@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/node/sensitive-content/sensitive-approval-port.d.ts

@@ -0,0 +1,22 @@
+import { type InterruptionService as InterruptionServiceInterface, type SessionManager as SessionManagerInterface } from '../../vendor/cbc-core/node/index.js';
+import { type SensitiveApprovalChoice, type SensitiveApprovalPort as SensitiveApprovalPortInterface } from './sensitive-content-protocol';
+type SensitiveApprovalRequest = Parameters<SensitiveApprovalPortInterface['requestApproval']>[0];
+export declare class SensitiveApprovalPortImpl implements SensitiveApprovalPortInterface {
+    protected readonly sessionManager?: SessionManagerInterface;
+    protected readonly interruptionService?: InterruptionServiceInterface;
+    requestApproval(request: SensitiveApprovalRequest): Promise<SensitiveApprovalChoice>;
+    registerAutomaticProtectionGrant(request: {
+        sessionId: string;
+        grantKey: string;
+        signal?: AbortSignal;
+    }): Promise<void>;
+    private requestApprovalTransport;
+    private getApprovalTimeoutMs;
+    private resolveActiveSession;
+    private getSessionManager;
+    private getInterruptionService;
+    private buildApprovalItem;
+    private mapTransportChoice;
+    private isTimeoutAbort;
+}
+export {};

package/cli/dist-server/types/node/sensitive-content/sensitive-content-mediation.d.ts

@@ -0,0 +1,6 @@
+import { type ReadOpenDecision, type ReadOpenRequest, type ResolvedToolEgressReviewRequest, type SensitiveContentMediation as SensitiveContentMediationInterface, type SensitiveDecisionMediation as SensitiveDecisionMediationInterface, type ToolEgressDecision } from './sensitive-content-protocol';
+export declare class SensitiveContentMediationImpl implements SensitiveContentMediationInterface {
+    protected readonly decisionMediation?: SensitiveDecisionMediationInterface;
+    authorizeReadOpen(_request: ReadOpenRequest): Promise<ReadOpenDecision>;
+    authorizeToolEgress(request: ResolvedToolEgressReviewRequest): Promise<ToolEgressDecision>;
+}

package/cli/dist-server/types/node/sensitive-content/sensitive-decision-mediation.d.ts

@@ -0,0 +1,69 @@
+import { type SessionManager as SessionManagerContract } from '../../vendor/cbc-core/node/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import { type SecurityReviewGate as SecurityReviewGateContract } from '../security-review/protocol';
+import { type SensitiveProtectionAuditAction, type SensitiveProtectionAuditDetail } from '../utils/security-audit-log';
+import { type SandboxCenterPort as SandboxCenterPortInterface, type SensitiveApprovalPort as SensitiveApprovalPortInterface, type SensitiveDecisionMediation as SensitiveDecisionMediationInterface, type SensitiveReviewDecision, type SensitiveReviewRequest } from './sensitive-content-protocol';
+export declare class SensitiveDecisionMediationImpl implements SensitiveDecisionMediationInterface {
+    protected sandboxCenterPort?: SandboxCenterPortInterface;
+    protected approvalPort?: SensitiveApprovalPortInterface;
+    protected logger?: Logger;
+    protected securityReviewGate?: SecurityReviewGateContract;
+    protected sessionManager?: SessionManagerContract;
+    protected readonly sessionGrants: import("./sensitive-session-grants").SensitiveSessionGrants;
+    private readonly failureAuditKeys;
+    /** Stores only opaque request identities. Sensitive plaintext never enters this cache. */
+    private readonly deniedDecisionScopes;
+    /** Serializes post-detection egress decisions within one model turn. */
+    private readonly egressDecisionTails;
+    /** Coalesces concurrent ingress dialogs without caching denial or timeout decisions. */
+    private readonly pendingIngressApprovals;
+    /** Reuses the first interactive ingress choice for the rest of one ToolCall. */
+    private readonly toolCallIngressApprovals;
+    /** Reuses only explicit clean detections for an unchanged file within one ToolCall. */
+    private readonly cleanFileDetections;
+    review(request: SensitiveReviewRequest): Promise<SensitiveReviewDecision>;
+    private getUnifiedApprovalState;
+    private reviewWithState;
+    private acquireEgressDecision;
+    private requestApproval;
+    private requestApprovalWithoutToolCallReuse;
+    private automaticProtectionEgressGrantKey;
+    private deletePendingIngressApproval;
+    private logReviewSafely;
+    private warnDetectionFailure;
+    private failOpen;
+    private approvalTimedOut;
+    protected auditSensitiveProtection(action: SensitiveProtectionAuditAction, request: SensitiveReviewRequest, detail?: Omit<SensitiveProtectionAuditDetail, 'sessionId' | 'toolCallId' | 'source' | 'direction'>): void;
+    private auditFailure;
+    private logReview;
+    private allowAndProtect;
+    private registerAutomaticProtectionGrants;
+    private filterAutomaticProtectionEgress;
+    private filterSessionOriginal;
+    private reuseSessionProtection;
+    private getToolCallIngressApproval;
+    private rememberToolCallIngressApproval;
+    private forgetToolCallIngressApproval;
+    private toolCallIngressApprovalKey;
+    private pruneToolCallIngressApprovals;
+    private excludeDetectedPlaintexts;
+    private allowedChoicesForDetection;
+    private grantSessionId;
+    private createAllowAndProtectDecision;
+    private isValidDetection;
+    private isCleanDetection;
+    private resolveCleanFileDetectionCandidate;
+    private hasCleanFileDetection;
+    private rememberCleanFileDetection;
+    protected monotonicNowMs(): number;
+    private isUnsupportedDetection;
+    private cancelled;
+    private accessDenied;
+    private approvalTimedOutDecision;
+    private protectionFailed;
+    private getDeniedDecisionScopeReason;
+    private rememberDeniedDecisionScope;
+    private deniedDecisionScopeKey;
+    private pruneDeniedDecisionScopes;
+    private deny;
+}

package/cli/dist-server/types/node/sensitive-content/sensitive-history-admission.d.ts

@@ -0,0 +1,42 @@
+import { AgentInputItemProcessor, AgentInputItemProcessorPriority, type Session } from '../../vendor/cbc-core/node/index.js';
+import type { AgentInputItem } from '../../vendor/cbc-shared/node/index.js';
+import { type CipherEntry, type SensitiveUserInputReview as SensitiveUserInputReviewInterface, type SensitiveUserInputReviewDecision } from './sensitive-content-protocol';
+/**
+ * Carry an already-completed current-input approval to the history admission point and project
+ * protected plaintext immediately. The same item is consumed by the SDK runner before addHistory,
+ * so delaying replacement until persistence would leave the current turn plaintext in the first
+ * model request. ACP has already published the user-visible plaintext optimistically; replay later
+ * restores user history locally from this ciphertext-backed projection.
+ */
+export declare function markSensitiveUserInputReviewed(item: AgentInputItem, decision: Extract<SensitiveUserInputReviewDecision, {
+    kind: 'allow';
+}>): void;
+/** Clone an optimistically published user item before history admission mutates its projection. */
+export declare function cloneForSensitiveHistoryAdmission(item: AgentInputItem): AgentInputItem;
+/**
+ * Final admission processor for history-backed model input.
+ *
+ * FunctionCallResult normalization runs first. This processor then protects the canonical Tool/MCP
+ * result fields before the item enters session.history or JSONL. It also consumes the current user
+ * approval prepared by ACP/the generic run interceptor, with a direct-addHistory fallback.
+ */
+export declare class SensitiveHistoryAdmissionProcessor implements AgentInputItemProcessor {
+    priority: AgentInputItemProcessorPriority;
+    protected readonly review: SensitiveUserInputReviewInterface;
+    private readonly pendingRuntimeCalls;
+    process(item: AgentInputItem, session: Session): Promise<void>;
+    private protectRuntimeSuppliedValues;
+    private finalizeRuntimeToolResult;
+}
+/**
+ * Project admitted Tool/MCP results onto the provider request copy.
+ *
+ * The OpenAI Agents streaming loop owns a detached copy of tool results, so mutating the item
+ * received by SessionManager is not sufficient by itself. This call-id projection is applied at
+ * the final model transport boundary after history admission has completed. It performs no rule
+ * detection: only already-approved cipher mappings or explicit withhold decisions are replayed.
+ */
+export declare function projectSensitiveToolResultsForModel<T>(session: Session, source: T): {
+    value: T;
+    entries: CipherEntry[];
+};

package/cli/dist-server/types/node/sensitive-content/sensitive-history-replay.d.ts

@@ -0,0 +1,6 @@
+import type { AgentInputItem } from '../../vendor/cbc-shared/node/index.js';
+/**
+ * Build the UI-only replay projection from item-local mappings.
+ * Model-visible fields remain ciphertext-backed; missing or conflicting mappings stay encrypted.
+ */
+export declare function restoreSensitiveHistoryForReplay(history: readonly AgentInputItem[]): AgentInputItem[];

package/cli/dist-server/types/node/sensitive-content/sensitive-local-sideband.d.ts

@@ -0,0 +1,21 @@
+import type { CipherEntry, SensitiveProtectionMetadata } from './sensitive-content-protocol';
+export declare const CODEBUDDY_LOCAL_KEY = "__codebuddyLocal";
+export interface SensitiveLocalSideband {
+    sensitiveProtection?: SensitiveProtectionMetadata;
+    sensitiveDisplayText?: string;
+    sensitiveUserInputReviewed?: true;
+}
+/** Pair the detached history copy with the SDK item that will feed the next model request. */
+export declare function linkSensitiveRuntimeProjection(historyItem: object, runtimeItem: object): void;
+export declare function getSensitiveRuntimeProjection(historyItem: object): object | undefined;
+/** Consume the pair once at history admission so runtime plaintext cannot outlive tool execution. */
+export declare function takeSensitiveRuntimeProjection(historyItem: object): object | undefined;
+export declare function getSensitiveLocalSideband(value: unknown): SensitiveLocalSideband | undefined;
+export declare function setSensitiveLocalSideband(target: unknown, patch: SensitiveLocalSideband): void;
+export declare function clearSensitiveLocalSideband(target: unknown): void;
+export declare function collectSensitiveLocalCiphertexts(source: unknown): string[];
+/** Collect complete local cipher mappings without querying Sandbox Center. */
+export declare function collectSensitiveLocalEntries(source: unknown): CipherEntry[] | undefined;
+export declare function collectSensitiveLocalMetadata(source: unknown, collect: (candidate: unknown) => void): void;
+/** Remove every CodeBuddy-local field at the final provider boundary. */
+export declare function stripCodebuddyLocalFields<T>(source: T): T;

package/cli/dist-server/types/node/sensitive-content/sensitive-model-boundary.d.ts

@@ -0,0 +1,22 @@
+import { type CipherEntry, type SensitiveModelBoundary as SensitiveModelBoundaryInterface, type SensitiveToolCallReviewInputProjection } from './sensitive-content-protocol';
+export declare class SensitiveModelBoundaryImpl implements SensitiveModelBoundaryInterface {
+    private readonly registry;
+    getToolCallReviewInputProjection(sessionId: string, toolCallId: string): SensitiveToolCallReviewInputProjection | undefined;
+    protectRequest(request: {
+        sessionId: string;
+        body: string;
+        ciphertexts?: readonly string[];
+        entries?: ReadonlyArray<Readonly<CipherEntry>>;
+        signal?: AbortSignal;
+    }): Promise<string>;
+    wrapModel<T>(model: T, sessionId: string, captureReviewInput?: boolean): T;
+    private prepareModelRequest;
+    private restoreRawModelStreamEvent;
+    private restoreStructured;
+    private restoreText;
+    private withProtectionMetadata;
+    private register;
+    private captureToolCallReviewInput;
+    private entries;
+    private prune;
+}

package/cli/dist-server/types/node/sensitive-content/sensitive-protection-metadata.d.ts

@@ -0,0 +1,7 @@
+import type { CipherEntry, SensitiveCipherProtectionMetadata, SensitiveProtectionMetadata } from './sensitive-content-protocol';
+export declare function sanitizeSensitiveProtectionMetadata(content: string, candidate: unknown): SensitiveProtectionMetadata | undefined;
+/** Merge same-version sidebands. A runtime plaintext range wins over persisted ciphertext metadata. */
+export declare function mergeSensitiveProtectionMetadataCandidates(...candidates: unknown[]): SensitiveProtectionMetadata | undefined;
+export declare function collectSensitiveProtectionMetadataCandidates(source: unknown): unknown[];
+export declare function createSensitiveProtectionMetadata(content: string, entries: ReadonlyArray<Readonly<CipherEntry>>, ruleNames?: readonly string[]): SensitiveCipherProtectionMetadata | undefined;
+export declare function mergeSensitiveProtectionMetadata(content: string, ...candidates: unknown[]): SensitiveProtectionMetadata | undefined;

package/cli/dist-server/types/node/sensitive-content/sensitive-session-grants.d.ts

@@ -0,0 +1,41 @@
+import type { CipherEntry } from './sensitive-content-protocol';
+/**
+ * Remembers explicit ingress choices for the lifetime of this process. Grants
+ * are isolated by logical session ID and never persist the sensitive plaintext
+ * itself.
+ */
+export declare class SensitiveSessionGrants {
+    private readonly fallbackFingerprintSecret;
+    private readonly sessions;
+    /**
+     * Trusted automatic-protection provenance is deliberately separate from user grants.
+     * Recording it must never suppress a foreground ingress approval; it is consumed only by
+     * explicitly opted-in egress destinations.
+     */
+    private readonly automaticProtectionSessions;
+    private readonly executionSessions;
+    /** Builds stable per-value opaque fingerprints for subset comparisons. */
+    fingerprintPlaintexts(sessionId: string, plaintexts: readonly string[]): string[];
+    /** Builds an order-independent opaque cache key whose value does not contain plaintext. */
+    fingerprintPlaintextSet(sessionId: string, plaintexts: readonly string[]): string;
+    /** Builds a worker-stable key used only for automatic-protection egress reuse. */
+    fingerprintAutomaticProtection(sessionId: string, plaintext: string): string;
+    filterOriginal(sessionId: string, plaintexts: readonly string[]): string[];
+    hasAllProtected(sessionId: string, plaintexts: readonly string[]): boolean;
+    filterProtected(sessionId: string, plaintexts: readonly string[]): string[];
+    matchesAllProtected(sessionId: string, entries: ReadonlyArray<Readonly<CipherEntry>>): boolean;
+    rememberOriginal(sessionId: string, plaintexts: readonly string[]): void;
+    rememberProtected(sessionId: string, entries: ReadonlyArray<Readonly<CipherEntry>>): void;
+    rememberAutomaticallyProtected(sessionId: string, entries: ReadonlyArray<Readonly<CipherEntry>>): void;
+    filterAutomaticallyProtected(sessionId: string, plaintexts: readonly string[]): string[];
+    hasAllExecution(sessionId: string, decisionScopeId: string | undefined, destinationKey: string | undefined, plaintexts: readonly string[]): boolean;
+    rememberExecution(sessionId: string, decisionScopeId: string | undefined, destinationKey: string | undefined, plaintexts: readonly string[]): void;
+    forget(sessionId: string, plaintexts: readonly string[]): void;
+    private remember;
+    private touchSession;
+    private touchExecutionSession;
+    private executionFingerprint;
+    private fingerprint;
+    private fingerprintSecret;
+}
+export declare function getProcessSensitiveSessionGrants(): SensitiveSessionGrants;

package/cli/dist-server/types/node/sensitive-content/sensitive-tool-egress-guard.d.ts

@@ -0,0 +1,7 @@
+import { type SensitiveContentMediation as SensitiveContentMediationInterface, type SensitiveEgressReusePolicy as SensitiveEgressReusePolicyInterface, type SensitiveProtectionPolicy as SensitiveProtectionPolicyInterface, type SensitiveToolEgressGuard as SensitiveToolEgressGuardInterface, type ToolEgressDecision, type ToolEgressReviewRequest } from './sensitive-content-protocol';
+export declare class SensitiveToolEgressGuardImpl implements SensitiveToolEgressGuardInterface {
+    protected readonly protectionPolicy?: SensitiveProtectionPolicyInterface;
+    protected readonly mediation?: SensitiveContentMediationInterface;
+    protected readonly egressReusePolicy?: SensitiveEgressReusePolicyInterface;
+    authorize(request: ToolEgressReviewRequest): Promise<ToolEgressDecision>;
+}

package/cli/dist-server/types/node/sensitive-content/sensitive-user-input-review.d.ts

@@ -0,0 +1,7 @@
+import { type SensitiveDecisionMediation as SensitiveDecisionMediationInterface, type SensitiveProtectionPolicy as SensitiveProtectionPolicyInterface, type SensitiveUserInputReview as SensitiveUserInputReviewInterface, type SensitiveUserInputReviewDecision, type SensitiveUserInputReviewRequest } from './sensitive-content-protocol';
+export declare class SensitiveUserInputReviewImpl implements SensitiveUserInputReviewInterface {
+    protected readonly protectionPolicy?: SensitiveProtectionPolicyInterface;
+    protected readonly decisionMediation?: SensitiveDecisionMediationInterface;
+    review(request: SensitiveUserInputReviewRequest): Promise<SensitiveUserInputReviewDecision>;
+    private deny;
+}

package/cli/dist-server/types/node/sensitive-content/settings-sensitive-protection-policy.d.ts

@@ -0,0 +1,14 @@
+import { type SessionManager as SessionManagerInterface } from '../../vendor/cbc-core/node/index.js';
+import { type SettingsManager as SettingsManagerInterface } from '../settings/settings-protocol';
+import { type SensitiveProtectionPolicy as SensitiveProtectionPolicyInterface } from './sensitive-content-protocol';
+export declare class SettingsSensitiveProtectionPolicy implements SensitiveProtectionPolicyInterface {
+    protected readonly settingsManager: SettingsManagerInterface;
+    protected readonly sessionManager: SessionManagerInterface;
+    isEnabled(request?: {
+        sessionId?: string;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+    /** fullAccess is the per-session equivalent of disabling sensitive protection. */
+    private isFullAccessSession;
+    private isFullAccess;
+}

package/cli/dist-server/types/node/server/types.d.ts

@@ -6,7 +6,7 @@
  */
 import type { SessionNotification } from '@agentclientprotocol/sdk-server';
 import type { UpdateSessionNotification } from '@agentclientprotocol/sdk-server/experimental/v2';
-import type { AgentPhaseInfo, CanUseTool, CombineEvent, SessionKey, SubagentEventReference, SubagentTokenUsageSnapshot, TranscriptStore as SessionStore } from '../../vendor/cbc-core/node/index.js';
+import type { AgentPhaseInfo, CanUseTool, CombineEvent, ModsBridge, SessionKey, SubagentEventReference, SubagentTokenUsageSnapshot, TranscriptStore as SessionStore } from '../../vendor/cbc-core/node/index.js';
 import type { AgentInputItem, ResponseStreamEvent, RunStreamEvent } from '../../vendor/cbc-shared/node/index.js';
 import type { Command, ProductConfiguration, Skill } from '../../workspace/product/lib/common/index.js';
 import type { RunAccount, RunAuth } from '../authentication/run-context';
@@ -142,7 +142,14 @@ export type QueryInput = string | unknown[] | {
     readonly type: 'compact';
 };
 export interface QueryOptions {
-    /** W3C trace context and baggage captured for this individual query. */
+    /**
+     * Opaque request metadata, captured for this query. The reserved W3C keys
+     * propagate through this request and its children using the turn context.
+     * Unknown extensions do not become session settings or arbitrary HTTP headers.
+     * `baggage: 'x-agent-intent=ask'` supplies attribution, not permissions.
+     * Host baggage and intent mapping are sent only to built-in model endpoints.
+     * The legacy `codebuddy.ai.mode` extension fills the scene only when baggage does not supply it.
+     */
     _meta?: Record<string, unknown> | null;
     /**
      * Working directory for the session. Defaults to process.cwd().
@@ -370,6 +377,8 @@ export interface QueryOptions {
      * Child work inherits its originating run's snapshot. Callbacks are never persisted.
      */
     hooks?: QueryHooks;
+    /** Host-owned functional hooks bridge. Captured per query; never persisted. */
+    mods?: ModsBridge;
 }
 export type StopReason = 'completed' | 'aborted' | 'error';
 export interface QueryResult {

package/cli/dist-server/types/node/session/index.d.ts

@@ -0,0 +1,15 @@
+export * from '../../vendor/cbc-core/node/index.js';
+export * from './session-middleware';
+export * from './session-http-protocol';
+export * from './session-abort-middleware';
+export * from './input-item-processors';
+export * from './session-history-clean-service';
+export * from './input-history-service';
+export * from './session-controller';
+export * from './tasks-controller';
+export * from './session-host-adapter';
+export * from './session-manager-host-adapter';
+export * from './session-interruption-host-adapter';
+export * from './session-hook-host-adapter';
+export * from './session-store-host-adapter';
+export * from './session-response-host-adapter';

package/cli/dist-server/types/node/session/input-history-service.d.ts

@@ -0,0 +1,47 @@
+import { Logger } from '@celljs/core';
+import { InputHistoryItem, InputHistoryService } from '../../vendor/cbc-core/node/index.js';
+import { LocalStorage } from '../../workspace/runtime/lib/common/index.js';
+import { WorkspaceFolderManager } from '../runtime';
+export declare class InputHistoryServiceImpl implements InputHistoryService {
+    protected readonly logger: Logger;
+    protected readonly workspaceFolderManager: WorkspaceFolderManager;
+    protected readonly localStorage: LocalStorage;
+    private writeLock;
+    private readonly maxHistorySize;
+    private readonly localStorageKey;
+    private cleanupTimer;
+    private readonly cleanupDelay;
+    private lastHistoryItem;
+    /**
+     * Get the history file path
+     */
+    private getHistoryFilePath;
+    /**
+     * Read the history file
+     */
+    private readHistoryFile;
+    /**
+     * Write the history file
+     */
+    private writeHistoryFile;
+    /**
+     * Get legacy history from localStorage (compatibility support)
+     */
+    private getLegacyHistoryFromLocalStorage;
+    /**
+     * Incrementally append history item to the end of file
+     */
+    private appendHistoryItem;
+    /**
+     * Schedule cleanup task (debounced)
+     */
+    private scheduleCleanup;
+    /**
+     * Periodically clean up excess history records
+     * This method first quickly checks file size and only performs cleanup when necessary
+     */
+    private cleanupExcessHistory;
+    addHistory(item: Omit<InputHistoryItem, 'timestamp' | 'project'>): Promise<void>;
+    getHistoryForProject(limit?: number): Promise<InputHistoryItem[]>;
+    cleanupHistory(olderThanDays?: number): Promise<void>;
+}

package/cli/dist-server/types/node/session/input-item-processors.d.ts

@@ -0,0 +1,70 @@
+import { AgentInputItemProcessor, AgentInputItemProcessorPriority, Session } from '../../vendor/cbc-core/node/index.js';
+import { type AgentInputItem } from '../../vendor/cbc-shared/node/index.js';
+import { ProductManager } from '../../workspace/product/lib/common/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import { ConsoleManager } from '../console';
+import { TelemetryService } from '../telemetry/telemetry-protocol';
+import { ToolCallArgumentRenderer, ToolManager } from '../tools';
+import { PlanStorageService } from '../tools/plan-storage-service';
+type WorkflowSourceResolverType = import('../../workspace/cbc-workflow/lib/node/index.js').WorkflowSourceResolver;
+export declare class ProductAgentInputItemProcessor implements AgentInputItemProcessor {
+    priority: number;
+    protected readonly productManager: ProductManager;
+    process(rawItem: AgentInputItem, session: Session): Promise<void>;
+}
+export declare class McpUiHistoryInputItemProcessor implements AgentInputItemProcessor {
+    priority: number;
+    process(rawItem: AgentInputItem): Promise<void>;
+}
+export declare class FunctionCallAgentInputItemProcessor implements AgentInputItemProcessor {
+    priority: AgentInputItemProcessorPriority;
+    protected readonly toolManager: ToolManager;
+    protected readonly logger: Logger;
+    /**
+     * Headless / 测试场景下 WorkflowSourceResolver 不一定注入(workflow 模块未启用)。
+     * 缺失时跳过预解析,UI 走"saved workflow: <name>"降级文案。
+     */
+    protected readonly workflowSourceResolver?: WorkflowSourceResolverType;
+    protected parseDisplayText(args: any, renderer?: ToolCallArgumentRenderer): string | undefined;
+    process(rawItem: AgentInputItem): Promise<void>;
+    /**
+     * 仅当 (1) 是 DeferExecuteTool(Workflow) 调用且 (2) WorkflowSourceResolver 已注入时,
+     * 主动 resolve 一次脚本,把 text 写到 providerData.workflowSourceText。
+     *
+     * 解析失败不影响主流程:UI 拿不到 text 就退化到"saved workflow: <name>"单行展示。
+     * 不抛异常,因为本函数是审批 UI 的最佳努力增强,不是关键路径。
+     */
+    private maybePreloadWorkflowSource;
+}
+/**
+ * `chat_tool_action` 的统一生命周期出口。
+ *
+ * 工具结果只有进入 addHistory 的 processor 链后，状态、错误信息和请求关联字段才已
+ * 完整落定。流式、非流式、权限拒绝与取消恢复都会经过这里；因此不再借用下一次
+ * `ModelProvider.getModel()` 的调用时机上报。
+ */
+export declare class ToolActionTelemetryInputItemProcessor implements AgentInputItemProcessor {
+    priority: AgentInputItemProcessorPriority;
+    protected readonly telemetryService: TelemetryService;
+    protected readonly logger: Logger;
+    private readonly reportedKeys;
+    process(rawItem: AgentInputItem, session: Session): Promise<void>;
+}
+export declare class DisplayTextPolishProcessor implements AgentInputItemProcessor {
+    priority: AgentInputItemProcessorPriority;
+    /**
+     * 把 function_call_result 的 renderer.value 统一转成显示就绪文本（剥 OSC/DCS、
+     * 非 SGR 控制序列与字符集控制，折 \r 重画；SGR 颜色保留）。
+     * renderer.value 是纯展示字段（llmContent/output 不经过这里），在入库口统一收口，
+     * 上屏层（TUI / web-ui）拿到的即最终文本。流式帧不进本链，由 ShellStreamPusher
+     * 在推送时做同一转换。
+     */
+    process(rawItem: AgentInputItem, _session: Session): Promise<void>;
+}
+export declare class ExitPlanModeInputItemProcessor implements AgentInputItemProcessor {
+    priority: AgentInputItemProcessorPriority;
+    protected readonly consoleManager: ConsoleManager;
+    protected readonly planStorageService: PlanStorageService;
+    process(rawItem: AgentInputItem, session: Session): Promise<void>;
+}
+export {};

package/cli/dist-server/types/node/session/session-abort-middleware.d.ts

@@ -0,0 +1,22 @@
+import { PathResolver } from '@celljs/web';
+import { Context, Middleware, RequestMatcher } from '@celljs/web/lib/node';
+import { SessionManager } from '../../vendor/cbc-core/node/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+/**
+ * Middleware that monitors HTTP connection and aborts session when client disconnects
+ *
+ * This middleware runs after SessionMiddleware (which creates/loads the session)
+ * and sets up a 'close' event listener on the HTTP request to detect client disconnection.
+ *
+ * When the client disconnects (e.g., closes connection, times out, or crashes),
+ * the session's AbortController is triggered to cancel ongoing agent execution.
+ */
+export declare class SessionAbortMiddleware implements Middleware {
+    readonly priority: number;
+    protected readonly requestMatcher: RequestMatcher;
+    protected readonly pathResolver: PathResolver;
+    protected readonly sessionManager: SessionManager;
+    protected readonly logger: Logger;
+    handle(ctx: Context, next: () => Promise<void>): Promise<void>;
+    private canHandle;
+}

package/cli/dist-server/types/node/session/session-controller.d.ts

@@ -0,0 +1,126 @@
+/**
+ * API v1 — Sessions
+ *
+ * 公开 REST API 端点：
+ *   GET    /api/v1/sessions             → 返回会话列表（支持 cwd 查询参数控制查询范围）
+ *   DELETE /api/v1/sessions/:id         → 删除指定会话
+ *   POST   /api/v1/sessions/:id/rename  → 重命名指定会话
+ *
+ * 已废弃端点（保留向下兼容）：
+ *   GET    /api/v1/sessions/across-projects → 使用 GET /api/v1/sessions?cwd=* 代替
+ *   GET    /api/v1/sessions/workspaces      → 使用 GET /api/v1/sessions?cwd=* 代替
+ */
+export declare class SessionController {
+    private readonly sessionManager;
+    private readonly storage;
+    private readonly agentService;
+    private readonly acpAgentManager?;
+    private readonly acpStreamManager?;
+    /**
+     * 检查历史是否为空（只包含系统自动生成的消息，如 /clear 命令的消息）
+     */
+    private isEmptyHistory;
+    /**
+     * GET /api/v1/sessions → 返回会话列表
+     *
+     * Query params:
+     *   - cwd?: string  工作目录参数：
+     *     - 不传：返回当前工作空间的会话
+     *     - 指定目录：返回该工作空间的会话
+     *     - '*'：返回所有工作空间的会话
+     *   - projectId?: string  按压缩工作目录名过滤特定项目（仅当 cwd=* 时有效）
+     */
+    list(): Promise<void>;
+    getLiveSession(): Promise<void>;
+    /**
+     * GET /api/v1/sessions/across-projects → 返回所有工作目录的会话列表（已废弃，使用 GET /api/v1/sessions?cwd=* 代替）
+     *
+     * 为了向下兼容性保留
+     *
+     * Query params:
+     *   - projectId?: string  按压缩工作目录名过滤特定项目
+     */
+    listAcrossProjects(): Promise<void>;
+    /**
+     * GET /api/v1/sessions/workspaces → 返回已知工作区列表（已废弃，使用 GET /api/v1/sessions?cwd=* 代替）
+     *
+     * 扫描 ~/.codebuddy/projects/ 下所有项目目录，
+     * 从每个项目的会话文件中提取原始 cwd，返回去重后的工作区列表。
+     *
+     * 为了向下兼容性保留
+     */
+    listWorkspaces(): Promise<void>;
+    /**
+     * GET /api/v1/sessions/pins?cwd= → { pinned: string[] }
+     *
+     * 置顶集合按项目目录分片，与会话文件同处一个目录。
+     */
+    getPins(cwd?: string): Promise<void>;
+    /**
+     * PUT /api/v1/sessions/pins?cwd= ← { sessionId, pinned } → { pinned: string[] }
+     */
+    putPins(cwd: string | undefined, body: {
+        sessionId?: string;
+        pinned?: boolean;
+    }): Promise<void>;
+    /**
+     * DELETE /api/v1/sessions/:id → 删除指定会话
+     *
+     * 查询参数：
+     *   ?cwd=PATH 该会话所属项目目录，传入时一并清理它在该项目下的置顶记录。
+     */
+    remove(id: string, cwd?: string): Promise<void>;
+    /**
+     * POST /api/v1/sessions/:id/rename → 重命名指定会话
+     * 请求体: { name: string }
+     */
+    rename(id: string, body: {
+        name?: string;
+    }): Promise<void>;
+    /**
+     * GET /api/v1/sessions/:id/history → 返回会话的对话历史摘要
+     *
+     * 为 Pulse 灵感生成系统设计，返回每个 user→assistant 对的精炼信息。
+     * 不返回完整消息内容，只返回 Stage 1 信号提取所需的三要素。
+     *
+     * Response:
+     * {
+     *   sessionId: string,
+     *   name: string,
+     *   requests: Array<{
+     *     userInput: string,
+     *     finalReply: string
+     *   }>
+     * }
+     */
+    getHistory(id: string): Promise<void>;
+    /**
+     * GET /api/v1/sessions/:id/replay → 返回可直接回放到 UI 的完整事件序列
+     *
+     * 返回值复用 ACP loadSession 的 replay 组装逻辑，但不要求建立 ACP 连接。
+     * desktop 可直接消费这些事件，避免为了查看历史而拉起完整 session runtime。
+     *
+     * 查询参数：
+     *   ?limit=N  显式指定 session history 加载上限（item 数）。
+     *             不传则走 SessionStore 的默认上限（见 SESSION_HISTORY_DEFAULT_LIMIT）。
+     *             由调用方（如 Desktop）根据自身展示需求决定；agent-cli 本身不硬编码
+     *             "展示型"具体数值，避免共享代码反向依赖特定宿主产品的 UI 约束。
+     *   ?cwd=PATH 优先从该工作目录对应的 project 历史文件读取，避免跨 project 扫描。
+     */
+    getReplay(id: string, limit?: string, cwd?: string): Promise<void>;
+    replySession(id: string, body: {
+        text?: string;
+    }): Promise<void>;
+    private resolveLiveSessionFollow;
+    /**
+     * Extract projectId (compressed working directory name) from a session.
+     * Looks for the first history item with a cwd field and compresses it.
+     */
+    private extractProjectId;
+    private extractCwd;
+    /**
+     * Extract cwd from the first session file in a project directory.
+     * Reads only the first line of the first .jsonl file to minimize I/O.
+     */
+    private extractCwdFromProjectDir;
+}

package/cli/dist-server/types/node/session/session-history-clean-flag.d.ts

@@ -0,0 +1,2 @@
+export declare const ENV_KEY_CODEBUDDY_DISABLE_SESSION_HISTORY_CLEANUP = "CODEBUDDY_DISABLE_SESSION_HISTORY_CLEANUP";
+export declare function isSessionHistoryCleanupDisabled(envValue?: string | undefined): boolean;