@tencent-ai/agent-harness 0.2.0-beta.1 → 0.2.0-beta.3

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/idle-queue-drain-service.d.ts

@@ -1,44 +1,7 @@
 /**
- * Idle Queue Drain Service (Mode A `session.queue` 通道)
- *
- * 为什么需要这个 service
- * =====================
- * 用户在 agent 还在跑（streaming 末尾、工具执行中等）时输入新消息，UI 调
- * `agentService.run([userMsg])` 进来，`MessageQueueAgentRunInterceptor`
- * (input-interceptors.ts:77-84) 看到 `inConversation=true`，把消息塞进
- * `session.queue` 并设 `skipRun=true`。当前 turn 自然结束、emit `agent_end`，
- * 但**没有任何组件**会主动调一次 `agentService.run([], session)` 来触发
- * interceptor 的 drain 分支（input-interceptors.ts:85-103，那条分支会
- * `mergeConsecutiveUserMessages` 把队列里的消息拍成一个新 turn）。
- *
- * 结果：消息僵在 `session.queue`，UI 显示"已发送"，agent 永远不回。
- *
- * `TeamInboxDispatchService` 看起来形态对，但它只检查
- * `RichMessageQueueManager`（团队成员消息进的那个 queue），全 codebase 只有
- * `team-create-tool.ts:332` 一处往 rich queue 写 —— 普通 TUI 用户输入完全
- * 走 `session.queue`，团队 dispatcher 看不到。
- *
- * 这个 service 就填这个空：每个 session 都订阅 `agent_end`，guard 通过后
- * 调一次空 input 的 `agentService.run`，让现有 interceptor 自己合并消费。
- *
- * 与 TeamInboxDispatchService 的关系
- * ==================================
- * - Mode A（默认）：`isDeferredDispatchEnabledSync()===false`。
- *   IdleQueueDrainService 接管 `session.queue` 的 drain；TeamInboxDispatchService
- *   也订阅了，但它看 rich queue（一般为空）→ short-circuit。
- * - Mode B：`isDeferredDispatchEnabledSync()===true`。
- *   IdleQueueDrainService 入口 short-circuit；TeamInboxDispatchService 走
- *   rich queue 的 immediate/pending 路径。
- * 两 service 各自有 `dispatching` Set，最坏情况下都是 short-circuit return，
- * 不会双重发起 run。
- *
- * 它不做的事
- * ==========
- * - 不动 `session.queue` 里的内容（让 interceptor 现有 mergeConsecutive 逻辑
- *   作为唯一消费点，避免逻辑漂移）。
- * - 不在 compact 中触发（`session.isCompressing` guard）。
- * - 不在 Mode B 中触发。
- * - 不影响 cancel 路径的 abort 行为（只在 `agent_end` 后做兜底）。
+ * Wake local queues after a turn ends. Mode A owns session.queue; Mode B tasks
+ * own its non-mirror items. Mode B main sessions remain with rich queue.
+ * MessageQueueAgentRunInterceptor remains the only dequeue/merge point.
  */
 import { Logger } from '../../../../telemetry/lib/common/index.js';
 import { AgentManager, AgentService } from '../agent/agent-protocol.js';
@@ -64,21 +27,6 @@ export declare class IdleQueueDrainServiceImpl implements IdleQueueDrainService
      * 空队列直接返回。
      */
     requestDrain(session: Session): void;
-    /**
-     * Guard 链 + 调 agentService.run 触发 interceptor 的 drain 分支。
-     *
-     * Guard 顺序（逐个 short-circuit return）：
-     *   1. 重入：同 session 上一次 tryDrain 还没 await 完。
-     *   2. compact 中：`session.isCompressing===true`。compact 自身的
-     *      continue-run 也会 emit `agent_end`，必须避让。
-     *   3. Mode B：rich queue 通道由 TeamInboxDispatchService 处理。
-     *   4. DI 兜底：headless 等变体可能没拉到 AgentService/AgentManager。
-     *   5. 空队列：没东西好 drain。
-     *   6. 取消记账在途：见下方注释。
-     *
-     * 失败回灌：interceptor 在 line 95 已经 `clearQueue`，如果后续 run 抛错，
-     * 队列里的消息会"被消费但又没真消费"，相当于丢了。所以在调 run 之前
-     * 快照 queue，run 抛错时检查 queue 是否被清空、被清空就把快照灌回。
-     */
+    /** Reuse the existing idle drain and its pre-result failure restoration. */
     private tryDrain;
 }

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/index.d.ts

@@ -8,6 +8,7 @@ export * from './session-response-host-protocol.js';
 export * from './background-task-protocol.js';
 export * from './root-session-scope.js';
 export * from './session-factory.js';
+export { assertSessionRuntimeOpen, closeSessionRuntime, isSessionRuntimeClosed, sessionRuntimeSignal, } from './session-runtime-lifecycle.js';
 export * from './session-admission-service.js';
 export * from './session-manager.js';
 export * from './session-store.js';
@@ -25,14 +26,17 @@ export { getSessionCanUseTool, resolveCanUseTool, resolveCanUseToolOwner, setSes
 export type { CanUseTool, CanUseToolOptions, CanUseToolOwner, PermissionBehavior, PermissionDecisionClassification, PermissionResult as CanUseToolPermissionResult, PermissionRuleValue, PermissionUpdate as CanUseToolPermissionUpdate, PermissionUpdateDestination, } from './can-use-tool.js';
 export * from './dual-channel-interaction.js';
 export * from './session-persistence.js';
+export * from './session-persistence-error.js';
 export * from './session-set-current.js';
 export * from './cancel-session-runtime-state.js';
 export * from './user-request-boundary.js';
 export { isTruncationRecoveryActive } from './truncation-recovery.js';
 export * from './aborted-stream-draft-store.js';
 export * from './stream-timeout-retry-budget.js';
+export { consumeRecoveryRequestPending } from './recovery-budget.js';
 export * from './session-run-state-machine-protocol.js';
 export * from './session-run-state-machine.js';
+export * from './model-request-retry-phase.js';
 export * from './session-run-state-projection-service.js';
 export * from './local-jsonl-session-store.js';
 export * from './transcript-branch.js';

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/interruption-service.d.ts

@@ -8,12 +8,44 @@ import { InterruptionService, type PendingApprovalView, Session, SessionHookMana
 import { SessionRunStateMachine } from './session-run-state-machine-protocol.js';
 type IIdleQueueDrainService = import('./session-protocol.js').IdleQueueDrainService;
 export declare class InterruptionServiceImpl implements InterruptionService {
+    private readonly resolvedSandboxItems;
     private pendingInterruptions;
     private itemToSessionMap;
     private interruptionQueues;
     private parentIdToMainSession;
     private childToMainSession;
     private waitForSubscriptions;
+    private readonly approvalSources;
+    private readonly handlingStates;
+    private readonly reportedStaleStates;
+    private readonly reportedDiscardedApprovals;
+    private readonly handledResults;
+    private readonly resumeProgress;
+    /**
+     * Terminal by design: a blocked continuation already proved it cannot make
+     * progress, and a later user request arrives on a *new* RunState, so the
+     * session is never stranded.
+     */
+    private readonly blockedResumeStates;
+    /**
+     * Deliberately not `session.meta.consecutiveEmptyDrainCount`: the idle
+     * empty-drain guard both increments that counter (tripping this
+     * continuation early, aborting a legitimate resume) and resets it
+     * (stretching the budget without bound).
+     */
+    private readonly resumeNoProgressCount;
+    private assertApprovalSource;
+    private approveSource;
+    private awaitPermissionReply;
+    /**
+     * A decision the user actually clicked must never disappear without a word.
+     *
+     * The card is dequeued and the deferred rejected, but the run that owned it
+     * is already gone — so nothing downstream surfaces the rejection and the
+     * user is left believing the tool was approved.
+     */
+    private reportDiscardedDecision;
+    private reportStaleSource;
     /**
      * 权限审批全局真相源（方案一：统一数据源）。
      *
@@ -61,12 +93,22 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     protected readonly idleQueueDrainService?: IIdleQueueDrainService;
     protected readonly traceCollector?: SessionInterruptionTraceHost;
     protected get startupProfiler(): SessionInterruptionProfilerHost;
+    /**
+     * 标记「用户取消本轮」的拒绝项（`reject(item, { cancelTurn: true })`）。
+     * 语义是取消当前 turn，而不是「拒绝并让模型带反馈续跑」。
+     * 记在 WeakSet 而不是 `rawItem.providerData`（那会落进历史），也不改
+     * deferred 的 reject 形状（下游按 error 类型分支的逻辑保持不变）。
+     */
+    private readonly cancelTurnItems;
+    /** Claim before calling out: sandbox callbacks can throw or synchronously re-enter. */
+    private takeSandboxResolve;
     approve(item: RunToolApprovalItem, options?: {
         alwaysApprove?: boolean;
         scope?: 'session' | 'localSettings';
     }): void;
     reject(item: RunToolApprovalItem, options?: {
         decision?: 'deny' | 'rejectAndExitPlan';
+        cancelTurn?: boolean;
     }): void;
     /**
      * 取消指定 session 上所有未决的 interruption Deferred。
@@ -101,8 +143,9 @@ export declare class InterruptionServiceImpl implements InterruptionService {
      *
      * 幂等：未注册的 sessionId 为 no-op。
      */
-    releaseSession(sessionId: string): void;
-    protected handleInterruptions(session: Session, interruptions: RunToolApprovalItem[]): Promise<void>;
+    releaseSession(target: string | Session): void;
+    protected handleInterruptions(session: Session, interruptions: RunToolApprovalItem[], result?: RunResult<any, any> | StreamedRunResult<any, any> | undefined): Promise<void>;
+    private processInterruptions;
     protected executePendingManualPostCompactHook(session: Session, result: RunResult<any, any> | StreamedRunResult<any, any>): Promise<void>;
     waitFor(session: Session): Promise<void>;
     /**
@@ -334,15 +377,26 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     private static sanitizeToolNotFoundMessage;
     private hasRecentModelErrorRetry;
     /**
-     * 检测是否已有 stream timeout 重试记录
-     * 避免反复重试导致无限循环
+     * 网络 / 流错误自动恢复的统一前置步骤：认领额度 → 可取消的指数退避 → 标记恢复轮。
+     *
+     * 认领放在退避之前、且晚于本 catch 里的第一个 await：session-manager 的 gate 在
+     * `result.completed` reject 后同步读取同一份预算判据，认领若早于 gate 读取，最后
+     * 一次重试会被 gate 误判为「预算已耗尽」而提前下发终态。
+     *
+     * 退避期间会话处于 RETRYING：失败的 run 与写入中断结果的 skipRun run 都已收尾回 idle，
+     * 这里重新置为 busy，TUI 继续显示进行中并响应 Esc，用户新消息进队列而不是直接起 run。
+     * 恢复 run 带 bypassMessageQueue 从 RETRYING 直接发起，中间不回 idle，不留让新 run
+     * 插入的空窗；恢复 run 收尾（AGENT_ENDED）时回 idle 并带出排队消息。
+     *
+     * 退避期间用户取消时退回额度、以 RUN_FAILED 收回 idle 并返回 `cancelled`，调用方不得
+     * 再发起。取消信号在等待前现取：写入中断结果的 skipRun run 会替换 `session.abortController`，
+     * 用户此后按下的 Stop 作用在新 controller 上；排队消息接管 owner 时，其 abort 会级联到这里。
      *
-     * 首 token 超时：允许最多 2 次重试（含线性延迟 2s/4s），给网络波动更多恢复机会
-     * 流数据超时：保持只重试 1 次
-     * 旧的基于历史消息窗口的检测不可靠：长任务（如 8 个子任务）会产生大量消息，
-     * 将 retry marker 推出 5 条消息的窗口，导致误判为"可以再次重试"
+     * 等待结束时若状态既不是 RETRYING 也不是 idle，说明 RETRYING 被迟到的收尾事件冲掉后
+     * 已有新 run 被接纳并在执行，返回 `superseded`，否则恢复 run 会与它同时写同一个会话。
+     * 此时不退回额度——新请求边界已经清零，再减一次会扣掉新链的额度。
      */
-    private incrementStreamTimeoutRetryCount;
+    private prepareRecoveryAttempt;
     /**
      * CLI TUI 手打 `/compact` 裸跑成功后补发 SessionStart('compact')。
      *

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/model-request-retry-phase.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRetryReason, Session } from './session-protocol.js';
+import { ModelRequestRetryPhase, SessionRunStateMachine } from './session-run-state-machine-protocol.js';
+export declare class ModelRequestRetryPhaseImpl implements ModelRequestRetryPhase {
+    protected readonly stateMachine: SessionRunStateMachine;
+    during<T>(session: Session | undefined, reason: AgentRetryReason, wait: () => Promise<T>): Promise<T>;
+    /**
+     * 辅助型调用复用主 session 却不回送 AGENT_ENDED（#52320），不得驱动其状态；
+     * 状态已离开 MODEL_REQUESTING 说明另有路径在推进，此时不抢写。
+     */
+    private enter;
+    /**
+     * 必须回到 MODEL_REQUESTING：RETRYING 不接收 TOOL_STARTED / MODEL_RESPONSE_DONE 等后续事件，
+     * 停留会让错误处理路径的转换被静默忽略。已被取消等事件推走时不再改写。
+     */
+    private leave;
+}

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/model-response-interceptors.d.ts

@@ -29,6 +29,24 @@ export declare class finishReasonErrorInterceptor implements ModelResponseInterc
     protected readonly sessionStore: SessionStore;
     protected readonly telemetryService: TelemetryService;
     intercept(ctx: ModelResponseInterceptorContext): Promise<boolean | void>;
+    /**
+     * 处理「已经产出实质内容之后才 `finish_reason=error`」：自动续写，最多 3 次、1s 起步 2 倍退避。
+     *
+     * 没有任何实质输出就 error 的两种形态（仅 reasoning / 零 token）在模型层被转成可重试的
+     * EmptyStreamError，走 interruption-service 的流错误恢复；三者认领同一份 error 预算。
+     *
+     * 能走到这里说明这次 run 已经结束：SDK 只要本轮还有可执行的工具调用就会继续循环，
+     * 不会把控制权交回。因此不存在「参数完整但尚未执行」的工具调用；万一出现，每次构造
+     * 请求前的 `fillFunctionCallResultHistory` 也会补齐配对，不会因孤儿调用触发上游 400。
+     * 本期只统计孤儿数量用于验证这一推论，不改补齐逻辑。
+     *
+     * 预算用尽、退避期间被取消或发起失败时都**不返回 `true`**：没有重跑在路上，本轮必须
+     * 正常收敛给上层，否则 CLI 会一直等一个不存在的 run。
+     */
+    private handleErrorFinishReason;
+    private writeErrorTerminalMessage;
+    /** 统计本轮以 error 收尾时残留的无配对结果工具调用，用于验证「此处不应有孤儿」的推论。 */
+    private logOrphanToolCallsOnError;
     private shouldSkipExpectedSubagentToolCalls;
     /**
      * 处理 length 类型的完成原因：从断点续写（#119765）。
@@ -197,6 +215,21 @@ export declare class MediaContentErrorInterceptor implements ModelResponseInterc
     private static readonly MAX_RETRY_ATTEMPTS;
     private static readonly MAX_MIME_MISMATCH_RETRY_ATTEMPTS;
     private static readonly GIF_UNSUPPORTED_ERROR_CODES;
+    /**
+     * Gateway business codes that mean "the model refused the images in this
+     * request" (`11135 InvalidInputImage`).
+     *
+     * The code is the only stable signal. The gateway folds several unrelated
+     * upstream causes into one hard-coded English sentence and overwrites the
+     * upstream text, so `ERROR_TYPE_PATTERNS` matching that sentence breaks the
+     * moment the wording is changed or localized (`docs/error-codes.md` already
+     * ships a Chinese user-facing string for this code). The code is carried on
+     * the error object all the way here — `error-analyzer` puts the parsed body
+     * code into the response, the SDK surfaces it as `APIError.error.code`, and
+     * `ErrorUtils.extractBizCode` recovers it — so key off it and keep the
+     * phrasing match only as a fallback for gateways that send no code.
+     */
+    private static readonly IMAGE_REJECTED_ERROR_CODES;
     private static readonly GIF_UNSUPPORTED_PLACEHOLDER;
     private static readonly ERROR_TYPE_PATTERNS;
     intercept(ctx: ModelResponseInterceptorContext): Promise<boolean | void>;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/recovery-budget.d.ts

@@ -0,0 +1,55 @@
+import type { Session } from './session-protocol.js';
+/**
+ * `finish_reason=error` 三种表现（已有输出 / 仅 reasoning / 零 token）共用的预算键。
+ *
+ * 三者是同一次上游故障的不同形态，而且会在恢复过程中互相转化（第一次零 token、
+ * 重试后只吐 reasoning、再重试吐了内容后又 error）。各记各的会让一次故障的总轮数
+ * 远超约定上限，所以必须认领同一个键。
+ */
+export declare const ERROR_RECOVERY_COUNT_META_KEY = "errorRecoveryCount";
+/**
+ * 流开始之后的网络错误（错误仍带原始 errno）使用的预算键。
+ *
+ * 响应头之前的连接失败由模型层连接级重试处理，耗尽后被归一化成 HTTP 502 上抛，
+ * 不会再走到这里——两层不会为同一次失败接力。
+ */
+export declare const NETWORK_RECOVERY_COUNT_META_KEY = "networkErrorRetryCount";
+/**
+ * `finish_reason=error` 后注入给模型的续写提示。
+ *
+ * 与截断续写（TRUNCATION_CONTINUATION_PROMPT）的区别是刻意去掉了「把剩下的工作拆小」：
+ * 那句是在修「一次输出太长」的因果，上游内部错误与输出长度无关，带上它既是错误归因，
+ * 也可能让模型把任务切碎、多烧轮次。同样不告诉模型「是服务端出错」——那会给它道歉和
+ * 复述的由头，与 no apology / no recap 自相矛盾。
+ */
+export declare const ERROR_RECOVERY_PROMPT: string;
+/**
+ * 包成 error-recovery system-reminder：stream-json 等输出通道会把只含 system-reminder
+ * 的内部用户消息清空丢弃，避免恢复提示混进用户可见的对话。
+ */
+export declare function buildErrorRecoveryReminder(): string;
+export declare function readRecoveryBudgetCount(session: Session, key: string): number;
+export declare function hasExhaustedRecoveryBudget(session: Session, key: string, limit?: number): boolean;
+/**
+ * 同步完成「判定 + 认领」，返回本次恢复的序号（1-based）；预算已用尽返回 `undefined`。
+ *
+ * 判定与消耗必须在同一个同步段里完成：分散到 `await` 两侧时，两处调用可能同时在
+ * `count = limit - 1` 通过检查，上限就不再成立。
+ */
+export declare function claimRecoveryBudget(session: Session, key: string, limit?: number): number | undefined;
+/** 认领后没有真正发起恢复（退避期间被取消、发起失败）时退回额度。 */
+export declare function releaseRecoveryBudget(session: Session, key: string): void;
+/** 清零并返回旧值，供日志使用。 */
+export declare function resetRecoveryBudget(session: Session, key: string): number;
+/**
+ * 「下一个模型请求是自动恢复轮」的一次性标记。
+ *
+ * 恢复轮的首 token 时限比首次请求短（见模型层）。这个标记在发起恢复 run 前由恢复
+ * 入口显式写入，由模型层在该 run 的第一个模型请求上读取并清除——之后同一 run 的工具
+ * 循环请求回到普通时限。不能改用重试计数反推「是否恢复轮」：计数跨多个模型请求累计，
+ * 反推会让恢复链之后的所有请求都被当成恢复轮。
+ */
+export declare const RECOVERY_REQUEST_PENDING_META_KEY = "recoveryRequestPending";
+export declare function markRecoveryRequestPending(session: Session): void;
+export declare function consumeRecoveryRequestPending(session: Session | undefined): boolean;
+export declare function clearRecoveryRequestPending(session: Session): void;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-hook-manager.d.ts

@@ -208,4 +208,19 @@ export declare class SessionHookManagerImpl implements SessionHookManager {
      * Does NOT support continueRequest.
      */
     executeFinalStopHooks(session: Session, reason?: FinalStopReason): Promise<void>;
+    /**
+     * UserPromptExpansion — Claude Code 官方事件：任何用户输入的命令/skill 展开成
+     * prompt、送进模型之前统一从这里触发，可阻断展开。`command_args` / `prompt` 按
+     * 官方 schema 是必填字段（无参数时发空串，而不是整个省略 key）。
+     */
+    executeUserPromptExpansionHooks(session: Session, payload: {
+        expansionType: 'slash_command' | 'mcp_prompt' | string;
+        commandName: string;
+        commandArgs: string;
+        commandSource?: string;
+        prompt: string;
+    }): Promise<{
+        allowed: boolean;
+        message?: string;
+    }>;
 }

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-manager-host-protocol.d.ts

@@ -1,5 +1,5 @@
 import type { AgentInputItem } from '../../../../cbc-shared/lib/node/index.js';
-import type { ModelResponseMetadata, Session } from './session-protocol.js';
+import type { ModelCallGeneration, ModelResponseMetadata, Session } from './session-protocol.js';
 export declare const SessionCheckpointHost: unique symbol;
 export interface SessionCheckpointHost {
     createCheckpoint(session: Session): Promise<void>;
@@ -57,7 +57,8 @@ export declare const SessionResponseTelemetryHost: unique symbol;
 export interface SessionResponseTelemetryHost {
     reportChatRequestResponseTelemetry(session: Session, result: NonNullable<Session['resultSubject']['value']>, isSuccessful: boolean, error: unknown, metadata: ModelResponseMetadata): Promise<void>;
     reportMessageResponseTelemetryStream(session: Session, usage: SessionResponseUsage | undefined, metadata: ModelResponseMetadata, error: unknown): Promise<void>;
-    reportChatMessageStatus(session: Session, errorCode: string, error?: unknown): Promise<void>;
+    /** Status of one model call (`generation`); run failures no model call owns are not reported. */
+    reportChatMessageStatus(session: Session, errorCode: string, generation: ModelCallGeneration, error?: unknown): Promise<void>;
 }
 export type SessionResponseTelemetrySnapshot = Pick<NonNullable<Session['telemetry']>, 'modelId' | 'modelName' | 'currentTurn' | 'traceId'>;
 export declare const SessionResponseObserver: unique symbol;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-manager.d.ts

@@ -4,7 +4,7 @@ import { Logger } from '../../../../telemetry/lib/common/index.js';
 import { BehaviorSubject } from 'rxjs';
 import { SessionRequestContextHost, SessionSettingsHost as SettingsManager, SessionUsageHost as UserStateManager } from './session-host-protocol.js';
 import { SessionBackgroundTaskHost as ToolManager, SessionCheckpointHost as CheckpointService, SessionProgressHost as ProgressSyncService, SessionResponseObserver as GalileoSessionBridge, SessionResponseTelemetryHost as TelemetryService, SessionSchedulerHost as CronSchedulerService, SessionSensitiveProjectionHost, SessionTaskLifecycleHost as AgentTaskManager } from './session-manager-host-protocol.js';
-import { AgentInputItemProcessor, InterruptionService, ModelResponseInterceptor, ModelResponseMetadata, Session, SessionFactory, SessionGetOptions, SessionHookManager, SessionManager, SessionStore } from './session-protocol.js';
+import { AgentInputItemProcessor, InterruptionService, ModelResponseInterceptor, ModelResponseMetadata, OverrideModelSource, Session, SessionFactory, SessionGetOptions, SessionHookManager, SessionManager, SessionStore } from './session-protocol.js';
 import { SessionRunStateMachine } from './session-run-state-machine-protocol.js';
 export declare class SessionManagerImpl implements SessionManager, ApplicationLifecycle<Application> {
     protected readonly sessionFactory: SessionFactory;
@@ -33,8 +33,19 @@ export declare class SessionManagerImpl implements SessionManager, ApplicationLi
     private sessionStartTimes;
     private addHistoryLocks;
     private resultSubscriptions;
+    private readonly resultSubscriptionOwners;
+    /**
+     * 每个 sessionId 当前活着的会话对象。身份守卫不能只认 result 订阅的登记：
+     * 订阅由调用方事后 `initRunResultHandler` 挂上（teammate / agent-task），而
+     * drain / team-inbox / turn-metrics 在 create 时就按 id 注册了，中间那段
+     * 「已注册、无订阅」的窗口里 owner 读不到，旧任务的延迟释放会摘掉同 id 后继
+     * 会话的注册。WeakRef：登记不得延长会话寿命，deref 为空即无需保护的对象。
+     */
+    private readonly liveSessionsById;
     private overridePermissionModes;
     private overrideModels;
+    /** 与 overrideModels 同生命周期的意图来源（user / declared / materialized）。 */
+    private overrideModelSources;
     /**
      * Issue #12554：会话级 thinking override（按 sessionId 隔离）。
      * 由 ACP setSessionConfigOption('thought_level') 或 prompt _meta 写入。
@@ -177,13 +188,15 @@ export declare class SessionManagerImpl implements SessionManager, ApplicationLi
      *
      * 幂等：未注册的 id 为 no-op；DI 容错：精简变体缺 service 时降级跳过。
      */
-    releaseInMemory(id: string): void;
+    releaseInMemory(target: string | Session): void;
     rename(session: Session, name: string): Promise<void>;
     setOverridePermissionMode(sessionId: string, mode: PermissionMode): void;
     getOverridePermissionMode(sessionId: string): PermissionMode | undefined;
-    setOverrideModel(sessionId: string, model: string): void;
+    setOverrideModel(sessionId: string, model: string, source?: OverrideModelSource): void;
     getOverrideModel(sessionId: string): string | undefined;
-    setRuntimeModel(session: Session | undefined, modelId: string): void;
+    getOverrideModelSource(sessionId: string): OverrideModelSource | undefined;
+    clearOverrideModel(sessionId: string): void;
+    setRuntimeModel(session: Session | undefined, modelId: string, source?: OverrideModelSource): void;
     setRuntimeOutputStyle(session: Session | undefined, style: string): void;
     /**
      * Issue #83229：把 settings.json 中的 model / outputStyle 读一次"钉"进 session.options，

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-persistence-error.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Typed local-transcript I/O failure (issue #119545).
+ *
+ * The only reason this type exists: `addHistory` must be able to tell "the
+ * local JSONL copy could not be written" apart from "this turn is broken".
+ * Windows `EBUSY` on the transcript is a third-party sharing violation, and a
+ * side-channel copy must never terminate a turn that is still executing tools.
+ *
+ * Everything else about persistence stays best-effort on purpose: there is no
+ * pending queue, no cross-process outbox and no durability barrier, so nothing
+ * else in the runtime waits on, or can be vetoed by, this file.
+ */
+export type SessionPersistencePhase = 'open' | 'stat' | 'write' | 'close' | 'rollback';
+export type SessionPersistenceRollbackOutcome = 'not-needed' | 'succeeded' | 'failed';
+export interface SessionPersistenceErrorOptions {
+    phase: SessionPersistencePhase;
+    cause: unknown;
+    attempt?: number;
+    rollbackOutcome?: SessionPersistenceRollbackOutcome;
+    retryable?: boolean;
+}
+/**
+ * Windows sharing violations and their POSIX lookalikes. `EBUSY` is the one
+ * this ticket measured (25% of appends within 10ms of the previous write);
+ * `EPERM` / `EACCES` ride along because the same scanners produce them.
+ */
+export declare function isRetryableSessionPersistenceError(error: unknown): boolean;
+export declare class SessionPersistenceError extends Error {
+    readonly phase: SessionPersistencePhase;
+    readonly code?: string;
+    readonly attempt: number;
+    readonly rollbackOutcome: SessionPersistenceRollbackOutcome;
+    readonly retryable: boolean;
+    constructor(options: SessionPersistenceErrorOptions);
+}
+/**
+ * Duck-typed on purpose: core and the host package can each hold their own copy
+ * of this class, so `instanceof` is not reliable across the package boundary.
+ * The required fields keep a foreign error named `SessionPersistenceError` from
+ * being mistaken for one of ours — an unrecognized error still fails the run,
+ * which is the safe direction.
+ */
+export declare function isSessionPersistenceError(error: unknown): error is SessionPersistenceError;