@tencent-ai/agent-harness 0.2.0-beta.1 → 0.2.0-beta.3

package/cli/dist-server/types/vendor/cbc-core/node/agent/speaker-label.d.ts

@@ -0,0 +1,44 @@
+export declare function resolveMessageSpeakerLabel(input: {
+    session?: {
+        id?: string;
+        storeId?: string;
+        meta?: Record<string, unknown>;
+    } | undefined;
+    runAgentName?: string;
+}): string | undefined;
+/**
+ * 子会话的**展示名**（给人看）：团队成员用成员名，其余子代理用自身预设名（`meta.agentName`）；
+ * 主会话 / 无会话 / 无身份线索返回 undefined。**只用于展示与遥测标签，不要拿它查表。**
+ */
+export declare function resolveSubAgentDisplayName(session: {
+    id?: string;
+    storeId?: string;
+    meta?: Record<string, unknown>;
+} | undefined): string | undefined;
+/**
+ * 子会话的**查表键**（REPL 沙箱白名单 / overlay 缓存用）：只认「预设名」这一种语义。
+ *
+ * 与展示名刻意分开（评审）：团队成员会把自己的成员名写进 `meta.agentName`（teammate-runner），
+ * 于是 `meta.agentName` 同时承载「预设名」与「成员名」两种含义 —— 拿成员名去查 agent 配置查不到，
+ * 只能落到默认 agent 的兜底（既不是成员自己的白名单、也不是「不过滤」）。取不到可信的预设名时
+ * 返回 undefined = 不额外收窄（与改动前一致），不去猜。
+ */
+export declare function resolveSubAgentAgentKey(session: {
+    id?: string;
+    storeId?: string;
+    meta?: Record<string, unknown>;
+} | undefined): string | undefined;
+/** 展示名的**派发侧镜像**：子会话还没建时拿不到 `meta.teamContext`，但这对值就是稍后写进 session 的同一对。 */
+export declare function resolveSubAgentDisplayNameFromParts(input: {
+    memberName?: string;
+    presetName?: string;
+}): string | undefined;
+/**
+ * 查表键的**派发侧镜像**（AgentManager.sandboxScopedAgentView 传身份用）：
+ * 预设名与成员名**同值**（团队成员把自己的名字写进 meta.agentName）时判为「没有可信预设名」→ undefined，
+ * 与运行期 `resolveSubAgentAgentKey` 同源 —— 否则派发侧按成员名收窄、执行侧判不到，两边分叉。
+ */
+export declare function resolveSubAgentAgentKeyFromParts(input: {
+    memberName?: string;
+    presetName?: string;
+}): string | undefined;

package/cli/dist-server/types/vendor/cbc-core/node/agent/tool-call-loop-detector-service.d.ts

@@ -6,9 +6,9 @@
  * wastes tokens/credits.
  *
  * Detection rules:
- * 1. Generic loop: blacklisted tool with identical arguments 4 consecutive times
+ * 1. Generic loop: blacklisted tool with semantically identical JSON arguments 4 consecutive times
  * 2. Read file loop: Read tool targeting the same file_path 40 consecutive times
- * 3. Non-blacklist loop: any tool NOT in blacklist with identical arguments 40 consecutive times
+ * 3. Non-blacklist loop: any tool NOT in blacklist with semantically identical JSON arguments 40 consecutive times
  */
 import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
 import { Logger } from '../../../../workspace/telemetry/lib/common/index.js';
@@ -38,14 +38,15 @@ export declare class ToolCallLoopDetectorImpl implements ToolCallLoopDetector {
         arguments: string;
     }>;
     /**
-     * Check for generic loop: same tool with identical arguments N consecutive times.
+     * Check for generic loop: same tool with semantically identical JSON arguments
+     * N consecutive times. Malformed or very large argument payloads retain exact-string semantics.
      */
     protected checkGenericLoop(tailCalls: Array<{
         name: string;
         arguments: string;
     }>): LoopDetectionResult;
     /**
-     * Check for non-blacklist tool loop: any tool NOT in the blacklist with identical arguments
+     * Check for non-blacklist tool loop: any tool NOT in the blacklist with semantically identical JSON arguments
      * called N consecutive times (threshold: NON_BLACKLIST_LOOP_THRESHOLD).
      * Scans from the tail of input, collecting only non-blacklist function_call items.
      */

package/cli/dist-server/types/vendor/cbc-core/node/agent/tool-call-loop-guard-protocol.d.ts

@@ -27,7 +27,7 @@ export declare const TOOL_CALL_LOOP_STOPPED_MESSAGE = "Request aborted: user sto
  * - `ToolCallLoopDetector` 在**模型请求前**拦截，静默向模型注入停止消息，用户无感；
  *   它覆盖的是旧的三条规则（黑名单同参 4 次 / Read 同文件 40 次 / 非黑名单同参 40 次）。
  * - `ToolCallLoopGuard` 在**工具执行前**拦截，弹窗让用户自己决定继续还是停止；
- *   它覆盖新增的两条规则（同工具连续 40 次 / 周期序列重复 10 轮）。
+ *   它覆盖新增的两条规则（同工具连续 40 次，Bash 与 Write 单独放到 80 次 / 周期序列重复 10 轮）。
  *
  * 两者刻意并存：旧规则的静默语义已被线上验证，不因新能力回归。
  */

package/cli/dist-server/types/vendor/cbc-core/node/agent/tool-call-loop-pattern.d.ts

@@ -5,8 +5,13 @@
  */
 import type { ToolCallLoopTriggerType } from '../../../../workspace/telemetry/lib/common/event/types/craft.js';
 export interface ToolCallLoopThresholds {
-    /** 同一工具连续调用达到该次数即判定为循环。 */
+    /** 同一工具连续调用达到该次数即判定为循环。Bash / Write 走单独阈值。 */
     consecutiveThreshold: number;
+    /**
+     * Bash 与 Write 连续调用的单独阈值。长任务里模型会连续跑很多条命令、
+     * 或连续落很多个文件，只看工具名时 40 次容易把正常推进误判成循环。
+     */
+    bashConsecutiveThreshold: number;
     /** AAB 块需要连续重复的轮数。 */
     sequenceRepeats: number;
 }
@@ -17,6 +22,9 @@ export interface ToolCallLoopHit {
     /** 重复序列的周期长度；AAB 恒为 3，连续同工具恒为 1。 */
     patternLength: number;
 }
+/** 与 `ToolNames.BASH` / `ToolNames.WRITE` 对齐。模式识别层不依赖 agent-protocol，避免把工具名枚举拉进来。 */
+export declare const BASH_LOOP_TOOL_NAME = "Bash";
+export declare const WRITE_LOOP_TOOL_NAME = "Write";
 export declare const DEFAULT_TOOL_CALL_LOOP_THRESHOLDS: ToolCallLoopThresholds;
 /** AAB 块的长度。多工具循环只识别这一种形状，因此是常量而非可配阈值。 */
 export declare const AAB_PERIOD = 3;
@@ -36,7 +44,7 @@ export declare class ToolCallLoopTracker {
      * 记录一次即将执行的工具调用，返回本次是否命中循环。
      *
      * 命中优先级：先判连续同工具，再判 AAB 重复。两条规则的阈值默认不重叠
-     * （40 次 vs AAB 重复 10 轮），实践中不会互相抢占。
+     * （普通工具 40 次、Bash / Write 80 次 vs AAB 重复 10 轮），实践中不会互相抢占。
      */
     record(toolName: string): ToolCallLoopHit | undefined;
     /**
@@ -52,14 +60,18 @@ export declare class ToolCallLoopTracker {
  * - `ABC`（三者互不相同）通常是正常的多步工作流（读文件 → 改文件 → 跑测试，
  *   然后换下一个文件），按周期重复判它循环误伤面太大；
  * - `ABAB` 这类两工具交替同样不判，避免把翻页 / 分批处理误当循环；
- * - `AAA…` 属于连续同工具，由 consecutiveThreshold 那条规则负责。
+ * - `AAA…` 属于连续同工具，由 consecutiveThreshold / bashConsecutiveThreshold（Bash、Write）那条规则负责。
  *
  * `X ≠ Y` 顺带保证了 AAB 一定是本原周期（唯一可能的更短整除周期是 1，
  * 那要求三个元素全等），所以不需要额外的本原性校验。
  */
 export declare function matchesRepeatedAabSequence(history: readonly string[], repeats: number): boolean;
 /**
- * 读取阈值配置。两个环境变量只用于 QA 快速复现，生产不设置即走默认值。
+ * 读取阈值配置。环境变量只用于 QA 快速复现，生产不设置即走默认值。
  * AAB 的周期是形状定义的一部分，不开放配置。
+ *
+ * `CBC_LOOP_GUARD_CONSECUTIVE_THRESHOLD` 只覆盖非 Bash / Write 工具。Bash 与 Write
+ * 共用 `CBC_LOOP_GUARD_BASH_CONSECUTIVE_THRESHOLD`，避免 QA 把通用阈值压低时
+ * 把长任务放宽一并关掉。
  */
 export declare function resolveToolCallLoopThresholds(env?: NodeJS.ProcessEnv): ToolCallLoopThresholds;

package/cli/dist-server/types/vendor/cbc-core/node/context/compaction-lineage.d.ts

@@ -0,0 +1,39 @@
+import type { CompactionKind, CompactionTrigger } from '../../../../workspace/telemetry/lib/common/index.js';
+import type { Session } from '../session/session-protocol';
+export type { CompactionKind, CompactionTrigger };
+export declare function compactionKindOf(trigger: CompactionTrigger): CompactionKind;
+/** Compactions of a Session's context. Never resets, like `modelStepSeq`. */
+export interface CompactionLineage {
+    /** Completed compactions. */
+    count: number;
+    /** Compaction the current context starts from. */
+    lastId?: string;
+    /** Trigger of the completed compaction the next agent-loop model call reports. */
+    pending?: CompactionTrigger;
+}
+type LineageSession = Pick<Session, 'id' | 'history' | 'compactionLineage' | 'meta'>;
+/** Compaction lineage of `session`, restored from its history after resume. */
+export declare function getCompactionLineage(session: LineageSession): CompactionLineage;
+/**
+ * Numbers a compaction boundary item before it enters history and stamps the running
+ * compaction onto it; the next agent-loop model call reports it.
+ */
+export declare function recordCompactionBoundary(session: LineageSession, providerData: Record<string, unknown>): void;
+/** Compaction lineage of one model call (gateway headers, `chat_message_send`). */
+export interface ModelCallCompaction {
+    /** Completed compactions of the Session when the call is sent. */
+    readonly count: number;
+    /** Compaction the call's context starts from. */
+    readonly id?: string;
+    /** Compaction calls: class of the running compaction (`X-Compaction`). */
+    readonly kind?: CompactionKind;
+    /** First agent-loop call after a compaction: its class (`X-Context-Compacted`) and trigger. */
+    readonly contextCompacted?: CompactionKind;
+    readonly trigger?: CompactionTrigger;
+}
+/**
+ * Compaction lineage for the model call in the current async chain. Only the first
+ * agent-loop call after a compaction reports it, like Claude Code's
+ * `consumePendingContextCompacted`.
+ */
+export declare function resolveModelCallCompaction(session: LineageSession & Pick<Session, 'agentPurpose' | 'conversationRequestId'>): ModelCallCompaction;

package/cli/dist-server/types/vendor/cbc-core/node/context/context-compact-summarizer.d.ts

@@ -16,6 +16,7 @@ import { CompactStrategy, type ContextCompactResult, ContextCompactSummarizeOpti
  * 不包含任何具体的压缩逻辑实现。
  */
 export declare class ContextCompactSummarizerImpl implements ContextCompactSummarizer {
+    private activeCompactions?;
     protected readonly productManager: ProductManager;
     protected readonly agentManager: AgentManager;
     protected readonly logger: Logger;
@@ -25,6 +26,7 @@ export declare class ContextCompactSummarizerImpl implements ContextCompactSumma
     protected readonly strategyProvider: Provider<CompactStrategy>;
     compactAndSummarize(session: Session, options?: ContextCompactSummarizeOptions): Promise<boolean>;
     compactWithResult(session: Session, options?: ContextCompactSummarizeOptions): Promise<ContextCompactResult>;
+    private compactWithResultOwned;
     /**
      * 按优先级匹配（PreMessage → MaxToken），跳过 Blocking（仅作最终兜底），执行第一个命中的策略；
      * 都不命中则安全网回落到 Blocking。逻辑与压缩 span 化之前完全一致，只是把散落的 `return` 收敛成

package/cli/dist-server/types/vendor/cbc-core/node/context/context-protocol.d.ts

@@ -1,7 +1,10 @@
+import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import type { CompactionTrigger } from '../../../../workspace/telemetry/lib/common/index.js';
 import { Session } from '../session/session-protocol';
 export declare const PromptContextProvider: unique symbol;
 export declare const PromptContextInitializer: unique symbol;
 export declare const ContextCompactSummarizer: unique symbol;
+export declare const ManualCompactRequestHandler: unique symbol;
 export declare const PromptRenderer: unique symbol;
 export declare const COMPACT_PROMPT = "compact-prompt";
 export declare const DEFAULT_TOKEN_THRESHOLD = 0.7;
@@ -190,6 +193,8 @@ export interface ContextCompactSummarizeOptions {
     type?: CompactType;
     /** Stable identity shared by live updates and the durable compact boundary. */
     compactionId?: string;
+    /** Why this compaction runs; defaults from `type` (manual / pre_message_threshold / emergency_threshold). */
+    trigger?: CompactionTrigger;
 }
 export type ContextCompactSkipReason = 'already_compacting' | 'pending_interruption' | 'auto_disabled' | 'empty_history' | 'already_compacted' | 'non_default_agent' | 'below_threshold';
 export type ContextCompactFailureReason = 'strategy_failed' | 'strategy_unavailable';
@@ -214,6 +219,8 @@ export declare function createCompactionId(): string;
 export declare const SESSION_META_COMPACT_TYPE: 'compactType';
 /** Current stable compaction identity, persisted onto the boundary item. */
 export declare const SESSION_META_COMPACTION_ID: 'compactionId';
+/** Trigger of the compaction the summarizer is running; unset for a typed `/compact`. */
+export declare const SESSION_META_COMPACTION_TRIGGER: 'compactionTrigger';
 /**
  * session.meta 上标记当前 compact 成功后会继续执行一次真实 agent run。
  *
@@ -321,6 +328,16 @@ export interface ContextCompactSummarizer {
     /** Compatibility wrapper for existing automatic-compaction callers. */
     compactAndSummarize(session: Session, options?: ContextCompactSummarizeOptions): Promise<boolean>;
 }
+/**
+ * Host-owned boundary for external `/compact` requests.
+ *
+ * AgentService invokes this before creating a normal run lifecycle when an
+ * interactive host opts in. Implementations must return false for internal compact
+ * inputs so strategy-owned internal runs cannot recursively re-enter this boundary.
+ */
+export interface ManualCompactRequestHandler {
+    tryHandle(input: string | AgentInputItem[], session: Session): Promise<boolean>;
+}
 export interface PromptRenderer {
     render(template: string, context?: PromptContext): Promise<string>;
 }

package/cli/dist-server/types/vendor/cbc-core/node/context/index.d.ts

@@ -1,4 +1,5 @@
 export * from './context-protocol';
+export * from './compaction-lineage';
 export * from './context-host-protocol';
 export * from './prompt-context-provider';
 export * from './prompt-renderer';

package/cli/dist-server/types/vendor/cbc-core/node/context/pre-message-compact-strategy.d.ts

@@ -4,8 +4,7 @@ import { CompactStrategyContext, ContextCompactSummarizeOptions } from './contex
 /**
  * PreMessage 压缩策略：在发送用户消息前触发。
  *
- * 触发条件：PRE_MESSAGE_AUTO 或 WorkBuddy 的 USER_COMMAND。
- * CBC 手动 /compact 不走该策略，继续由 compact agent 路径处理。
+ * 触发条件：PRE_MESSAGE_AUTO 或 USER_COMMAND（WorkBuddy / TUI 手动压缩）。
  *
  * 流程：
  * 1. Engineering compact (no LLM call)

package/cli/dist-server/types/vendor/cbc-core/node/hooks/agent-trigger.d.ts

@@ -1,31 +1,15 @@
-/**
- * Agent-trigger payload helper, shared by SessionHookManager and ToolHookManager.
- *
- * Mirrors Claude Code's `createBaseHookInput` (utils/hooks.ts) so that every
- * hook event carries enough context for users to branch on
- * "main thread vs sub-agent" inside their Settings-level hooks.
- *
- * Rules (CC parity):
- *  - `agent_type` is the agent's display name; populated from `session.agentName`
- *    when set. On the main thread this is the `--agent` flag (when used) or the
- *    default agent name. Inside a sub-agent this is the sub-agent's `name`
- *    (e.g. "Explore", "Plan", "general-purpose").
- *  - `agent_id` is only meaningful inside a sub-agent run — CC leaves it
- *    `undefined` on the main thread. We honour the same convention by only
- *    emitting it when `session.storeId` is present (sub-agent sessions get a
- *    `agent-{8}` storeId; main sessions do not).
- *
- * Kept dependency-free so it can be imported from anywhere — including modules
- * that must avoid pulling the full `../session` barrel (which transitively
- * loads SessionManager / tips and triggers IoC initialisation).
- */
 export interface AgentTriggerLike {
     id?: string;
     agentName?: string;
     storeId?: string;
+    /** 会话 meta：身份标签要读 agentName / teamContext.memberName，parentSessionId 供子会话判定。 */
     meta?: {
         parentSessionId?: string;
-    };
+        agentName?: string;
+        teamContext?: {
+            memberName?: unknown;
+        };
+    } & Record<string, unknown>;
 }
 export declare function buildAgentTrigger(session: AgentTriggerLike | undefined | null): {
     agent_id?: string;

package/cli/dist-server/types/vendor/cbc-core/node/hooks/hook-protocol.d.ts

@@ -31,7 +31,10 @@ export interface HookInput {
      */
     reason?: SessionEndReason;
     /**
-     * User prompt content (for UserPromptSubmit event)
+     * User prompt content.
+     * - UserPromptSubmit: the submitted prompt text.
+     * - UserPromptExpansion: Claude Code spec required field, always sent — the
+     *   raw, pre-expansion text as typed by the user (e.g. "/deploy prod").
      */
     prompt?: string;
     /**

package/cli/dist-server/types/vendor/cbc-core/node/session/idle-queue-drain-service.d.ts

@@ -1,44 +1,7 @@
 /**
- * Idle Queue Drain Service (Mode A `session.queue` 通道)
- *
- * 为什么需要这个 service
- * =====================
- * 用户在 agent 还在跑（streaming 末尾、工具执行中等）时输入新消息，UI 调
- * `agentService.run([userMsg])` 进来，`MessageQueueAgentRunInterceptor`
- * (input-interceptors.ts:77-84) 看到 `inConversation=true`，把消息塞进
- * `session.queue` 并设 `skipRun=true`。当前 turn 自然结束、emit `agent_end`，
- * 但**没有任何组件**会主动调一次 `agentService.run([], session)` 来触发
- * interceptor 的 drain 分支（input-interceptors.ts:85-103，那条分支会
- * `mergeConsecutiveUserMessages` 把队列里的消息拍成一个新 turn）。
- *
- * 结果：消息僵在 `session.queue`，UI 显示"已发送"，agent 永远不回。
- *
- * `TeamInboxDispatchService` 看起来形态对，但它只检查
- * `RichMessageQueueManager`（团队成员消息进的那个 queue），全 codebase 只有
- * `team-create-tool.ts:332` 一处往 rich queue 写 —— 普通 TUI 用户输入完全
- * 走 `session.queue`，团队 dispatcher 看不到。
- *
- * 这个 service 就填这个空：每个 session 都订阅 `agent_end`，guard 通过后
- * 调一次空 input 的 `agentService.run`，让现有 interceptor 自己合并消费。
- *
- * 与 TeamInboxDispatchService 的关系
- * ==================================
- * - Mode A（默认）：`isDeferredDispatchEnabledSync()===false`。
- *   IdleQueueDrainService 接管 `session.queue` 的 drain；TeamInboxDispatchService
- *   也订阅了，但它看 rich queue（一般为空）→ short-circuit。
- * - Mode B：`isDeferredDispatchEnabledSync()===true`。
- *   IdleQueueDrainService 入口 short-circuit；TeamInboxDispatchService 走
- *   rich queue 的 immediate/pending 路径。
- * 两 service 各自有 `dispatching` Set，最坏情况下都是 short-circuit return，
- * 不会双重发起 run。
- *
- * 它不做的事
- * ==========
- * - 不动 `session.queue` 里的内容（让 interceptor 现有 mergeConsecutive 逻辑
- *   作为唯一消费点，避免逻辑漂移）。
- * - 不在 compact 中触发（`session.isCompressing` guard）。
- * - 不在 Mode B 中触发。
- * - 不影响 cancel 路径的 abort 行为（只在 `agent_end` 后做兜底）。
+ * Wake local queues after a turn ends. Mode A owns session.queue; Mode B tasks
+ * own its non-mirror items. Mode B main sessions remain with rich queue.
+ * MessageQueueAgentRunInterceptor remains the only dequeue/merge point.
  */
 import { Logger } from '../../../../workspace/telemetry/lib/common/index.js';
 import { AgentManager, AgentService } from '../agent/agent-protocol';
@@ -64,21 +27,6 @@ export declare class IdleQueueDrainServiceImpl implements IdleQueueDrainService
      * 空队列直接返回。
      */
     requestDrain(session: Session): void;
-    /**
-     * Guard 链 + 调 agentService.run 触发 interceptor 的 drain 分支。
-     *
-     * Guard 顺序（逐个 short-circuit return）：
-     *   1. 重入：同 session 上一次 tryDrain 还没 await 完。
-     *   2. compact 中：`session.isCompressing===true`。compact 自身的
-     *      continue-run 也会 emit `agent_end`，必须避让。
-     *   3. Mode B：rich queue 通道由 TeamInboxDispatchService 处理。
-     *   4. DI 兜底：headless 等变体可能没拉到 AgentService/AgentManager。
-     *   5. 空队列：没东西好 drain。
-     *   6. 取消记账在途：见下方注释。
-     *
-     * 失败回灌：interceptor 在 line 95 已经 `clearQueue`，如果后续 run 抛错，
-     * 队列里的消息会"被消费但又没真消费"，相当于丢了。所以在调 run 之前
-     * 快照 queue，run 抛错时检查 queue 是否被清空、被清空就把快照灌回。
-     */
+    /** Reuse the existing idle drain and its pre-result failure restoration. */
     private tryDrain;
 }

package/cli/dist-server/types/vendor/cbc-core/node/session/index.d.ts

@@ -8,6 +8,7 @@ export * from './session-response-host-protocol';
 export * from './background-task-protocol';
 export * from './root-session-scope';
 export * from './session-factory';
+export { assertSessionRuntimeOpen, closeSessionRuntime, isSessionRuntimeClosed, sessionRuntimeSignal, } from './session-runtime-lifecycle';
 export * from './session-admission-service';
 export * from './session-manager';
 export * from './session-store';
@@ -25,14 +26,17 @@ export { getSessionCanUseTool, resolveCanUseTool, resolveCanUseToolOwner, setSes
 export type { CanUseTool, CanUseToolOptions, CanUseToolOwner, PermissionBehavior, PermissionDecisionClassification, PermissionResult as CanUseToolPermissionResult, PermissionRuleValue, PermissionUpdate as CanUseToolPermissionUpdate, PermissionUpdateDestination, } from './can-use-tool';
 export * from './dual-channel-interaction';
 export * from './session-persistence';
+export * from './session-persistence-error';
 export * from './session-set-current';
 export * from './cancel-session-runtime-state';
 export * from './user-request-boundary';
 export { isTruncationRecoveryActive } from './truncation-recovery';
 export * from './aborted-stream-draft-store';
 export * from './stream-timeout-retry-budget';
+export { consumeRecoveryRequestPending } from './recovery-budget';
 export * from './session-run-state-machine-protocol';
 export * from './session-run-state-machine';
+export * from './model-request-retry-phase';
 export * from './session-run-state-projection-service';
 export * from './local-jsonl-session-store';
 export * from './transcript-branch';

package/cli/dist-server/types/vendor/cbc-core/node/session/interruption-service.d.ts

@@ -8,12 +8,44 @@ import { InterruptionService, type PendingApprovalView, Session, SessionHookMana
 import { SessionRunStateMachine } from './session-run-state-machine-protocol';
 type IIdleQueueDrainService = import('./session-protocol').IdleQueueDrainService;
 export declare class InterruptionServiceImpl implements InterruptionService {
+    private readonly resolvedSandboxItems;
     private pendingInterruptions;
     private itemToSessionMap;
     private interruptionQueues;
     private parentIdToMainSession;
     private childToMainSession;
     private waitForSubscriptions;
+    private readonly approvalSources;
+    private readonly handlingStates;
+    private readonly reportedStaleStates;
+    private readonly reportedDiscardedApprovals;
+    private readonly handledResults;
+    private readonly resumeProgress;
+    /**
+     * Terminal by design: a blocked continuation already proved it cannot make
+     * progress, and a later user request arrives on a *new* RunState, so the
+     * session is never stranded.
+     */
+    private readonly blockedResumeStates;
+    /**
+     * Deliberately not `session.meta.consecutiveEmptyDrainCount`: the idle
+     * empty-drain guard both increments that counter (tripping this
+     * continuation early, aborting a legitimate resume) and resets it
+     * (stretching the budget without bound).
+     */
+    private readonly resumeNoProgressCount;
+    private assertApprovalSource;
+    private approveSource;
+    private awaitPermissionReply;
+    /**
+     * A decision the user actually clicked must never disappear without a word.
+     *
+     * The card is dequeued and the deferred rejected, but the run that owned it
+     * is already gone — so nothing downstream surfaces the rejection and the
+     * user is left believing the tool was approved.
+     */
+    private reportDiscardedDecision;
+    private reportStaleSource;
     /**
      * 权限审批全局真相源（方案一：统一数据源）。
      *
@@ -61,12 +93,22 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     protected readonly idleQueueDrainService?: IIdleQueueDrainService;
     protected readonly traceCollector?: SessionInterruptionTraceHost;
     protected get startupProfiler(): SessionInterruptionProfilerHost;
+    /**
+     * 标记「用户取消本轮」的拒绝项（`reject(item, { cancelTurn: true })`）。
+     * 语义是取消当前 turn，而不是「拒绝并让模型带反馈续跑」。
+     * 记在 WeakSet 而不是 `rawItem.providerData`（那会落进历史），也不改
+     * deferred 的 reject 形状（下游按 error 类型分支的逻辑保持不变）。
+     */
+    private readonly cancelTurnItems;
+    /** Claim before calling out: sandbox callbacks can throw or synchronously re-enter. */
+    private takeSandboxResolve;
     approve(item: RunToolApprovalItem, options?: {
         alwaysApprove?: boolean;
         scope?: 'session' | 'localSettings';
     }): void;
     reject(item: RunToolApprovalItem, options?: {
         decision?: 'deny' | 'rejectAndExitPlan';
+        cancelTurn?: boolean;
     }): void;
     /**
      * 取消指定 session 上所有未决的 interruption Deferred。
@@ -101,8 +143,9 @@ export declare class InterruptionServiceImpl implements InterruptionService {
      *
      * 幂等：未注册的 sessionId 为 no-op。
      */
-    releaseSession(sessionId: string): void;
-    protected handleInterruptions(session: Session, interruptions: RunToolApprovalItem[]): Promise<void>;
+    releaseSession(target: string | Session): void;
+    protected handleInterruptions(session: Session, interruptions: RunToolApprovalItem[], result?: RunResult<any, any> | StreamedRunResult<any, any> | undefined): Promise<void>;
+    private processInterruptions;
     protected executePendingManualPostCompactHook(session: Session, result: RunResult<any, any> | StreamedRunResult<any, any>): Promise<void>;
     waitFor(session: Session): Promise<void>;
     /**
@@ -334,15 +377,26 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     private static sanitizeToolNotFoundMessage;
     private hasRecentModelErrorRetry;
     /**
-     * 检测是否已有 stream timeout 重试记录
-     * 避免反复重试导致无限循环
+     * 网络 / 流错误自动恢复的统一前置步骤：认领额度 → 可取消的指数退避 → 标记恢复轮。
+     *
+     * 认领放在退避之前、且晚于本 catch 里的第一个 await：session-manager 的 gate 在
+     * `result.completed` reject 后同步读取同一份预算判据，认领若早于 gate 读取，最后
+     * 一次重试会被 gate 误判为「预算已耗尽」而提前下发终态。
+     *
+     * 退避期间会话处于 RETRYING：失败的 run 与写入中断结果的 skipRun run 都已收尾回 idle，
+     * 这里重新置为 busy，TUI 继续显示进行中并响应 Esc，用户新消息进队列而不是直接起 run。
+     * 恢复 run 带 bypassMessageQueue 从 RETRYING 直接发起，中间不回 idle，不留让新 run
+     * 插入的空窗；恢复 run 收尾（AGENT_ENDED）时回 idle 并带出排队消息。
+     *
+     * 退避期间用户取消时退回额度、以 RUN_FAILED 收回 idle 并返回 `cancelled`，调用方不得
+     * 再发起。取消信号在等待前现取：写入中断结果的 skipRun run 会替换 `session.abortController`，
+     * 用户此后按下的 Stop 作用在新 controller 上；排队消息接管 owner 时，其 abort 会级联到这里。
      *
-     * 首 token 超时：允许最多 2 次重试（含线性延迟 2s/4s），给网络波动更多恢复机会
-     * 流数据超时：保持只重试 1 次
-     * 旧的基于历史消息窗口的检测不可靠：长任务（如 8 个子任务）会产生大量消息，
-     * 将 retry marker 推出 5 条消息的窗口，导致误判为"可以再次重试"
+     * 等待结束时若状态既不是 RETRYING 也不是 idle，说明 RETRYING 被迟到的收尾事件冲掉后
+     * 已有新 run 被接纳并在执行，返回 `superseded`，否则恢复 run 会与它同时写同一个会话。
+     * 此时不退回额度——新请求边界已经清零，再减一次会扣掉新链的额度。
      */
-    private incrementStreamTimeoutRetryCount;
+    private prepareRecoveryAttempt;
     /**
      * CLI TUI 手打 `/compact` 裸跑成功后补发 SessionStart('compact')。
      *

package/cli/dist-server/types/vendor/cbc-core/node/session/model-request-retry-phase.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRetryReason, Session } from './session-protocol';
+import { ModelRequestRetryPhase, SessionRunStateMachine } from './session-run-state-machine-protocol';
+export declare class ModelRequestRetryPhaseImpl implements ModelRequestRetryPhase {
+    protected readonly stateMachine: SessionRunStateMachine;
+    during<T>(session: Session | undefined, reason: AgentRetryReason, wait: () => Promise<T>): Promise<T>;
+    /**
+     * 辅助型调用复用主 session 却不回送 AGENT_ENDED（#52320），不得驱动其状态；
+     * 状态已离开 MODEL_REQUESTING 说明另有路径在推进，此时不抢写。
+     */
+    private enter;
+    /**
+     * 必须回到 MODEL_REQUESTING：RETRYING 不接收 TOOL_STARTED / MODEL_RESPONSE_DONE 等后续事件，
+     * 停留会让错误处理路径的转换被静默忽略。已被取消等事件推走时不再改写。
+     */
+    private leave;
+}

package/cli/dist-server/types/vendor/cbc-core/node/session/model-response-interceptors.d.ts

@@ -29,6 +29,24 @@ export declare class finishReasonErrorInterceptor implements ModelResponseInterc
     protected readonly sessionStore: SessionStore;
     protected readonly telemetryService: TelemetryService;
     intercept(ctx: ModelResponseInterceptorContext): Promise<boolean | void>;
+    /**
+     * 处理「已经产出实质内容之后才 `finish_reason=error`」：自动续写，最多 3 次、1s 起步 2 倍退避。
+     *
+     * 没有任何实质输出就 error 的两种形态（仅 reasoning / 零 token）在模型层被转成可重试的
+     * EmptyStreamError，走 interruption-service 的流错误恢复；三者认领同一份 error 预算。
+     *
+     * 能走到这里说明这次 run 已经结束：SDK 只要本轮还有可执行的工具调用就会继续循环，
+     * 不会把控制权交回。因此不存在「参数完整但尚未执行」的工具调用；万一出现，每次构造
+     * 请求前的 `fillFunctionCallResultHistory` 也会补齐配对，不会因孤儿调用触发上游 400。
+     * 本期只统计孤儿数量用于验证这一推论，不改补齐逻辑。
+     *
+     * 预算用尽、退避期间被取消或发起失败时都**不返回 `true`**：没有重跑在路上，本轮必须
+     * 正常收敛给上层，否则 CLI 会一直等一个不存在的 run。
+     */
+    private handleErrorFinishReason;
+    private writeErrorTerminalMessage;
+    /** 统计本轮以 error 收尾时残留的无配对结果工具调用，用于验证「此处不应有孤儿」的推论。 */
+    private logOrphanToolCallsOnError;
     private shouldSkipExpectedSubagentToolCalls;
     /**
      * 处理 length 类型的完成原因：从断点续写（#119765）。
@@ -197,6 +215,21 @@ export declare class MediaContentErrorInterceptor implements ModelResponseInterc
     private static readonly MAX_RETRY_ATTEMPTS;
     private static readonly MAX_MIME_MISMATCH_RETRY_ATTEMPTS;
     private static readonly GIF_UNSUPPORTED_ERROR_CODES;
+    /**
+     * Gateway business codes that mean "the model refused the images in this
+     * request" (`11135 InvalidInputImage`).
+     *
+     * The code is the only stable signal. The gateway folds several unrelated
+     * upstream causes into one hard-coded English sentence and overwrites the
+     * upstream text, so `ERROR_TYPE_PATTERNS` matching that sentence breaks the
+     * moment the wording is changed or localized (`docs/error-codes.md` already
+     * ships a Chinese user-facing string for this code). The code is carried on
+     * the error object all the way here — `error-analyzer` puts the parsed body
+     * code into the response, the SDK surfaces it as `APIError.error.code`, and
+     * `ErrorUtils.extractBizCode` recovers it — so key off it and keep the
+     * phrasing match only as a fallback for gateways that send no code.
+     */
+    private static readonly IMAGE_REJECTED_ERROR_CODES;
     private static readonly GIF_UNSUPPORTED_PLACEHOLDER;
     private static readonly ERROR_TYPE_PATTERNS;
     intercept(ctx: ModelResponseInterceptorContext): Promise<boolean | void>;