@tencent-ai/agent-harness 0.2.0-beta.1 → 0.2.0-beta.2

package/cli/dist-server/types/workspace/authentication/lib/common/account-scoped-external-link-authentication-provider.d.ts

@@ -2,7 +2,7 @@ import { RestOperations } from '@celljs/http';
 import { AuthenticationType, ClientInfoProvider, ProductConfiguration, ProductManager } from '../../../product/lib/common/index.js';
 import { ExternalUriOpener } from '../../../runtime/lib/common/index.js';
 import { Logger } from '../../../telemetry/lib/common/index.js';
-import { Account, APIResult, AuthenticationProvider, AuthSession, AuthState, AuthToken, LoginContext, ProductEnvService, SignContext } from './authentication-protocol.js';
+import { Account, APIResult, AuthenticationProvider, AuthSession, AuthState, AuthToken, LoginContext, LogoutOptions, ProductEnvService, SignContext } from './authentication-protocol.js';
 /**
  * External-link auth variant whose current account is scoped by the token.
  *
@@ -26,7 +26,7 @@ export declare class AccountScopedExternalLinkAuthenticationProvider implements
     checkNetworkConnectivity(): Promise<APIResult<boolean>>;
     createSession(ctx: SignContext): Promise<AuthSession>;
     refreshSession(session: AuthSession, ctx: SignContext): Promise<AuthSession>;
-    removeSession(): Promise<void>;
+    removeSession(_session?: AuthSession, _options?: LogoutOptions): Promise<void>;
     switchAccount(account: Account, authSession: AuthSession, ctx: SignContext): Promise<AuthSession>;
     private toSessionAccountLists;
     protected openAuthUrl(authState: AuthState): Promise<void>;

package/cli/dist-server/types/workspace/authentication/lib/common/account-utils.d.ts

@@ -51,4 +51,29 @@ export declare function mergeCurrentAccountDetails(account: Account, accounts: A
  * 仅以账号类型为准，不用 enterpriseId 反推，避免 unknown/legacy account 被误判。
  */
 export declare function isPersonalAccount(account?: Pick<Account, 'type'>): boolean;
+/**
+ * 判断账号是否属于「个人版」这一**商业化版本**（个人版 + 个人版已订阅 Pro）。
+ *
+ * 与 {@link isPersonalAccount} 的区别，调用前请先确认要哪一个：
+ * - `isPersonalAccount`：严格的类型判定，只认 `type === 'personal'`，用于需要区分
+ *   「免费个人版」与其它一切档位的场景（如 IOA 请求头是否补默认企业 ID）。
+ * - `isPersonalEditionAccount`（本函数）：版本归属判定，把 `pro`（「个人版已订阅 Pro」，
+ *   见 agent-provider `types.ts` 的 Edition 注释）也算进个人版，用于「个人版专属功能」
+ *   门禁——把付费个人用户挡在个人版功能外不符合产品预期。
+ *
+ * 判定采用**反向排除**而非 type 白名单，原因是 `Account.type` 在协议层仅声明为 `string`，
+ * 完全透传后端 `/console/accounts`，前端不做任何映射校正：
+ * - 历史上出现过空串 type，白名单写法会把付费账号整块漏掉（见 agent-provider
+ *   `backend-provider.ts:getEditionDisplayType` 的同款踩坑注释）；反向排除对未知值
+ *   降级为「个人版」，与该处「其余（含 type 为空串 / 未知值）按个人账号推导」一致。
+ * - `enterpriseId` 非空一律视为企业租户：它是 enterprise-policy 包区分
+ *   personal / enterprise 的唯一依据（`bypass-personal` 语义），也是现有 4 处
+ *   `isPersonalAccount()` 调用统一叠加 `&& !enterpriseId` 的原因。这样即便后端返回
+ *   `type=personal` + 非空 enterpriseId（IOA 个人账号即属此类），也不会误放行。
+ *
+ * **未登录（`account` 为空）返回 `false`**：此时无从判断版本归属，不能因为「查不到企业
+ * 特征」就当成个人版放行个人版专属能力。这与上面对「已登录但 type 未知」降级为个人版
+ * 是两件事——后者至少确认了不是企业租户。
+ */
+export declare function isPersonalEditionAccount(account?: Pick<Account, 'type' | 'enterpriseId'>): boolean;
 export {};

package/cli/dist-server/types/workspace/authentication/lib/common/authentication-manager.d.ts

@@ -5,7 +5,7 @@ import { AuthenticationType, ProductManager } from '../../../product/lib/common/
 import { Notifier } from '../../../runtime/lib/common/index.js';
 import { EventService, Logger, TraceService } from '../../../telemetry/lib/common/index.js';
 import { BehaviorSubject } from 'rxjs';
-import { Account, APIResult, AuthenticationManager, AuthenticationProvider, type AuthenticationStartupGate as IAuthenticationStartupGate, AuthenticationStorage, AuthSession, LoginContext, type PrewarmActivationGate as IPrewarmActivationGate, ProductEnvService } from './authentication-protocol.js';
+import { Account, APIResult, AuthenticationManager, AuthenticationProvider, type AuthenticationStartupGate as IAuthenticationStartupGate, AuthenticationStorage, AuthSession, LoginContext, LogoutOptions, type PrewarmActivationGate as IPrewarmActivationGate, ProductEnvService } from './authentication-protocol.js';
 /**
  * 注入 doInit 二级探针 sink。仅供 daemon 装配层调用，把 [AuthDoInitProbe] 复制一路
  * 落到 daemon.log；main.log 主 sink 走 celljs Logger 不受影响。
@@ -97,7 +97,7 @@ export declare class AuthenticationManagerImpl implements AuthenticationManager
     cancelLogin(): void;
     private clearLastAuthUrl;
     login(ctx?: LoginContext): Promise<boolean>;
-    logout(): Promise<void>;
+    logout(options?: LogoutOptions): Promise<void>;
     refreshSession(): Promise<void>;
     waitForSessionRefresh(): Promise<void>;
     refreshSessionForAuthenticationFailure(): Promise<AuthSession>;

package/cli/dist-server/types/workspace/authentication/lib/common/authentication-protocol.d.ts

@@ -159,12 +159,29 @@ export interface AuthDevice {
     expiresIn: number;
     interval: number;
 }
+/**
+ * Options shared by the logout decision point (`AuthenticationManager.logout`)
+ * and the provider hook (`AuthenticationProvider.removeSession`).
+ */
+export interface LogoutOptions {
+    /**
+     * Whether to revoke the session on the server (call the server logout
+     * endpoint) in addition to clearing local state.
+     *
+     * Only user-initiated ("manual") logout should set this to `true`. Passive
+     * logout (e.g. auto-logout triggered by a 401 on an auth verification path)
+     * must leave it `false`/unset: at that point the token is already rejected
+     * by the server and the endpoint/refresh-token context is unreliable, so a
+     * server revoke call would be useless noise. Defaults to `false`.
+     */
+    revokeServerSession?: boolean;
+}
 export interface AuthenticationProvider {
     getAuthenticationType(): Promise<AuthenticationType[]>;
     support(ctx?: LoginContext): Promise<boolean>;
     createSession(ctx: SignContext): Promise<AuthSession>;
     refreshSession(session: AuthSession, ctx: SignContext): Promise<AuthSession>;
-    removeSession(session: AuthSession): Promise<void>;
+    removeSession(session: AuthSession, options?: LogoutOptions): Promise<void>;
     switchAccount(account: Account, authSession: AuthSession, ctx: SignContext): Promise<AuthSession>;
     checkNetworkConnectivity?(): Promise<APIResult<boolean>>;
 }
@@ -217,7 +234,7 @@ export interface AuthenticationManager {
     currentSessionSubject: BehaviorSubject<AuthSession | undefined>;
     login(ctx?: LoginContext): Promise<boolean>;
     cancelLogin(): void;
-    logout(): Promise<void>;
+    logout(options?: LogoutOptions): Promise<void>;
     refreshSession(): Promise<void>;
     waitForSessionRefresh(): Promise<void>;
     /** Force one authoritative, singleflight refresh after an auth failure. */

package/cli/dist-server/types/workspace/authentication/lib/common/external-link-authentication-provider.d.ts

@@ -2,7 +2,7 @@ import { RestOperations } from '@celljs/http';
 import { AuthenticationType, ClientInfoProvider, ProductManager } from '../../../product/lib/common/index.js';
 import { ExternalUriOpener } from '../../../runtime/lib/common/index.js';
 import { Logger } from '../../../telemetry/lib/common/index.js';
-import { Account, APIResult, AuthenticationProvider, AuthSession, LoginContext, ProductEnvService, SignContext, SignLicenseError } from './authentication-protocol.js';
+import { Account, APIResult, AuthenticationProvider, AuthSession, LoginContext, LogoutOptions, ProductEnvService, SignContext, SignLicenseError } from './authentication-protocol.js';
 /** 登录漏斗步骤回调，由外部消费者（如 workbuddy-server）注入上报逻辑。 */
 export type LoginStepCallback = (step: string, dims: Record<string, string>) => void;
 /**
@@ -55,7 +55,7 @@ export declare class ExternalLinkAuthenticationProvider implements Authenticatio
     getAuthenticationType(): Promise<AuthenticationType[]>;
     createSession(ctx: SignContext): Promise<AuthSession>;
     refreshSession(session: AuthSession, ctx: SignContext): Promise<AuthSession>;
-    removeSession(): Promise<void>;
+    removeSession(session?: AuthSession, options?: LogoutOptions): Promise<void>;
     switchAccount(account: Account, authSession: AuthSession, ctx: SignContext): Promise<AuthSession>;
     private fetchAuthState;
     protected openAuthUrl(authState: AuthState): Promise<void>;

package/cli/dist-server/types/workspace/authentication/lib/common/wx-authentication-provider.d.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@celljs/core';
 import { RestOperations } from '@celljs/http';
 import { AuthenticationType, ProductManager } from '../../../product/lib/common/index.js';
-import { Account, AuthenticationProvider, AuthSession, SignContext } from './authentication-protocol.js';
+import { Account, AuthenticationProvider, AuthSession, LogoutOptions, SignContext } from './authentication-protocol.js';
 export declare class WxAuthenticationProvider implements AuthenticationProvider {
     protected readonly restOperations: RestOperations;
     protected readonly productManager: ProductManager;
@@ -12,7 +12,7 @@ export declare class WxAuthenticationProvider implements AuthenticationProvider
     getAuthenticationType(): Promise<AuthenticationType[]>;
     createSession(ctx: SignContext): Promise<AuthSession>;
     refreshSession(session: AuthSession, ctx: SignContext): Promise<AuthSession>;
-    removeSession(): Promise<void>;
+    removeSession(_session?: AuthSession, _options?: LogoutOptions): Promise<void>;
     switchAccount(account: Account, authSession: AuthSession, ctx: SignContext): Promise<AuthSession>;
     private fetchTokenByTmpCode;
     private fetchAccounts;

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/agent-protocol.d.ts

@@ -179,6 +179,12 @@ export declare function isBuiltinDisableableAgent(agentName: string): boolean;
  * waste prompt tokens on a tool they can never legitimately call (the SendMessage
  * tool itself returns an error when invoked outside a team context), and for
  * structured-output agents like `compact` it can pollute the model's output.
+ *
+ * **这些名字是保留字，不得被用作子代理 / teammate 预设名**（评审 #128343）：
+ * `resolveMessageSpeakerLabel` 把本名单的判定放在「子会话报自身身份」**之前**，因为历史与
+ * 用量多处按 `providerData.agent === 'compact'` 这类字符串比较判定，子会话里跑 compact 时
+ * 不能被身份名覆盖。反过来说，一旦有真实子代理取了这里的名字，它的消息会被标成生成器名
+ * 而不是自己的身份 —— 属于要靠人眼才能发现的错标。新增名字前先确认它不会与任何预设名撞。
  */
 export declare const INTERNAL_GENERATOR_AGENTS: Set<string>;
 /**
@@ -289,6 +295,13 @@ export interface AgentManager {
      * 同输入逐轮返回同一对象（prompt cache 稳定）；视图字节永不写回全局物化面。
      */
     sessionScopedAgentView(session: Session, base: Agent): Promise<Agent>;
+    /**
+     * sandbox-agent-view：把 REPL 的动态 schema 按子代理身份重新物化一遍。Code Mode 的
+     * agent 实例进程级共享（`get('ptc')` 命中同一对象），schema 在构建期用合成会话采集 ——
+     * 继承模式的子代理（Explore 等）会看到模式的全量目录。派发侧知道身份，经此覆盖。
+     * 只克隆 REPL 一个工具，视图不进 agentMap；空身份 / 同名 / 无 REPL 时原样返回基座。
+     */
+    sandboxScopedAgentView(base: Agent, sandboxAgentName: string): Promise<Agent>;
     /** served 激活链的视图预热（默认 agent），派发路径是失效兜底。 */
     prepareSessionAgentView(session: Session): Promise<void>;
     get(agentName: string): Promise<Agent | undefined>;
@@ -543,6 +556,16 @@ export type AgentStandardRunOptions<TContext = Session> = AgentSdkRunOptions<TCo
     /** Process-local provenance for fresh user turns; stripped before SDK dispatch. */
     inputOrigin?: AgentRunOrigin;
     continuation?: never;
+    /**
+     * Per-arrival out-signal: invoked when this run was routed to the message
+     * queue (skipRun, session busy) instead of executing now. Callers that owe
+     * their caller *this* prompt's own result (print / stream-json) use it to
+     * keep waiting until the queue drains and their turn actually runs.
+     *
+     * A run-scoped callback (not a shared session flag) so concurrent arrivals
+     * cannot clobber each other's outcome.
+     */
+    onEnqueued?: () => void;
 };
 /**
  * Explicitly claim the current process-local logical turn.
@@ -558,6 +581,10 @@ export type AgentCurrentContinuationOptions = AgentSdkRunOptions<Session> & Agen
 };
 export type AgentServiceRunOptions<TContext = Session> = AgentStandardRunOptions<TContext> | AgentCurrentContinuationOptions;
 export interface AgentService {
+    /** Atomically close a task's runtime only after its last result and queued work settle. */
+    tryCloseTaskSession?(session: Session, result: NonNullable<Session['resultSubject']['value']>): Promise<boolean>;
+    /** Stop accepting task work and join its physical runs before releasing dependencies. */
+    retireTaskSession?(session: Session): Promise<void>;
     run<TAgent extends Agent<any, any>>(agent: TAgent, input: string | AgentInputItem[], options: AgentCurrentContinuationOptions): Promise<void>;
     run<TAgent extends Agent<any, any>, TContext = Session>(agent: TAgent, input: string | AgentInputItem[] | RunState<TContext, TAgent>, options?: AgentStandardRunOptions<TContext>): Promise<void>;
     runDefault<TAgent extends Agent<any, any>>(input: string | AgentInputItem[], options: AgentCurrentContinuationOptions): Promise<void>;
@@ -779,6 +806,8 @@ export declare enum CustomAgentSavePath {
 }
 export declare enum OutputStyleType {
     DEFAULT = "default",
+    PROACTIVE = "proactive",
+    CONCISE = "concise",
     EXPLANATORY = "explanatory",
     LEARNING = "learning"
 }

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/agent-service.d.ts

@@ -38,6 +38,8 @@ export declare class AgentServiceImpl implements AgentService {
      */
     private lifecycleOwners;
     protected getLifecycleOwners(): WeakMap<Session, AbortController>;
+    tryCloseTaskSession(session: Session, result: NonNullable<Session['resultSubject']['value']>): Promise<boolean>;
+    retireTaskSession(session: Session): Promise<void>;
     /** compare-and-delete：仅当 token 仍指向本轮 controller 时清除。 */
     private clearLifecycleOwner;
     /** 本轮是否是当前 lifecycle owner。 */

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/index.d.ts

@@ -6,6 +6,7 @@ export * from './agent-service.js';
 export * from './agent-factory.js';
 export * from './runner-factory.js';
 export * from './runner-provider.js';
+export * from './speaker-label.js';
 export * from './ordered-tools-agent.js';
 export * from './tool-call-loop-detector-protocol.js';
 export * from './tool-call-loop-detector-service.js';

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/interceptors/input-interceptors.d.ts

@@ -17,12 +17,7 @@ export declare class MessageQueueAgentRunInterceptor implements AgentRunIntercep
     protected readonly logger: Logger;
     protected readonly stateMachine: SessionRunStateMachine;
     intercept(request: AgentRunRequest): Promise<void>;
-    /**
-     * 触发后不再重复打 error（防日志风暴）；下次"有实际工作"分支复位 counter/flag，
-     * session 自动恢复处理能力。
-     */
-    private trackEmptyDrainAndMaybeTripGuard;
-    private resetEmptyDrainLoopGuard;
+    private consumeQueueItems;
 }
 /**
  * 用户查询包裹拦截器

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/runner-factory.d.ts

@@ -1,4 +1,4 @@
-import { type RunConfig, Runner } from '../../../../cbc-shared/lib/node/index.js';
+import { type AgentInputItem, type RunConfig, Runner } from '../../../../cbc-shared/lib/node/index.js';
 import { ProductManager } from '../../../../product/lib/common/index.js';
 import { Logger } from '../../../../telemetry/lib/common/index.js';
 import { type NotificationInjectionBuffer as INotificationInjectionBuffer } from '../message-queue/notification-injection-buffer-protocol.js';
@@ -15,6 +15,15 @@ import { ToolCallLoopDetector } from './tool-call-loop-detector-protocol.js';
  * Used by finishReasonErrorInterceptor to detect prior retries across both mechanisms.
  */
 export declare const TRUNCATION_RETRY_MARKER = "Do NOT repeat the same oversized tool call. Break it into smaller operations.";
+export interface ModelInputMemoryPressure {
+    heapUsed: number;
+    heapLimit: number;
+    headroom: number;
+    inputItems: number;
+    estimatedInputBytes?: number;
+    reject: boolean;
+}
+export declare function assessModelInputMemoryPressure(input: AgentInputItem[], heapUsed?: number, heapLimit?: number): ModelInputMemoryPressure;
 /**
  * Tool-specific hints for how to decompose a truncated tool call into smaller operations.
  */
@@ -72,6 +81,7 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      */
     protected readonly acpBroadcastService?: AgentQueueOutput;
     create(config?: Partial<RunConfig>): Promise<Runner>;
+    private assertModelInputCloneHeadroom;
     /**
      * 在每次模型请求前检查是否需要自动压缩。
      * 此时所有工具都已执行完毕，可以安全地触发压缩。
@@ -211,10 +221,10 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      * model / agent / argumentsDisplayText 等键同样会跟着走，它们是惰性字段、上游不解读，
      * 这里不做处理；真正需要清掉的只有语义已经反转的 discard。
      *
-     * 改写与删标记都只作用于当轮副本（见 filterTruncatedToolCalls 的
-     * "Scope of the rewrite"），session.history 里的原值保持不变。
+     * 返回一个浅复制的新 item；providerData 仅在需要删除 discard 时 copy-on-write。
+     * session.history 与 SDK 传入的原 item 始终保持不变。
      */
-    private rewriteCallArguments;
+    private withRewrittenCallArguments;
     /**
      * SDK callModelInputFilter: called before every model API request within the SDK run loop.
      *
@@ -240,13 +250,23 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      *   message instructing the model to break the call into smaller operations. This
      *   turns the SDK's automatic retry into a valid, useful request.
      *
-     * Scope of the rewrite: `agents-core`'s `applyCallModelInputFilter` hands us a
-     * `structuredClone` of the turn input and clones our return value again, explicitly so
-     * that filter-side mutations cannot touch cached turn state. So every rewrite here
-     * lands on a per-turn copy only — `session.history` keeps the malformed arguments and
-     * we redo the same rewrite on every subsequent turn. That is correct but not free:
-     * anything reported from this path must be aggregated per turn rather than logged per
-     * call, or a long session with N bad calls emits N log lines every turn.
+     * Scope of the rewrite: this filter opts into the SDK's `preserveInputIdentity` mode,
+     * so existing history items arrive by identity and MUST remain immutable. Repairs use
+     * item-level copy-on-write and array-level shallow copies; the SDK still creates isolated
+     * model/session copies after the filter returns. `session.history` therefore keeps the
+     * malformed arguments and we redo the same rewrite on every subsequent turn. Anything
+     * reported from this path must be aggregated per turn rather than logged per call.
+     */
+    /**
+     * 模型输入的两步修复，**顺序不能反**：
+     *
+     * 1. `filterTruncatedToolCalls` 先跑。截断（finish_reason=length）与坏 JSON 的
+     *    call 正是「参数半截 + 没有任何 result」那一类；它删掉这些 call 的同时会注入
+     *    拆解引导与防循环停止标记。若先按配对摘掉它们，该分支因 `invalidCallIds` 为空
+     *    直接早退，模型拿不到任何引导，退回 #75892 那条老路，而且请求本身合法、无错可见。
+     * 2. `filterUnpairedToolCalls` 后跑，收掉剩下的孤儿（参数合法但结果丢失、重复 callId、
+     *    头部被截断留下的孤儿结果）。本地正文里的孤儿是持久化的，留着每次恢复都被上游 400。
      */
+    private repairModelInput;
     private filterTruncatedToolCalls;
 }

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/speaker-label.d.ts

@@ -0,0 +1,44 @@
+export declare function resolveMessageSpeakerLabel(input: {
+    session?: {
+        id?: string;
+        storeId?: string;
+        meta?: Record<string, unknown>;
+    } | undefined;
+    runAgentName?: string;
+}): string | undefined;
+/**
+ * 子会话的**展示名**（给人看）：团队成员用成员名，其余子代理用自身预设名（`meta.agentName`）；
+ * 主会话 / 无会话 / 无身份线索返回 undefined。**只用于展示与遥测标签，不要拿它查表。**
+ */
+export declare function resolveSubAgentDisplayName(session: {
+    id?: string;
+    storeId?: string;
+    meta?: Record<string, unknown>;
+} | undefined): string | undefined;
+/**
+ * 子会话的**查表键**（REPL 沙箱白名单 / overlay 缓存用）：只认「预设名」这一种语义。
+ *
+ * 与展示名刻意分开（评审）：团队成员会把自己的成员名写进 `meta.agentName`（teammate-runner），
+ * 于是 `meta.agentName` 同时承载「预设名」与「成员名」两种含义 —— 拿成员名去查 agent 配置查不到，
+ * 只能落到默认 agent 的兜底（既不是成员自己的白名单、也不是「不过滤」）。取不到可信的预设名时
+ * 返回 undefined = 不额外收窄（与改动前一致），不去猜。
+ */
+export declare function resolveSubAgentAgentKey(session: {
+    id?: string;
+    storeId?: string;
+    meta?: Record<string, unknown>;
+} | undefined): string | undefined;
+/** 展示名的**派发侧镜像**：子会话还没建时拿不到 `meta.teamContext`，但这对值就是稍后写进 session 的同一对。 */
+export declare function resolveSubAgentDisplayNameFromParts(input: {
+    memberName?: string;
+    presetName?: string;
+}): string | undefined;
+/**
+ * 查表键的**派发侧镜像**（AgentManager.sandboxScopedAgentView 传身份用）：
+ * 预设名与成员名**同值**（团队成员把自己的名字写进 meta.agentName）时判为「没有可信预设名」→ undefined，
+ * 与运行期 `resolveSubAgentAgentKey` 同源 —— 否则派发侧按成员名收窄、执行侧判不到，两边分叉。
+ */
+export declare function resolveSubAgentAgentKeyFromParts(input: {
+    memberName?: string;
+    presetName?: string;
+}): string | undefined;

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/tool-call-loop-detector-service.d.ts

@@ -6,9 +6,9 @@
  * wastes tokens/credits.
  *
  * Detection rules:
- * 1. Generic loop: blacklisted tool with identical arguments 4 consecutive times
+ * 1. Generic loop: blacklisted tool with semantically identical JSON arguments 4 consecutive times
  * 2. Read file loop: Read tool targeting the same file_path 40 consecutive times
- * 3. Non-blacklist loop: any tool NOT in blacklist with identical arguments 40 consecutive times
+ * 3. Non-blacklist loop: any tool NOT in blacklist with semantically identical JSON arguments 40 consecutive times
  */
 import type { AgentInputItem } from '../../../../cbc-shared/lib/node/index.js';
 import { Logger } from '../../../../telemetry/lib/common/index.js';
@@ -38,14 +38,15 @@ export declare class ToolCallLoopDetectorImpl implements ToolCallLoopDetector {
         arguments: string;
     }>;
     /**
-     * Check for generic loop: same tool with identical arguments N consecutive times.
+     * Check for generic loop: same tool with semantically identical JSON arguments
+     * N consecutive times. Malformed or very large argument payloads retain exact-string semantics.
      */
     protected checkGenericLoop(tailCalls: Array<{
         name: string;
         arguments: string;
     }>): LoopDetectionResult;
     /**
-     * Check for non-blacklist tool loop: any tool NOT in the blacklist with identical arguments
+     * Check for non-blacklist tool loop: any tool NOT in the blacklist with semantically identical JSON arguments
      * called N consecutive times (threshold: NON_BLACKLIST_LOOP_THRESHOLD).
      * Scans from the tail of input, collecting only non-blacklist function_call items.
      */

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/tool-call-loop-guard-protocol.d.ts

@@ -27,7 +27,7 @@ export declare const TOOL_CALL_LOOP_STOPPED_MESSAGE = "Request aborted: user sto
  * - `ToolCallLoopDetector` 在**模型请求前**拦截，静默向模型注入停止消息，用户无感；
  *   它覆盖的是旧的三条规则（黑名单同参 4 次 / Read 同文件 40 次 / 非黑名单同参 40 次）。
  * - `ToolCallLoopGuard` 在**工具执行前**拦截，弹窗让用户自己决定继续还是停止；
- *   它覆盖新增的两条规则（同工具连续 40 次 / 周期序列重复 10 轮）。
+ *   它覆盖新增的两条规则（同工具连续 40 次，Bash 单独放到 80 次 / 周期序列重复 10 轮）。
  *
  * 两者刻意并存：旧规则的静默语义已被线上验证，不因新能力回归。
  */

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/tool-call-loop-pattern.d.ts

@@ -5,8 +5,13 @@
  */
 import type { ToolCallLoopTriggerType } from '../../../../telemetry/lib/common/event/types/craft.js';
 export interface ToolCallLoopThresholds {
-    /** 同一工具连续调用达到该次数即判定为循环。 */
+    /** 同一工具连续调用达到该次数即判定为循环。Bash 走单独阈值。 */
     consecutiveThreshold: number;
+    /**
+     * Bash 连续调用的单独阈值。长任务里模型会连续跑很多条不同命令，
+     * 只看工具名时 40 次容易把正常推进误判成循环。
+     */
+    bashConsecutiveThreshold: number;
     /** AAB 块需要连续重复的轮数。 */
     sequenceRepeats: number;
 }
@@ -17,6 +22,8 @@ export interface ToolCallLoopHit {
     /** 重复序列的周期长度；AAB 恒为 3，连续同工具恒为 1。 */
     patternLength: number;
 }
+/** 与 `ToolNames.BASH` 对齐。模式识别层不依赖 agent-protocol，避免把工具名枚举拉进来。 */
+export declare const BASH_LOOP_TOOL_NAME = "Bash";
 export declare const DEFAULT_TOOL_CALL_LOOP_THRESHOLDS: ToolCallLoopThresholds;
 /** AAB 块的长度。多工具循环只识别这一种形状，因此是常量而非可配阈值。 */
 export declare const AAB_PERIOD = 3;
@@ -36,7 +43,7 @@ export declare class ToolCallLoopTracker {
      * 记录一次即将执行的工具调用，返回本次是否命中循环。
      *
      * 命中优先级：先判连续同工具，再判 AAB 重复。两条规则的阈值默认不重叠
-     * （40 次 vs AAB 重复 10 轮），实践中不会互相抢占。
+     * （普通工具 40 次、Bash 80 次 vs AAB 重复 10 轮），实践中不会互相抢占。
      */
     record(toolName: string): ToolCallLoopHit | undefined;
     /**
@@ -52,14 +59,18 @@ export declare class ToolCallLoopTracker {
  * - `ABC`（三者互不相同）通常是正常的多步工作流（读文件 → 改文件 → 跑测试，
  *   然后换下一个文件），按周期重复判它循环误伤面太大；
  * - `ABAB` 这类两工具交替同样不判，避免把翻页 / 分批处理误当循环；
- * - `AAA…` 属于连续同工具，由 consecutiveThreshold 那条规则负责。
+ * - `AAA…` 属于连续同工具，由 consecutiveThreshold / bashConsecutiveThreshold 那条规则负责。
  *
  * `X ≠ Y` 顺带保证了 AAB 一定是本原周期（唯一可能的更短整除周期是 1，
  * 那要求三个元素全等），所以不需要额外的本原性校验。
  */
 export declare function matchesRepeatedAabSequence(history: readonly string[], repeats: number): boolean;
 /**
- * 读取阈值配置。两个环境变量只用于 QA 快速复现，生产不设置即走默认值。
+ * 读取阈值配置。环境变量只用于 QA 快速复现，生产不设置即走默认值。
  * AAB 的周期是形状定义的一部分，不开放配置。
+ *
+ * `CBC_LOOP_GUARD_CONSECUTIVE_THRESHOLD` 只覆盖非 Bash 工具。Bash 用
+ * `CBC_LOOP_GUARD_BASH_CONSECUTIVE_THRESHOLD`，避免 QA 把通用阈值压低时
+ * 把长任务放宽一并关掉。
  */
 export declare function resolveToolCallLoopThresholds(env?: NodeJS.ProcessEnv): ToolCallLoopThresholds;

package/cli/dist-server/types/workspace/cbc-core/lib/node/hooks/agent-trigger.d.ts

@@ -1,31 +1,15 @@
-/**
- * Agent-trigger payload helper, shared by SessionHookManager and ToolHookManager.
- *
- * Mirrors Claude Code's `createBaseHookInput` (utils/hooks.ts) so that every
- * hook event carries enough context for users to branch on
- * "main thread vs sub-agent" inside their Settings-level hooks.
- *
- * Rules (CC parity):
- *  - `agent_type` is the agent's display name; populated from `session.agentName`
- *    when set. On the main thread this is the `--agent` flag (when used) or the
- *    default agent name. Inside a sub-agent this is the sub-agent's `name`
- *    (e.g. "Explore", "Plan", "general-purpose").
- *  - `agent_id` is only meaningful inside a sub-agent run — CC leaves it
- *    `undefined` on the main thread. We honour the same convention by only
- *    emitting it when `session.storeId` is present (sub-agent sessions get a
- *    `agent-{8}` storeId; main sessions do not).
- *
- * Kept dependency-free so it can be imported from anywhere — including modules
- * that must avoid pulling the full `../session` barrel (which transitively
- * loads SessionManager / tips and triggers IoC initialisation).
- */
 export interface AgentTriggerLike {
     id?: string;
     agentName?: string;
     storeId?: string;
+    /** 会话 meta：身份标签要读 agentName / teamContext.memberName，parentSessionId 供子会话判定。 */
     meta?: {
         parentSessionId?: string;
-    };
+        agentName?: string;
+        teamContext?: {
+            memberName?: unknown;
+        };
+    } & Record<string, unknown>;
 }
 export declare function buildAgentTrigger(session: AgentTriggerLike | undefined | null): {
     agent_id?: string;

package/cli/dist-server/types/workspace/cbc-core/lib/node/hooks/hook-protocol.d.ts

@@ -31,7 +31,10 @@ export interface HookInput {
      */
     reason?: SessionEndReason;
     /**
-     * User prompt content (for UserPromptSubmit event)
+     * User prompt content.
+     * - UserPromptSubmit: the submitted prompt text.
+     * - UserPromptExpansion: Claude Code spec required field, always sent — the
+     *   raw, pre-expansion text as typed by the user (e.g. "/deploy prod").
      */
     prompt?: string;
     /**

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/idle-queue-drain-service.d.ts

@@ -1,44 +1,7 @@
 /**
- * Idle Queue Drain Service (Mode A `session.queue` 通道)
- *
- * 为什么需要这个 service
- * =====================
- * 用户在 agent 还在跑（streaming 末尾、工具执行中等）时输入新消息，UI 调
- * `agentService.run([userMsg])` 进来，`MessageQueueAgentRunInterceptor`
- * (input-interceptors.ts:77-84) 看到 `inConversation=true`，把消息塞进
- * `session.queue` 并设 `skipRun=true`。当前 turn 自然结束、emit `agent_end`，
- * 但**没有任何组件**会主动调一次 `agentService.run([], session)` 来触发
- * interceptor 的 drain 分支（input-interceptors.ts:85-103，那条分支会
- * `mergeConsecutiveUserMessages` 把队列里的消息拍成一个新 turn）。
- *
- * 结果：消息僵在 `session.queue`，UI 显示"已发送"，agent 永远不回。
- *
- * `TeamInboxDispatchService` 看起来形态对，但它只检查
- * `RichMessageQueueManager`（团队成员消息进的那个 queue），全 codebase 只有
- * `team-create-tool.ts:332` 一处往 rich queue 写 —— 普通 TUI 用户输入完全
- * 走 `session.queue`，团队 dispatcher 看不到。
- *
- * 这个 service 就填这个空：每个 session 都订阅 `agent_end`，guard 通过后
- * 调一次空 input 的 `agentService.run`，让现有 interceptor 自己合并消费。
- *
- * 与 TeamInboxDispatchService 的关系
- * ==================================
- * - Mode A（默认）：`isDeferredDispatchEnabledSync()===false`。
- *   IdleQueueDrainService 接管 `session.queue` 的 drain；TeamInboxDispatchService
- *   也订阅了，但它看 rich queue（一般为空）→ short-circuit。
- * - Mode B：`isDeferredDispatchEnabledSync()===true`。
- *   IdleQueueDrainService 入口 short-circuit；TeamInboxDispatchService 走
- *   rich queue 的 immediate/pending 路径。
- * 两 service 各自有 `dispatching` Set，最坏情况下都是 short-circuit return，
- * 不会双重发起 run。
- *
- * 它不做的事
- * ==========
- * - 不动 `session.queue` 里的内容（让 interceptor 现有 mergeConsecutive 逻辑
- *   作为唯一消费点，避免逻辑漂移）。
- * - 不在 compact 中触发（`session.isCompressing` guard）。
- * - 不在 Mode B 中触发。
- * - 不影响 cancel 路径的 abort 行为（只在 `agent_end` 后做兜底）。
+ * Wake local queues after a turn ends. Mode A owns session.queue; Mode B tasks
+ * own its non-mirror items. Mode B main sessions remain with rich queue.
+ * MessageQueueAgentRunInterceptor remains the only dequeue/merge point.
  */
 import { Logger } from '../../../../telemetry/lib/common/index.js';
 import { AgentManager, AgentService } from '../agent/agent-protocol.js';
@@ -64,21 +27,6 @@ export declare class IdleQueueDrainServiceImpl implements IdleQueueDrainService
      * 空队列直接返回。
      */
     requestDrain(session: Session): void;
-    /**
-     * Guard 链 + 调 agentService.run 触发 interceptor 的 drain 分支。
-     *
-     * Guard 顺序（逐个 short-circuit return）：
-     *   1. 重入：同 session 上一次 tryDrain 还没 await 完。
-     *   2. compact 中：`session.isCompressing===true`。compact 自身的
-     *      continue-run 也会 emit `agent_end`，必须避让。
-     *   3. Mode B：rich queue 通道由 TeamInboxDispatchService 处理。
-     *   4. DI 兜底：headless 等变体可能没拉到 AgentService/AgentManager。
-     *   5. 空队列：没东西好 drain。
-     *   6. 取消记账在途：见下方注释。
-     *
-     * 失败回灌：interceptor 在 line 95 已经 `clearQueue`，如果后续 run 抛错，
-     * 队列里的消息会"被消费但又没真消费"，相当于丢了。所以在调 run 之前
-     * 快照 queue，run 抛错时检查 queue 是否被清空、被清空就把快照灌回。
-     */
+    /** Reuse the existing idle drain and its pre-result failure restoration. */
     private tryDrain;
 }

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/index.d.ts

@@ -8,6 +8,7 @@ export * from './session-response-host-protocol.js';
 export * from './background-task-protocol.js';
 export * from './root-session-scope.js';
 export * from './session-factory.js';
+export { assertSessionRuntimeOpen, closeSessionRuntime, isSessionRuntimeClosed, sessionRuntimeSignal, } from './session-runtime-lifecycle.js';
 export * from './session-admission-service.js';
 export * from './session-manager.js';
 export * from './session-store.js';
@@ -25,12 +26,14 @@ export { getSessionCanUseTool, resolveCanUseTool, resolveCanUseToolOwner, setSes
 export type { CanUseTool, CanUseToolOptions, CanUseToolOwner, PermissionBehavior, PermissionDecisionClassification, PermissionResult as CanUseToolPermissionResult, PermissionRuleValue, PermissionUpdate as CanUseToolPermissionUpdate, PermissionUpdateDestination, } from './can-use-tool.js';
 export * from './dual-channel-interaction.js';
 export * from './session-persistence.js';
+export * from './session-persistence-error.js';
 export * from './session-set-current.js';
 export * from './cancel-session-runtime-state.js';
 export * from './user-request-boundary.js';
 export { isTruncationRecoveryActive } from './truncation-recovery.js';
 export * from './aborted-stream-draft-store.js';
 export * from './stream-timeout-retry-budget.js';
+export { consumeRecoveryRequestPending } from './recovery-budget.js';
 export * from './session-run-state-machine-protocol.js';
 export * from './session-run-state-machine.js';
 export * from './session-run-state-projection-service.js';