@qoder-ai/qoder-agent-sdk 1.0.23 → 1.0.24

package/dist/types/options.d.ts

@@ -8,7 +8,7 @@ import type { HookCallbackMatcher, HookEvent } from './hooks.js';
 import type { McpServerConfig, McpServerStatus, McpSetServersResult, OAuthToken } from './mcp.js';
 import type { SDKMessage, SDKUserMessage } from './messages.js';
 import type { Settings } from './settings.js';
-import type { SDKControlInterruptResponse, SDKControlInitializeResponse, SDKControlGetContextUsageResponse, SDKControlGenerateSessionTitleResponse, SDKControlAddDirectoriesResponse, SDKControlReloadPluginsResponse, StdoutMessage } from './control.js';
+import type { SDKControlInterruptResponse, SDKControlInitializeResponse, SDKControlGetContextUsageResponse, SDKControlGenerateSessionTitleResponse, AskSideQuestionOptions, SideQuestionResult, SDKControlAddDirectoriesResponse, SDKControlReloadPluginsResponse, StdoutMessage } from './control.js';
 import type { ModelPolicyProvider } from './model-policy-provider.js';
 import type { BYOKModelValidationInput, BYOKProviderInfo } from './byok.js';
 import type { RewindFilesResult, RewindResult, RewindScope } from './session.js';
@@ -17,6 +17,7 @@ import type { QueryTransportProviderOption } from '../core/query-transport.js';
 import type { PluginDetails } from './plugins.js';
 import type { SessionStore, SessionStoreFlush } from '../session/session-store.js';
 import type { ModelPromptPatches } from '../protocol/model-prompt-patches.js';
+import type { MemoryOptions } from './memory.js';
 export type { CanUseTool };
 export type { AuthOptions };
 export type ElicitationRequest = {
@@ -50,6 +51,15 @@ export type PromptResponse = {
 };
 export type SettingSource = 'user' | 'project' | 'local';
 export type QueryTransportOptions = QueryTransportProviderOption;
+/** Built-in code security capabilities. All switches default to false. */
+export type SecurityScanOptions = {
+    /** Run the static security check after supported file edits. */
+    l1StaticCheck?: boolean;
+    /** Allow lightweight repository security scans. */
+    l2LightweightScan?: boolean;
+    /** Allow deep repository security scans. */
+    l3DeepScan?: boolean;
+};
 export type Options = {
     /**
      * Optional controller for defining when the host ends the session. Calling
@@ -80,6 +90,18 @@ export type Options = {
      */
     auth?: InternalAuthOptions;
     additionalDirectories?: string[];
+    /**
+     * Opaque business identifiers forwarded to every local qodercli inference
+     * request unless a user message supplies its own `custom_context`.
+     *
+     * Backend-enforced limits are 1–8 string entries, keys up to 32 Unicode code
+     * points, values up to 128 Unicode code points, and at most 1024 UTF-8 bytes
+     * for the serialized JSON object. Do not include tokens, Service Account
+     * keys, email addresses, phone numbers, other credentials, or sensitive
+     * personal data. Backend acceptance requires Service Account authentication
+     * and a qoder VPC deployment.
+     */
+    customContext?: Record<string, string>;
     /**
      * @experimental
      * @unstable Cloud Agent runtime is experimental and may change without
@@ -161,6 +183,11 @@ export type Options = {
      */
     resumeDropsTurn?: string;
     hooks?: Partial<Record<HookEvent, HookCallbackMatcher[]>>;
+    /**
+     * Configure QoderCLI-owned memory generation and consumption for this query.
+     * Functions stay in the SDK process and are bridged through control requests.
+     */
+    memory?: MemoryOptions;
     onElicitation?: OnElicitation;
     /**
      * Called when the SDK detects that authentication has expired or
@@ -226,6 +253,11 @@ export type Options = {
     loadTimeoutMs?: number;
     sessionId?: string;
     settings?: string | Settings;
+    /**
+     * Enables built-in code security capabilities for this SDK session.
+     * Omitted switches are disabled. This option is authoritative when provided.
+     */
+    securityScan?: SecurityScanOptions;
     settingSources?: SettingSource[];
     stderr?: (data: string) => void;
     strictMcpConfig?: boolean;
@@ -358,6 +390,11 @@ export interface Query extends AsyncGenerator<SDKMessage, void> {
     generateSessionTitle(description: string, options?: {
         persist?: boolean;
     }): Promise<SDKControlGenerateSessionTitleResponse['title']>;
+    /**
+     * Ask a one-off question using the current conversation context without
+     * interrupting or mutating the main agent turn.
+     */
+    askSideQuestion?(question: string, options?: AskSideQuestionOptions): Promise<SideQuestionResult | null>;
     /**
      * Add directories to the running session's workspace context.
      *
@@ -417,6 +454,10 @@ export interface Query extends AsyncGenerator<SDKMessage, void> {
         dryRun?: boolean;
     }): Promise<RewindResult>;
     seedReadState(path: string, mtime: number): Promise<void>;
+    /** Wait until pending TurnComplete memory generation has finished. */
+    flushMemory(): Promise<void>;
+    /** Reload configured memory consumption files without changing config. */
+    refreshMemory(): Promise<void>;
     /**
      * 主动驱动 MCP OAuth：拉起 OAuth 流程，返回授权 URL 让 host 引导用户跳转。
      *

package/dist/types/plugins.d.ts

@@ -97,6 +97,7 @@ export type PluginValidationReport = {
     resources?: PluginResources;
 };
 export type ValidatePluginOptions = {
+    /** Optional qodercli executable or qoder Worker runtime entry override. */
     cliPath?: string;
     env?: Record<string, string>;
     signal?: AbortSignal;

package/dist/types/session.d.ts

@@ -36,6 +36,12 @@ export type SessionMessage = {
     isApiErrorMessage?: true;
     /** CLI-stamped display metadata for tool results that did not execute. */
     tool_result_meta?: SDKToolResultMeta[];
+    /**
+     * Structured tool result persisted by qodercli alongside a user
+     * `tool_result` message. When one transcript entry contains multiple
+     * `tool_result` blocks, this is an array aligned with those blocks by index.
+     */
+    tool_use_result?: unknown;
     /**
      * ISO 8601 timestamp of when this transcript entry was written to the
      * jsonl file. Mirrors the on-disk `timestamp` field. Optional because

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qoder-ai/qoder-agent-sdk",
-  "version": "1.0.23",
+  "version": "1.0.24",
   "description": "TypeScript SDK for building Qoder-powered coding agents.",
   "type": "module",
   "main": "dist/index.js",
@@ -50,7 +50,7 @@
   "peerDependencies": {
     "zod": "^3.25.0 || ^4.0.0"
   },
-  "qoderCliVersion": "1.1.23",
+  "qoderCliVersion": "1.1.25",
   "qoderSdkBrand": "global",
   "license": "SEE LICENSE IN LICENSE"
 }