@tencent-ai/agent-harness 0.2.0-beta.10 → 0.2.0-beta.11

package/cli/dist-server/types/node/tools/multi-edit-tool.d.ts

@@ -24,19 +24,19 @@ declare const MultiEditFileParameters: z.ZodObject<{
         replace_all?: boolean | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
+    file_path: string;
     edits: {
         new_string: string;
         old_string: string;
         replace_all: boolean;
     }[];
-    file_path: string;
 }, {
+    file_path: string;
     edits: {
         new_string: string;
         old_string: string;
         replace_all?: boolean | undefined;
     }[];
-    file_path: string;
 }>;
 export declare class MultiEditTool extends SandboxPermissionFileTool implements Tool {
     protected readonly workspace: Workspace;
@@ -62,19 +62,19 @@ export declare class MultiEditTool extends SandboxPermissionFileTool implements
             replace_all?: boolean | undefined;
         }>, "many">;
     }, "strip", z.ZodTypeAny, {
+        file_path: string;
         edits: {
             new_string: string;
             old_string: string;
             replace_all: boolean;
         }[];
-        file_path: string;
     }, {
+        file_path: string;
         edits: {
             new_string: string;
             old_string: string;
             replace_all?: boolean | undefined;
         }[];
-        file_path: string;
     }>;
     argumentRenderer: ToolCallArgumentRenderer;
     resolveNeedPermissionArgs(_runContext: RunContext, input: z.infer<typeof MultiEditFileParameters>, _callId?: string): ToolArg[];

package/cli/dist-server/types/node/tools/powershell-tool.d.ts

@@ -14,6 +14,8 @@ import { BaseTool } from './base-tool';
 import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
 type ShellServiceType = import('../shell/index.js').ShellService;
 type BashSandboxManagerType = import('../bash-sandbox/bash-sandbox-protocol.js').BashSandboxManager;
+export declare const RESOLVED_PS_MAX_TIMEOUT_MS = 600000;
+export declare const RESOLVED_PS_DEFAULT_TIMEOUT_MS = 120000;
 declare const PowerShellParameters: z.ZodObject<{
     command: z.ZodString;
     timeout: z.ZodOptional<z.ZodNumber>;

package/cli/dist-server/types/node/tools/send-message-tool.d.ts

@@ -53,15 +53,15 @@ export declare class SendMessageTool extends BaseTool implements Tool {
         type: "message" | "broadcast" | "shutdown_request" | "shutdown_response" | "plan_approval_response";
         summary?: string | undefined;
         content?: string | undefined;
-        approve?: boolean | undefined;
         request_id?: string | undefined;
+        approve?: boolean | undefined;
         recipient?: string | undefined;
     }, {
         type: "message" | "broadcast" | "shutdown_request" | "shutdown_response" | "plan_approval_response";
         summary?: string | undefined;
         content?: string | undefined;
-        approve?: boolean | undefined;
         request_id?: string | undefined;
+        approve?: boolean | undefined;
         recipient?: string | undefined;
     }>;
     argumentRenderer: ToolCallArgumentRenderer;

package/cli/dist-server/types/node/tools/tool-hook-manager.d.ts

@@ -1,4 +1,4 @@
-import { Session } from '../../vendor/cbc-core/node/index.js';
+import { type InternalHookContext, Session } from '../../vendor/cbc-core/node/index.js';
 import { Logger } from '../../workspace/telemetry/lib/common/index.js';
 import { GalileoSessionBridge } from '../galileo/galileo-session-bridge-protocol';
 import { HookManager } from '../hooks/hook-protocol';
@@ -33,7 +33,7 @@ export declare class ToolHookManagerImpl implements ToolHookManager {
      * NOTE: toolResponse should be the RAW response from the tool,
      * not the ToolResult wrapper. This ensures Claude Code compatibility.
      */
-    executePostToolUseHooks(toolName: string, toolInput: Record<string, any>, toolResponse: unknown, session: Session, transcriptPath: string, cwd?: string, callId?: string): Promise<{
+    executePostToolUseHooks(toolName: string, toolInput: Record<string, any>, toolResponse: unknown, session: Session, transcriptPath: string, cwd?: string, callId?: string, internalContext?: InternalHookContext): Promise<{
         message?: string;
         additionalContext?: string;
         updatedToolOutput?: unknown;

package/cli/dist-server/types/node/tools/tool-manager.d.ts

@@ -471,6 +471,7 @@ export declare class ToolManagerImpl implements ToolManager {
     protected executeToolWithHooks(tool: Tool, originalExecute: (...args: any[]) => any, input: any, context?: RunContext<Session>, details?: {
         toolCall: FunctionCallItem;
     }, inputFormat?: 'legacy' | 'parsed'): Promise<any>;
+    private doExecuteToolWithHooks;
     private authorizeFinalToolAction;
     private getExecutionApprovalAdapter;
     private recordToolRiskExecutionStatus;

package/cli/dist-server/types/node/tools/tool-protocol.d.ts

@@ -1,4 +1,4 @@
-import type { BackgroundTask, PromptCacheStability, Session, SubagentLifecycleSnapshot } from '../../vendor/cbc-core/node/index.js';
+import type { BackgroundTask, InternalHookContext, PromptCacheStability, Session, SubagentLifecycleSnapshot } from '../../vendor/cbc-core/node/index.js';
 import { type Agent, type AgentInputItem, type ApprovalScope, type FunctionCallItem, type PermissionMode, type PermissionUpdate, type RuleValue, type RunContext, type RunToolApprovalItem, type ToolArg, type ToolExecuteArgument, type ToolPermissionResult } from '../../vendor/cbc-shared/node/index.js';
 import type { Agent as ProductAgent, Command as ProductCommand, LanguageModel, ProductConfiguration, Skill as ProductSkill } from '../../workspace/product/lib/common/index.js';
 import type { ToolInputParameters as AgentsCoreToolInputParameters } from '@openai/agents-core';
@@ -539,7 +539,7 @@ export interface ToolHookManager {
      * @param cwd - Current working directory
      * @returns Result with optional message and additional context
      */
-    executePostToolUseHooks(toolName: string, toolInput: Record<string, any>, toolResponse: unknown, session: Session, transcriptPath: string, cwd?: string, callId?: string): Promise<{
+    executePostToolUseHooks(toolName: string, toolInput: Record<string, any>, toolResponse: unknown, session: Session, transcriptPath: string, cwd?: string, callId?: string, internalContext?: InternalHookContext): Promise<{
         message?: string;
         additionalContext?: string;
         updatedToolOutput?: unknown;

package/cli/dist-server/types/node/tools/video-service.d.ts

@@ -5,6 +5,7 @@ import { LanguageModel, ProductConfiguration, ProductManager } from '../../works
 import { Logger } from '../../workspace/telemetry/lib/common/index.js';
 import type { RunContext } from '@openai/agents';
 import { SettingsManager } from '../settings';
+import { MediaFileWriter } from './media-file-writer';
 import { type VideoGenerationResult, VideoGenParams, VideoService } from './tool-protocol';
 /**
  * 视频服务实现
@@ -16,6 +17,7 @@ export declare class VideoServiceImpl implements VideoService {
     protected readonly productManager: ProductManager;
     protected readonly logger: Logger;
     protected readonly settingsManager: SettingsManager;
+    protected readonly mediaFileWriter: MediaFileWriter;
     private outputDir;
     /**
      * 初始化视频输出目录

package/cli/dist-server/types/node/tools/wecom-reply-tool.d.ts

@@ -33,14 +33,14 @@ export declare class WecomReplyTool extends BaseTool implements Tool {
     }, "strip", z.ZodTypeAny, {
         chat_id: string;
         text?: string | undefined;
-        image_url?: string | undefined;
         file_path?: string | undefined;
+        image_url?: string | undefined;
         file_url?: string | undefined;
     }, {
         chat_id: string;
         text?: string | undefined;
-        image_url?: string | undefined;
         file_path?: string | undefined;
+        image_url?: string | undefined;
         file_url?: string | undefined;
     }>;
     execute(input: {

package/cli/dist-server/types/vendor/cbc-core/node/agent/agent-protocol.d.ts

@@ -727,6 +727,18 @@ export interface ForkedAgentOptions {
 export interface OneTimeRunOptions {
     /** X-Agent-Purpose of the call; defaults to the agent's `AGENT_PURPOSE_MAP` entry, else its name. */
     purpose?: string;
+    /**
+     * 本次一次性调用使用的模型 id / name / alias。
+     * 解析成功时优先于会话当前模型和 agent 默认模型；解析不到时回落到原有解析。
+     * 用于切换模型后的压缩摘要：阈值按新模型，摘要请求仍走切换前的模型。
+     */
+    model?: string;
+    /**
+     * 本次调用的 modelSettings，整体替换 run-scoped agent 的 modelSettings，不写回共享 agent。
+     * 按会话变化的参数（如 maxTokens）必须走这里：共享 agent 实例进程内各会话共用，
+     * 先写共享实例再调用会被并发会话覆盖。
+     */
+    modelSettings?: Agent['modelSettings'];
 }
 export interface RunRequest {
     prompt?: string;

package/cli/dist-server/types/vendor/cbc-core/node/agent/agent-service.d.ts

@@ -213,6 +213,17 @@ export declare class AgentServiceImpl implements AgentService {
      * scope instead of on the Session.
      */
     private streamOneTimeText;
+    /**
+     * 辅助一次性 run（调用方没传 context、由本方法新建 session）复用「当前会话」的信任锚点：
+     * 敏感审批锚 `sensitiveGrantSessionId` 与会话级隐私锁定位。
+     *
+     * Auxiliary one-time runs inherit the main session's sensitive approval anchor so a
+     * previously admitted input remains admitted throughout the trusted call chain.
+     *
+     * 前提：调用发生在该会话的 async 链内（`getCurrent()` 读 ALS，由 SessionMiddleware
+     * 每轮 setCurrent）。纯定时器驱动的调用取不到，此时与既有行为一致地不做任何事。
+     */
+    private inheritGrantsFromCurrentSession;
     runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: NonStreamRunOptions<TContext> & OneTimeRunOptions): Promise<string>;
     runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: StreamRunOptions<TContext> & OneTimeRunOptions): Promise<string>;
     runReviewerOneTime(request: ReviewerOneTimeRequest): Promise<ReviewerOneTimeResult>;

package/cli/dist-server/types/vendor/cbc-core/node/agent/index.d.ts

@@ -24,6 +24,7 @@ export * from './interceptors/pre-message-compact-interceptor';
 export * from '../tools/prompt-cache-tool-metadata';
 export * from '../trace/turn-context';
 export * from '../trace/trace-id-utils';
+export * from '../trace/trace-turn-gate';
 export * from '../file-rollback/file-rollback-service-protocol';
 export * from '../file-rollback/file-rollback-operation-lock';
 export * from './reviewer-recovery';

package/cli/dist-server/types/vendor/cbc-core/node/agent/runner-factory.d.ts

@@ -140,6 +140,12 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      * of an ephemeral `callModelInputFilter` addition. The visible history stays the bare user
      * message; it is admitted exactly once, by the stream consumer, in RunState order.
      */
+    /**
+     * 与普通 prompt 的图片拦截器同一实现（#140576）：只加工模型输入副本（压缩 / 按模型能力过滤图片），
+     * 历史项保留原图。宿主未提供实现（精简变体）时跳过；加工失败按原内容插入，不丢消息。
+     */
+    private prepareSteerModelInput;
+    private resolveSteerModelInputPreparer;
     private takeSteerContinuationInput;
     /**
      * Visible-history + ACP admission of one drained steer group.

package/cli/dist-server/types/vendor/cbc-core/node/context/compact-strategy-base.d.ts

@@ -1,4 +1,4 @@
-import { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import { type Agent, AgentInputItem } from '../../../cbc-shared/node/index.js';
 import { ProductManager } from '../../../../workspace/product/lib/common/index.js';
 import { Logger } from '../../../../workspace/telemetry/lib/common/index.js';
 import { AgentManager, AgentService } from '../agent/agent-protocol';
@@ -6,6 +6,7 @@ import { HistoryReloadReason, Session, SessionHookManager, SessionManager } from
 import { SessionRunStateMachine } from '../session/session-run-state-machine-protocol';
 import { CompactBroadcast } from './context-host-protocol';
 import { CompactStrategy, CompactStrategyContext, ContextCompactSummarizeOptions, PromptRenderer, SummaryScenario } from './context-protocol';
+import { type CompactSummaryModel } from './pre-switch-model';
 /**
  * 压缩策略共享基类，封装 session 状态管理、广播、continue 消息、abort 等基础设施方法。
  * 各具体策略通过继承获得这些能力，只需关注自己的压缩逻辑。
@@ -94,20 +95,31 @@ export declare abstract class CompactStrategyBase implements CompactStrategy {
      */
     protected sendContinueMessage(session: Session, preCompactAgentName?: string, overrideInput?: AgentInputItem[]): Promise<boolean>;
     /**
-     * 为 contextSummary agent 准备 modelSettings。
+     * 计算 contextSummary 本次调用的 modelSettings，由调用方经 `runOneTime({ modelSettings })` 传入。
+     * 不写共享的 contextSummary agent：serve/daemon 多会话并发压缩时，maxTokens 随会话的
+     * 切换前模型变化，写共享实例会被其他会话覆盖。
      *
      * contextSummary 经 `runOneTime` 调用，绕过 ModelConfigAgentRunInterceptor，
      * 因此不会自动获得主 agent 那套采样参数（temperature / maxTokens / reasoning / text 等）。
      *
      * 这里做两件事：
      *   1) 继承主 agent 当前的 modelSettings（temperature、maxTokens、reasoning、text、providerData 等），
-     *      使摘要请求与主对话使用一致的模型配置。contextSummary 始终继承主 agent 的模型，
+     *      使摘要请求与主对话使用一致的模型配置。contextSummary 默认继承主 agent 的模型，
      *      故继承到的 maxTokens 已是该模型经 ModelUtils.getMaxOutputTokens 处理后的值，无需重算。
-     *   2) 仅当继承后仍缺 maxTokens（模型未配 maxOutputTokens 且未设 CODEBUDDY_CODE_MAX_OUTPUT_TOKENS，
+     *      有切换前模型时，maxTokens 按那个模型重算（继承到的是新模型的输出上限）。
+     *   2) 仍缺 maxTokens（模型未配 maxOutputTokens 且未设 CODEBUDDY_CODE_MAX_OUTPUT_TOKENS，
      *      此时主 agent 自身也不写 maxTokens）时，补摘要兜底 24k，避免请求不带 `max_tokens`
      *      让上游网关回退到模型原生输出上限。
+     *
+     * 失败时返回 undefined，runOneTime 沿用 contextSummary agent 自身的 modelSettings。
+     */
+    protected buildSummaryModelSettings(summaryModel?: CompactSummaryModel): Promise<Agent['modelSettings'] | undefined>;
+    /**
+     * 切换后第一次压缩的摘要模型。从历史用量推导；没有、解析不到、或窗口不比当前大时
+     * 返回 undefined，调用方保持「用当前会话模型做摘要」。预算按该模型的物理窗口，
+     * 不用新模型的档位 override。
      */
-    protected applySummaryAgentModelSettings(): Promise<void>;
+    protected resolveSummaryModel(session: Session): Promise<CompactSummaryModel | undefined>;
     /**
      * Render summary prompt template based on scenario.
      */

package/cli/dist-server/types/vendor/cbc-core/node/context/pre-switch-model.d.ts

@@ -0,0 +1,34 @@
+import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import { type ModelContextWindowLike } from './context-protocol';
+/** 摘要请求用切换前模型执行，inputTokens 是它预留输出后的可用输入。 */
+export interface CompactSummaryModel {
+    id: string;
+    maxOutputTokens?: number;
+    inputTokens?: number;
+}
+/** 比较上下文窗口时需要的模型字段。不含会话档位 override。 */
+export interface PreSwitchModelLike {
+    id: string;
+    maxInputTokens?: number;
+    maxOutputTokens?: number;
+    contextWindow?: ModelContextWindowLike;
+}
+/**
+ * 从会话历史推导切换前真正执行过的模型。
+ *
+ * 只有它能解析出来，且有效窗口大于当前模型时才返回。窗口不更大时不当作切换：
+ * Auto 路由可能让 requestModelId 和会话模型不一致，换到更大窗口也不需要强制压缩。
+ * 预算用模型自己的窗口，不用会话上的档位 override。
+ */
+export declare function resolveEligiblePreSwitchModel(input: {
+    session: {
+        history?: AgentInputItem[];
+    };
+    currentModel: PreSwitchModelLike;
+    resolveModel: (modelId: string) => Promise<PreSwitchModelLike | undefined>;
+    logger?: {
+        warn: (message: string) => void;
+    };
+}): Promise<PreSwitchModelLike | undefined>;
+/** 按切换前模型的物理窗口计算摘要预算，不用当前模型的档位 override。 */
+export declare function buildPreSwitchSummaryModel(model: PreSwitchModelLike): CompactSummaryModel;

package/cli/dist-server/types/vendor/cbc-core/node/hooks/hook-protocol.d.ts

@@ -1,5 +1,120 @@
-import type { BackgroundTaskInfo, CronTaskInfo, FinalStopReason, HookEvent, HookExecutionOptions, HookExecutionResult, HookPermissionMode, NotificationType, SessionEndReason, SessionStartSource } from '../../../cbc-shared/node/index.js';
-import type { Session } from '../session/session-protocol';
+import type { AgentInputItem, BackgroundTaskInfo, CronTaskInfo, FinalStopReason, HookEvent, HookExecutionOptions, HookExecutionResult, HookPermissionMode, NotificationType, SessionEndReason, SessionStartSource } from '../../../cbc-shared/node/index.js';
+import type { InterceptorGate, Session } from '../session/session-protocol';
+/**
+ * Internal Hook Provider interface
+ *
+ * Use @Component(Hook) to register internal hooks that execute
+ * alongside external shell hooks in HookManager.executeHooks().
+ *
+ * @example
+ * ```typescript
+ * @Component(Hook)
+ * export class MyStopHook implements Hook {
+ *     readonly event = HookEvent.STOP;
+ *     readonly priority = HookPriority.Normal;
+ *
+ *     async execute(input: HookInput): Promise<HookExecutionResult | undefined> {
+ *         // Return undefined to skip, or HookExecutionResult to participate
+ *         return undefined;
+ *     }
+ * }
+ * ```
+ */
+export declare const Hook: unique symbol;
+/**
+ * Data available only to in-process hooks.
+ *
+ * This context is never forwarded to command, HTTP, prompt, agent, or SDK hooks.
+ * It can therefore carry process-local data that must not become part of the
+ * serializable hook input contract.
+ */
+export interface InternalHookContext {
+    /** Structured input items for the current user prompt. */
+    inputItems?: readonly AgentInputItem[];
+    /** Files declared by the tool invocation of a PostToolUse hook (`ToolResult.producedArtifacts`). */
+    producedArtifacts?: ReadonlyArray<{
+        /** Artifact URI or process-local path. */
+        uri: string;
+    }>;
+    /**
+     * Set by the hook executor: resolves with the aggregated `allowed` verdict of
+     * every hook in this dispatch, internal ones included. A hook must not await
+     * it inside `execute` (that would wait on itself); chain work onto it instead.
+     */
+    decision?: Promise<boolean>;
+    /**
+     * FinalStop only: the interceptor gate stamped on the run result that reached
+     * FinalStop. Unlike `session.interceptorGate`, a later result cannot replace it.
+     */
+    interceptorGate?: InterceptorGate;
+}
+/** Associate local attachment paths with an input item without mutating serializable message data. */
+export declare function setInternalInputAttachmentPaths(item: AgentInputItem, paths: readonly string[]): void;
+/** Read process-local attachment paths associated with an input item. */
+export declare function getInternalInputAttachmentPaths(item: unknown): readonly string[];
+/** Carry attachment paths onto a clone or merge of input items; WeakMap entries do not survive copying. */
+export declare function copyInternalInputAttachmentPaths(from: readonly unknown[], to: AgentInputItem): void;
+/**
+ * Optional in-process service that keeps a private copy of a local input
+ * attachment the host deletes right after submission (TUI paste cleanup).
+ * `data` is the file content the host already read, so the copy needs no second read.
+ * Returns the copy's path, or undefined to keep the original path.
+ */
+export declare const InputAttachmentRetainer: unique symbol;
+export interface InputAttachmentRetainer {
+    retain(filePath: string, data?: Uint8Array): Promise<string | undefined>;
+}
+export interface InputAttachmentSource {
+    path: string;
+    /** Content the host already read from `path`, if any. */
+    data?: Uint8Array;
+}
+/** Like {@link setInternalInputAttachmentPaths}, but lets a registered retainer copy the files first. */
+export declare function retainInternalInputAttachmentPaths(item: AgentInputItem, attachments: readonly InputAttachmentSource[]): Promise<void>;
+export interface Hook {
+    /**
+     * Hook event type this hook responds to
+     */
+    readonly event: HookEvent;
+    /**
+     * Priority for execution order (lower = earlier)
+     */
+    readonly priority: number;
+    /**
+     * Optional matcher pattern (regex) for filtering
+     * - PreToolUse/PostToolUse: matches tool_name
+     * - SessionStart: matches source
+     * - SessionEnd: matches reason
+     * - Other events: not used
+     */
+    readonly matcher?: string;
+    /**
+     * Execute the hook logic
+     *
+     * @param input - Serializable hook input data
+     * @param context - Optional process-local data available only to internal hooks
+     * @returns HookExecutionResult or undefined to skip
+     */
+    execute(input: HookInput, context?: InternalHookContext): Promise<HookExecutionResult | undefined>;
+}
+/**
+ * Priority levels for internal hooks
+ * Lower values execute first
+ */
+export declare enum HookPriority {
+    /** Highest priority - runs first */
+    Highest = 0,
+    /** High priority */
+    High = 100,
+    /** Structured output processing */
+    StructuredOutput = 200,
+    /** Normal priority - default */
+    Normal = 500,
+    /** Low priority */
+    Low = 800,
+    /** Lowest priority - runs last */
+    Lowest = 1000
+}
 export interface HookInput {
     /**
      * Session identifier
@@ -312,6 +427,6 @@ export interface HookInput {
 }
 export declare const CoreHookExecutor: unique symbol;
 export interface CoreHookExecutor {
-    executeHooks(event: HookEvent, input: HookInput, options?: HookExecutionOptions): Promise<HookExecutionResult>;
+    executeHooks(event: HookEvent, input: HookInput, options?: HookExecutionOptions, internalContext?: InternalHookContext): Promise<HookExecutionResult>;
     hasHooks(event: HookEvent, toolName?: string): Promise<boolean>;
 }

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/index.d.ts

@@ -7,6 +7,7 @@ export * from './prompt-mid-turn-buffer';
 export * from './rich-queue-manager-protocol';
 export * from './rich-queue-manager';
 export * from './steer-input-buffer-protocol';
+export * from './steer-model-input-preparer-protocol';
 export * from './steer-input-buffer';
 export * from './followup-queue-protocol';
 export * from './followup-queue';

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/injectable-content.d.ts

@@ -4,13 +4,11 @@ import type { SteerDrainedGroup } from './steer-input-buffer-protocol';
 /**
  * 待插入内容的文本抽取与可注入性判定（#85193）。
  *
- * agent-cli 内两处共用同一份，避免过滤规则漂移：
- * - `acp-agent.ts` 的 `session/steer` handler：纵深防御，不可注入内容直接拒收；
- * - `runner-factory.ts` 的 `buildSteerInjectionInput`：注入前过滤 + 拼装。
+ * - `isInjectableContent`：只承载文本的 mid-turn 注入（acp-view 后台 drain 轮）。
+ * - `isSteerableContent`：steer 入口（ACP `session/steer` / `send_followup_now`）。steer 与普通 prompt
+ *   使用同一套用户输入转换，图片随消息进入模型（#140576），因此有文本**或有图片**即可。
  *
- * 旧文本入口与 `RichMessageQueueManager.isInjectable` 对齐：斜杠命令和空文本不可注入。
- * Server 的完整 user message 入口单独完成入队校验，保留图片与文件内容。
- * 兼容 `<channel>` 包裹（channel 消息里的斜杠命令同样识别）。
+ * 两者都拒绝斜杠命令，兼容 `<channel>` 包裹（channel 消息里的斜杠命令同样识别）。
  */
 /** 把一组 contentBlock 里的文本抽出并用换行拼接（string 块与 {type:'text'} 块都算，非文本块忽略）。 */
 export declare function contentBlocksToText(contentBlocks: unknown[]): string;
@@ -18,20 +16,19 @@ export declare function contentBlocksToText(contentBlocks: unknown[]): string;
 export declare function isSlashCommandText(text: string): boolean;
 /** 一组 contentBlocks 是否可作为普通文本注入（有文本且非斜杠命令）。 */
 export declare function isInjectableContent(contentBlocks: unknown[]): boolean;
+/** 一组 ACP contentBlocks 是否可 steer 进当前一轮：非斜杠命令，且有文本或有图片。 */
+export declare function isSteerableContent(contentBlocks: unknown[]): boolean;
 /**
- * 把若干组待插入的消息拼成一条可注入的模型输入（`<system-reminder>` 包装）。
- * 可注入的组合并进同一个 reminder（多条按顺序保留、`\n\n` 分隔）。全部不可注入返回 undefined。
+ * 把若干组已准入的 steer 消息拼成模型输入 + 历史项 + 实时回执（#87145 / #95921 / #140576）。
  *
- * 落盘 vs 注入（对齐 {@link buildPromptMidTurnInput} 的模式）：
- * - **注入项 `item`**（喂模型）：把全部可注入文本合并进一个 `<system-reminder data-role=
- *   "message-queue">` 包装，与 `clientMeta` 无关（模型不需要看到业务 metadata）。
- * - **历史项 `historyItems`**（落盘）：每组一条、只存用户原文；若该组带 `clientMeta`，把它
- *   **原样**挂进 `providerData.clientMeta`（不解构、不加 isMeta、零行为副作用）。agent-cli 不
- *   解读该 metadata，业务侧（如 WorkBuddy）读它在重放/重开时区分 steer 消息。无 clientMeta
- *   时退化为裸 user 记录（旧行为）。若带 `clientUserMessageId`，同时将其落为历史 item.id，
- *   保证 CLI 回放的 `user_message_chunk.messageId` 与实时回执一致。
- * - **实时事件 `emitInfos`**（#95921 Phase 2）：仅带 `clientUserMessageId` 的组产出一条；
- *   该 id 控制注入完成后的 pending 对账，`clientMeta` 只作为独立的不透明 metadata 随事件携带。
+ * 每组的 `messages` 与普通 prompt 一样是完整 user message（可含 `input_image`），本函数只做
+ * steer 独有的三件事，不再改写内容：
+ * - **注入项 `items`**（喂模型）：每条消息原样放进 `<system-reminder data-role="message-queue">`
+ *   包装（包装文本在内容前后各一个 input_text），图片随之进入模型。
+ * - **历史项 `historyItems`**（落盘）：消息对象本身（按引用，保留准入标记）。带 `clientUserMessageId`
+ *   的单消息组把它落为 item.id，保证 CLI 回放的 `user_message_chunk.messageId` 与实时回执一致；
+ *   带 `clientMeta` 时原样挂进 `providerData.clientMeta`（CLI 不解读，WorkBuddy 据此识别 steer）。
+ * - **实时回执 `emitInfos`**：仅带 `clientUserMessageId` 的组产出一条，`clientMeta` 随事件携带。
  */
 export declare function buildSteerInjectionInput(groups: readonly SteerDrainedGroup[]): {
     items: AgentInputItem[];

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/steer-input-buffer-protocol.d.ts

@@ -32,9 +32,11 @@ export type SteerInputDisposition = 'consumed' | 'cancelled' | 'discarded';
 export interface SteerDrainedGroup {
     /** Set only after the host validates a one-time mod prompt receipt. */
     readonly modsPromptSubmitted?: true;
-    readonly blocks: unknown[];
-    /** Native, already reviewed messages. Kept by reference for in-memory admission markers. */
-    readonly messages?: readonly UserMessageItem[];
+    /**
+     * 待插入的用户消息，与普通 prompt 同构（可含 `input_image`，#140576）。
+     * 按引用保留，内存中的准入标记（WeakMap）随对象传递。
+     */
+    readonly messages: readonly UserMessageItem[];
     /**
      * 客户端为本条用户消息提供的不透明对账 id。存在时，CLI 在真正注入后原样回贴；
      * 同时落为历史 user item.id，保证回放身份一致；不存在时不产生实时回执。
@@ -50,7 +52,7 @@ export interface SteerDrainedGroup {
     readonly clientMeta?: unknown;
 }
 /**
- * push 的归属 + 客户端不透明 metadata 入参（合并为一个对象，避免 push 参数过多）。
+ * pushMessages 的归属 + 客户端不透明 metadata 入参（合并为一个对象，避免参数过多）。
  */
 export interface SteerPushInput {
     /** Server-only provenance, independent of untrusted clientMeta. */
@@ -72,16 +74,13 @@ export interface SteerPushInput {
 }
 export interface SteerInputBuffer {
     /**
-     * 暂存一组待插入的消息（一次 `session/steer` 一组）。
-     * 同一次请求执行里可被调用多次（用户连发多条），取出时一次性全部合并。
-     */
-    push(sessionId: string, contentBlocks: unknown[], input: SteerPushInput): void;
-    /**
-     * Transfer reviewed native messages. Aborting withdraws only this submission while buffered.
-     * Drain and cancellation are synchronous, so exactly one wins. Once consumed, cancellation
-     * cannot retract the input. Clear or a stale owner discards it. The promise never rejects.
+     * 暂存一组待插入的用户消息（一次 steer 一组）。同一次请求执行里可被调用多次（用户连发多条）。
+     * 转移所有权：调用方必须先 clone / 审查，交出后不得再修改。
+     * Aborting withdraws only this submission while buffered. Drain and cancellation are
+     * synchronous, so exactly one wins. Once consumed, cancellation cannot retract the input.
+     * Clear or a stale owner discards it. The consumption promise never rejects.
      */
-    pushMessages(sessionId: string, messages: readonly UserMessageItem[], ownerRequestId: string, signal?: AbortSignal): Promise<SteerInputDisposition>;
+    pushMessages(sessionId: string, messages: readonly UserMessageItem[], input: SteerPushInput, signal?: AbortSignal): Promise<SteerInputDisposition>;
     /**
      * 取出并清空当前会话的全部待插入消息（取出即视为已消费）。
      * 只返回归属 `currentRequestId` 的消息；归属其它请求的陈旧残留一并丢弃、不注入。

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/steer-input-buffer.d.ts

@@ -9,9 +9,8 @@ import { type SteerDrainedGroup, type SteerInputBuffer, type SteerInputDispositi
  */
 export declare class SteerInputBufferImpl implements SteerInputBuffer {
     private readonly store;
-    push(sessionId: string, contentBlocks: unknown[], input: SteerPushInput): void;
+    pushMessages(sessionId: string, messages: readonly UserMessageItem[], input: SteerPushInput, signal?: AbortSignal): Promise<SteerInputDisposition>;
     drain(sessionId: string, currentRequestId: string | undefined): SteerDrainedGroup[];
-    pushMessages(sessionId: string, messages: readonly UserMessageItem[], ownerRequestId: string, signal?: AbortSignal): Promise<SteerInputDisposition>;
     has(sessionId: string, currentRequestId: string | undefined): boolean;
     clear(sessionId: string): void;
 }

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/steer-model-input-preparer-protocol.d.ts

@@ -0,0 +1,13 @@
+import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import type { Session } from '../session/session-protocol';
+/**
+ * steer 插入点对**模型输入副本**的加工（#140576），由宿主（agent-cli）实现。
+ *
+ * 普通 prompt 在 run 起点由图片压缩 / 模型能力过滤拦截器处理，且只改发给模型的副本、历史保留原图；
+ * steer 在 run 中途进入 RunState，不经过这些拦截器，因此在插入点用同一份实现处理，语义保持一致。
+ */
+export declare const SteerModelInputPreparer: unique symbol;
+export interface SteerModelInputPreparer {
+    /** 就地加工模型输入副本：按当前模型能力过滤图片、压缩超限图片。不得修改历史项。 */
+    prepare(session: Session, items: AgentInputItem[]): Promise<void>;
+}

package/cli/dist-server/types/vendor/cbc-core/node/session/interruption-service.d.ts

@@ -448,6 +448,17 @@ export declare class InterruptionServiceImpl implements InterruptionService {
      * 此时不退回额度——新请求边界已经清零，再减一次会扣掉新链的额度。
      */
     private prepareRecoveryAttempt;
+    /**
+     * reasoning-only 空流的续写前置：把模型层随错误交出的思考落史，续写请求才带得上它，
+     * 模型可以接着已有思考往下写，而不是从头审题。
+     *
+     * 只在重试已经确定发起时调用：不重试（预算耗尽、跑满上游时限、退避期间取消）时历史保持原样。
+     * 返回 `false` 时调用方退回原样重发——没有思考可接，就不能让提示说「从中断处继续」。
+     *
+     * 落史形状与 AbortedStreamDraftStore 的中途取消半成品一致（status=incomplete +
+     * isPartialAborted）；发请求时由 attachOrphanedReasoningCarriers 补承载项回传给模型。
+     */
+    private persistEmptyStreamReasoning;
     /**
      * CLI TUI 手打 `/compact` 裸跑成功后补发 SessionStart('compact')。
      *

package/cli/dist-server/types/vendor/cbc-core/node/session/session-fork-guard.d.ts

@@ -1,3 +1,4 @@
 export declare class SessionForkGraphError extends Error {
-    constructor(message: string);
+    readonly reason: 'invalid_history' | 'budget_exceeded';
+    constructor(message: string, reason?: 'invalid_history' | 'budget_exceeded');
 }

package/cli/dist-server/types/vendor/cbc-core/node/session/session-hook-manager.d.ts

@@ -1,6 +1,6 @@
 import { type AgentInputItem, FinalStopReason, NotificationType, RunResult, SessionEndReason, SessionStartSource, StreamedRunResult } from '../../../cbc-shared/node/index.js';
 import { Logger } from '../../../../workspace/telemetry/lib/common/index.js';
-import { CoreHookExecutor as HookManager } from '../hooks/hook-protocol';
+import { CoreHookExecutor as HookManager, type InternalHookContext } from '../hooks/hook-protocol';
 import { SessionHookHost } from './session-hook-host-protocol';
 import { Session, SessionHookManager, SessionStore } from './session-protocol';
 /**
@@ -207,7 +207,7 @@ export declare class SessionHookManagerImpl implements SessionHookManager {
      * final terminal state and will not continue via the current Stop hook.
      * Does NOT support continueRequest.
      */
-    executeFinalStopHooks(session: Session, reason?: FinalStopReason): Promise<void>;
+    executeFinalStopHooks(session: Session, reason?: FinalStopReason, internalContext?: Pick<InternalHookContext, 'interceptorGate'>): Promise<void>;
     /**
      * UserPromptExpansion — Claude Code 官方事件：任何用户输入的命令/skill 展开成
      * prompt、送进模型之前统一从这里触发，可阻断展开。`command_args` / `prompt` 按

package/cli/dist-server/types/vendor/cbc-core/node/session/session-manager.d.ts

@@ -176,6 +176,15 @@ export declare class SessionManagerImpl implements SessionManager, ApplicationLi
     initRunResultHandler(session: Session): void;
     protected handleRunResult(session: Session): Promise<void>;
     protected handleStreamRunResult(session: Session, result: StreamedRunResult<any, any>, modelResponseMetadata: ModelResponseMetadata): Promise<void>;
+    /**
+     * Issue #65246：把 API 实际响应的物理模型 id 存到 session.meta，
+     * 供 ACP injectMeta 透传给前端，用于 auto 模式展示「推荐模型（xxx）」。
+     */
+    private recordResponseModel;
+    /**
+     * 记录一次模型响应的 finish_reason（Chat Completions 的 choice 与 Responses API 终态事件共用）。
+     */
+    private recordModelFinishReason;
     /**
      * content_filter 安全审查终止处理。
      *