@tencent-ai/agent-harness 0.2.0-beta.2 → 0.2.0-beta.4

package/cli/dist-server/types/vendor/cbc-core/node/agent/agent-service.d.ts

@@ -3,10 +3,11 @@ import { AuthenticationManager } from '../../../../workspace/authentication/lib/
 import { type AbortLinkDisposer, Agent, type AgentInputItem, type NonStreamRunOptions, RunState, type StreamRunOptions } from '../../../cbc-shared/node/index.js';
 import { type LanguageModel } from '../../../../workspace/product/lib/common/index.js';
 import { Logger } from '../../../../workspace/telemetry/lib/common/index.js';
+import { type ManualCompactRequestHandler as ManualCompactRequestHandlerContract } from '../context/context-protocol';
 import { type FileRollbackOperationLock as FileRollbackOperationLockContract } from '../file-rollback/file-rollback-service-protocol';
 import { Session, SessionManager } from '../session/session-protocol';
 import { SessionRunStateMachine } from '../session/session-run-state-machine-protocol';
-import { type AgentCurrentContinuationOptions, AgentManager, AgentRunInterceptor, AgentRunRequest, AgentService, type AgentStandardRunOptions, RunnerProvider } from './agent-protocol';
+import { type AgentCurrentContinuationOptions, AgentManager, AgentRunInterceptor, AgentRunRequest, AgentService, type AgentStandardRunOptions, type OneTimeRunOptions, RunnerProvider } from './agent-protocol';
 import { type AgentRunScope as IAgentRunScope } from './agent-run-scope';
 import { AgentPluginRefresh, AgentRunObserver, AgentRuntimeResolver } from './agent-runtime-protocol';
 export declare class AgentServiceImpl implements AgentService {
@@ -22,6 +23,7 @@ export declare class AgentServiceImpl implements AgentService {
     protected readonly agentRunInterceptorProvider: Provider<AgentRunInterceptor>;
     protected readonly fileRollbackOperationLock?: FileRollbackOperationLockContract;
     protected readonly logger: Logger;
+    protected readonly manualCompactRequestHandler?: ManualCompactRequestHandlerContract;
     /**
      * Preserve the pre-start cancellation snapshot across runDefault's agent
      * lookup controller and run()'s own controller. This is process-local
@@ -40,6 +42,20 @@ export declare class AgentServiceImpl implements AgentService {
     protected getLifecycleOwners(): WeakMap<Session, AbortController>;
     tryCloseTaskSession(session: Session, result: NonNullable<Session['resultSubject']['value']>): Promise<boolean>;
     retireTaskSession(session: Session): Promise<void>;
+    waitForRunsSettled(session: Session): Promise<void>;
+    /**
+     * 有界 join：等到该 session 上的物理 run 全部交还 lifecycle owner 与 in-flight 信号。
+     *
+     * 为什么需要它而不是直接看 `agent_end`：`finalizeRun` 晚于本轮把最终产出写进
+     * history，`agent_end` 却早于 `finalizeRun`。任何依赖「上一轮 history 已写完」这个
+     * 因果的调用方（如队列 drain）必须 join 到这里。
+     *
+     * Bounded: `runSettledSubject` is optional, so a session built without
+     * one has nothing to observe and would hang the caller's cleanup — which
+     * owns hook, MCP and background-shell teardown. `agent_end` 也可能来自没有物理
+     * run 的路径（skipRun / 迟到事件），无界等待会把调用方永久挂住。
+     */
+    private joinRunsSettled;
     /** compare-and-delete：仅当 token 仍指向本轮 controller 时清除。 */
     private clearLifecycleOwner;
     /** 本轮是否是当前 lifecycle owner。 */
@@ -156,6 +172,7 @@ export declare class AgentServiceImpl implements AgentService {
     protected resolveRunOneTimeModel(agentName: string, session?: Session): Promise<LanguageModel>;
     run<TAgent extends Agent<any, any>>(agent: TAgent, input: string | AgentInputItem[], options: AgentCurrentContinuationOptions): Promise<void>;
     run<TAgent extends Agent<any, any>, TContext = Session>(agent: TAgent, input: string | AgentInputItem[] | RunState<TContext, TAgent>, options?: AgentStandardRunOptions<TContext>): Promise<void>;
+    private runPipeline;
     /**
      * #59319-stream: 抽取的 physical run cleanup 逻辑。
      * 非 stream 路径由 run() finally 同步调用；
@@ -189,8 +206,14 @@ export declare class AgentServiceImpl implements AgentService {
     private prepareRunAdmission;
     runDefault<TAgent extends Agent<any, any>>(input: string | AgentInputItem[], options: AgentCurrentContinuationOptions): Promise<void>;
     runDefault<TAgent extends Agent<any, any>, TContext = Session>(input: string | AgentInputItem[] | RunState<TContext, TAgent>, options?: AgentStandardRunOptions<TContext>): Promise<void>;
-    runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: NonStreamRunOptions<TContext>): Promise<string>;
-    runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: StreamRunOptions<TContext>): Promise<string>;
+    /**
+     * Streams the text of a one-shot run on `session`. A reused caller Session is shared
+     * with its in-flight main run, so the call's purpose and request id live in its async
+     * scope instead of on the Session.
+     */
+    private streamOneTimeText;
+    runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: NonStreamRunOptions<TContext> & OneTimeRunOptions): Promise<string>;
+    runOneTime<TContext = Session>(agentName: string, input: string | AgentInputItem[], options?: StreamRunOptions<TContext> & OneTimeRunOptions): Promise<string>;
     /**
      * Enhanced version of runOneTime that supports per-request overrides
      * for temperature, maxTokens, maxTurns, systemPrompt, and bypassPermissions.

package/cli/dist-server/types/vendor/cbc-core/node/agent/index.d.ts

@@ -1,5 +1,8 @@
 export * from './agent-protocol';
 export * from './agent-purpose-protocol';
+export * from './agent-purpose-scope';
+export * from './model-step-sequence';
+export * from './model-call-failure';
 export * from './agent-runtime-protocol';
 export * from './agent-run-scope';
 export * from './agent-service';

package/cli/dist-server/types/vendor/cbc-core/node/agent/model-call-failure.d.ts

@@ -0,0 +1,9 @@
+import type { ModelCallGeneration } from '../session/session-protocol';
+/**
+ * Marks `error` as the failure of one model call. The call's ids live in the model-call
+ * async scope, which does not reach the consumer of the SDK run stream; the error does.
+ * An error rethrown through an outer call keeps the innermost call's mark.
+ */
+export declare function markModelCallFailure<T>(error: T, sessionId: string, generation: ModelCallGeneration): T;
+/** The model call of this Session that failed with `error`; undefined when the failure is not one. */
+export declare function getFailedModelCall(error: unknown, sessionId: string): ModelCallGeneration | undefined;

package/cli/dist-server/types/vendor/cbc-core/node/agent/model-step-sequence.d.ts

@@ -0,0 +1,11 @@
+import type { Session } from '../session/session-protocol';
+type StepSequenceSession = Pick<Session, 'id' | 'history' | 'agentPurpose' | 'modelStepSeq'>;
+/** Latest step of the Session's agent loop, restored from persisted history after resume. */
+export declare function currentModelStepSeq(session: StepSequenceSession): number;
+/**
+ * Step number for the model call in the current async chain. Agent-loop calls
+ * advance the counter; auxiliary calls reuse the latest step. The counter never
+ * resets across runs, compaction continuations or teammate wake-ups.
+ */
+export declare function allocateModelStepSeq(session: StepSequenceSession): number;
+export {};

package/cli/dist-server/types/vendor/cbc-core/node/agent/runner-factory.d.ts

@@ -21,6 +21,14 @@ export interface ModelInputMemoryPressure {
     headroom: number;
     inputItems: number;
     estimatedInputBytes?: number;
+    /**
+     * Whether the retained-size walk finished (fully traversed, or provably ≥ the byte budget).
+     * `false` means the walk stopped on the node cap with bytes still under budget — the graph is
+     * deep/wide but not necessarily large, so `estimatedInputBytes` must NOT drive a rejection.
+     */
+    estimateComplete: boolean;
+    /** Real, content-independent OOM signal: heap is already near its ceiling. */
+    heapCritical: boolean;
     reject: boolean;
 }
 export declare function assessModelInputMemoryPressure(input: AgentInputItem[], heapUsed?: number, heapLimit?: number): ModelInputMemoryPressure;
@@ -80,8 +88,18 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      * 否则前端的 sending 态无人清除、永久转圈（#73022）。
      */
     protected readonly acpBroadcastService?: AgentQueueOutput;
+    /** Sessions with a deferred emergency compaction already scheduled (see scheduleEmergencyCompact). */
+    private readonly emergencyCompactInFlight;
     create(config?: Partial<RunConfig>): Promise<Runner>;
     private assertModelInputCloneHeadroom;
+    /**
+     * Fire a one-shot emergency compaction for an over-large history so the user's retry can
+     * succeed. Deferred + de-duplicated per session; failures are swallowed because the surfaced
+     * error already tells the user how to recover. Mirrors checkAutoCompact's non-blocking branch
+     * (setImmediate keeps it off the current runner's abort signal). compactAndSummarize has its
+     * own session-level lock, so the in-flight set only avoids scheduling redundant callbacks.
+     */
+    private scheduleEmergencyCompact;
     /**
      * 在每次模型请求前检查是否需要自动压缩。
      * 此时所有工具都已执行完毕，可以安全地触发压缩。
@@ -90,10 +108,10 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
     /**
      * Mode B：把「立即发送」队列项注入正在运行的 turn（#73022）。
      *
-     * 调用点在 `callModelInputFilter`（见 `create()`），即**每次模型请求之前**，
-     * 且此时本轮工具已全部执行完、tool result 已回填。选这个边界是因为既不用
-     * 打断在跑的工具，也不会破坏 `tool_call` 与 `tool_result` 的配对——Codex 与
-     * Claude Code 同样选在这个位置。
+     * 调用点在 `callModelInputFilter`（见 `create()`），即**每次模型请求之前**。
+     * rich message / notification / drain prompt 仍在这里注入请求副本；真实 steer
+     * 由 `continuationInputProvider` 在 `prepareTurn` 前写入 SDK RunState，避免后续
+     * 工具 step 从权威状态重建请求时丢失。
      *
      * 注入内容已经进入本次模型请求，无需再为“曾经注入过”强制续圈。只有模型响应期间
      * 新到达、尚未被取出的消息，才由 `__codebuddySteerPending` 在收尾时实时判定是否
@@ -111,6 +129,22 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      *   `create()` 注释）。payload 与授权同为调用局部值，天然不跨 run 共享。
      */
     private injectSendNowItems;
+    /**
+     * Drain steer only at the SDK continuation boundary, before it prepares the next model step.
+     *
+     * The returned model items are installed by the SDK into RunState.generatedItems before
+     * `prepareTurn`. This makes steer authoritative input for every later tool/model step instead
+     * of an ephemeral `callModelInputFilter` addition. The visible history stays the bare user
+     * message; it is admitted exactly once, by the stream consumer, in RunState order.
+     */
+    private takeSteerContinuationInput;
+    /**
+     * Visible-history + ACP admission of one drained steer group.
+     *
+     * Ordering is the caller's responsibility (continuation-history-queue.ts); this only performs
+     * the writes and must never throw back into the run.
+     */
+    private admitSteerToVisibleHistory;
     /**
      * #100404：落定来源一（rich queue sendNow）的消费。
      *
@@ -139,11 +173,11 @@ export declare class RunnerFactoryImpl implements RunnerFactory {
      * （`session/session-manager.ts` 的 `MODEL_STREAM_STARTED`），涉及跨模块反向布线与
      * 事件类型白名单依赖，另开 issue 跟进。
      *
-     * **落史顺序反转（显式接受）**：`modelData.input` 的 push 顺序是来源一 → 二 → 三 → 四，
-     * 但来源一的 `addHistory` 推迟到本方法内执行，来源二/三/四仍在 `injectSendNowItems` 里
-     * 就地 addHistory。同一 model step 同时命中多个来源时，history 里队员消息会排在
-     * steer / 通知之后，与模型当时看到的输入顺序相反。已确认下游按 role/type 消费、不依赖
-     * 交错位置，故接受该反转，不做「四来源 historyItems 统一收敛」的重构。
+     * **落史顺序反转（显式接受）**：`modelData.input` 的 filter push 顺序是来源一 → 三 → 四，
+     * 但来源一的 `addHistory` 推迟到本方法内执行，来源三/四仍在 `injectSendNowItems` 里
+     * 就地 addHistory。同一 model step 同时命中多个来源时，history 里队员消息会排在通知
+     * 之后，与模型当时看到的输入顺序相反。steer 已在更早的 SDK continuation 边界同时进入
+     * RunState 与可见历史，不参与这段反转。下游按 role/type 消费、不依赖交错位置，故接受。
      *
      * at-most-once 由**作用域**保证，不再依赖「commit 前清暂存」这类补偿动作：`pending` 是
      * 单次 `callModelInputFilter` 调用的局部值，每次调用最多把它 commit 一次，也不可能被

package/cli/dist-server/types/vendor/cbc-core/node/agent/tool-call-loop-guard-protocol.d.ts

@@ -27,7 +27,7 @@ export declare const TOOL_CALL_LOOP_STOPPED_MESSAGE = "Request aborted: user sto
  * - `ToolCallLoopDetector` 在**模型请求前**拦截，静默向模型注入停止消息，用户无感；
  *   它覆盖的是旧的三条规则（黑名单同参 4 次 / Read 同文件 40 次 / 非黑名单同参 40 次）。
  * - `ToolCallLoopGuard` 在**工具执行前**拦截，弹窗让用户自己决定继续还是停止；
- *   它覆盖新增的两条规则（同工具连续 40 次，Bash 单独放到 80 次 / 周期序列重复 10 轮）。
+ *   它覆盖新增的两条规则（同工具连续 40 次，Bash 与 Write 单独放到 80 次 / 周期序列重复 10 轮）。
  *
  * 两者刻意并存：旧规则的静默语义已被线上验证，不因新能力回归。
  */

package/cli/dist-server/types/vendor/cbc-core/node/agent/tool-call-loop-pattern.d.ts

@@ -5,11 +5,11 @@
  */
 import type { ToolCallLoopTriggerType } from '../../../../workspace/telemetry/lib/common/event/types/craft.js';
 export interface ToolCallLoopThresholds {
-    /** 同一工具连续调用达到该次数即判定为循环。Bash 走单独阈值。 */
+    /** 同一工具连续调用达到该次数即判定为循环。Bash / Write 走单独阈值。 */
     consecutiveThreshold: number;
     /**
-     * Bash 连续调用的单独阈值。长任务里模型会连续跑很多条不同命令，
-     * 只看工具名时 40 次容易把正常推进误判成循环。
+     * Bash 与 Write 连续调用的单独阈值。长任务里模型会连续跑很多条命令、
+     * 或连续落很多个文件，只看工具名时 40 次容易把正常推进误判成循环。
      */
     bashConsecutiveThreshold: number;
     /** AAB 块需要连续重复的轮数。 */
@@ -22,8 +22,9 @@ export interface ToolCallLoopHit {
     /** 重复序列的周期长度；AAB 恒为 3，连续同工具恒为 1。 */
     patternLength: number;
 }
-/** 与 `ToolNames.BASH` 对齐。模式识别层不依赖 agent-protocol，避免把工具名枚举拉进来。 */
+/** 与 `ToolNames.BASH` / `ToolNames.WRITE` 对齐。模式识别层不依赖 agent-protocol，避免把工具名枚举拉进来。 */
 export declare const BASH_LOOP_TOOL_NAME = "Bash";
+export declare const WRITE_LOOP_TOOL_NAME = "Write";
 export declare const DEFAULT_TOOL_CALL_LOOP_THRESHOLDS: ToolCallLoopThresholds;
 /** AAB 块的长度。多工具循环只识别这一种形状，因此是常量而非可配阈值。 */
 export declare const AAB_PERIOD = 3;
@@ -43,7 +44,7 @@ export declare class ToolCallLoopTracker {
      * 记录一次即将执行的工具调用，返回本次是否命中循环。
      *
      * 命中优先级：先判连续同工具，再判 AAB 重复。两条规则的阈值默认不重叠
-     * （普通工具 40 次、Bash 80 次 vs AAB 重复 10 轮），实践中不会互相抢占。
+     * （普通工具 40 次、Bash / Write 80 次 vs AAB 重复 10 轮），实践中不会互相抢占。
      */
     record(toolName: string): ToolCallLoopHit | undefined;
     /**
@@ -59,7 +60,7 @@ export declare class ToolCallLoopTracker {
  * - `ABC`（三者互不相同）通常是正常的多步工作流（读文件 → 改文件 → 跑测试，
  *   然后换下一个文件），按周期重复判它循环误伤面太大；
  * - `ABAB` 这类两工具交替同样不判，避免把翻页 / 分批处理误当循环；
- * - `AAA…` 属于连续同工具，由 consecutiveThreshold / bashConsecutiveThreshold 那条规则负责。
+ * - `AAA…` 属于连续同工具，由 consecutiveThreshold / bashConsecutiveThreshold（Bash、Write）那条规则负责。
  *
  * `X ≠ Y` 顺带保证了 AAB 一定是本原周期（唯一可能的更短整除周期是 1，
  * 那要求三个元素全等），所以不需要额外的本原性校验。
@@ -69,8 +70,8 @@ export declare function matchesRepeatedAabSequence(history: readonly string[], r
  * 读取阈值配置。环境变量只用于 QA 快速复现，生产不设置即走默认值。
  * AAB 的周期是形状定义的一部分，不开放配置。
  *
- * `CBC_LOOP_GUARD_CONSECUTIVE_THRESHOLD` 只覆盖非 Bash 工具。Bash 用
- * `CBC_LOOP_GUARD_BASH_CONSECUTIVE_THRESHOLD`，避免 QA 把通用阈值压低时
+ * `CBC_LOOP_GUARD_CONSECUTIVE_THRESHOLD` 只覆盖非 Bash / Write 工具。Bash 与 Write
+ * 共用 `CBC_LOOP_GUARD_BASH_CONSECUTIVE_THRESHOLD`，避免 QA 把通用阈值压低时
  * 把长任务放宽一并关掉。
  */
 export declare function resolveToolCallLoopThresholds(env?: NodeJS.ProcessEnv): ToolCallLoopThresholds;

package/cli/dist-server/types/vendor/cbc-core/node/context/compaction-lineage.d.ts

@@ -0,0 +1,39 @@
+import type { CompactionKind, CompactionTrigger } from '../../../../workspace/telemetry/lib/common/index.js';
+import type { Session } from '../session/session-protocol';
+export type { CompactionKind, CompactionTrigger };
+export declare function compactionKindOf(trigger: CompactionTrigger): CompactionKind;
+/** Compactions of a Session's context. Never resets, like `modelStepSeq`. */
+export interface CompactionLineage {
+    /** Completed compactions. */
+    count: number;
+    /** Compaction the current context starts from. */
+    lastId?: string;
+    /** Trigger of the completed compaction the next agent-loop model call reports. */
+    pending?: CompactionTrigger;
+}
+type LineageSession = Pick<Session, 'id' | 'history' | 'compactionLineage' | 'meta'>;
+/** Compaction lineage of `session`, restored from its history after resume. */
+export declare function getCompactionLineage(session: LineageSession): CompactionLineage;
+/**
+ * Numbers a compaction boundary item before it enters history and stamps the running
+ * compaction onto it; the next agent-loop model call reports it.
+ */
+export declare function recordCompactionBoundary(session: LineageSession, providerData: Record<string, unknown>): void;
+/** Compaction lineage of one model call (gateway headers, `chat_message_send`). */
+export interface ModelCallCompaction {
+    /** Completed compactions of the Session when the call is sent. */
+    readonly count: number;
+    /** Compaction the call's context starts from. */
+    readonly id?: string;
+    /** Compaction calls: class of the running compaction (`X-Compaction`). */
+    readonly kind?: CompactionKind;
+    /** First agent-loop call after a compaction: its class (`X-Context-Compacted`) and trigger. */
+    readonly contextCompacted?: CompactionKind;
+    readonly trigger?: CompactionTrigger;
+}
+/**
+ * Compaction lineage for the model call in the current async chain. Only the first
+ * agent-loop call after a compaction reports it, like Claude Code's
+ * `consumePendingContextCompacted`.
+ */
+export declare function resolveModelCallCompaction(session: LineageSession & Pick<Session, 'agentPurpose' | 'conversationRequestId'>): ModelCallCompaction;

package/cli/dist-server/types/vendor/cbc-core/node/context/context-compact-summarizer.d.ts

@@ -16,6 +16,7 @@ import { CompactStrategy, type ContextCompactResult, ContextCompactSummarizeOpti
  * 不包含任何具体的压缩逻辑实现。
  */
 export declare class ContextCompactSummarizerImpl implements ContextCompactSummarizer {
+    private activeCompactions?;
     protected readonly productManager: ProductManager;
     protected readonly agentManager: AgentManager;
     protected readonly logger: Logger;
@@ -25,6 +26,7 @@ export declare class ContextCompactSummarizerImpl implements ContextCompactSumma
     protected readonly strategyProvider: Provider<CompactStrategy>;
     compactAndSummarize(session: Session, options?: ContextCompactSummarizeOptions): Promise<boolean>;
     compactWithResult(session: Session, options?: ContextCompactSummarizeOptions): Promise<ContextCompactResult>;
+    private compactWithResultOwned;
     /**
      * 按优先级匹配（PreMessage → MaxToken），跳过 Blocking（仅作最终兜底），执行第一个命中的策略；
      * 都不命中则安全网回落到 Blocking。逻辑与压缩 span 化之前完全一致，只是把散落的 `return` 收敛成

package/cli/dist-server/types/vendor/cbc-core/node/context/context-protocol.d.ts

@@ -1,7 +1,10 @@
+import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import type { CompactionTrigger } from '../../../../workspace/telemetry/lib/common/index.js';
 import { Session } from '../session/session-protocol';
 export declare const PromptContextProvider: unique symbol;
 export declare const PromptContextInitializer: unique symbol;
 export declare const ContextCompactSummarizer: unique symbol;
+export declare const ManualCompactRequestHandler: unique symbol;
 export declare const PromptRenderer: unique symbol;
 export declare const COMPACT_PROMPT = "compact-prompt";
 export declare const DEFAULT_TOKEN_THRESHOLD = 0.7;
@@ -190,6 +193,8 @@ export interface ContextCompactSummarizeOptions {
     type?: CompactType;
     /** Stable identity shared by live updates and the durable compact boundary. */
     compactionId?: string;
+    /** Why this compaction runs; defaults from `type` (manual / pre_message_threshold / emergency_threshold). */
+    trigger?: CompactionTrigger;
 }
 export type ContextCompactSkipReason = 'already_compacting' | 'pending_interruption' | 'auto_disabled' | 'empty_history' | 'already_compacted' | 'non_default_agent' | 'below_threshold';
 export type ContextCompactFailureReason = 'strategy_failed' | 'strategy_unavailable';
@@ -214,6 +219,8 @@ export declare function createCompactionId(): string;
 export declare const SESSION_META_COMPACT_TYPE: 'compactType';
 /** Current stable compaction identity, persisted onto the boundary item. */
 export declare const SESSION_META_COMPACTION_ID: 'compactionId';
+/** Trigger of the compaction the summarizer is running; unset for a typed `/compact`. */
+export declare const SESSION_META_COMPACTION_TRIGGER: 'compactionTrigger';
 /**
  * session.meta 上标记当前 compact 成功后会继续执行一次真实 agent run。
  *
@@ -321,6 +328,16 @@ export interface ContextCompactSummarizer {
     /** Compatibility wrapper for existing automatic-compaction callers. */
     compactAndSummarize(session: Session, options?: ContextCompactSummarizeOptions): Promise<boolean>;
 }
+/**
+ * Host-owned boundary for external `/compact` requests.
+ *
+ * AgentService invokes this before creating a normal run lifecycle when an
+ * interactive host opts in. Implementations must return false for internal compact
+ * inputs so strategy-owned internal runs cannot recursively re-enter this boundary.
+ */
+export interface ManualCompactRequestHandler {
+    tryHandle(input: string | AgentInputItem[], session: Session): Promise<boolean>;
+}
 export interface PromptRenderer {
     render(template: string, context?: PromptContext): Promise<string>;
 }

package/cli/dist-server/types/vendor/cbc-core/node/context/index.d.ts

@@ -1,5 +1,7 @@
 export * from './context-protocol';
+export * from './compaction-lineage';
 export * from './context-host-protocol';
+export * from './mods-bridge';
 export * from './prompt-context-provider';
 export * from './prompt-renderer';
 export * from './context-compact-summarizer';

package/cli/dist-server/types/vendor/cbc-core/node/context/mods-bridge.d.ts

@@ -0,0 +1,115 @@
+import type { AgentInputItem } from '../../../cbc-shared/node/index.js';
+import type { PromptContext } from './context-protocol';
+export interface ModsPromptSubmitResult {
+    text?: string;
+    drop?: string;
+}
+/** Host-only provenance: a mod initiated submission has already traversed the fold. */
+export declare const MODS_PROMPT_SUBMITTED_KEY = "modsPromptSubmitted";
+/**
+ * Function hooks（Claude mods）在 core 侧的**窄接口**。
+ *
+ * ## 为什么 core 不直接调 mods
+ *
+ * `cbc-core` 只允许依赖 `@genie/cbc-shared`（见仓库 CODEBUDDY.md 的单向依赖卡点，
+ * `package-boundaries.spec.ts` 会扫源码 import、动态 import 与依赖声明）。而 mods
+ * 引擎住在 `cbc-plugins`。所以 core 这一侧只声明「我会在这几个时刻问一句」，具体
+ * 分发由宿主实现后注入。
+ *
+ * ## 为什么形状映射也不在 core
+ *
+ * cbc 的 `PromptContext` 是一个松散字典，官方 `prompt.context` 事件是
+ * `{ blocks, instructionFiles }`。两者的对应关系属于**适配**，而适配是宿主的事 ——
+ * 让 core 认识官方 payload 等于把上游协议渗进核心包，将来上游改一次形状，core 就
+ * 得跟着改。因此接口按 core 自己的类型说话，桥的实现负责翻译。
+ *
+ * ## 未注入时必须是零开销
+ *
+ * function hooks 默认关闭。没有桥时每个调用点只多一次 `=== undefined` 判断，
+ * 不构造对象、不进 async、不改变任何既有行为。
+ */
+export interface ModsBridge {
+    /**
+     * 上下文装配完成、尚未拼成最终 prompt 时问一句。
+     *
+     * @param context 当前这一版上下文
+     * @returns 可能被 mod 改写过的上下文；桥自身出问题时应原样返回入参
+     */
+    promptContext(context: PromptContext): Promise<PromptContext>;
+    /**
+     * 会话建立时通知一次。
+     *
+     * @param input 会话 cwd 与是否交互式 —— 官方 `session.start` 的入参
+     */
+    sessionStart(input: {
+        cwd: string;
+        isInteractive: boolean;
+    }): Promise<void>;
+    /**
+     * 用户提交输入时问一句。对齐官方 `prompt.submit`。
+     *
+     * @param input 即将送达模型的文本
+     * @returns `{ drop }` 阻断输入，`{ text }` 改写可见文本；附件与隐藏上下文由 core 保留。
+     */
+    promptSubmit(input: {
+        text: string;
+        sessionId?: string;
+        signal?: AbortSignal;
+    }): Promise<ModsPromptSubmitResult | undefined>;
+    /**
+     * 把一条 mod 打出来的 `$.ui.log` 行落到用户可见的会话里。
+     *
+     * ## 为什么走桥而不是让 core 直接推消息
+     *
+     * `$.ui.log` 是 mod 侧发起的用户可见事件（官方语义：进 transcript），但 core
+     * 不知道"当前会话"是哪一个（AsyncLocalStorage 上下文由宿主入口决定），也不认
+     * `plugin` 这个身份维度（那是 mods 引擎的概念）。宿主拿到这一对
+     * `(text, plugin)` 之后，负责取当前 session 并 push 进 `inputSubject` /
+     * `combineSubject` / `sessionStore.appendHistory`，就跟宿主自己的系统消息
+     * 是同一条路径。
+     *
+     * ## 未装桥时的兜底在哪
+     *
+     * 宿主没实现这一项时，`bindings.log` 侧应当把行文继续写到 stderr（headless /
+     * bootstrap 早期 / 无当前 session 时用得到）—— 那种场景下用户看不到"消息历史"，
+     * 但仍能通过日志追溯这一行，与既有行为保持一致。
+     *
+     * @param text 已由宿主前缀好 `<plugin>: ` 的完整行文（core 不重复加前缀）
+     * @param meta 至少携带 `plugin`；用于前端识别 / 分组
+     */
+    pushModLog?(text: string, meta: {
+        plugin: string;
+    }): void;
+}
+/**
+ * 注入桥。宿主在 mods 运行时起来之后调用一次。
+ *
+ * @param next 桥实现；传 `undefined` 卸载（测试用）
+ */
+export declare function setModsBridge(next: ModsBridge | undefined): void;
+/** 当前桥；未注入时 undefined。 */
+export declare function currentModsBridge(): ModsBridge | undefined;
+/**
+ * 经桥过一遍上下文。
+ *
+ * **桥出问题不能影响主流程**：mod 是第三方代码，它抛错、超时、返回垃圾，都只该
+ * 让 function hooks 这一层失效，而不是让会话起不来。因此这里兜住一切异常并回退到
+ * 原上下文 —— 与「加载失败不阻塞宿主」同一条原则。
+ *
+ * @param context 当前上下文
+ * @returns 改写后的上下文；无桥或出错时是原对象
+ */
+export declare function throughModsPromptContext(context: PromptContext): Promise<PromptContext>;
+/** A failed third-party fold must not corrupt or lose the original input. */
+export declare function throughModsPromptSubmit(text: string, sessionId?: string, signal?: AbortSignal): Promise<ModsPromptSubmitResult | undefined>;
+/** Mutates only user text, before the shared history/model consumers see these items. */
+export declare function applyModsPromptSubmit(items: AgentInputItem[], sessionId: string, signal?: AbortSignal): Promise<string | undefined>;
+/**
+ * 通知会话开始。同样绝不向外抛。
+ *
+ * @param input 会话 cwd 与是否交互式
+ */
+export declare function notifyModsSessionStart(input: {
+    cwd: string;
+    isInteractive: boolean;
+}): Promise<void>;

package/cli/dist-server/types/vendor/cbc-core/node/context/pre-message-compact-strategy.d.ts

@@ -4,8 +4,7 @@ import { CompactStrategyContext, ContextCompactSummarizeOptions } from './contex
 /**
  * PreMessage 压缩策略：在发送用户消息前触发。
  *
- * 触发条件：PRE_MESSAGE_AUTO 或 WorkBuddy 的 USER_COMMAND。
- * CBC 手动 /compact 不走该策略，继续由 compact agent 路径处理。
+ * 触发条件：PRE_MESSAGE_AUTO 或 USER_COMMAND（WorkBuddy / TUI 手动压缩）。
  *
  * 流程：
  * 1. Engineering compact (no LLM call)

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/followup-queue-protocol.d.ts

@@ -30,12 +30,13 @@ export interface FollowupQueueSnapshot {
     items: FollowupQueueItemView[];
 }
 /** ACP `session/steer` 回调。服务不直接碰 ACP，方便单测。 */
-export type FollowupSteerFn = (contentBlocks: unknown[]) => Promise<{
+export type FollowupSteerFn = (contentBlocks: unknown[], modsPromptSubmitted?: true) => Promise<{
     steered: boolean;
 }>;
 export interface FollowupQueueService {
     snapshot(session: Session): FollowupQueueSnapshot;
-    enqueue(session: Session, contentBlocks: unknown[], hold: boolean): FollowupQueueSnapshot;
+    /** modsPromptSubmitted is host-validated provenance, never a client flag. */
+    enqueue(session: Session, contentBlocks: unknown[], hold: boolean, modsPromptSubmitted?: true): FollowupQueueSnapshot;
     remove(session: Session, itemId: string): FollowupQueueSnapshot;
     /**
      * 立即发送：能插入当前回合就 `steer` 并从队列拿掉；否则只摘 queueHold。

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/followup-queue.d.ts

@@ -23,7 +23,7 @@ export declare class FollowupQueueServiceImpl implements FollowupQueueService {
      */
     private readonly pendingBroadcasts;
     snapshot(session: Session): FollowupQueueSnapshot;
-    enqueue(session: Session, contentBlocks: unknown[], hold: boolean): FollowupQueueSnapshot;
+    enqueue(session: Session, contentBlocks: unknown[], hold: boolean, modsPromptSubmitted?: true): FollowupQueueSnapshot;
     remove(session: Session, itemId: string): FollowupQueueSnapshot;
     sendNow(session: Session, itemId: string, steer?: FollowupSteerFn): Promise<FollowupQueueSnapshot>;
     watch(session: Session): void;

package/cli/dist-server/types/vendor/cbc-core/node/message-queue/steer-input-buffer-protocol.d.ts

@@ -28,6 +28,8 @@ export declare const SteerInputBuffer: unique symbol;
  * drain 返回的一组：待插入内容 + 独立对账 id + 客户端不透明 metadata。
  */
 export interface SteerDrainedGroup {
+    /** Set only after the host validates a one-time mod prompt receipt. */
+    readonly modsPromptSubmitted?: true;
     readonly blocks: unknown[];
     /** Native, already reviewed messages. Kept by reference for in-memory admission markers. */
     readonly messages?: readonly UserMessageItem[];
@@ -49,6 +51,8 @@ export interface SteerDrainedGroup {
  * push 的归属 + 客户端不透明 metadata 入参（合并为一个对象，避免 push 参数过多）。
  */
 export interface SteerPushInput {
+    /** Server-only provenance, independent of untrusted clientMeta. */
+    readonly modsPromptSubmitted?: true;
     /**
      * 这组消息归属的请求 id（当前正在执行的 turn 的 requestId）；
      * `undefined` 表示无归属信息（drain 时按「当前也无归属」放行，退化为旧行为）。

package/cli/dist-server/types/vendor/cbc-core/node/session/can-use-tool.d.ts

@@ -40,6 +40,8 @@ export type PermissionResult = {
     updatedPermissions?: PermissionUpdate[];
     toolUseID?: string;
     decisionClassification?: PermissionDecisionClassification;
+    /** Optional host response metadata; interpreted only by the requesting tool. */
+    metadata?: Record<string, unknown>;
 } | {
     behavior: 'deny';
     message: string;
@@ -68,6 +70,8 @@ export interface CanUseToolOptions {
     displayName?: string;
     /** 桥端渲染的副标题说明。 */
     description?: string;
+    /** Tool-provided display/context metadata for host permission UIs. Not an authorization grant. */
+    metadata?: Record<string, unknown>;
     /** 本次工具调用在 assistant 消息内的唯一 id。 */
     toolUseID: string;
     /** 子代理上下文中触发时，子代理的 id。 */

package/cli/dist-server/types/vendor/cbc-core/node/session/index.d.ts

@@ -36,6 +36,7 @@ export * from './stream-timeout-retry-budget';
 export { consumeRecoveryRequestPending } from './recovery-budget';
 export * from './session-run-state-machine-protocol';
 export * from './session-run-state-machine';
+export * from './model-request-retry-phase';
 export * from './session-run-state-projection-service';
 export * from './local-jsonl-session-store';
 export * from './transcript-branch';

package/cli/dist-server/types/vendor/cbc-core/node/session/interruption-service.d.ts

@@ -93,6 +93,13 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     protected readonly idleQueueDrainService?: IIdleQueueDrainService;
     protected readonly traceCollector?: SessionInterruptionTraceHost;
     protected get startupProfiler(): SessionInterruptionProfilerHost;
+    /**
+     * 标记「用户取消本轮」的拒绝项（`reject(item, { cancelTurn: true })`）。
+     * 语义是取消当前 turn，而不是「拒绝并让模型带反馈续跑」。
+     * 记在 WeakSet 而不是 `rawItem.providerData`（那会落进历史），也不改
+     * deferred 的 reject 形状（下游按 error 类型分支的逻辑保持不变）。
+     */
+    private readonly cancelTurnItems;
     /** Claim before calling out: sandbox callbacks can throw or synchronously re-enter. */
     private takeSandboxResolve;
     approve(item: RunToolApprovalItem, options?: {
@@ -101,6 +108,7 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     }): void;
     reject(item: RunToolApprovalItem, options?: {
         decision?: 'deny' | 'rejectAndExitPlan';
+        cancelTurn?: boolean;
     }): void;
     /**
      * 取消指定 session 上所有未决的 interruption Deferred。

package/cli/dist-server/types/vendor/cbc-core/node/session/model-request-retry-phase.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRetryReason, Session } from './session-protocol';
+import { ModelRequestRetryPhase, SessionRunStateMachine } from './session-run-state-machine-protocol';
+export declare class ModelRequestRetryPhaseImpl implements ModelRequestRetryPhase {
+    protected readonly stateMachine: SessionRunStateMachine;
+    during<T>(session: Session | undefined, reason: AgentRetryReason, wait: () => Promise<T>): Promise<T>;
+    /**
+     * 辅助型调用复用主 session 却不回送 AGENT_ENDED（#52320），不得驱动其状态；
+     * 状态已离开 MODEL_REQUESTING 说明另有路径在推进，此时不抢写。
+     */
+    private enter;
+    /**
+     * 必须回到 MODEL_REQUESTING：RETRYING 不接收 TOOL_STARTED / MODEL_RESPONSE_DONE 等后续事件，
+     * 停留会让错误处理路径的转换被静默忽略。已被取消等事件推走时不再改写。
+     */
+    private leave;
+}

package/cli/dist-server/types/vendor/cbc-core/node/session/model-response-interceptors.d.ts

@@ -215,6 +215,21 @@ export declare class MediaContentErrorInterceptor implements ModelResponseInterc
     private static readonly MAX_RETRY_ATTEMPTS;
     private static readonly MAX_MIME_MISMATCH_RETRY_ATTEMPTS;
     private static readonly GIF_UNSUPPORTED_ERROR_CODES;
+    /**
+     * Gateway business codes that mean "the model refused the images in this
+     * request" (`11135 InvalidInputImage`).
+     *
+     * The code is the only stable signal. The gateway folds several unrelated
+     * upstream causes into one hard-coded English sentence and overwrites the
+     * upstream text, so `ERROR_TYPE_PATTERNS` matching that sentence breaks the
+     * moment the wording is changed or localized (`docs/error-codes.md` already
+     * ships a Chinese user-facing string for this code). The code is carried on
+     * the error object all the way here — `error-analyzer` puts the parsed body
+     * code into the response, the SDK surfaces it as `APIError.error.code`, and
+     * `ErrorUtils.extractBizCode` recovers it — so key off it and keep the
+     * phrasing match only as a fallback for gateways that send no code.
+     */
+    private static readonly IMAGE_REJECTED_ERROR_CODES;
     private static readonly GIF_UNSUPPORTED_PLACEHOLDER;
     private static readonly ERROR_TYPE_PATTERNS;
     intercept(ctx: ModelResponseInterceptorContext): Promise<boolean | void>;