@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/node/memory/subdirectory-memory-loader.d.ts

@@ -0,0 +1,55 @@
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import { Memory, MemoryParser, MemoryValidator, SubdirectoryMemoryLoader } from './memory-protocol';
+export declare class SubdirectoryMemoryLoaderImpl implements SubdirectoryMemoryLoader {
+    protected readonly parser: MemoryParser;
+    protected readonly validator: MemoryValidator;
+    protected readonly logger: Logger;
+    private chainCache;
+    private dirCache;
+    private fileCache;
+    protected initialize(): void;
+    loadForPaths(filePaths: string[]): Promise<Memory[]>;
+    clear(): void;
+    /**
+     * 加载指定目录到 workDir 之间所有目录的 memory
+     * @param dirPath 目录路径
+     * @param workDir 工作目录
+     * @returns memory 列表
+     */
+    private loadForDirectory;
+    /**
+     * 加载单个目录的 memory
+     * @param dirPath 目录路径
+     * @param workDir 工作目录
+     * @returns memory 或 undefined
+     */
+    private loadDirMemory;
+    /**
+     * 转换用户定义的 globs 为基于 workDir 的路径
+     * @param userGlobs 用户定义的 globs
+     * @param relativeDirPath 相对于 workDir 的目录路径
+     * @returns 转换后的 globs，无有效 globs 时返回默认目录 glob
+     */
+    private resolveGlobs;
+    /**
+     * 将单个 glob 转换为基于 workDir 的路径
+     * @param glob 原始 glob 模式
+     * @param relativeDirPath 相对于 workDir 的目录路径
+     * @returns 转换后的 glob，绝对路径保留，.. 开头返回 undefined
+     */
+    private resolveGlobToWorkDir;
+    /**
+     * 查找目录下的 memory 文件
+     * @param dirPath 目录路径
+     * @returns memory 文件路径或 undefined
+     */
+    private findMemoryFile;
+    /**
+     * 检查路径是否在父路径内
+     */
+    private isSubPath;
+    /**
+     * 检查目录是否在产品目录（.codebuddy / 定制版 .xxxcode）内
+     */
+    private isInsideProductDir;
+}

package/cli/dist-server/types/node/model/model-protocol.d.ts

@@ -0,0 +1,22 @@
+import { type Model, OpenAIChatCompletionsModel, type RawModelProvider } from '../../vendor/cbc-shared/node/index.js';
+export { Model, OpenAIChatCompletionsModel };
+export declare const MAX_MODEL_CACHE_SIZE = 10;
+export { AUTHENTICATION_REQUIRED_MESSAGE, AUTHENTICATION_FAILED_MESSAGE } from '../../vendor/cbc-shared/node/index.js';
+export declare const ModelProvider: unique symbol;
+export declare const ModelErrorAnalyzer: unique symbol;
+export declare const ModelRequestProcessor: unique symbol;
+export interface ModelProvider extends RawModelProvider {
+}
+export interface ModelErrorAnalyzer {
+    analyze(error: unknown, axiosConfig: any): Promise<Response>;
+    createErrorResponse(body: string, status: number, statusText: string, headers?: Record<string, string>): Response;
+}
+export interface ModelRequestProcessor {
+    /**
+     * Priority of the processor. Lower values execute first.
+     * Default is 1000. GzipRequestProcessor should use a high value (e.g., 9999)
+     * to ensure it runs after all other processors that need to access the raw body.
+     */
+    priority?: number;
+    process(axiosConfig: any): Promise<void>;
+}

package/cli/dist-server/types/node/multitask/session-flags.d.ts

@@ -0,0 +1,110 @@
+import { type AgentTaskManager } from '../agent-task/agent-task-protocol';
+import { type CoordinatorLiveWorker, type MultitaskSessionRef } from './types';
+/** starting 短路有 TTL：二次 init 泄漏时 sweep 仍能拆掉僵尸。 */
+export declare const STARTING_DELEGATION_TTL_MS = 30000;
+/**
+ * worker session 打标（markWorkerSession）完成时刻的监听者。
+ * 唯一的生产消费者是 coordinator-acp-bridge：worker session 在 AgentTask.execute()
+ * 的 setupPhase 里才创建，spawn 路径拿不到，靠这个钩子在创建的同一调用栈里挂桥。
+ */
+export type MultitaskWorkerSessionListener = (worker: MultitaskSessionRef, parent?: MultitaskSessionRef) => void;
+/** 返回退订函数。监听者抛错只 warn，不影响打标主流程。 */
+export declare function onMultitaskWorkerSession(listener: MultitaskWorkerSessionListener): () => void;
+/** 极简站立不能开 overlay（无子代理面）。站立键优先，否则看 leftover agentName。 */
+export declare function isMinimalStandingForMultitask(session?: MultitaskSessionRef | null): boolean;
+/** 只认布尔 `true`。字符串 `"true"` / 1 都算关，避免脏 meta 误开。 */
+export declare function isMultitaskMode(session?: MultitaskSessionRef | null): boolean;
+/** 协调器：mode 开且非 worker/子会话。站立键会拷到子会话，role/parent 双保险。 */
+export declare function isMultitaskCoordinator(session?: MultitaskSessionRef | null): boolean;
+export declare function shouldDetachCoordinatorSpawn(session?: MultitaskSessionRef | null): boolean;
+/** overlay 已开，或旧会话站立键 / agentName 仍是 multitask（挡住同步 Agent 堵主会话）。 */
+export declare function isCoordinatorStanding(session?: MultitaskSessionRef | null): boolean;
+/** worker / 子会话 / 落盘 agent-* 转录。续聊、斜杠、选名共用，避免只认内存 role。 */
+export declare function isMultitaskWorkerOrSubagent(session?: MultitaskSessionRef | null): boolean;
+/** overlay 会落盘；旧站立键 `multitask` 时补盖并迁回。DISABLE_BACKGROUND 下不盖。 */
+export declare function restoreCoordinatorFromStanding(session?: MultitaskSessionRef | null): void;
+/** overlay 真正打开/关掉过几次。关了之后靠它决定要不要热注入站立工具面。 */
+export declare function readSurfaceEpoch(session?: MultitaskSessionRef | null): number;
+/** REPL 常驻 kernel 目录新鲜度：indexEpoch + overlay 开关。两者都只增，和单调。 */
+export declare function overlayCatalogEpoch(indexEpoch: number, session?: MultitaskSessionRef | null): number;
+/** 只开 overlay（mode + coordinator role）。不改站立 mode / agentName / permissionMode。 */
+export declare function stampMultitaskSession(session: MultitaskSessionRef): void;
+/** 关掉 overlay。站立 mode 不动；旧会话若站立键仍是 multitask 则迁回。锁不清。 */
+export declare function clearMultitaskSession(session: MultitaskSessionRef): void;
+export declare function markDelegationStarting(taskId: string): void;
+export declare function clearDelegationStarting(taskId: string): void;
+export declare function resetDelegationStartingForTests(): void;
+/** 测试用：清掉未正常 detach 的桥监听，避免跨用例泄漏。生产靠 worker 终态拆订阅。 */
+export declare function resetWorkerSessionListenersForTests(): void;
+export declare function addDelegationLock(session: MultitaskSessionRef, taskId: string): void;
+export declare function clearDelegationLock(session: MultitaskSessionRef, taskId: string): void;
+export declare function hasLiveDelegation(session?: MultitaskSessionRef | null): boolean;
+export declare function listDelegationLockIds(session?: MultitaskSessionRef | null): string[];
+export declare function normalizeWorkerScopeKey(scopeKey?: string): string | undefined;
+export declare function setWorkerScopeKey(session: MultitaskSessionRef, taskId: string, scopeKey?: string): void;
+export declare function getWorkerScopeKey(session: MultitaskSessionRef | null | undefined, taskId: string): string | undefined;
+export declare function clearWorkerScopeKey(session: MultitaskSessionRef, taskId: string): void;
+/**
+ * Coordinator UI surface: expose every delegation lock without sweeping it through
+ * this process's TaskManager. Detached workers may execute in another runtime,
+ * while the coordinator session meta is the shared cross-runtime source of truth.
+ *
+ * Keep this separate from listCoordinatorLiveWorkers(), whose lock ∩ local
+ * TaskManager semantics are intentionally used by lifecycle/cleanup logic.
+ */
+export declare function listCoordinatorSurfaceWorkers(session?: MultitaskSessionRef | null): CoordinatorLiveWorker[] | null;
+/** 协调器 ListAgents：活锁 ∩ TaskManager live。非协调器返回 null（走原目录）。 */
+export declare function listCoordinatorLiveWorkers(session?: MultitaskSessionRef | null): CoordinatorLiveWorker[] | null;
+/** Ask / ExitPlanMode only. Write/Bash and other permissions still follow parent teardown. */
+export declare function isLiveDetachedWorkerHitlTool(effectiveToolName: unknown): boolean;
+/**
+ * Live coordinator worker: `multitaskRole=worker` and a pending/running AgentTask
+ * whose sub-session matches `source`. Fail-closed if TaskManager is unavailable.
+ *
+ * Do not use `parentSessionId` alone — ordinary (non-multitask) subagents must
+ * still lose HITL when the parent turn is cancelled.
+ */
+export declare function isLiveDetachedWorkerSession(source?: MultitaskSessionRef | null, parentSessionId?: string): boolean;
+/**
+ * Parent-turn sweep (`prompt_timeout` / user Stop / sandbox timeout) must not
+ * settle a live detached worker's Ask/plan. Closing the parent session still does.
+ */
+export declare function shouldKeepLiveDetachedWorkerHitl(args: {
+    effectiveToolName: unknown;
+    source?: MultitaskSessionRef | null;
+    sweepSessionId: string;
+    reason: string;
+}): boolean;
+/** 只读协议上的 `resume`，不穿透实现类 private `config`。 */
+export declare function readTaskResumeId(task: {
+    resume?: unknown;
+}): string | undefined;
+/** 按 task.id / sessionId / resume 找任意状态的任务（含已终态，供 resume 验 id）。 */
+export declare function findMatchingTask(taskManager: AgentTaskManager, taskId: string): ReturnType<AgentTaskManager['getTask']>;
+/** 按 task.id / sessionId / resume 找仍 pending/running 的 worker。 */
+export declare function findLiveMatchingTask(taskManager: AgentTaskManager, taskId: string): ReturnType<AgentTaskManager['getTask']>;
+/** live = pending/running（含别名）。死任务清锁；TaskManager 不可用则认锁数组。 */
+export declare function isLiveDelegationId(session?: MultitaskSessionRef | null, taskId?: string): boolean;
+/** 先回灌再扫僵尸。新开 worker 和终态通知都要走。 */
+export declare function sweepStaleDelegationLocks(session?: MultitaskSessionRef | null): void;
+/** 第一条活锁（顺手清僵尸）。不参与默认派工。 */
+export declare function resolveLiveResume(session?: MultitaskSessionRef | null): string | undefined;
+/** worker：标 role、剥 multitaskMode，从父会话抄 acpConnectionId。 */
+export declare function markWorkerSession(session: MultitaskSessionRef, parent?: MultitaskSessionRef): void;
+export declare function markModuleSpawn(taskId: string): void;
+export declare function clearModuleSpawn(taskId: string): void;
+export declare function isModuleSpawned(taskId?: string): boolean;
+export declare function resetModuleSpawnMarksForTests(): void;
+export declare function shouldSkipTeamNotification(task: {
+    id?: string;
+    teamContext?: unknown;
+    getMainSession?: () => MultitaskSessionRef | undefined;
+} | null | undefined): boolean;
+export declare function applyCoordinatorTaskOutput<T extends {
+    block?: unknown;
+}>(session: MultitaskSessionRef | null | undefined, input: T): T;
+export declare const COORDINATOR_TASKOUTPUT_RUNNING_HINT: string;
+/** 协调器上把「稍后再查」改成禁止空转，避免 block=false 后模型仍 tight-loop。 */
+export declare function annotateCoordinatorTaskOutput<T extends {
+    content?: unknown;
+}>(session: MultitaskSessionRef | null | undefined, result: T): T;

package/cli/dist-server/types/node/multitask/types.d.ts

@@ -0,0 +1,123 @@
+import type { ToolResult } from '../tools/tool-protocol';
+export declare const MULTITASK_MODE_NAME = "multitask";
+/** 必须与 `MAIN_AGENT_META_KEY` 同字面量，本模块不反向 import main-agent-session。 */
+export declare const MULTITASK_STANDING_META_KEY = "codebuddy.ai/mainAgent";
+export declare const MULTITASK_MODE_META_KEY = "multitaskMode";
+export declare const MULTITASK_ROLE_META_KEY = "multitaskRole";
+export declare const MULTITASK_ACTIVE_TASK_IDS_KEY = "multitaskActiveTaskIds";
+/** 旧会话站立键曾写成 `multitask` 时，用来迁回进 overlay 前的 mode。新盖章不再写。 */
+export declare const MULTITASK_PREVIOUS_AGENT_KEY = "multitaskPreviousAgent";
+export declare const MULTITASK_SCOPE_BY_TASK_KEY = "multitaskWorkerScopeByTaskId";
+export declare const MULTITASK_TASK_STORAGE_ID_KEY = "multitaskTaskStorageId";
+export declare const MULTITASK_LAST_PLAN_KEY = "multitaskLastPlan";
+export declare const MULTITASK_LAST_PLAN_TURN_KEY = "multitaskLastPlanTurn";
+/** 每次真正打开/关掉 overlay 加一。关了之后每轮靠它决定要不要热注入站立工具面。 */
+export declare const MULTITASK_SURFACE_EPOCH_KEY = "multitaskSurfaceEpoch";
+export declare const MULTITASK_DELEGATED_FORBIDDEN = "delegated_work_forbidden";
+/** 同批探测通过后才放行。不在 shipped 白名单里单独开；策略按 batch 判定。 */
+export declare const MULTITASK_COORDINATOR_READONLY_TOOL_NAMES: readonly ["Grep", "Read"];
+/** Overlay 打开时的热注入首句。拦截器 / notes / InspectSelf 共用，不作废历史。 */
+export declare const OVERLAY_ON_SURFACE_LEAD: string;
+/** 派工后：别空转等完成；用户问进度时必须读一次中途输出。 */
+export declare const COORDINATOR_WAIT_FOR_NOTIFICATION: string;
+/** 通知后：TaskOutput 就是用来读全文的。`<summary>` 只有 240 字标题。 */
+export declare const COORDINATOR_READ_REPORT_THEN_SYNTHESIZE: string;
+/** Code Mode overlay：对话层没有 TaskOutput，必须在 REPL 里 await 一次。 */
+export declare const COORDINATOR_READ_REPORT_IN_REPL: string;
+/** 每轮 reminder / InspectSelf / snapshot 共用，避免三处文案漂移。 */
+export declare const COORDINATOR_BEHAVIOR_NOTES: string;
+/** 协调器工具白名单。策略拦截与 shipped mode `tools` 共用这一份。 */
+export declare const MULTITASK_COORDINATOR_TOOL_NAMES: readonly ["Agent", "TaskOutput", "TaskStop", "InterruptAgent", "ListAgents", "InspectSelf", "AskUserQuestion", "SendUserMessage", "Grep", "Read"];
+export type MultitaskCoordinatorToolName = (typeof MULTITASK_COORDINATOR_TOOL_NAMES)[number];
+export type MultitaskRole = 'coordinator' | 'worker';
+/** 策略 / 盖章用的最小 session 面，避免单测拉齐完整 Session。 */
+export interface MultitaskSessionRef {
+    id?: string;
+    /** 子代理落盘用 agent-*，反序列化后 role/parent 已丢，靠这个认 worker。 */
+    storeId?: string;
+    meta?: Record<string, unknown>;
+    agentName?: string;
+    options?: {
+        permissionMode?: string;
+    };
+    permissionModeSubject?: {
+        next(mode: string): void;
+    };
+}
+export interface SpawnDetachedInput {
+    prompt?: string;
+    description?: string;
+    model?: string;
+    resume?: string;
+    subagent_type?: string;
+    name?: string;
+    max_turns?: number;
+    run_in_background?: boolean;
+    scopeKey?: string;
+}
+export interface SpawnDetachedContext {
+    session: MultitaskSessionRef & {
+        id?: string;
+    };
+    input: SpawnDetachedInput;
+    parentToolUseId?: string;
+}
+export interface PreparedCoordinatorSpawn {
+    agentType: string;
+    resume?: string;
+    /** 目标 worker 仍 pending/running：禁止再 new 一条 execute。 */
+    alreadyLive?: boolean;
+    consumeBudget: boolean;
+    description: string;
+    prompt: string;
+    /** Optional display label for this detached worker. It does not create a Team member. */
+    displayName?: string;
+    /** Original isolation mode of the worker being resumed. */
+    historicalAgentIsolation?: 'worktree';
+    scopeKey?: string;
+}
+export interface MultitaskProcessGuardOpts {
+    /** 已归一化的进程 agent 名（`--multitask` 必须先收成 `multitask`）。 */
+    agentName?: string;
+    print?: boolean;
+    streamJson?: boolean;
+    stdoutIsTTY?: boolean;
+    stdinIsTTY?: boolean;
+    acp?: boolean;
+    serve?: boolean;
+    backgroundDisabled?: boolean;
+}
+export interface PlannerSpawnSibling {
+    subagentType?: string;
+    scopeKey: string;
+    hint: string;
+}
+export type PlannerDecision = {
+    action: 'answer_inline';
+} | {
+    action: 'spawn';
+    subagentType: string;
+    count: number;
+    scopeKey?: string;
+    siblings?: PlannerSpawnSibling[];
+    followUp?: string;
+} | {
+    action: 'resume';
+    taskId: string;
+};
+export interface CoordinatorLiveWorker {
+    id: string;
+    status: string;
+    scopeKey?: string;
+    description?: string;
+}
+export interface SelfSnapshot {
+    role: 'coordinator';
+    tools: readonly string[];
+    liveWorkers: CoordinatorLiveWorker[];
+    locks: string[];
+    plan?: PlannerDecision;
+    permissionMode?: string;
+    notes: string;
+}
+export type CoordinatorToolDecision = ToolResult | null;

package/cli/dist-server/types/node/navigation/index.d.ts

@@ -0,0 +1,2 @@
+export * from './navigation-protocol';
+export * from './navigation-manager';

package/cli/dist-server/types/node/navigation/navigation-manager.d.ts

@@ -0,0 +1,12 @@
+import { Subject } from 'rxjs';
+import { initialRender, InitialRoute, NavigationManager } from './navigation-protocol';
+export declare class NavigationManagerImpl implements NavigationManager {
+    navigateSubject: Subject<string>;
+    initialRoute?: InitialRoute;
+    initialRender?: initialRender;
+    to(path: string): Promise<void>;
+    setInitialRoute(route: InitialRoute): void;
+    setInitialRender(renderer: initialRender): void;
+    clearInitialRender(): void;
+    clearInitialRoute(): void;
+}

package/cli/dist-server/types/node/navigation/navigation-protocol.d.ts

@@ -0,0 +1,23 @@
+import { Subject } from 'rxjs';
+export declare const NavigationManager: unique symbol;
+export interface InitialRoute {
+    currentPath: string;
+    params?: {
+        escapeExit: string;
+        skipAuth: string;
+    };
+}
+export interface initialRender {
+    component: React.ComponentType<any>;
+    props: Record<string, unknown>;
+}
+export interface NavigationManager {
+    navigateSubject: Subject<string>;
+    initialRoute?: InitialRoute;
+    initialRender?: initialRender;
+    setInitialRender: (renderer: initialRender) => void;
+    to: (path: string) => Promise<void>;
+    setInitialRoute: (route: InitialRoute) => void;
+    clearInitialRoute: () => void;
+    clearInitialRender: () => void;
+}

package/cli/dist-server/types/node/notification/notification-protocol.d.ts

@@ -0,0 +1,19 @@
+import { NotificationType } from '../../vendor/cbc-shared/node/index.js';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { ProgressState } from '../utils/osc-protocol-utils';
+export declare const TerminalNotificationService: unique symbol;
+export interface TerminalNotificationService {
+    sendNotification(message: string, title?: string, notificationType?: NotificationType, session?: Session): Promise<void>;
+    /**
+     * Tool-triggered notification (model calling PushNotificationTool).
+     * Bypasses the hooks-only NotificationType whitelist in sendNotification.
+     */
+    sendToolNotification(message: string, title?: string, session?: Session): Promise<void>;
+}
+export declare const ProgressSyncService: unique symbol;
+export interface ProgressSyncService {
+    start(session: Session): Promise<void>;
+    stop(sessionId: string): void;
+    updateProgress(state: ProgressState, percentage?: number): void;
+    clearProgress(): void;
+}

package/cli/dist-server/types/node/output-style/output-style-protocol.d.ts

@@ -0,0 +1,60 @@
+export declare const OUTPUT_STYLE_DIRNAME = "output-styles";
+export declare const OUTPUT_STYLE_PATTERN = "*.md";
+export declare const OutputStyleManager: unique symbol;
+export interface OutputStyle {
+    name: string;
+    description: string;
+    content: string;
+    keepCodingInstructions?: boolean;
+    /** 插件样式启用时强制应用，覆盖用户的 outputStyle 设置。 */
+    forceForPlugin?: boolean;
+    /**
+     * 待渲染的 instructions 模板名（仅内置样式携带）。内置样式的 `content` 渲染成本较高
+     * （`promptRenderer.render`），而 `initialize` 握手 / 样式选择面板只需要 name/description
+     * 列表，不需要 content。因此加载列表时**不预渲染**，把模板名暂存在此，等 `getOutputStyleByName`
+     * 真正要用样式内容（run 时应用到 agent instructions）才懒渲染并写回 `content` 缓存。
+     * 自定义/插件样式的 content 直接来自文件读取，无渲染成本，不使用本字段。
+     */
+    instructionsTemplate?: string;
+}
+export interface OutputStyleManager {
+    /** Rebuild cached styles from the current active plugin snapshot. */
+    reload?(): Promise<void>;
+    /**
+     * Get all output styles (built-in + custom)
+     * Returns cached data after initialization
+     */
+    getAllOutputStyles(): Promise<OutputStyle[]>;
+    /**
+     * initialize 握手专用的**快速快照**：只返回来自 product 配置的内置样式列表
+     * （name/description/instructionsTemplate），**不做**任何 fs 扫描 / 插件遍历，
+     * 从而避免把工作目录树遍历 + 插件消费拖进 SDK 首次 `initialize` 的关键路径。
+     *
+     * 自定义 / 插件样式的加载改为**在返回快照之后 fire-and-forget** 由完整
+     * `getAllOutputStyles()` 触发；下游首次通过 `getOutputStyleByName` 消费时若尚未
+     * 就绪，会自然等待那次后台加载完成 —— 语义等价，仅把耗时从 initialize 握手挪到
+     * 首个 prompt 的路径上（run 时本来就要等一堆 await，感知不到）。
+     *
+     * 语义边界（重要）：本方法**只用于 initialize 握手**回报可选项，不承诺完备性。
+     * 需要拿完整列表（TUI 面板 / 按名匹配）请继续用 `getAllOutputStyles()` /
+     * `getOutputStyleByName()`。
+     */
+    getInitializeSnapshot(): Promise<OutputStyle[]>;
+    /**
+     * Get output style by name
+     * Returns the first matching style (case-insensitive)
+     */
+    getOutputStyleByName(name: string): Promise<OutputStyle | undefined>;
+    /** 返回首个由已启用插件强制应用的样式。 */
+    getForcedOutputStyle(): Promise<OutputStyle | undefined>;
+    /**
+     * Get all output styles from current project and parent directories
+     * Returns array of output styles ordered from parent to child directories
+     * @deprecated Use getAllOutputStyles instead
+     */
+    getProjectOutputStyles(): Promise<OutputStyle[]>;
+    /**
+     * Parse markdown content to extract output style information
+     */
+    parseOutputStyleContent(content: string, filePath: string): OutputStyle;
+}

package/cli/dist-server/types/node/permission/brokered-sandbox/approval-coordinator.d.ts

@@ -0,0 +1,32 @@
+import { Logger } from '@celljs/core';
+import type { DecisionRecord } from '../../../workspace/sandbox-cli/lib/common/protocol.generated.js';
+import type { FileBlockRecord } from '../../sandbox-cli/sandbox-cli-protocol';
+import type { BrokeredSandboxApprovalScope, BrokeredSandboxFileTokenResult, BrokeredSandboxHostResult } from './host-protocol';
+export declare const BrokeredSandboxApprovalCoordinator: unique symbol;
+/** Memory-only: native verdicts may carry sensitive items and must not enter raw block logs. */
+export declare const BROKERED_FILE_DECISION: unique symbol;
+interface BrokeredFileBlock extends FileBlockRecord {
+    [BROKERED_FILE_DECISION]?: DecisionRecord;
+}
+export interface BrokeredApprovalRequest {
+    id?: string;
+    operation?: string;
+    sessionId?: string;
+    toolCallId?: string;
+    brokerTraceId?: string;
+}
+export declare class BrokeredSandboxApprovalCoordinatorImpl {
+    protected readonly logger?: Logger;
+    private readonly promptBlocks;
+    runApprovalLoop(request: BrokeredApprovalRequest, dispatch: (approvalScope: BrokeredSandboxApprovalScope | undefined) => Promise<BrokeredSandboxFileTokenResult | BrokeredSandboxHostResult | undefined>): Promise<BrokeredSandboxFileTokenResult | BrokeredSandboxHostResult | undefined>;
+    dispatchAndRecordPrompt(request: BrokeredApprovalRequest, dispatch: (approvalScope: BrokeredSandboxApprovalScope | undefined) => Promise<BrokeredSandboxFileTokenResult | BrokeredSandboxHostResult | undefined>): Promise<BrokeredSandboxFileTokenResult | BrokeredSandboxHostResult | undefined>;
+    recordPromptBlock(request: BrokeredApprovalRequest, result: BrokeredSandboxFileTokenResult | BrokeredSandboxHostResult): void;
+    drainPromptBlocks(request: {
+        sessionId?: string;
+        toolCallId?: string;
+    }): BrokeredFileBlock[];
+    clearSessionApprovals(): void;
+    private prunePromptBlocks;
+}
+export type BrokeredSandboxApprovalCoordinator = Pick<BrokeredSandboxApprovalCoordinatorImpl, keyof BrokeredSandboxApprovalCoordinatorImpl>;
+export {};

package/cli/dist-server/types/node/permission/brokered-sandbox/host-protocol.d.ts

@@ -0,0 +1,103 @@
+import type { SecurityCenterFileRule } from '../../bash-sandbox/bash-sandbox-protocol';
+import type { BrokeredFileAccessDecision, BrokeredFileDecision, BrokeredFileOperation } from '../file-policy-assessment';
+export interface BrokeredSandboxApprovedAccess {
+    operation: BrokeredFileOperation;
+    normalisedPath: string;
+    matchedRule?: BrokeredFileAccessDecision['matchedRule'];
+}
+export interface BrokeredSandboxApprovalScope {
+    accesses: readonly BrokeredSandboxApprovedAccess[];
+}
+export type BrokeredSandboxDeleteMode = 'trash' | 'unlink';
+export type BrokeredSandboxPolicyReason = 'implicit-safe-delete-fallback';
+interface BrokeredSandboxPolicyParams {
+    orderedFileRules?: readonly SecurityCenterFileRule[];
+    approvalScope?: BrokeredSandboxApprovalScope;
+    sandboxFilesystem?: import('../../bash-sandbox/bash-sandbox-protocol').SandboxConfig['filesystem'];
+    sessionId?: string;
+}
+type BrokeredSandboxPathParams<T extends object = Record<never, never>> = BrokeredSandboxPolicyParams & {
+    path: string;
+} & T;
+type BrokeredSandboxPairParams<T extends object = Record<never, never>> = BrokeredSandboxPolicyParams & {
+    from: string;
+    to: string;
+} & T;
+export type BrokeredSandboxDeleteParams = BrokeredSandboxPathParams<{
+    deleteMode?: BrokeredSandboxDeleteMode;
+    recursive?: boolean;
+    force?: boolean;
+    safeDeleteReportPath?: string;
+    runtime?: string;
+}>;
+export type BrokeredSandboxMkdirParams = BrokeredSandboxPathParams<{
+    recursive?: boolean;
+    mode?: number;
+}>;
+export type BrokeredSandboxRenameParams = BrokeredSandboxPairParams;
+export type BrokeredSandboxCopyParams = BrokeredSandboxPairParams<{
+    recursive?: boolean;
+}>;
+export type BrokeredSandboxChmodParams = BrokeredSandboxPathParams<{
+    mode: number;
+}>;
+export type BrokeredSandboxLinkParams = BrokeredSandboxPairParams<{
+    symbolic?: boolean;
+}>;
+export type BrokeredSandboxTouchParams = BrokeredSandboxPathParams;
+export type BrokeredSandboxFileTokenParams = BrokeredSandboxPathParams<{
+    operation: 'read' | 'write';
+}>;
+interface BrokeredSandboxDecisionResult {
+    ok: boolean;
+    path: string;
+    normalisedPath: string;
+    decision: BrokeredFileDecision;
+    decisionRecord?: BrokeredFileAccessDecision['decisionRecord'];
+    refusedOperation?: BrokeredFileOperation;
+    matchedRule?: BrokeredFileAccessDecision['matchedRule'];
+    approvalAccess?: BrokeredSandboxApprovedAccess;
+    approvedByUser?: boolean;
+    error?: string;
+}
+export type BrokeredSandboxHostResult = BrokeredSandboxDecisionResult & {
+    operation: 'delete' | 'mkdir' | 'rename' | 'copy' | 'chmod' | 'link' | 'touch';
+    deleteMode?: BrokeredSandboxDeleteMode;
+    policyReason?: BrokeredSandboxPolicyReason;
+    sourceApprovedByUser?: boolean;
+    to?: string;
+    normalisedTo?: string;
+    toMatchedRule?: BrokeredFileAccessDecision['matchedRule'];
+    toApprovedByUser?: boolean;
+    toDeleteDecision?: BrokeredFileDecision;
+    toDeleteMatchedRule?: BrokeredFileAccessDecision['matchedRule'];
+    toDeleteApprovedByUser?: boolean;
+};
+export type BrokeredSandboxFileTokenResult = BrokeredSandboxDecisionResult & {
+    operation: 'read' | 'write';
+    inspectionPath?: string;
+    token?: string;
+};
+type BrokeredHostPathRef = Pick<BrokeredFileAccessDecision, 'path' | 'normalisedPath' | 'matchedRule' | 'decisionRecord'>;
+type BrokeredResultOperation = BrokeredSandboxHostResult['operation'] | BrokeredSandboxFileTokenResult['operation'];
+type BrokeredPairPathRef = BrokeredHostPathRef | BrokeredFileAccessDecision;
+type BrokeredResultExtra = Partial<Pick<BrokeredSandboxDecisionResult, 'matchedRule' | 'approvalAccess' | 'approvedByUser' | 'error' | 'decisionRecord' | 'refusedOperation'> & Pick<BrokeredSandboxHostResult, 'deleteMode' | 'policyReason' | 'sourceApprovedByUser' | 'to' | 'normalisedTo' | 'toMatchedRule' | 'toApprovedByUser' | 'toDeleteDecision' | 'toDeleteMatchedRule' | 'toDeleteApprovedByUser'> & Pick<BrokeredSandboxFileTokenResult, 'inspectionPath' | 'token'>>;
+type BrokeredResult<TOperation extends BrokeredResultOperation> = BrokeredSandboxDecisionResult & {
+    operation: TOperation;
+} & BrokeredResultExtra;
+type BrokeredRefusalResult<TOperation extends BrokeredResultOperation> = BrokeredResult<TOperation> & {
+    ok: false;
+    error: string;
+};
+type BrokeredPairOperation = 'rename' | 'copy' | 'link';
+export declare function isAccessApproved(access: BrokeredFileAccessDecision, expectedDecision: BrokeredFileDecision, approvalScope?: BrokeredSandboxApprovalScope): boolean;
+export declare function hasApprovedAccess(access: BrokeredFileAccessDecision, approvalScope?: BrokeredSandboxApprovalScope): boolean;
+export declare function toApprovalAccess(access: BrokeredFileAccessDecision): BrokeredSandboxApprovedAccess | undefined;
+export declare function hostDeny<TOperation extends BrokeredResultOperation>(operation: TOperation, path: string, error: string, extra?: BrokeredResultExtra): BrokeredRefusalResult<TOperation>;
+export declare function hostPolicyRefusal<TOperation extends BrokeredResultOperation>(operation: TOperation, access: BrokeredFileAccessDecision, error: string, extra?: BrokeredResultExtra): BrokeredRefusalResult<TOperation>;
+export declare function hostRefusal<TOperation extends BrokeredResultOperation>(operation: TOperation, access: BrokeredHostPathRef, decision: BrokeredFileDecision, error: string, extra?: BrokeredResultExtra): BrokeredRefusalResult<TOperation>;
+export declare function hostSuccess<TOperation extends BrokeredResultOperation>(operation: TOperation, access: BrokeredFileAccessDecision, decision: BrokeredFileDecision, approvalScope: BrokeredSandboxApprovalScope | undefined, extra?: BrokeredResultExtra): BrokeredResult<TOperation>;
+export declare function rawPathRef(path: string): BrokeredHostPathRef;
+export declare function hostPairPolicyRefusal(operation: BrokeredPairOperation, pathAccess: BrokeredPairPathRef, toAccess: BrokeredHostPathRef, refusedAccess: BrokeredFileAccessDecision, error: string): BrokeredSandboxHostResult;
+export declare function hostPairCompletion(operation: BrokeredPairOperation, pathAccess: BrokeredPairPathRef, toAccess: BrokeredFileAccessDecision, approvalScope: BrokeredSandboxApprovalScope | undefined, error?: string, additionalAccess?: BrokeredFileAccessDecision): BrokeredSandboxHostResult;
+export {};

package/cli/dist-server/types/node/permission/canonicalize-command.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Canonicalize a shell command string into a stable key for the sandbox
+ * approval cache (SandboxApprovalStore).
+ *
+ * The goal is to recognise "the same user intent" across superficial syntax
+ * differences introduced by shell wrappers, so that a session-level approval
+ * granted for `rm x` through one invocation path is also honoured when the
+ * model later invokes the same command through a different wrapper.
+ *
+ * Design reference: Codex's `canonicalize_command_for_approval`
+ * (codex-rs/core/src/command_canonicalization.rs).
+ *
+ * Our version is deliberately lighter-weight:
+ *
+ *   1. Identify common shell wrappers (`bash -c 'script'`, `/bin/bash -lc ...`,
+ *      `zsh -c ...`, `pwsh -Command ...`, `powershell -Command ...`) and extract
+ *      the inner script body as the key. Shell path and login/interactive flags
+ *      are normalised away.
+ *   2. Otherwise fall back to the trimmed original command as-is.
+ *
+ * Returning a plain string keeps the key hashable and cheap to log. Callers
+ * combine this with the cwd to form the full approval key.
+ */
+/**
+ * Normalise a command string into an approval-cache key.
+ *
+ * The output is a plain string prefixed with a tag that identifies how the
+ * command was recognised, keeping keys human-readable in logs.
+ */
+export declare function canonicalizeCommand(command: string): string;

package/cli/dist-server/types/node/permission/codebuddy-sandbox-env.d.ts

@@ -0,0 +1,35 @@
+import { PermissionMode } from '../../vendor/cbc-shared/node/index.js';
+/**
+ * Isolated-sandbox full pass (HIGH-RISK).
+ *
+ * Default `-y` stays `bypassPermissions`: HIGH/CRITICAL commands still prompt.
+ * A truthy process env (`1` / `true` / `yes` / `on`) makes `-y` / bypass skip
+ * those prompts without changing the visible permission mode.
+ *
+ * Intentionally an env var, not a CLI flag: full pass can run arbitrary
+ * commands (data loss, host damage, credential leak via prompt injection).
+ * The launch process must opt in explicitly (industry sandbox design).
+ *
+ * Process-level only: do not honor `settings.json` `env` (especially project
+ * scope) so a repo cannot silently upgrade `-y`.
+ * `permissions.disableBypassPermissionsMode` still blocks the bypass path.
+ */
+export declare const CODEBUDDY_IS_SANDBOX_ENV = "CODEBUDDY_IS_SANDBOX";
+export declare function isCodeBuddySandboxEnabled(env?: NodeJS.Dict<string>): boolean;
+/**
+ * Skip HIGH/CRITICAL safety prompts: explicit `fullAccess`, or bypass while
+ * `CODEBUDDY_IS_SANDBOX` is set on the process.
+ */
+export declare function isUnrestrictedPermissionMode(mode: PermissionMode | string | undefined, env?: NodeJS.Dict<string>): boolean;
+/**
+ * Session-aware full pass. `permissions.disableBypassPermissionsMode` still
+ * blocks the CLI bypass path; ACP `fullAccess` is an explicit IDE mode.
+ */
+export declare function isUnrestrictedSandboxSession(session: {
+    permissionModeSubject?: {
+        value?: PermissionMode | string;
+    };
+    toolPermissionContext?: {
+        isBypassPermissionsModeAvailable?: boolean;
+    };
+}): boolean;