null || child.signalCode !== null
+  });
+}
+function collectStreams(child, onOverflow, onOutput) {
+  let stdout = "";
+  let stderr = "";
+  let truncated = false;
+  const outDecoder = createStreamDecoder();
+  const errDecoder = createStreamDecoder();
+  child.stdout?.on("data", (chunk) => {
+    if (truncated) return;
+    const piece = outDecoder.write(chunk);
+    if (piece) {
+      stdout += piece;
+      onOutput?.(piece);
+    }
+    if (stdout.length > MAX_CAPTURE_BYTES) {
+      truncated = true;
+      stdout = stdout.slice(0, MAX_CAPTURE_BYTES);
+      onOverflow();
+    }
+  });
+  child.stderr?.on("data", (chunk) => {
+    if (stderr.length >= MAX_CAPTURE_BYTES) return;
+    const piece = errDecoder.write(chunk);
+    if (!piece) return;
+    stderr += piece;
+    onOutput?.(piece);
+  });
+  return () => {
+    if (!truncated) stdout += outDecoder.end();
+    if (stderr.length < MAX_CAPTURE_BYTES) stderr += errDecoder.end();
+    const tail = truncated ? OVER_CAPTURE_NOTICE : "";
+    return { stdout: (stdout + tail).trimEnd(), stderr: stderr.trimEnd() };
+  };
+}
+function runCommand(command, options) {
+  return new Promise((resolve2, reject) => {
+    const raw = shellSpawnArgs2(command);
+    const sh = confineShell({ file: raw.file, args: raw.args }, options.sandbox, options.cwd);
+    const child = spawn(sh.file, sh.args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      cwd: options.cwd,
+      ...raw.options
+    });
+    let killedBy = null;
+    let settled = false;
+    let forceTimer;
+    const drain = collectStreams(child, () => kill("overflow"), options.onOutput);
+    const timer = setTimeout(() => kill("timeout"), options.timeout);
+    const abortCheck = setInterval(() => {
+      if (options.signal?.aborted) kill("abort");
+    }, 100);
+    function clearTimers() {
+      clearTimeout(timer);
+      clearTimeout(forceTimer);
+      clearInterval(abortCheck);
+    }
+    function finish() {
+      if (settled) return;
+      settled = true;
+      clearTimers();
+      const { stdout, stderr } = drain();
+      const exitCode = child.exitCode ?? -1;
+      resolve2({
+        stdout,
+        stderr,
+        exitCode,
+        ...killedBy === "timeout" ? { timedOut: true } : {},
+        ...killedBy === "abort" ? { aborted: true } : {},
+        // 分类只在**我们没有主动杀它**的时候做：超时 / 中断的非零退出是我们
+        // 自己造成的，往分类器里送只会得到一句「命令自己失败了」的废话，
+        // 而调用方那边已经有 `timedOut` / `aborted` 两个更准确的字段
+        sandbox: killedBy ? sh.outcome : sh.classify(exitCode, stderr)
+      });
+    }
+    function kill(why) {
+      if (killedBy) return;
+      killedBy = why;
+      killChildTree(child);
+      forceTimer = setTimeout(finish, FORCE_SETTLE_MS);
+    }
+    if (options.signal?.aborted) kill("abort");
+    child.on("close", finish);
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimers();
+      reject(err);
+    });
+  });
+}
+async function cleanupBackgroundProcesses() {
+  await Promise.all([killAllTrackedProcesses(), ...killAllPtySessions()]);
+}
+
+// src/sandbox-notice.ts
+var MODE_BOUNDARY = {
+  "read-only": "\u53EA\u8BFB\uFF1A\u5199\u4EFB\u4F55\u6587\u4EF6\u90FD\u4F1A\u88AB OS \u6321\u4E0B",
+  "workspace-write": "\u5199\u5165\u9650\u4E8E\u5DE5\u4F5C\u533A\u3001\u4E34\u65F6\u76EE\u5F55\u548C\u5DE5\u5177\u94FE\u7F13\u5B58\uFF1B\u8BFB\u53D6\u548C\u7F51\u7EDC\u4E0D\u53D7\u9650",
+  "danger-full-access": "\u4E0D\u8BBE\u9650"
+};
+function sandboxNotice(sb) {
+  if (sb.skipped === "not-requested") return "";
+  if (sb.skipped === "mode-disabled") {
+    return "[\u6C99\u7BB1: \u5173] \u5F53\u524D\u6743\u9650\u6863\u4F4D\u662F\u300C\u5141\u8BB8\u4E00\u5207\u300D\uFF0C\u672C\u6B21\u6CA1\u6709 OS \u7EA7\u9694\u79BB\u3002\u5371\u9669\u547D\u4EE4\u8868\u4ECD\u7136\u5728\u5C97\u3002";
+  }
+  if (sb.skipped === "no-backend") {
+    return `[\u6C99\u7BB1: \u65E0] \u672C\u6B21\u6CA1\u6709 OS \u7EA7\u9694\u79BB\u2014\u2014\u8FD9\u4E2A\u5E73\u53F0\uFF08${sb.backend === "none" ? process.platform : sb.backend}\uFF09\u4E0A\u63A2\u6D4B\u4E0D\u5230\u53EF\u7528\u540E\u7AEF\uFF0C\u547D\u4EE4\u80FD\u8BFB\u5199\u6574\u4E2A\u6587\u4EF6\u7CFB\u7EDF\u3002`;
+  }
+  const boundary = MODE_BOUNDARY[sb.mode ?? ""] ?? "";
+  if (sb.enforcement === "partial") {
+    return `[\u6C99\u7BB1: ${sb.backend} \xB7 ${sb.mode} \xB7 \u5F3A\u5236\u4E0D\u5B8C\u6574] ${boundary}\u3002\u4E0D\u5B8C\u6574\u4E4B\u5904\uFF1APOSIX shell \u5FC5\u987B\u7559\u7740 /dev/null \u8FD9\u4E2A\u5199\u5165\u53E3\uFF0C\u5426\u5219\u5B83\u81EA\u5DF1\u90FD\u8D77\u4E0D\u6765\u3002`;
+  }
+  return `[\u6C99\u7BB1: ${sb.backend} \xB7 ${sb.mode}] ${boundary}\u3002`;
+}
+function sandboxError(sb) {
+  const failure2 = sb.failure;
+  if (!failure2) return null;
+  if (failure2.kind === "runner-failed") {
+    return {
+      message: `\u6C99\u7BB1\u542F\u52A8\u5931\u8D25\uFF0C\u547D\u4EE4\u6CA1\u6709\u6267\u884C\uFF1A${failure2.evidence ?? "(\u6C99\u7BB1\u672A\u7ED9\u51FA\u539F\u56E0)"}`,
+      suggestion: "\u8FD9\u4E0D\u662F\u547D\u4EE4\u672C\u8EAB\u7684\u95EE\u9898\uFF0C\u522B\u6539\u547D\u4EE4\u3002\u628A\u8FD9\u6761\u539F\u6587\u62A5\u7ED9\u7528\u6237\uFF0C\u6216\u6362\u5230\u300C\u5141\u8BB8\u4E00\u5207\u300D\u6863\u4F4D\u7ED5\u5F00\u6C99\u7BB1\u3002"
+    };
+  }
+  if (failure2.kind === "sandbox-denied") {
+    return {
+      message: `\u547D\u4EE4\u88AB\u6C99\u7BB1\u6321\u4E0B\uFF1A${failure2.evidence ?? "(\u6C99\u7BB1\u672A\u7ED9\u51FA\u539F\u56E0)"}`,
+      suggestion: sb.mode === "read-only" ? "\u5F53\u524D\u662F\u53EA\u8BFB\u6863\u4F4D\uFF0C\u4EFB\u4F55\u5199\u5165\u90FD\u4F1A\u88AB\u6321\u3002\u8981\u771F\u7684\u6539\u4E1C\u897F\uFF0C\u5148\u8BF7\u7528\u6237\u5207\u6362\u6743\u9650\u6863\u4F4D\u3002" : "\u6C99\u7BB1\u53EA\u653E\u5F00\u5DE5\u4F5C\u533A\u3001\u4E34\u65F6\u76EE\u5F55\u548C\u5DE5\u5177\u94FE\u7F13\u5B58\u3002\u8981\u5199\u5230\u522B\u5904\uFF0C\u5148\u8BF7\u7528\u6237\u786E\u8BA4\u3002"
+    };
+  }
+  return null;
+}
+
+// src/spill.ts
+import { artifactsDir as artifactsDir2, headCodePoints, tailCodePoints, writeArtifact } from "@epoch-agent/infra";
+var PREVIEW_HEAD = 2e3;
+var PREVIEW_TAIL = 2e3;
+var SPILL_THRESHOLD = 5e4;
+function formatBytes(text) {
+  return `${(Buffer.byteLength(text, "utf-8") / 1024).toFixed(1)} KB`;
+}
+function retrievalHint(locator) {
+  return `
+
+\u5B8C\u6574\u8F93\u51FA\u5DF2\u4FDD\u5B58\uFF1A${locator}
+\u53D6\u56DE\u65B9\u5F0F\uFF1A\u7528 file_search \u5728\u8FD9\u4E2A\u8DEF\u5F84\u91CC\u641C\u4F60\u8981\u7684\u5185\u5BB9\uFF08\u6BD4\u5982\u62A5\u9519\u5173\u952E\u5B57\uFF09\uFF0C\u6216\u7528 file_read \u5206\u9875\u8BFB\u3002`;
+}
+var NOT_STORED = "\n\n\uFF08\u8FD9\u6B21\u6CA1\u80FD\u4FDD\u5B58\u5B8C\u6574\u8F93\u51FA\uFF0C\u88AB\u7701\u7565\u7684\u90E8\u5206\u5DF2\u7ECF\u6CA1\u6709\u4E86\uFF09";
+function spillOutput(input) {
+  const { full, sessionId, homeDir, label, mode } = input;
+  if (full.length <= SPILL_THRESHOLD) return { text: full };
+  const locator = sessionId ? writeArtifact(artifactsDir2(sessionId, homeDir), label, ".txt", full, "unique") : void 0;
+  const head = mode === "tail" ? "" : headCodePoints(full, PREVIEW_HEAD);
+  const tail = tailCodePoints(full, PREVIEW_TAIL);
+  const skipped = full.slice(head.length, full.length - tail.length);
+  if (skipped.length === 0) return { text: full, ...locator ? { locator } : {} };
+  const body = `[\u8F93\u51FA ${formatBytes(full)}\uFF0C\u4E0B\u9762\u53EA\u662F\u9884\u89C8]
+${head ? `${head}
+` : ""}\u2026[\u7701\u7565 ${formatBytes(skipped)}]\u2026
+${tail}`;
+  return {
+    text: body + (locator ? retrievalHint(locator) : NOT_STORED),
+    ...locator ? { locator } : {}
+  };
+}
+function describeMissed(missed, locator) {
+  const where = locator ? retrievalHint(locator) : NOT_STORED;
+  return `\uFF08\u5F00\u5934 ${missed} \u5B57\u8282\u5DF2\u7ECF\u6EDA\u51FA\u73AF\u5F62\u7F13\u51B2\uFF09${where}`;
+}
+
+// src/tasks.ts
+var DEFAULT_WAIT_MS = 3e4;
+var MAX_WAIT_MS = 3e5;
+function ok(output) {
+  return { success: true, output, duration: 0 };
+}
+function notFound(id) {
+  return {
+    success: false,
+    output: "",
+    error: {
+      code: 2101,
+      message: `\u6CA1\u6709\u7F16\u53F7\u4E3A ${id} \u7684\u540E\u53F0\u4EFB\u52A1`,
+      suggestion: "\u7528 task_list \u770B\u5F53\u524D\u6709\u54EA\u4E9B"
+    },
+    duration: 0
+  };
+}
+var taskList = {
+  name: "task_list",
+  description: "\u5217\u51FA\u672C\u6B21\u4F1A\u8BDD\u8D77\u8FC7\u7684\u540E\u53F0\u4EFB\u52A1\uFF08terminal \u7684 background: true \u8D77\u7684\uFF09\uFF0C\u542B\u72B6\u6001\u3001\u9000\u51FA\u7801\u3001\u8F93\u51FA\u5B57\u8282\u6570\u3002",
+  parameters: { type: "object", properties: {}, required: [] },
+  annotations: { readOnlyHint: true, idempotentHint: false, openWorldHint: false },
+  operation: "file_read",
+  execute: (_args, ctx) => {
+    const tasks = listTasks(ctx.sessionId);
+    if (tasks.length === 0) {
+      return Promise.resolve(ok("\u6CA1\u6709\u540E\u53F0\u4EFB\u52A1\u3002\u7528 terminal \u7684 background: true \u8D77\u4E00\u4E2A\u3002"));
+    }
+    return Promise.resolve(
+      ok([`${tasks.length} \u4E2A\u540E\u53F0\u4EFB\u52A1`, ...tasks.map(describeTask)].join("\n"))
+    );
+  }
+};
+var taskOutputTool = {
+  name: "task_output",
+  description: `\u53D6\u4E00\u4E2A\u540E\u53F0\u4EFB\u52A1\u7684\u8F93\u51FA\u3002\u53C2\u6570: id(\u5FC5\u586B), since(\u4E0A\u6B21\u8FD4\u56DE\u7684 nextCursor\uFF0C\u7528\u6765\u53EA\u53D6\u65B0\u589E\u90E8\u5206)\u3002\u5355\u6B21\u6700\u591A ${MAX_OUTPUT_CHUNK} \u5B57\u8282\uFF1B\u8F93\u51FA\u5F88\u957F\u65F6\u4F1A\u5206\u6B21\u53D6\uFF0C\u8FD4\u56DE\u91CC\u4F1A\u8BF4\u660E\u8FD8\u6709\u6CA1\u6709\u66F4\u591A\u3002`,
+  parameters: {
+    type: "object",
+    properties: {
+      id: { type: "string", description: "\u4EFB\u52A1 id\uFF0C\u4F8B\u5982 t1" },
+      since: { type: "number", description: "\u4E0A\u6B21\u8FD4\u56DE\u7684 nextCursor\uFF1B\u4E0D\u7ED9\u5C31\u4ECE\u5934\u53D6" }
+    },
+    required: ["id"]
+  },
+  annotations: { readOnlyHint: true, idempotentHint: false, openWorldHint: false },
+  operation: "file_read",
+  describeTarget: (args) => String(args["id"] ?? ""),
+  execute: (args, ctx) => {
+    const id = String(args["id"] ?? "");
+    const since = Number(args["since"]);
+    const result = taskOutput(ctx.sessionId, id, Number.isFinite(since) && since > 0 ? since : 0);
+    if (!result) return Promise.resolve(notFound(id));
+    const head = describeTask(result.info);
+    const notes = [];
+    if (result.missed > 0) notes.push(describeMissed(result.missed, result.info.artifact));
+    if (result.hasMore) notes.push(`\uFF08\u8FD8\u6709\u66F4\u591A\uFF0C\u7528 since: ${result.nextCursor} \u7EE7\u7EED\u53D6\uFF09`);
+    const sb = taskSandbox(ctx.sessionId, id);
+    const sbErr = sb ? sandboxError(sb) : null;
+    if (sbErr) notes.push(`${sbErr.message}
+${sbErr.suggestion}`);
+    const body = result.output || "\uFF08\u8FD9\u4E00\u6BB5\u6CA1\u6709\u65B0\u8F93\u51FA\uFF09";
+    return Promise.resolve(
+      ok([head, ...notes, "", body, "", `nextCursor: ${result.nextCursor}`].join("\n"))
+    );
+  }
+};
+var taskWait = {
+  name: "task_wait",
+  description: "\u963B\u585E\u7B49\u4E00\u4E2A\u540E\u53F0\u4EFB\u52A1\u7ED3\u675F\u3002\u53C2\u6570: id(\u5FC5\u586B), timeoutMs(\u9ED8\u8BA4 30000\uFF0C\u6700\u5927 300000)\u3002**\u8D85\u65F6\u4E0D\u4F1A\u6740\u5B83** \u2014\u2014 \u53EA\u662F\u544A\u8BC9\u4F60\u8FD8\u5728\u8DD1\uFF0C\u8981\u505C\u7528 task_stop\u3002",
+  parameters: {
+    type: "object",
+    properties: {
+      id: { type: "string", description: "\u4EFB\u52A1 id" },
+      timeoutMs: { type: "number", description: "\u6700\u591A\u7B49\u591A\u4E45\uFF08\u6BEB\u79D2\uFF09" }
+    },
+    required: ["id"]
+  },
+  annotations: { readOnlyHint: true, idempotentHint: false, openWorldHint: false },
+  operation: "file_read",
+  describeTarget: (args) => String(args["id"] ?? ""),
+  execute: async (args, ctx) => {
+    const id = String(args["id"] ?? "");
+    const requested = Number(args["timeoutMs"]);
+    const timeout = Math.min(
+      Number.isFinite(requested) && requested > 0 ? requested : DEFAULT_WAIT_MS,
+      MAX_WAIT_MS
+    );
+    const result = await waitTask(ctx.sessionId, id, timeout);
+    if (!result) return notFound(id);
+    const tail = result.timedOut ? `
+\u7B49\u4E86 ${Math.round(timeout / 1e3)}s \u8FD8\u6CA1\u7ED3\u675F\uFF0C**\u6CA1\u6709\u505C\u5B83**\u3002\u53EF\u4EE5\u63A5\u7740\u5E72\u522B\u7684\uFF0C\u6216\u518D\u7B49\u4E00\u6B21\u3002` : "\n\u7528 task_output \u53D6\u8F93\u51FA\u3002";
+    return ok(describeTask(result.info) + tail);
+  }
+};
+var taskStop = {
+  name: "task_stop",
+  description: "\u505C\u6389\u4E00\u4E2A\u540E\u53F0\u4EFB\u52A1\uFF08\u6740\u6574\u68F5\u8FDB\u7A0B\u6811\uFF0C\u542B\u5B83\u8D77\u7684\u5B50\u8FDB\u7A0B\uFF09\u3002\u53C2\u6570: id(\u5FC5\u586B)\u3002",
+  parameters: {
+    type: "object",
+    properties: { id: { type: "string", description: "\u4EFB\u52A1 id" } },
+    required: ["id"]
+  },
+  // 它真的会杀进程，所以**不是** readOnly
+  annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+  operation: "file_read",
+  describeTarget: (args) => String(args["id"] ?? ""),
+  execute: async (args, ctx) => {
+    const id = String(args["id"] ?? "");
+    const stopped = await stopTask(ctx.sessionId, id);
+    if (!stopped) {
+      const tasks = listTasks(ctx.sessionId);
+      const exists = tasks.some((t) => t.id === id);
+      return exists ? ok(`${id} \u5DF2\u7ECF\u4E0D\u5728\u8FD0\u884C\u4E2D\u4E86\u3002`) : notFound(id);
+    }
+    return ok(`${id} \u5DF2\u505C\u6B62\uFF08\u542B\u5B83\u8D77\u7684\u5B50\u8FDB\u7A0B\uFF09\u3002`);
+  }
+};
+var TASK_TOOLS = [taskList, taskOutputTool, taskWait, taskStop];
+
+// src/index.ts
+var DEFAULT_TIMEOUT = 6e4;
+var PTY_TIMEOUT = 3e4;
+var CANCELLED = "\u547D\u4EE4\u5DF2\u88AB\u53D6\u6D88";
+function detectCd(command) {
+  const trimmed = command.trim();
+  const cdMatch = trimmed.match(/^cd\s+([^&|;]+)$/);
+  if (!cdMatch) return null;
+  const rawTarget = cdMatch[1];
+  if (!rawTarget) return null;
+  return rawTarget.trim().replace(/^["']|["']$/g, "");
+}
+function sandboxPolicyFor(ctx, workspaceRoot) {
+  return {
+    mode: sandboxModeForLevel(ctx.permissionLevel),
+    workspaceRoot,
+    ...ctx.extraRoots ? { extraRoots: ctx.extraRoots } : {},
+    allowNetwork: true
+  };
+}
+function toSandboxFailure(sb, output, duration) {
+  const err = sandboxError(sb);
+  if (!err) return null;
+  return {
+    success: false,
+    output,
+    error: {
+      // 2008 = 被沙箱挡下（命令跑了，动作被拒）
+      // 2009 = 沙箱自己没起来（命令**没有**跑）
+      code: sb.failure?.kind === "runner-failed" ? 2009 : 2008,
+      message: err.message,
+      suggestion: err.suggestion
+    },
+    duration
+  };
+}
+var CD_NOTICE = (target) => `[\u63D0\u793A] cd \u53EA\u5728\u672C\u6B21\u5B50 shell \u5185\u751F\u6548\uFF0C\u4E0B\u6B21\u8C03\u7528\u4ECD\u5728\u539F\u5DE5\u4F5C\u76EE\u5F55\u3002\u82E5\u540E\u7EED\u547D\u4EE4\u9700\u8981\u5728 ${target} \u4E0B\u6267\u884C\uFF0C\u8BF7\u4F20 workdir \u53C2\u6570\uFF0C\u6216\u5199\u6210 "cd ${target} && <\u547D\u4EE4>"\u3002`;
+var terminalTool = {
+  name: "terminal",
+  description: "\u5728\u7EC8\u7AEF\u4E2D\u6267\u884C shell \u547D\u4EE4\u3002\u652F\u6301\u540E\u53F0(background)\u3001PTY \u4EA4\u4E92(pty)\u3001cwd \u5207\u6362\u3002\u9002\u7528\u4E8E\u811A\u672C\u3001\u6784\u5EFA\u3001\u5B89\u88C5\u3001\u4EA4\u4E92\u5F0F\u547D\u4EE4\u7B49\u3002",
+  parameters: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: "\u8981\u6267\u884C\u7684 shell \u547D\u4EE4"
+      },
+      background: {
+        type: "boolean",
+        description: "\u540E\u53F0\u6267\u884C\uFF1A\u7ACB\u5373\u8FD4\u56DE\u4EFB\u52A1 id \u4E0D\u7B49\u7ED3\u679C\uFF0C\u914D\u5408 task_output / task_wait / task_stop \u7528\u3002\u9002\u5408\u6784\u5EFA\u3001\u8DD1 watch\u3001\u8D77\u670D\u52A1\uFF08\u8D77\u670D\u52A1\u518D curl \u5B83\u8FD9\u6761\u8DEF\u53EA\u80FD\u8FD9\u4E48\u8D70\uFF09\u3002**\u6743\u9650\u5224\u5B9A\u548C\u524D\u53F0\u5B8C\u5168\u4E00\u6837**\uFF0C\u540E\u53F0\u4E0D\u662F\u7ED5\u8FC7\u786E\u8BA4\u7684\u65C1\u8DEF\u3002"
+      },
+      pty: {
+        type: "boolean",
+        description: "PTY \u6A21\u5F0F\uFF1A\u7528\u4E8E\u4EA4\u4E92\u5F0F\u547D\u4EE4\uFF08npm init\u3001git add -p \u7B49\uFF09\u3002[Hermes/Codex]"
+      },
+      stdin: {
+        type: "string",
+        description: "PTY \u6A21\u5F0F\u4E0B\u53D1\u9001\u7ED9\u547D\u4EE4\u7684\u6807\u51C6\u8F93\u5165"
+      },
+      workdir: {
+        type: "string",
+        description: "\u5DE5\u4F5C\u76EE\u5F55\uFF08\u5FC5\u987B\u5728\u5DE5\u4F5C\u533A\u5185\uFF0C\u76F8\u5BF9\u8DEF\u5F84\u6309\u5DE5\u4F5C\u533A\u6839\u89E3\u6790\uFF09"
+      }
+    },
+    required: ["command"]
+  },
+  supportsParallel: false,
+  // 任意 shell 命令：能删数据、能联网，两个方向都到顶。
+  // `openWorldHint: true` 同时让 core 把输出包进 `<tool_output untrusted="true">`
+  // —— `curl` 抓回来的东西和 web_fetch 抓的没有区别。
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true
+  },
+  operation: "command",
+  // 审批目标就是完整命令串（五候选里的 command 也能猜到，这里写明确的）
+  describeTarget: (args) => String(args["command"] ?? ""),
+  async execute(args, ctx) {
+    const command = String(args["command"] ?? "");
+    const isBackground = Boolean(args["background"]);
+    const usePty = Boolean(args["pty"]);
+    const stdin = args["stdin"] ? String(args["stdin"]) : void 0;
+    const workdir = args["workdir"] ? String(args["workdir"]) : void 0;
+    if (!command.trim()) {
+      return {
+        success: false,
+        output: "",
+        error: { code: 2004, message: "\u547D\u4EE4\u4E0D\u80FD\u4E3A\u7A7A", suggestion: "\u8BF7\u63D0\u4F9B\u8981\u6267\u884C\u7684\u547D\u4EE4" },
+        duration: 0
+      };
+    }
+    const danger = checkDangerousCommand(command);
+    if (danger.dangerous) {
+      return {
+        success: false,
+        output: "",
+        error: {
+          code: 2003,
+          message: `\u5371\u9669\u64CD\u4F5C\u5DF2\u88AB\u62E6\u622A: ${danger.desc}`,
+          suggestion: `\u547D\u4EE4 "${command}" \u6D89\u53CA ${danger.desc}`
+        },
+        duration: 0
+      };
+    }
+    const baseDir = ctx.workDir || process.cwd();
+    let cwd = baseDir;
+    if (workdir) {
+      if (!isInWorkspace(workdir, baseDir, ctx.extraRoots)) {
+        return {
+          success: false,
+          output: "",
+          error: {
+            code: 2006,
+            message: `workdir \u8D8A\u754C: ${workdir} \u4E0D\u5728\u5DE5\u4F5C\u533A ${baseDir} \u5185`,
+            suggestion: "\u53EA\u80FD\u5728\u5DE5\u4F5C\u533A\u5185\u6267\u884C\u547D\u4EE4\uFF1B\u5982\u9700\u8DE8\u76EE\u5F55\u64CD\u4F5C\u8BF7\u8BF4\u660E\u7406\u7531\u7531\u7528\u6237\u786E\u8BA4"
+          },
+          duration: 0
+        };
+      }
+      cwd = isAbsolute(workdir) ? resolve(workdir) : resolve(baseDir, workdir);
+    }
+    if (isBackground) {
+      const started = startTask(
+        ctx.sessionId,
+        command,
+        cwd,
+        ctx.homeDir,
+        sandboxPolicyFor(ctx, baseDir)
+      );
+      if ("error" in started) {
+        return {
+          success: false,
+          output: "",
+          error: { code: 2006, message: started.error, suggestion: "\u7528 task_stop \u505C\u6389\u4E00\u4E2A\u518D\u8BD5" },
+          duration: 0
+        };
+      }
+      const bgNotice = sandboxNotice(started.sandbox);
+      return {
+        success: true,
+        output: [
+          ...bgNotice ? [bgNotice] : [],
+          `\u540E\u53F0\u4EFB\u52A1 ${started.task.id} \u5DF2\u542F\u52A8\uFF1A${command}`,
+          "task_output \u53D6\u8F93\u51FA \xB7 task_wait \u7B49\u5B83\u7ED3\u675F \xB7 task_stop \u505C\u6389 \xB7 task_list \u770B\u5168\u90E8\u3002",
+          "\u6CE8\u610F\uFF1A\u540E\u53F0\u4EFB\u52A1\u6D3B\u4E0D\u8FC7 epoch \u8FDB\u7A0B\uFF0C\u9000\u51FA\u65F6\u4F1A\u88AB\u4E00\u8D77\u6536\u6389\u3002"
+        ].join("\n"),
+        duration: 0
+      };
+    }
+    const cdTarget = detectCd(command);
+    const startTime = Date.now();
+    if (usePty) {
+      try {
+        const result = await runCommandPty(command, {
+          timeout: PTY_TIMEOUT,
+          cwd,
+          tag: ctx.sessionId + "::pty",
+          ...stdin ? { stdin } : {},
+          ...ctx.signal ? { signal: ctx.signal } : {},
+          ...ctx.onOutput ? { onOutput: ctx.onOutput } : {},
+          // 方案 46 PR-5：PTY 这条路 2026-08-17 起也有 OS 强制的写入边界。
+          // tty 分配 / 窗口尺寸 / 信号转发三样在真 Seatbelt 上逐条验过照旧，
+          // 实测表在 pty.ts 的文件头 —— 那三样正是方案 §三 点名要单独验的
+          sandbox: sandboxPolicyFor(ctx, baseDir)
+        });
+        const duration = Date.now() - startTime;
+        if (result.aborted) {
+          return {
+            success: false,
+            output: result.stdout,
+            error: { code: 2007, message: CANCELLED },
+            duration
+          };
+        }
+        let output = spillOutput({
+          full: result.stdout,
+          sessionId: ctx.sessionId,
+          ...ctx.homeDir ? { homeDir: ctx.homeDir } : {},
+          label: "pty",
+          mode: "head-tail"
+        }).text;
+        const ptyNotice = sandboxNotice(result.sandbox);
+        if (ptyNotice) output = `${ptyNotice}
+${output}`;
+        if (cdTarget) output += `
+${CD_NOTICE(cdTarget)}`;
+        const ptySandboxFailure = toSandboxFailure(result.sandbox, output || NO_OUTPUT, duration);
+        if (ptySandboxFailure) return ptySandboxFailure;
+        return { success: result.exitCode === 0, output, duration };
+      } catch (err) {
+        const duration = Date.now() - startTime;
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+          success: false,
+          output: "",
+          error: {
+            code: 2005,
+            message: `PTY \u6267\u884C\u5931\u8D25: ${message}`,
+            suggestion: "\u68C0\u67E5 node-pty \u662F\u5426\u6B63\u786E\u5B89\u88C5"
+          },
+          duration
+        };
+      }
+    }
+    try {
+      const result = await runCommand(command, {
+        timeout: DEFAULT_TIMEOUT,
+        signal: ctx.signal,
+        cwd,
+        ...ctx.onOutput ? { onOutput: ctx.onOutput } : {},
+        // 方案 46 PR-1：`terminal` 的默认路径从这里起有 OS 强制的写入边界。
+        // **边界按工作区主根算，不按 `cwd` 算** —— `cwd` 可能是工作区的子目录
+        // （模型传了 workdir），按它算的话「写工作区里另一个目录」会被挡，
+        // 而那是一次完全正常的操作
+        sandbox: sandboxPolicyFor(ctx, baseDir)
+      });
+      const duration = Date.now() - startTime;
+      const notice = sandboxNotice(result.sandbox);
+      let output = result.stdout;
+      if (result.stderr) output += (output ? "\n" : "") + result.stderr;
+      output = spillOutput({
+        full: output,
+        sessionId: ctx.sessionId,
+        ...ctx.homeDir ? { homeDir: ctx.homeDir } : {},
+        label: "terminal",
+        mode: "head-tail"
+      }).text;
+      if (notice) output = `${notice}
+${output}`;
+      if (result.timedOut) {
+        return {
+          success: false,
+          output,
+          error: {
+            code: 2002,
+            message: `\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF08${DEFAULT_TIMEOUT / 1e3} \u79D2\uFF09\uFF0C\u8FDB\u7A0B\u6811\u5DF2\u7EC8\u6B62`,
+            suggestion: "\u5C1D\u8BD5\u7B80\u5316\u547D\u4EE4\uFF0C\u6216\u7528 background: true \u653E\u540E\u53F0\u8DD1"
+          },
+          duration
+        };
+      }
+      if (result.aborted) {
+        return {
+          success: false,
+          output,
+          error: { code: 2007, message: CANCELLED },
+          duration
+        };
+      }
+      if (cdTarget) output += `
+${CD_NOTICE(cdTarget)}`;
+      const sandboxFailure = toSandboxFailure(result.sandbox, output || NO_OUTPUT, duration);
+      if (sandboxFailure) return sandboxFailure;
+      return { success: result.exitCode === 0, output: output || NO_OUTPUT, duration };
+    } catch (err) {
+      const duration = Date.now() - startTime;
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        success: false,
+        output: "",
+        error: { code: 2005, message: `\u547D\u4EE4\u6267\u884C\u5931\u8D25: ${message}`, suggestion: "\u68C0\u67E5\u547D\u4EE4\u662F\u5426\u6B63\u786E" },
+        duration
+      };
+    }
+  }
+};
+var terminalPlugin = {
+  name: "@epoch-agent/plugin-terminal",
+  version: "0.0.0",
+  description: "\u7EC8\u7AEF\u547D\u4EE4\u6267\u884C + PTY \u4EA4\u4E92 + \u540E\u53F0\u4EFB\u52A1 [Hermes/Codex]",
+  // 四个后台任务工具**无条件注册**：它们只读任务表，没有任务时 task_list
+  // 就说一句「没有」。按「有没有任务」动态注册的话，模型第一次起后台任务之后
+  // 工具表会变，而它这一轮看到的还是旧的
+  tools: [terminalTool, ...TASK_TOOLS]
+};
+export {
+  MAX_TASKS,
+  TASK_TOOLS,
+  cleanupBackgroundProcesses,
+  clearAllTasks,
+  describeTask,
+  listTasks,
+  rekeyTasks,
+  startTask,
+  stopTask,
+  taskOutput,
+  taskSandbox,
+  terminalPlugin,
+  waitTask
+};