@sema-ai/core 1.275.1

package/dist/core/runner/turn-attachments.d.ts

@@ -0,0 +1,381 @@
+/**
+ * design/133 §R3 — turn-boundary attachment seam: the PURE producer layer (CC `getContextAttachments`
+ * parity). This module is the single home of the CC-parity cadence judgment + reminder copy (提示词主权批:
+ * harness 语料归 core); it holds NO harness handle, does NO I/O, and never injects anything itself — the
+ * run loop (runtask onTurnBoundary) is the ONLY steerer. That split exists so every trigger window is
+ * offline-testable and the injection gate/ordering stays at the one arbitration point the engine already has.
+ *
+ * F3 (wrapper semantics): a {@link TurnAttachment} carries the BODY ONLY — no `<system-reminder>` shell.
+ * The steerer wraps each body exactly once at a single call site, so double-wrap/no-wrap can't drift
+ * per-producer.
+ */
+/** CC-verbatim cadence constants (CC attachments.ts:254-262). */
+export declare const TODO_REMINDER_CONFIG: {
+    readonly TURNS_SINCE_WRITE: 10;
+    readonly TURNS_BETWEEN_REMINDERS: 10;
+};
+export declare const PLAN_MODE_ATTACHMENT_CONFIG: {
+    readonly TURNS_BETWEEN_ATTACHMENTS: 5;
+    readonly FULL_REMINDER_EVERY_N_ATTACHMENTS: 5;
+};
+/** F5: per-boundary stat scan upper bound — at most this many most-recently-read files are stat'ed. */
+export declare const CHANGED_FILES_MAX = 20;
+/**
+ * F5 (记档 known limitation): `ReadEntry.lastReadAt` is wall-clock (Date.now) while `FileInfo.mtimeMs`
+ * is the fs clock — a cross-clock comparison (CC getChangedFiles is the same shape: its readFileState
+ * timestamp is also wall-clock). The 2s epsilon absorbs ordinary skew/mtime granularity; git-checkout /
+ * formatter storms remain a documented false-positive source (hash-confirm 抗假阳 = v2).
+ */
+export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
+/** Per-boundary payload byte cap over the whole bundle (weak-model context economics). */
+export declare const ATTACHMENT_BYTE_CAP: number;
+export type AttachmentSource = "todo_reminder" | "task_reminder" | "changed_files" | "plan_mode" | "budget_usd" | "background_tasks" | "tools_delta" | "agent_listing" | "mcp_instructions";
+/** G1 续批 — one agent type on the delegation tool's roster (ToolSpec.agentListing, filled by
+ *  createSubagentTool: defined agents + the built-in fork when offered). */
+export interface AgentListingEntry {
+    name: string;
+    description: string;
+    /** Pre-rendered tool-boundary note for the `(Tools: …)` line tail (CC `gHm`, pretty.js:453014-453027:
+     *  "All tools" / "All tools except X, Y" / an explicit list / "None"). Computed by the producer
+     *  (createSubagentTool → {@link import("../../agents/subagent.js").agentToolsNote}); omitted ⇒ the line
+     *  renders without a tail (pre-F3 shape, kept for hand-built deployments). */
+    tools?: string;
+}
+/** G1 通告层 (黑板 [482]): a background task visible to THIS run, snapshotted at the boundary by the
+ *  runtask-side getter (registry ground truth — the producer never touches the registry itself). */
+export interface BackgroundTaskSnapshot {
+    id: string;
+    description?: string;
+    status: string;
+}
+/** One due reminder. `body` is the inner text — the steerer adds the `<system-reminder>` wrapper (F3). */
+export interface TurnAttachment {
+    source: AttachmentSource;
+    body: string;
+}
+/** H4 — the thin projection of a todo list kept run-local (NEVER the wire-capped structuredFrom card).
+ *  Pure CONTENT memory: the write-window anchor lives on {@link AttachmentState.todoLastWriteTurn}
+ *  (task #51 F3 — the window resets on tool-call INITIATION, which may precede/outlive any ingest). */
+export interface ListProjection {
+    /** status → count over the FULL list (uncapped counts stay honest when items are clipped). */
+    statusCounts: Record<string, number>;
+    /** ≤{@link PROJECTION_ITEMS_MAX} items, content clipped to {@link PROJECTION_CONTENT_MAX} chars. */
+    items: Array<{
+        content: string;
+        status: string;
+    }>;
+}
+/**
+ * Run-local mutable producer state, owned by the run loop (one per run, torn down with it). Mutated by
+ * {@link reduceToolEnd} (ingest) and {@link collectDueAttachments} (window bookkeeping on fire) — both
+ * synchronous and deterministic, so the state stays offline-testable despite the mutation.
+ */
+export interface AttachmentState {
+    /** TodoWrite family snapshot; undefined = TodoWrite never used this run (CC still reminds: the
+     *  gentle "hasn't been used recently" nudge with no list section). */
+    todo?: ListProjection;
+    /** Task family (TaskCreate/TaskUpdate/TaskGet/TaskList) — keyed by task id so per-task updates from a
+     *  PARALLEL tool batch commute (F10: distinct ids reduce to the same map in either completion order). */
+    taskItems?: Map<string, {
+        content: string;
+        status: string;
+    }>;
+    /** Cadence-clock value AT the last task WRITE anchor block, INCLUSIVE (task #51 F1 block units — see
+     *  {@link advanceCadenceClock}). 口径① (CC 198 pretty.js:480254): CC's `qFm` counter resets ONLY on a
+     *  TaskCreate/TaskUpdate tool_use (`a.name === bD || a.name === hF`) — a TaskGet/TaskList READ is NOT
+     *  engagement and leaves the 10-unit window running. F3: stamped on tool-call INITIATION (the tool_use
+     *  block existing in the transcript IS CC's anchor — qFm never checks execution outcome, so a failed or
+     *  policy-blocked write still resets the window), via {@link stampWriteAnchor} from the message walk. */
+    taskLastWriteTurn?: number;
+    /** TodoWrite counterpart of {@link taskLastWriteTurn} (same block coordinate, same initiation-anchor
+     *  semantics — CC BFm :480217-480219 matches the TodoWrite tool_use block by name only). */
+    todoLastWriteTurn?: number;
+    lastTodoReminderTurn: number;
+    lastTaskReminderTurn: number;
+    /** plan_mode attachments emitted so far — drives CC's full/sparse rotation (1st, 6th, 11th… = full).
+     *  0 also encodes "never attached": CC always attaches on the FIRST plan-mode boundary, then throttles. */
+    planAttachmentCount: number;
+    lastPlanReminderTurn: number;
+    /** changed_files per-path dedup: the last mtime already surfaced for a path — the same (path, mtime)
+     *  is never reported twice. Evicted alongside readFileState's ENOENT eviction (LOW-9: bounded by it). */
+    surfacedMtime: Map<string, number>;
+    /** G1 backgroundTasks ([482], CC /compact parity): SET by the run loop when a compaction LANDS,
+     *  CONSUMED at the next boundary the collector actually runs (a steered-away boundary carries it
+     *  forward untouched — the collector is never called there). One-shot: post-compact announce once,
+     *  never per-boundary nagging. A cap-starved bundle loses this one snapshot (documented trade-off,
+     *  same class as the truncated changed_files batch): the next compaction re-arms it. */
+    postCompactPending: boolean;
+    /** G1 续批 agent_listing (CC `agent_listing_delta`): name → description of the agent types already
+     *  ANNOUNCED this leg. `undefined` = the initial full-roster announcement is still pending (CC
+     *  isInitial). Advanced ONLY by {@link commitAgentListing} (run-loop-owned, on intact cap survival —
+     *  MED-3①). A durable-resume leg is SEEDED by the run loop ONLY when the prior leg's transcript
+     *  actually carries a listing reminder (MED-3② conservative seed — a first leg that suspended
+     *  before its first clean boundary never announced, so the resume leg re-announces; cross-leg
+     *  roster drift is deliberately not delta-announced, static-registry assumption recorded). */
+    announcedAgentTypes?: Map<string, string>;
+}
+export declare function createAttachmentState(): AttachmentState;
+/**
+ * H4 — thin-projection reducer over a tool's RAW `result.details` (NOT the wire `structuredFrom`
+ * projection and its 4×16K caps: a huge todo list must shrink into a bounded snapshot here, never
+ * disarm the reminder by being dropped wholesale). Only the first-party discriminants `todo` /
+ * `task` / `task-list` are recognized — every other card type (subagent `agent`/`fork`/`task-output`,
+ * bash, fs, mcp, …) is structurally ignored, which is also the child-isolation contract: a subagent's
+ * own todo state never reaches the parent's onToolEnd, and its delegation-card types don't parse here.
+ *
+ * task #51 F3 (窗口复位/投影摄入拆分, 复审 confirmed): this reducer is PROJECTION INGEST ONLY — it
+ * never touches the write windows. CC's window anchor is the tool_use block's PRESENCE in the
+ * transcript (qFm/BFm match the block by name, :480217-480219/:480253-480254, with no execution-
+ * outcome check), so the run loop stamps the windows on INITIATION via {@link stampWriteAnchor}
+ * (inside {@link advanceCadenceClock}'s message walk); ingest stays success-only — a failed write
+ * has no trustworthy `details`, exactly like CC's reminder body rendering from the authoritative
+ * store rather than from tool results.
+ *
+ * Idempotent (same event twice ⇒ same state) and commutative across DISTINCT task ids (F10); two
+ * whole-list writes (TodoWrite / TaskList) racing in one batch are last-write-wins by nature — the
+ * later list IS the truer snapshot, documented rather than fought.
+ */
+export declare function reduceToolEnd(state: AttachmentState, details: unknown): void;
+/** task #51 F2/F3 — which reminder window a WRITE tool resets. Resolved by the run loop (alias-aware:
+ *  ToolSpec.aliases + canonicalToolName); the producers here never inspect tool names themselves. */
+export type WriteFamily = "todo" | "task";
+/**
+ * task #51 F3 (发起锚) — reset a write window at the cadence-clock value of the write tool_use block
+ * (INCLUSIVE of that block). CC's qFm/BFm anchor is the tool_use block's presence in the transcript
+ * (:480217-480219/:480253-480254) with NO execution-outcome check — a failed, policy-blocked, or
+ * suspended call still resets the 10-unit window. Callers: {@link advanceCadenceClock}'s message walk
+ * (the transcript-anchor moment) and the durable-resume gated-write replay (leg-local clock).
+ */
+export declare function stampWriteAnchor(state: AttachmentState, family: WriteFamily, clock: number): void;
+/**
+ * 口径④ cadence clock, task #51 F1 (复审 HIGH, 锚核坐实 2026-07-10) — CC's cadence unit is the
+ * per-content-block assistant TRANSCRIPT ENTRY, not the physical turn. CC 198 mints ONE
+ * `{type:"assistant"}` entry PER content block: the streaming layer at `content_block_stop`
+ * (pretty.js:593011-593038 — `content: pnn([Pr],…)` single-block array, `rn.push` per block) and the
+ * `tgf` normalizer (:597284 — `content.map` → one single-block entry each). The reminder counters
+ * BFm/qFm (:480210-480226/:480246-480262) then tick `r++`/`o++` once per non-`_or` entry, and `_or`
+ * (:599513-599517) applied to a single-block entry degenerates to "is this block thinking/
+ * redacted_thinking" — so the 10/10 windows consume ONE unit per NON-THINKING CONTENT BLOCK. A
+ * `[text, tool_use]` turn costs 2 units, a parallel-k tool batch costs k(+lead) — live probe
+ * (bench/probes/task51-cadence-live, real CC 2.1.198 + stub API): `[text, tool_use]×N` fires the
+ * task_reminder at request #7, block-exact, where a turn-level clock predicts #11-12.
+ *
+ * Applied by the run loop once per completed assistant MESSAGE; returns the advanced clock. CC edge
+ * semantics kept verbatim: non-array content → `_or` false → counted as ONE entry; an empty array is
+ * vacuously all-thinking (`.every`) → 0. sema folds `redacted_thinking` into `{type:"thinking",
+ * redacted:true}` (brain/anthropic.ts B2) so matching "thinking" covers both; the literal
+ * "redacted_thinking" arm serves CC-shape inputs. `stats.turns` is untouched — it has unrelated
+ * consumers (limits/budget/telemetry) whose physical-turn semantics must not drift.
+ *
+ * F3 write anchors ride the SAME walk: a toolCall block whose name resolves (alias-aware, F2) to a
+ * write family stamps that window at the block's inclusive clock value — CC-exact: same-message
+ * leading text blocks sit BEFORE the anchor (they consumed budget but are not part of the
+ * since-write distance), later sibling blocks count toward it; the LAST write block wins, matching
+ * qFm's tail-first scan.
+ */
+export declare function advanceCadenceClock(state: AttachmentState, clock: number, content: unknown, writeFamilyOf: (toolName: string) => WriteFamily | undefined): number;
+/**
+ * task #51 F4 (压缩交互, 复审 confirmed) — rebase every reminder window to the CURRENT cadence clock
+ * when a compaction LANDS. CC's windows are recomputed per request by BACKWARD TRANSCRIPT SCAN
+ * (BFm/qFm): compaction removes the write tool_use anchors and the reminder attachment entries, so
+ * both counters find nothing (t=-1/n=-1) and only count post-compaction entries — the windows
+ * effectively RESET, needing another 10 non-thinking entries before the next fire. sema's stateful
+ * windows would otherwise survive compaction and fire at the first post-compact boundary where CC
+ * stays silent. Setting all four fields to `clock` makes each window measure distance from the
+ * compaction point — arithmetic-identical to CC's anchor loss. (If a messagesToKeep-style preserved
+ * segment is ever implemented, a recent anchor inside the kept tail would survive in CC — refine
+ * this to check the preserved segment then; recorded caveat.)
+ */
+export declare function rebaseCadenceWindows(state: AttachmentState, clock: number): void;
+export interface AttachmentInputs {
+    /** COMPLETED assistant turns at this boundary (`stats.turns`). */
+    turn: number;
+    /** 口径④/F1 — the BLOCK-level cadence clock at this boundary: total NON-THINKING content blocks
+     *  across all completed assistant messages ({@link advanceCadenceClock}, CC per-block transcript
+     *  entries :593011/:597284 ticked by BFm/qFm :480210-480226/:480246-480262). This is the todo/task
+     *  reminder-cadence clock — thinking blocks never consume 10/10 budget (`_or` :599513), and a
+     *  multi-block turn consumes one unit PER block, so the windows run 2-3× faster than physical
+     *  turns on real transcripts (text+tool_use is the norm). Write anchors ({@link stampWriteAnchor})
+     *  are stamped in this SAME coordinate. Omitted ⇒ falls back to `turn` (correct only for the
+     *  degenerate one-non-thinking-block-per-turn transcript). plan_mode keeps `turn` (its cadence is
+     *  a recorded sema deviation already — assistant turns, not CC human turns). */
+    cadenceTurn?: number;
+    /** Whether TodoWrite is mounted (CC gate: no tool ⇒ no reminder, ever). */
+    todoMounted: boolean;
+    /** Whether the task-family tools are mounted. Both mounted ⇒ task_reminder wins (CC isTodoV2 branch). */
+    taskListMounted: boolean;
+    /** Live plan-mode flag (planModeRef.active). One-way in sema: exit re-prepares the run, so a false
+     *  here simply stops the producer — no re-entry cycle reset is needed (documented deviation from CC's
+     *  countPlanModeAttachmentsSinceLastExit, which sema's lifecycle makes unreachable). */
+    planActive: boolean;
+    /** SR-3 budget_usd lane (CC 198 `QFm` producer :480424-480428 + renderer :600225): the run's cost
+     *  progress against its $ ceiling, in USD. Only passed when `config.budgetUsd` opted in AND the task
+     *  actually carries a ceiling (CC gate `e === void 0 → []` — no `maxBudgetUsd`, no lane). CC computes
+     *  `used = sy()` (session-cumulative totalCostUSD) and `remaining = total − used`, both raw JS numbers;
+     *  sema feeds the SAME coordinate its budget gate enforces (`stats.costMicroUsd`/`maxCostMicroUsd`,
+     *  ÷1e6 → USD) so the model-visible numbers can never disagree with the `budget.exceeded` verdict. */
+    budgetUsd?: {
+        used: number;
+        total: number;
+    };
+    config: {
+        todoReminder: boolean;
+        /** 口径③ — CC `r2o()` kill-switch parity (pretty.js:479167-479171; consumed by both producers at
+         *  :480232/:480268 as `if (r2o() === "off") return []`). CC resolves the mode from env
+         *  `CLAUDE_CODE_TODO_REMINDER_MODE` (highest precedence) else the `tengu_soft_slate_nudge` gate;
+         *  `"off"` silences BOTH the todo and task reminder lanes even when otherwise wired on, any other
+         *  value (or absence) = CC `"baseline"` (on). sema keeps env resolution at the deployment shell
+         *  (sema-tb `TB_TODOREMIND=off`) and carries only the resolved mode here — core reads no env. */
+        todoReminderMode?: "baseline" | "off";
+        changedFiles: boolean;
+        planModeReminder: boolean;
+        /** SR-3: budget_usd progressive reminder lane (opt-in, default OFF like every 133 member). CC 198
+         *  fires it on EVERY attachment cycle of the MAIN agent while `maxBudgetUsd` is set (mount
+         *  :479243-479245, gated `d = !t.agentId` :479177 — subagents never see it); there is NO threshold
+         *  ladder and no throttle window in CC (QFm is unconditional) — the "progression" is the numbers
+         *  advancing with spend. sema mirrors that: one line per collected clean boundary, no window state
+         *  here; the run loop adds a continuation gate (tool-calling turns only — a boundary steer must
+         *  never EXTEND a finished run, see runtask's `lastTurnHadToolCalls`). */
+        budgetUsd?: boolean;
+        /** G1 [482]: post-compact background-task announce (opt-in, default OFF like the 133 members). */
+        backgroundTasks?: boolean;
+        /** G1: deferred-tool materialization announce (design/36 setTools delta → boundary notice). */
+        toolsDelta?: boolean;
+        /** G1 续批: agent-type roster announce (CC `agent_listing_delta`). */
+        agentListing?: boolean;
+        /** G1 续批: MCP server-instruction delta announce (CC `mcp_instructions_delta`). */
+        mcpInstructions?: boolean;
+    };
+    /** Boundary-time scan result (already stat'ed + EPS-filtered by the prepare-task closure). Only
+     *  passed when `changedFiles` is opted in — OFF must mean zero stat calls upstream. */
+    changedFiles?: ReadonlyArray<{
+        path: string;
+        mtimeMs: number;
+    }>;
+    /** G1 backgroundTasks: registry snapshot (pending/running only, filtered by the runtask getter).
+     *  Only fetched when opted in AND `state.postCompactPending` — OFF means zero registry reads. */
+    backgroundTasks?: ReadonlyArray<BackgroundTaskSnapshot>;
+    /** G1 toolsDelta: deferred tools MATERIALIZED since the last announcement (prepare-task's
+     *  rematerialize diff — already newly-added-only, resume-seeded actives never appear here). The
+     *  CALLER owns consumption: drain its pending list only when the returned capped bundle actually
+     *  retained the `tools_delta` block (cap starvation must not lose the announcement forever). */
+    newTools?: readonly string[];
+    /** G1 续批 agent_listing: the boundary-time roster snapshot of the mounted delegation tool
+     *  (prepare-time static in practice; the producer's delta path serves dynamic-registration
+     *  deployments and tests). Only passed when `config.agentListing` opted in. */
+    agentListing?: ReadonlyArray<AgentListingEntry>;
+    /** The delegation tool's mounted name — interpolated into the CC-verbatim headers ("…for the
+     *  Agent tool:"); byte-identical to CC under the default name "Agent". */
+    agentToolName?: string;
+    /** G1 续批 mcp_instructions: pending deltas snapshotted from `MaterializedMcp.instructionsDelta`.
+     *  CALLER-owned consumption on intact cap survival (same `newTools` discipline). */
+    mcpInstructions?: {
+        added: ReadonlyArray<{
+            server: string;
+            text: string;
+        }>;
+        removed: readonly string[];
+    };
+}
+/**
+ * Compute every reminder due at this clean turn boundary. Pure decision + render — no I/O; the only
+ * mutation is the window bookkeeping on the state the caller owns (reminder turns, surfacedMtime),
+ * done HERE because the caller only invokes this once per boundary after its injection gate passed —
+ * splitting "decide" from "mark sent" would just invite a drift between the two.
+ *
+ * Returns attachments in EVIDENCE-STRENGTH order (todo/task → plan_mode → budget_usd →
+ * background_tasks → tools_delta → agent_listing → mcp_instructions → changed_files), which is also the §R3 MED-6
+ * truncation order read backwards: under the 8KB cap changed_files is sacrificed first, the todo/task
+ * list last. The G1 members ([482] + 续批) are registry/engine ground truth (strong), but the
+ * todo/plan lane keeps priority: it carries the run's own work-tracking state, which the model can
+ * least afford to lose.
+ */
+export declare function collectDueAttachments(state: AttachmentState, inp: AttachmentInputs): readonly TurnAttachment[];
+/**
+ * SR-3 — CC 2.1.198 VERBATIM template (bundle pretty.js:600225, the `budget_usd` attachment renderer):
+ *   `USD budget: $${used}/$${total}; $${remaining} remaining`
+ * `remaining = total − used` is computed producer-side in CC (QFm :480427 `n = e - t`) and re-derived
+ * here from the two inputs — one fewer number to drift. CC interpolates RAW JS numbers (sy() is a
+ * float accumulator; no rounding anywhere in QFm or the renderer), kept verbatim: sema's inputs come
+ * from integer micro-USD ÷ 1e6, so they render with ≤6 decimals by construction.
+ */
+export declare function renderBudgetUsd(used: number, total: number): string;
+/**
+ * SR-7 — CC 2.1.198 VERBATIM inner text (bundle pretty.js:698391-698398, `F6c`): the aggregated
+ * orphaned-background-task notice a restarted/resumed leg injects ONCE (CC's own `<system-reminder>`
+ * wrapper is added by the caller — sema's single-wrap-point discipline, F3). Line shape CC-exact:
+ * `- ${description || "(no description)"} (task ${id})` — `||` kept (an EMPTY description also reads
+ * "(no description)", CC-same). Consumed by the runtask durable-resume path, NOT a boundary producer:
+ * the trigger is the resume itself (CC gate `CLAUDE_CODE_RESUME_INTERRUPTED_TURN`, :707384), not a
+ * cadence window.
+ */
+export declare function renderOrphanedBackgroundTasks(tasks: ReadonlyArray<{
+    id: string;
+    description?: string;
+}>): string;
+/**
+ * G1 — deferred-tool materialization announce (design/36 boundary notice). CC 2.1.198 template
+ * (bundle pretty.js:599148, `deferred_tools_delta` case) verbatim reads: "The following deferred
+ * tools are now available via ${ToolSearch}. Their schemas are NOT loaded — calling them directly
+ * will fail with InputValidationError. Use ${ToolSearch} with query \"select:<name>[,...]\" to load
+ * tool schemas before calling them:" — but CC announces DISCOVERABLE tools (schemas still deferred),
+ * while sema announces MATERIALIZED tools (tool_search already ran setTools; schemas ARE live), so
+ * the middle clause is inverted to match sema's actual contract. Same CC shape: lead sentence +
+ * name list.
+ */
+export declare function renderToolsDelta(names: readonly string[]): string;
+/** CC 2.1.198 verbatim (bundle pretty.js:599221, `agent_listing_delta` isInitial+showConcurrencyNote arm). */
+export declare const AGENT_CONCURRENCY_NOTE = "When you launch multiple agents for independent work, send them in a single message with multiple tool uses so they run concurrently.";
+/** CC-verbatim ambient-context tail (CC 2.1.198 `Emr`, pretty.js:599992 — resolved by the 2026-07-10
+ *  parity spot audit, PARITY-SPOT-AGENT-TYPES F5 / PARITY-SPOT-REMINDERS SR-V1). CC appends it after BOTH
+ *  removal lists (agent types :599211, mcp instructions :599240) so the model treats the drift notice as
+ *  background, not something to announce. */
+export declare const AMBIENT_CONTEXT_NOTE = "This is ambient context \u2014 do not narrate it to the user unless they ask or it is directly relevant to their request.";
+/** CC-verbatim initial-roster header (interpolated tool name) — single-sourced here for the renderer
+ *  AND the run loop's resume transcript probe (MED-3②: "was the listing ever delivered?"). */
+export declare function agentListingInitialHeader(toolName: string): string;
+/** CC-verbatim roster-drift header — same single-source rationale as {@link agentListingInitialHeader}. */
+export declare function agentListingDeltaHeader(toolName: string): string;
+/**
+ * G1 续批 — agent-type roster announce (CC 2.1.198 `agent_listing_delta`, bundle pretty.js:599199-599223,
+ * headers VERBATIM with the tool name interpolated — byte-identical to CC under the default "Agent").
+ * First call (no announced map) = CC `isInitial`: full roster under "Available agent types…", plus the
+ * concurrency note when more than one type is offered (考据档 showConcurrencyNote semantics). Later
+ * calls announce only drift: adds under "New agent types are now available…", removals under "The
+ * following agent types are no longer available:" + `- <name>` lines, followed by the CC-verbatim
+ * {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`, pretty.js:599211/599992). Name-keyed like CC: a description
+ * change on an existing name is not re-announced. Lines carry a `(Tools: …)` tail when the entry
+ * provides one (CC `tIl`/`gHm`, pretty.js:453014-453031 — the model needs each type's tool boundary
+ * to pick a type; PARITY-SPOT-AGENT-TYPES F3).
+ *
+ * 1.256 复审 MED-3①: PURE — never mutates `state`. The announced-set advance is CALLER-owned via
+ * {@link commitAgentListing}, committed ONLY when the rendered block survived the byte cap INTACT
+ * (tools_delta/mcp_instructions discipline — a cap-clipped/dropped block previously advanced the
+ * announced map anyway, losing the roster announcement forever).
+ */
+export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string): string | undefined;
+/**
+ * MED-3① commit half of {@link renderAgentListingDelta}: mark the CURRENT roster as announced. The run
+ * loop calls this only when the `agent_listing` block survived the capped bundle INTACT (body equality
+ * against a re-render — same predicate as the tools_delta drain); a clipped/dropped block leaves the
+ * announced map untouched so the next quiet boundary re-announces. Snapshotting `entries` wholesale is
+ * equivalent to add/remove bookkeeping (the diff is name-keyed; descriptions are never re-diffed).
+ */
+export declare function commitAgentListing(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>): void;
+/**
+ * G1 续批 — MCP server-instruction delta (CC 2.1.198 `mcp_instructions_delta`, bundle
+ * pretty.js:599225-599248, headers VERBATIM). Deliberate CC deviations (recorded):
+ * - added instruction text is UNTRUSTED server-controlled text → each block rides inside a
+ *   `delimitUntrusted` fence (CC injects the raw block; sema's external-inlet posture is fencing —
+ *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
+ * The disconnect list is followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`,
+ * pretty.js:599240/599992 — resolved by the 2026-07-10 parity spot audit).
+ * Removal names are `\n`-joined WITHOUT a `- ` prefix (CC-exact; the agent-listing removal list DOES
+ * carry the prefix — the asymmetry is CC's, kept verbatim). Exported for the run loop's
+ * intact-survival consumption check (tools_delta discipline).
+ */
+export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
+    server: string;
+    text: string;
+}>, removed: readonly string[]): string | undefined;
+//# sourceMappingURL=turn-attachments.d.ts.map

package/dist/core/runner/turn-attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-attachments.d.ts","sourceRoot":"","sources":["../../../src/core/runner/turn-attachments.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,iEAAiE;AACjE,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AACX,eAAO,MAAM,2BAA2B;;;CAG9B,CAAC;AAEX,uGAAuG;AACvG,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAW,CAAC;AAO5C,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,eAAe,GACf,eAAe,GACf,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,aAAa,GACb,eAAe,GACf,kBAAkB,CAAC;AAEvB;4EAC4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;kFAG8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;oGACoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;uGAEuG;AACvG,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oGAAoG;IACpG,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;0EACsE;IACtE,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;6GACyG;IACzG,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;6GAKyG;IACzG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;gGAC4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B;+GAC2G;IAC3G,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B;6GACyG;IACzG,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;4FAIwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;kGAM8F;IAC9F,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CASvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CA0D5E;AAED;qGACqG;AACrG,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAGjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,GAC3D,MAAM,CAaR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAKhF;AAQD,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;oFAQgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,yGAAyG;IACzG,eAAe,EAAE,OAAO,CAAC;IACzB;;4FAEwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;0GAKsG;IACtG,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,MAAM,EAAE;QACN,YAAY,EAAE,OAAO,CAAC;QACtB;;;;;yGAKiG;QACjG,gBAAgB,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;QACtC,YAAY,EAAE,OAAO,CAAC;QACtB,gBAAgB,EAAE,OAAO,CAAC;QAC1B;;;;;;kFAM0E;QAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kGAAkG;QAClG,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,+FAA+F;QAC/F,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,oEAAoE;QACpE,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kFAAkF;QAClF,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF;2FACuF;IACvF,YAAY,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE;qGACiG;IACjG,eAAe,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACxD;;;oGAGgG;IAChG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;mFAE+E;IAC/E,YAAY,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAChD;8EAC0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;wFACoF;IACpF,eAAe,CAAC,EAAE;QAAE,KAAK,EAAE,aAAa,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1G;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,SAAS,cAAc,EAAE,CAiH9G;AA2CD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAMhH;AA4CD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMjE;AAED,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,0IACsG,CAAC;AAE1I;;;6CAG6C;AAC7C,eAAO,MAAM,oBAAoB,8HACuF,CAAC;AAEzH;8FAC8F;AAC9F,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,2GAA2G;AAC3G,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACzC,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAwBpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAE1G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACtD,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,GAAG,SAAS,CAcpB"}