@mono-agent/agent-runtime 0.3.0 → 0.4.1

package/src/runtime.js

@@ -1,13 +1,16 @@
 // Top-level runtime factory.
 //
 // `createRuntime(host)` is the ergonomic entry point for hosts. It binds the
-// host integration callbacks (pricing, persistence, credentials), configures
-// the module-level tool runtime, and returns a `.run(systemPrompt, options)`
+// host integration callbacks (pricing, persistence, credentials), builds a
+// per-instance `ToolContext` (agent/tools/shared/tool-context.js) that this
+// runtime instance threads to every bridge call via `options.toolContext`
+// instead of a process-global, and returns a `.run(systemPrompt, options)`
 // method that resolves the right provider bridge based on `options.model` +
 // `options.executionMode`.
 //
-// All four built-in bridges (claude-sdk, claude-cli, pi-sdk, codex-app)
-// register themselves on import via the runtime registry. Hosts that need
+// The built-in bridges (claude-sdk, claude-cli, pi-native, codex-app,
+// opencode-app) register themselves on import via the runtime registry. Hosts
+// that need
 // finer control can keep using the named exports (resolveRuntimeBridge,
 // generateClaudeResponse, etc.) directly.
 //
@@ -23,12 +26,22 @@
 // a product-specific result object,
 // task envelopes, etc.) parse it themselves.
 
+// @ts-check
+
 import { resolveRuntimeBridge } from "./ai/runtime/registry.js";
 import { createObserverHub } from "./ai/observer.js";
 import { disposeAllProviderSessions, disposeProviderSession } from "./ai/runtime/sessions.js";
-import { configureToolRuntime } from "./agent/tools/shared/runtime-context.js";
+import { createToolContext, updateToolContext } from "./agent/tools/shared/tool-context.js";
 import { resolveRuntimeBrand } from "./runtime-brand.js";
 
+/**
+ * @typedef {import('./ai/types.js').AgentRuntimeHostOptions} AgentRuntimeHostOptions
+ * @typedef {import('./ai/types.js').AgentRuntimeToolOptions} AgentRuntimeToolOptions
+ * @typedef {import('./ai/types.js').AgentRuntimeInstance} AgentRuntimeInstance
+ * @typedef {import('./ai/types.js').RuntimeRunOptions} RuntimeRunOptions
+ * @typedef {import('./ai/types.js').RuntimeResult} RuntimeResult
+ */
+
 const HOST_KEYS = [
   "resolveCustomPricing",
   "resolvePiApiKey",
@@ -47,8 +60,15 @@ const TOOL_RUNTIME_KEYS = [
   "ripgrepPath",
   "qaOutputDir",
   "sandboxPolicy",
+  "sandboxEngine",
+  "sandbox",
 ];
 
+/**
+ * @param {Object<string, *>} source
+ * @param {Array<string>} keys
+ * @returns {Object<string, *>}
+ */
 function pickDefined(source, keys) {
   const out = {};
   for (const key of keys) {
@@ -57,17 +77,53 @@ function pickDefined(source, keys) {
   return out;
 }
 
+const PROMPT_OVERRIDE_KEYS = ["structuredOutputInstruction", "structuredOutputFinalization", "liveInputGuidance"];
+
+/**
+ * Per-field merge of the prompt overrides: a run-level override wins over the
+ * host-level default wins over the bridge's built-in default (an absent field
+ * leaves the bridge on its built-in string). Kept out of the `...hostDefaults,
+ * ...options` spread so a run that overrides ONE prompt does not drop the host's
+ * other prompt defaults (an object-replacing spread would).
+ * @param {import('./ai/types.js').RuntimePromptOverrides} [hostPrompts]
+ * @param {import('./ai/types.js').RuntimePromptOverrides} [runPrompts]
+ * @returns {import('./ai/types.js').RuntimePromptOverrides|undefined}
+ */
+function resolvePrompts(hostPrompts, runPrompts) {
+  if (!hostPrompts && !runPrompts) return undefined;
+  /** @type {Record<string, *>} */
+  const merged = {};
+  for (const key of PROMPT_OVERRIDE_KEYS) {
+    const value = /** @type {any} */ (runPrompts)?.[key] ?? /** @type {any} */ (hostPrompts)?.[key];
+    if (value !== undefined) merged[key] = value;
+  }
+  return merged;
+}
+
+/**
+ * @param {AgentRuntimeHostOptions} [host]
+ * @returns {AgentRuntimeInstance}
+ */
 export function createRuntime(host = {}) {
   const hostDefaults = pickDefined(host, HOST_KEYS);
   const toolRuntime = pickDefined(host, TOOL_RUNTIME_KEYS);
   const runtimeBrand = resolveRuntimeBrand(host.runtimeBrand);
   const hostObservers = Array.isArray(host.observers) ? host.observers.slice() : [];
-  // Always configure: even when no tool keys are supplied, we must publish
-  // the resolved brand so internal modules (transcript, pi-bridge, ripgrep
-  // error message) pick it up.
-  configureToolRuntime({ ...toolRuntime, runtimeBrand });
+  // Per-instance tool context, built once and threaded to every bridge via
+  // `options.toolContext` (below). It replaces the former global side effect:
+  // two runtimes in one process now keep independent workspace/brand/sandbox
+  // config instead of clobbering a shared singleton. `configureTools` mutates
+  // THIS object so later runs of this instance observe the update.
+  const toolContext = createToolContext({ ...toolRuntime, runtimeBrand });
 
   return {
+    /**
+     * @param {string} systemPrompt
+     * @param {Partial<RuntimeRunOptions>} [options] Optional only so the
+     *   `options.model` guard below can throw a descriptive error; every
+     *   real caller must supply a model (see AgentRuntimeInstance.run).
+     * @returns {Promise<RuntimeResult>}
+     */
     async run(systemPrompt, options = {}) {
       if (!options.model) throw new Error("createRuntime.run requires options.model");
       const executionMode = typeof options.executionMode === "string" ? options.executionMode : "sdk";
@@ -80,19 +136,28 @@ export function createRuntime(host = {}) {
         observers: [...hostObservers, ...callObservers],
         onEvent: options.onEvent,
       });
+      const prompts = resolvePrompts(host.prompts, options.prompts);
       const result = await bridge.execute(systemPrompt, {
         ...hostDefaults,
         ...options,
+        // `...options` alone doesn't carry the `options.model` narrowing above
+        // (spread reads the parameter's declared — Partial — type); re-assert
+        // the already-validated model so the request satisfies RuntimeRequest.
+        model: options.model,
         executionMode,
         runtimeBrand,
+        toolContext,
         observerHub: hub,
         onEvent: hub.emit,
+        // Merged AFTER the spreads so the per-field run>host>default precedence
+        // wins over either bag's whole-object `prompts`.
+        ...(prompts === undefined ? {} : { prompts }),
       });
       await hub.flush();
       return result;
     },
     configureTools(next = {}) {
-      configureToolRuntime(pickDefined(next, TOOL_RUNTIME_KEYS));
+      updateToolContext(toolContext, pickDefined(next, TOOL_RUNTIME_KEYS));
     },
     async disposeSession(providerSessionId) {
       return disposeProviderSession(providerSessionId);

package/types/agent/allowlists.d.ts

@@ -0,0 +1,25 @@
+export function normalizeList(value: any): any[];
+export function normalizeAllowlistMode(value: any): any;
+export function storedAllowlistMode(value: any): "all" | "custom";
+export function parseStoredAllowlist(value: any): any[];
+/**
+ * @param {{mode?: string, list?: any, fallback?: string}} [options]
+ */
+export function inferAllowlistMode({ mode, list, fallback }?: {
+    mode?: string;
+    list?: any;
+    fallback?: string;
+}): any;
+export function resolveAllowlist({ mode, allowlist, all, getName }: {
+    mode: any;
+    allowlist: any;
+    all: any;
+    getName?: (item: any) => any;
+}): any;
+export function resolveAllowlistMap({ mode, allowlist, all }: {
+    mode: any;
+    allowlist: any;
+    all: any;
+}): any;
+export const ALLOWLIST_MODE_ALL: "all";
+export const ALLOWLIST_MODE_CUSTOM: "custom";

package/types/agent/approval.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @param {{onToolApprovalRequest?: any, defaultRiskTier?: string, timeoutMs?: number, onEvent?: (event: any) => void, riskTiersByTool?: any, alwaysAllowTools?: any}} [options]
+ */
+export function createApprovalManager({ onToolApprovalRequest, defaultRiskTier, timeoutMs, onEvent, riskTiersByTool, alwaysAllowTools, }?: {
+    onToolApprovalRequest?: any;
+    defaultRiskTier?: string;
+    timeoutMs?: number;
+    onEvent?: (event: any) => void;
+    riskTiersByTool?: any;
+    alwaysAllowTools?: any;
+}): {
+    request: (toolCall?: {}) => Promise<{
+        decision: string;
+        reason: string;
+        riskTier: any;
+    } | {
+        requestId: any;
+        riskTier: any;
+        decision: any;
+        reason: any;
+    }>;
+    riskTierFor: (toolName: any) => any;
+    sessionAllowlist: () => Set<any>;
+    isAlwaysAllowed: (toolName: any) => boolean;
+};
+export function wrapToolsWithApprovalGate(tools: any, approvalManager: any, { model }?: {
+    model?: any;
+}): any[];
+export const APPROVAL_DECISIONS: readonly string[];
+export const RISK_TIERS: readonly string[];

package/types/agent/compaction.d.ts

@@ -0,0 +1,97 @@
+/**
+ * @param {Object<string, *>} [settings]
+ * @param {Object} [model]
+ * @param {number} [model.contextWindow]
+ * @returns {AgentCompactionPolicy}
+ */
+export function resolveAgentCompactionPolicy(settings?: {
+    [x: string]: any;
+}, model?: {
+    contextWindow?: number;
+}): AgentCompactionPolicy;
+/**
+ * Fold the typed `toolLimits` / `compaction` policy objects and the deprecated
+ * `settings` bag into ONE settings-like object resolveAgentCompactionPolicy
+ * consumes, honoring PER-GROUP precedence: when a typed object is present its
+ * fields win and the legacy settings keys for that group are ignored entirely;
+ * when the typed object is absent, that group's settings keys are consumed (and
+ * reported in `consumedSettingsKeys` so the caller can emit exactly one
+ * deprecation warning per run).
+ * @param {{toolLimits?: Object<string, *>, compaction?: Object<string, *>, settings?: Object<string, *>}} [options]
+ * @returns {{settingsLike: Object<string, *>, consumedSettingsKeys: Array<string>}}
+ */
+export function resolveRuntimePolicyInputs({ toolLimits, compaction, settings }?: {
+    toolLimits?: {
+        [x: string]: any;
+    };
+    compaction?: {
+        [x: string]: any;
+    };
+    settings?: {
+        [x: string]: any;
+    };
+}): {
+    settingsLike: {
+        [x: string]: any;
+    };
+    consumedSettingsKeys: Array<string>;
+};
+/**
+ * Build the one-per-run deprecation warning fired when the legacy `settings`
+ * bag was consumed as a policy fallback. Shape matches the other pi/claude
+ * bridge runtime warnings ({warning_kind, source, message}).
+ * @param {ReadonlyArray<string>} consumedKeys
+ * @returns {{warning_kind: string, source: string, message: string, settings_keys: Array<string>}}
+ */
+export function deprecatedSettingsWarning(consumedKeys: ReadonlyArray<string>): {
+    warning_kind: string;
+    source: string;
+    message: string;
+    settings_keys: Array<string>;
+};
+/**
+ * @param {Object} [options]
+ * @param {string} [options.systemPrompt]
+ * @param {Array<Object>} [options.tools]
+ * @param {Array<Object>} [options.messages]
+ * @returns {{systemPromptTokens: number, toolSchemaTokens: number, userMessageTokens: number, fixedOverheadTokens: number}}
+ */
+export function estimateFixedOverheadTokens({ systemPrompt, tools, messages }?: {
+    systemPrompt?: string;
+    tools?: Array<any>;
+    messages?: Array<any>;
+}): {
+    systemPromptTokens: number;
+    toolSchemaTokens: number;
+    userMessageTokens: number;
+    fixedOverheadTokens: number;
+};
+/**
+ * @param {string} message
+ * @param {Object<string, *>} [diagnostics]
+ * @returns {boolean}
+ */
+export function isLikelyContextTermination(message: string, diagnostics?: {
+    [x: string]: any;
+}): boolean;
+export const DEPRECATED_SETTINGS_WARNING_KIND: "deprecated_settings_option";
+export type AgentCompactionPolicy = {
+    enabled: boolean;
+    contextWindow: number;
+    triggerRatio: number;
+    triggerTokens: number;
+    keepRecentTokens: number;
+    summaryMaxTokens: number;
+    fixedOverheadEnabled: boolean;
+    compactionMinSavingsTokens: number;
+    toolPayloadCompactionTriggerChars: number;
+    toolPruneTriggerTokens: number;
+    toolTextLimitChars: number;
+    bashOutputLimitChars: number;
+    mcpTextLimitChars: number;
+    searchResultLimit: number;
+    imageInlineMaxBytes: number;
+    toolPayloadMaxBytes: number;
+    mcpCallTimeoutMs: number;
+    mcpCallMaxTotalTimeoutMs: number;
+};

package/types/agent/index.d.ts

@@ -0,0 +1,5 @@
+export { isLikelyContextTermination, resolveAgentCompactionPolicy } from "./compaction.js";
+export { buildTranscriptTailSnapshot, renderResumeSnapshot } from "./transcript.js";
+export { ALLOWLIST_MODE_ALL, ALLOWLIST_MODE_CUSTOM, inferAllowlistMode, normalizeAllowlistMode, normalizeList, parseStoredAllowlist, resolveAllowlist, resolveAllowlistMap, storedAllowlistMode } from "./allowlists.js";
+export { APPROVAL_DECISIONS, RISK_TIERS, createApprovalManager, wrapToolsWithApprovalGate } from "./approval.js";
+export { BINARY_BLOAT_TOOLS, DEFAULT_TOOL_BLOAT_CONFIG, MAX_TOOL_RESULT_BYTES } from "./tool-bloat.js";

package/types/agent/prompt/skill-index.d.ts

@@ -0,0 +1,19 @@
+export function inferSkillsRoot(skills?: any[]): string;
+export function getSkillAccessDirs(skills?: any[]): string[];
+/**
+ * @param {{assetsPath?: string, skillsRoot?: any}} [options]
+ */
+export function buildSkillPathNote({ assetsPath, skillsRoot }?: {
+    assetsPath?: string;
+    skillsRoot?: any;
+}): string;
+/**
+ * @param {{body?: string, assetsPath?: string, skillsRoot?: any, maxChars?: number}} [options]
+ */
+export function formatSkillBodyWithPathNote({ body, assetsPath, skillsRoot, maxChars }?: {
+    body?: string;
+    assetsPath?: string;
+    skillsRoot?: any;
+    maxChars?: number;
+}): string;
+export function buildSkillIndex(skills: any): string;

package/types/agent/sandbox-seam.d.ts

@@ -0,0 +1,148 @@
+/** @type {RuntimeSandbox} */
+export const passthroughSandbox: RuntimeSandbox;
+export type SandboxCommandSpec = {
+    command: string;
+    args?: ReadonlyArray<string>;
+    cwd?: string;
+    env?: {
+        [x: string]: string;
+    };
+};
+export type PreparedSandboxCommand = SandboxCommandSpec & {
+    sandboxed: boolean;
+    cleanup?: () => Promise<void>;
+};
+export type SandboxNetworkPolicyLike = {
+    mode?: string;
+    allowlist?: ReadonlyArray<string>;
+};
+/**
+ * Opaque, host-defined sandbox policy. The kernel itself only ever inspects
+ * `mode` (passthroughSandbox's fail-closed check) and `network.mode`
+ * (passthroughSandbox's networkAllowsUrl) — every other field (root,
+ * readableRoots, writableRoots, denyWrite, ...) is read directly off whatever
+ * the injected `mergePolicies` returns by path-resolver.js, and is opaque
+ * pass-through data as far as this module is concerned. Real hosts get the
+ * full, richly-typed policy from
+ */
+export type SandboxPolicy = any;
+/**
+ * Optional concrete sandboxing backend a caller can hand to `prepareCommand`
+ * (matches
+ */
+export type RuntimeSandboxEngine = any;
+export type PrepareSandboxedCommandInput = {
+    policy?: SandboxPolicy;
+    engine?: RuntimeSandboxEngine;
+    command: SandboxCommandSpec;
+};
+/**
+ * The injectable sandbox seam. A host constructs one (or reuses
+ * `passthroughSandbox`) and passes it to `createRuntime({sandbox})`.
+ */
+export type RuntimeSandbox = {
+    /**
+     *   Monotonic tighten-only merge (I13): the result must never allow anything
+     *   `configured` alone would have denied.
+     */
+    mergePolicies: (configured: (SandboxPolicy | undefined), request: (SandboxPolicy | undefined)) => (SandboxPolicy | undefined);
+    /**
+     *   Resolves a command spec into whatever the underlying process spawner
+     *   should actually exec (identity when no enforcement is needed).
+     */
+    prepareCommand: (input: PrepareSandboxedCommandInput) => Promise<PreparedSandboxCommand>;
+    /**
+     *   Whether a tool call to `url` is allowed under `policy`.
+     */
+    networkAllowsUrl: (policy: (SandboxPolicy | undefined), url: string) => boolean;
+    /**
+     * Optional host-provided extra read-allowed roots beyond the tool
+     * context's workspace/repoRoot. Not consumed by any kernel helper today;
+     * documented for forward-compatibility with host-side path resolution.
+     */
+    additionalReadPaths?: ReadonlyArray<string>;
+};
+/**
+ * Plain Error with a `.code`/`.details` shape matching the workspace's
+ * CodedError convention (code discriminant + details that echo it, see the
+ * agent-contracts package's CodedError) — duplicated here rather than
+ * imported, since the kernel must not depend on any workspace package.
+ */
+export class SandboxUnavailableError extends Error {
+    /**
+     * @param {string} message
+     * @param {Record<string, unknown>} [details]
+     */
+    constructor(message: string, details?: Record<string, unknown>);
+    code: string;
+    details: {
+        code: string;
+    };
+}
+/**
+ * @typedef {Object} SandboxCommandSpec
+ * @property {string} command
+ * @property {ReadonlyArray<string>} [args]
+ * @property {string} [cwd]
+ * @property {Object<string, string|undefined>} [env]
+ */
+/**
+ * @typedef {SandboxCommandSpec & {sandboxed: boolean, cleanup?: () => Promise<void>}} PreparedSandboxCommand
+ */
+/**
+ * @typedef {Object} SandboxNetworkPolicyLike
+ * @property {string} [mode]
+ * @property {ReadonlyArray<string>} [allowlist]
+ */
+/**
+ * @typedef {Object} SandboxPolicy
+ * Opaque, host-defined sandbox policy. The kernel itself only ever inspects
+ * `mode` (passthroughSandbox's fail-closed check) and `network.mode`
+ * (passthroughSandbox's networkAllowsUrl) — every other field (root,
+ * readableRoots, writableRoots, denyWrite, ...) is read directly off whatever
+ * the injected `mergePolicies` returns by path-resolver.js, and is opaque
+ * pass-through data as far as this module is concerned. Real hosts get the
+ * full, richly-typed policy from @mono-agent/runtime-adapter
+ * (`packages/runtime-adapter/src/sandbox.ts`), whose `SandboxPolicy` is a
+ * structural superset of this shape.
+ * @property {string} [mode]
+ * @property {SandboxNetworkPolicyLike} [network]
+ * @property {ReadonlyArray<string>} [readableRoots]
+ * @property {ReadonlyArray<string>} [writableRoots]
+ * @property {ReadonlyArray<string>} [denyWrite]
+ * @property {string} [root]
+ */
+/**
+ * @typedef {Object} RuntimeSandboxEngine
+ * Optional concrete sandboxing backend a caller can hand to `prepareCommand`
+ * (matches @mono-agent/runtime-adapter's `SandboxEngine`). Not used by
+ * `passthroughSandbox` (see module doc: adapters live in runtime-adapter, not
+ * the kernel) — documented here only because it is part of the
+ * `prepareCommand` input shape real implementations accept.
+ * @property {() => Promise<boolean>} isAvailable
+ * @property {(command: SandboxCommandSpec, policy: SandboxPolicy) => Promise<PreparedSandboxCommand>} prepareCommand
+ */
+/**
+ * @typedef {Object} PrepareSandboxedCommandInput
+ * @property {SandboxPolicy} [policy]
+ * @property {RuntimeSandboxEngine} [engine]
+ * @property {SandboxCommandSpec} command
+ */
+/**
+ * @typedef {Object} RuntimeSandbox
+ * The injectable sandbox seam. A host constructs one (or reuses
+ * `passthroughSandbox`) and passes it to `createRuntime({sandbox})`.
+ * @property {(configured: (SandboxPolicy|undefined), request: (SandboxPolicy|undefined)) => (SandboxPolicy|undefined)} mergePolicies
+ *   Monotonic tighten-only merge (I13): the result must never allow anything
+ *   `configured` alone would have denied.
+ * @property {(input: PrepareSandboxedCommandInput) => Promise<PreparedSandboxCommand>} prepareCommand
+ *   Resolves a command spec into whatever the underlying process spawner
+ *   should actually exec (identity when no enforcement is needed).
+ * @property {(policy: (SandboxPolicy|undefined), url: string) => boolean} networkAllowsUrl
+ *   Whether a tool call to `url` is allowed under `policy`.
+ * @property {ReadonlyArray<string>} [additionalReadPaths]
+ *   Optional host-provided extra read-allowed roots beyond the tool
+ *   context's workspace/repoRoot. Not consumed by any kernel helper today;
+ *   documented for forward-compatibility with host-side path resolution.
+ */
+export const SANDBOX_UNAVAILABLE_CODE: "sandbox_unavailable";

package/types/agent/tool-bloat.d.ts

@@ -0,0 +1,22 @@
+export function summarisePayload(toolName: any, contentBlocks: any, persistArtifact: any, options?: {}): {
+    rewrittenBlocks: any[];
+    savedPaths: any[];
+    originalBytes: any;
+    truncated: boolean;
+} | {
+    rewrittenBlocks: {
+        type: string;
+        text: string;
+    }[];
+    savedPaths: any[];
+    originalBytes: any;
+    truncated: boolean;
+};
+export function applyToolBloatGuard(toolName: any, executePromise: any, options?: {}): Promise<any>;
+export function wrapToolsWithBloatGuard(tools: any, options?: {}): any[];
+export const MAX_TOOL_RESULT_BYTES: 262144;
+export const BINARY_BLOAT_TOOLS: readonly string[];
+export const DEFAULT_TOOL_BLOAT_CONFIG: Readonly<{
+    maxBytes: 262144;
+    binaryBloatTools: readonly string[];
+}>;

package/types/agent/tools/bash.d.ts

@@ -0,0 +1,16 @@
+export function normalizeBashTimeoutMs(value: any, fallback?: number): number;
+/**
+ * @param {{command: string, timeout?: number, max_output_chars?: number, workdir?: string}} params
+ * @param {{signal?: any, sandboxPolicy?: any, sandboxEngine?: any, ctx?: any}} [options]
+ */
+export function bashToolImpl({ command, timeout, max_output_chars, workdir }: {
+    command: string;
+    timeout?: number;
+    max_output_chars?: number;
+    workdir?: string;
+}, { signal, sandboxPolicy, sandboxEngine, ctx }?: {
+    signal?: any;
+    sandboxPolicy?: any;
+    sandboxEngine?: any;
+    ctx?: any;
+}): Promise<string>;

package/types/agent/tools/edit.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @param {{file_path: string, old_string: string, new_string: string, replace_all?: boolean, workdir?: string}} params
+ * @param {{sandboxPolicy?: any, ctx?: any}} [options]
+ */
+export function editToolImpl({ file_path, old_string, new_string, replace_all, workdir }: {
+    file_path: string;
+    old_string: string;
+    new_string: string;
+    replace_all?: boolean;
+    workdir?: string;
+}, { sandboxPolicy, ctx }?: {
+    sandboxPolicy?: any;
+    ctx?: any;
+}): Promise<string>;

package/types/agent/tools/glob.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @param {{pattern: string, path?: string, limit?: number, offset?: number, max_matches?: number, max_output_chars?: number, workdir?: string}} params
+ * @param {{sandboxPolicy?: any, ctx?: any}} [options]
+ */
+export function globToolImpl({ pattern, path, limit, offset, max_matches, max_output_chars, workdir }: {
+    pattern: string;
+    path?: string;
+    limit?: number;
+    offset?: number;
+    max_matches?: number;
+    max_output_chars?: number;
+    workdir?: string;
+}, { sandboxPolicy, ctx }?: {
+    sandboxPolicy?: any;
+    ctx?: any;
+}): Promise<string>;

package/types/agent/tools/grep.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @param {{pattern: string, path?: string, glob?: string, type?: string, output_mode?: string, context?: number, case_insensitive?: boolean, multiline?: boolean, head_limit?: number, offset?: number, max_matches?: number, max_output_chars?: number, workdir?: string}} params
+ * @param {{sandboxPolicy?: any, ctx?: any}} [options]
+ */
+export function grepToolImpl({ pattern, path, glob, type, output_mode, context, case_insensitive, multiline, head_limit, offset, max_matches, max_output_chars, workdir, }: {
+    pattern: string;
+    path?: string;
+    glob?: string;
+    type?: string;
+    output_mode?: string;
+    context?: number;
+    case_insensitive?: boolean;
+    multiline?: boolean;
+    head_limit?: number;
+    offset?: number;
+    max_matches?: number;
+    max_output_chars?: number;
+    workdir?: string;
+}, { sandboxPolicy, ctx }?: {
+    sandboxPolicy?: any;
+    ctx?: any;
+}): Promise<string>;

package/types/agent/tools/index.d.ts

@@ -0,0 +1,10 @@
+export { readToolImpl } from "./read.js";
+export { writeToolImpl } from "./write.js";
+export { editToolImpl } from "./edit.js";
+export { globToolImpl } from "./glob.js";
+export { grepToolImpl } from "./grep.js";
+export { webFetchToolImpl } from "./web-fetch.js";
+export { webSearchToolImpl } from "./web-search.js";
+export { resolveRgPath } from "./shared/ripgrep.js";
+export { bashToolImpl, normalizeBashTimeoutMs } from "./bash.js";
+export { isPathAllowed, isWorkdirAllowed } from "./shared/path-resolver.js";