@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/node/tools/agent-tool.d.ts

@@ -0,0 +1,202 @@
+import { type Session } from '../../vendor/cbc-core/node/index.js';
+import { FunctionCallItem, ToolNames } from '../../vendor/cbc-shared/node/index.js';
+import { type ICwdService, type IWorktreeChangeDetector, type IWorktreeService } from '../../workspace/cbc-worktree/lib/node/index.js';
+import { EventService, Logger } from '../../workspace/telemetry/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { ConsoleManager } from '../console';
+import { BaseTool } from './base-tool';
+import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
+/** Override for the synchronous sub-agent wall-clock budget (positive integer ms). */
+export declare const ENV_SUBAGENT_TIMEOUT_MS = "CODEBUDDY_SUBAGENT_TIMEOUT_MS";
+export declare class AgentTool extends BaseTool implements Tool {
+    protected readonly logger: Logger;
+    protected readonly consoleManager: ConsoleManager;
+    protected readonly eventService: EventService;
+    protected readonly cwdService: ICwdService;
+    protected readonly worktreeService: IWorktreeService;
+    protected readonly worktreeChangeDetector: IWorktreeChangeDetector;
+    private teamSpawnChain;
+    /** 串行化团队 spawn；当前项失败返回调用方，但不污染后续队列。 */
+    private enqueueTeamSpawn;
+    name: ToolNames;
+    readonly promptCacheStability: "volatile";
+    /**
+     * Tool schema is a **method** (not a static object) so ToolManager.get()
+     * re-evaluates it per invocation and reflects the current process env.
+     * This is how we hide `run_in_background` from the model when
+     * `CODEBUDDY_CODE_DISABLE_BACKGROUND_TASKS` is truthy (issue #63114 — in
+     * request-response SDK / print-mode consumers, background agent results
+     * cannot flow back into the lead's final answer, so the host disables the
+     * whole capability instead of shipping half a feature).
+     *
+     * The runtime guard in `execute()` still ignores `run_in_background=true`
+     * from stale/cached tool calls that bypass this schema.
+     */
+    parameters(): z.ZodTypeAny;
+    private buildParametersSchema;
+    argumentRenderer: ToolCallArgumentRenderer;
+    needsApproval: boolean;
+    /**
+     * Auto mode classifier projection: `(${subagent_type}, mode=${mode}): ${prompt}`
+     * (Claude alignment, decision D1). The sub-agent prompt is projected so a
+     * delegated dangerous action is visible to the classifier (delegation-bypass
+     * defense). NOTE: CodeBuddy's Agent tool has `needsApproval = false`, so the
+     * current action never reaches the classifier directly — this projection is
+     * consumed when an Agent call appears in the history transcript.
+     */
+    toAutoClassifierInput(input: unknown): string;
+    execute(input: any, context?: RunContext<Session>, details?: {
+        toolCall: FunctionCallItem;
+    }): Promise<ToolResult>;
+    /**
+     * 将 Agent 工具执行异常映射到 19920 段细分错误码。
+     */
+    private classifyAgentError;
+    /**
+     * Classify an error thrown out of `task.execute()` on a synchronous sub-agent.
+     *
+     * Timeout is matched by error type; the abort/interruption flags stay
+     * substring-based for the pre-existing abort sentinels.
+     */
+    private static classifySubagentFailure;
+    /**
+     * Tool result handed back to the parent agent when a synchronous sub-agent
+     * spent its wall-clock budget, so the parent can adapt instead of hanging.
+     *
+     * Carries the same durable sub-agent link (`ToolResult.subAgent`) as the
+     * interrupted branch below: the failed run already exposed it through
+     * `task.getResult()`, and dropping it would leave the timed-out call with no
+     * child-transcript link, no lifecycle descriptor and no session id.
+     */
+    private static buildTimeoutResult;
+    /**
+     * Wall-clock budget that actually fired, in seconds; `undefined` when it
+     * cannot be recovered.
+     *
+     * Prefers the value carried on the `SubagentWallClockTimeoutError` so the
+     * message can never disagree with the budget that was armed; falls back to a
+     * live env read for dual-dist builds where the error arrived from a second
+     * copy of the module and only its `name` matched.
+     *
+     * Rounded to a whole second but never below 1: a sub-second budget (e.g.
+     * `CODEBUDDY_SUBAGENT_TIMEOUT_MS=400`) would otherwise read "timed out after 0s".
+     */
+    private static timeoutSecondsOf;
+    /**
+     * Resolve the wall-clock budget for synchronous sub-agents from
+     * `CODEBUDDY_SUBAGENT_TIMEOUT_MS` — same family as the other sub-agent
+     * guardrails (`CODEBUDDY_CODE_SUBAGENT_MAX_TURNS` et al.): operator-set env,
+     * live-read from `process.env` (prewarm contract).
+     *
+     * **Opt-in**: unset, empty, unusable (non-numeric / non-positive) or above
+     * {@link MAX_SUBAGENT_TIMEOUT_MS} → no watchdog, i.e. the previous
+     * wait-forever behaviour, so unrelated scenarios are unaffected. The upper
+     * bound is load-bearing: Node clamps an oversized `setTimeout` delay to 1 ms,
+     * which would abort the sub-agent instantly instead of never timing out.
+     */
+    private static resolveSubagentTimeoutMs;
+    /**
+     * Generate an auto-name for a background agent: "{agentType}-{seq}"
+     * e.g. "explore-1", "explore-2", "plan-1"
+     */
+    private generateBackgroundAgentName;
+    /**
+     * Resolve a member name that is unique within `teamName` (checked against
+     * the in-memory TeamMemberRegistry). If `desired` already exists, append a
+     * short random hex suffix and retry — aligns with TeamCreate's "rename on
+     * conflict" idempotency strategy and prevents a leftover/stale teammate
+     * (e.g. a `critic` from a finished team) from blocking new background
+     * agent spawns with misleading "already active" errors.
+     */
+    private resolveUniqueMemberName;
+    /**
+     * Ensure the lead is in a team before spawning a named/background member.
+     * Named Agent() from Code Mode must not require a prior TeamCreate.
+     */
+    private ensureTeamForSpawn;
+    /**
+     * Spawn a background agent as a team member in an auto-created team.
+     *
+     * This replaces the old "implicit team" approach. Instead of ad-hoc
+     * TeamMember + setAgentTask() + ensureInboxPolling(), we:
+     * 1. Auto-create a team via TeamManager (if not already in one)
+     * 2. Spawn the agent using TeamMember.spawn() for full lifecycle support
+     * 3. Register with TeamManager for persistence to config.json
+     */
+    private spawnBackgroundAgent;
+    /**
+     * Spawn a teammate in the current active team.
+     * Teammates always run in detached + background mode.
+     * If the lead is not in a team yet, auto-create one (same as background Agent).
+     */
+    private spawnTeammate;
+    /**
+     * Cleanup agent worktree after task completion.
+     * - No changes: auto-delete worktree, return removal message
+     * - Has changes: preserve worktree, return info message
+     *
+     * Message format aligned with Claude Code:
+     * - No changes: "Worktree removed (no changes)"
+     * - Has changes: "Worktree preserved at ${path} on branch: ${branch}"
+     */
+    private cleanupAgentWorktree;
+    /**
+     * Spawn a Fork subagent that inherits the parent agent's full context.
+     * Reuses spawnBackgroundAgent() with agentType='fork', which is recognized
+     * by AgentTask.setupPhase() to inherit the default agent definition.
+     */
+    private spawnForkAgent;
+    private backgroundSubAgentMeta;
+    /**
+     * Execute a Fork subagent synchronously (blocking).
+     * Same as standard sync sub-agent but uses AgentNames.FORK so that
+     * AgentTask.setupPhase() inherits the default agent definition and
+     * setupSubAgentSession() injects parent conversation history.
+     */
+    private executeSyncForkAgent;
+    /**
+     * Build the fork child's prompt by prepending behavioral rules.
+     * The <fork-boilerplate> tag serves dual purpose:
+     * 1. Behavioral instructions for the fork child
+     * 2. Marker for isInForkChild() recursive fork prevention
+     */
+    private buildForkChildPrompt;
+    /**
+     * Check if the current execution context is inside a Fork child.
+     * Two-layer defense:
+     * 1. Session meta: check if agentName === 'fork'
+     * 2. Message scan: check for <fork-boilerplate> tag in session history
+     */
+    private isInForkChild;
+    private getAgentManager;
+    /**
+     * Enforces `CODEBUDDY_DISABLE_BUILTIN_SUBAGENTS` (issue #99451) for a
+     * built-in-disableable `subagent_type`. Throws unless a custom OR plugin
+     * agent overrides it (matching tool-manager.ts's exposure-layer check —
+     * see that file's `CUSTOM_AGENT_TAG || PLUGIN_AGENT_TAG` filter).
+     *
+     * Deliberately reads tags via `AgentManager.getAgentConfig()` rather than
+     * `CustomAgentManager.get()`: the latter's `loadCustomAgents()` filters
+     * out anything tagged `PLUGIN_AGENT_TAG`, so a plugin-provided override
+     * would be misreported as absent here — a "shown in the tool catalog but
+     * blocked at runtime" bug that existed in the original CustomAgentManager
+     * -based check.
+     */
+    private assertBuiltinSubagentOverrideAllowed;
+    /**
+     * 上报插件 subagent 能力调用埋点。
+     * Agent 的 tags 格式为 [CLI_AGENT_TAG, CUSTOM_AGENT_TAG, PLUGIN_TAG, source]，
+     * 其中 source 形如 "pluginName@marketplaceName"。
+     * 仅在 WorkBuddy Desktop 宿主下上报。
+     */
+    private reportPluginAgentCall;
+    /**
+     * Build the optional `subAgent` slice on the returned ToolResult — present
+     * when AgentTask recorded a stable child session identity. `lastId` remains
+     * optional because an empty run still has observable lifecycle state even
+     * though it contributes no nested transcript items. Spread
+     * `...AgentTool.subAgentMetaOf(executionResult)` at the call site.
+     */
+    private static subAgentMetaOf;
+}

package/cli/dist-server/types/node/tools/artifact-control-tool.d.ts

@@ -0,0 +1,103 @@
+import { AuthenticationManager } from '../../workspace/authentication/lib/common/index.js';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { Agent, ToolNames } from '../../vendor/cbc-shared/node/index.js';
+import { AbTestService, ProductManager } from '../../workspace/product/lib/common/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { BaseTool } from './base-tool';
+import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
+/**
+ * ArtifactControl 工具参数：对一个已发布的 artifact 执行控制动作。
+ *
+ * 当前**唯一**支持的动作是「取消发布」（unpublish）：把此前用 Artifact 工具发布的
+ * HTML 页面 / Markdown 文档的公开链接设为私密（撤销公开访问）。
+ *
+ * 二选一（至少一个）：
+ *   - shareLink：Artifact 返回的完整链接（形如 .../p/{nodeId}），工具会自行解析出 nodeId。
+ *   - nodeId：链接末段的裸标识（等价于后端取消发布接口所需的 fileId）。
+ */
+declare const ArtifactControlParameters: z.ZodObject<{
+    shareLink: z.ZodOptional<z.ZodString>;
+    nodeId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    nodeId?: string | undefined;
+    shareLink?: string | undefined;
+}, {
+    nodeId?: string | undefined;
+    shareLink?: string | undefined;
+}>;
+/**
+ * ArtifactControl 工具 —— 已发布 artifact 的控制入口（issue #81031 更名自 ShareLinkUnpublish）。
+ *
+ * 当前**唯一**能力：取消发布（unpublish）——把一个 Artifact 工具发布的
+ * HTML 页面 / Markdown 文档的公开分享链接设为私密（互联网不可访问，并尽量移除协作人）。
+ * 尚不支持列表 / 删除 / 权限调整等其他动作；命名仅为后续以可选参数扩展预留空间。
+ *
+ * 与 ArtifactTool 对称：同样仅面向国内 / iOA / 内部 endpoint，复用 CBC 自身会话的
+ * access token。按链接形态路由（见 classifyShareLink / revoke）：
+ *   - html 页面节点（/p/）→ `POST /space/api/view/page/unpublish`（body `{ fileId }`）；
+ *   - markdown 文档节点（/space/d/）→ `POST /space/api/permission/set-permission`
+ *     设为 `{ role: 'invalid' }`（doc 节点没有 page/unpublish，硬调会报 "page meta not found"）；
+ *   - 裸 nodeId（无法判型）→ 先试 page/unpublish，任意失败回退 set-permission(invalid)。
+ *
+ * 用户可以直接把 Artifact 返回的链接贴回来撤销，无需记忆内部标识，也无需依赖会话状态——
+ * nodeId 稳定内嵌在链接中（见 spaceengine urlgen.PublishURL）。
+ */
+export declare class ArtifactControlTool extends BaseTool implements Tool {
+    protected readonly authManager: AuthenticationManager;
+    protected readonly productManager: ProductManager;
+    protected readonly abTestService?: AbTestService;
+    protected readonly logger: Logger;
+    name: ToolNames;
+    aliases: string[];
+    description: string;
+    parameters: z.ZodObject<{
+        shareLink: z.ZodOptional<z.ZodString>;
+        nodeId: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        nodeId?: string | undefined;
+        shareLink?: string | undefined;
+    }, {
+        nodeId?: string | undefined;
+        shareLink?: string | undefined;
+    }>;
+    strict: boolean;
+    argumentRenderer: ToolCallArgumentRenderer;
+    isEnabled: (_args: {
+        runContext: RunContext<Session>;
+        agent: Agent;
+    }) => Promise<boolean>;
+    execute(input: z.infer<typeof ArtifactControlParameters>, _context: RunContext<Session>): Promise<ToolResult>;
+    /**
+     * 按节点类型取消公开访问，返回成功走的是哪条路径（page / permission）。
+     *
+     * - `page`：仅 page/unpublish。
+     * - `doc`：仅 makeDocPrivate（关闭公开档位 + 移除所有人类协作人）。
+     * - `unknown`：先 page/unpublish，**任意**失败即回退 makeDocPrivate
+     *   （不按错误串匹配——串匹配脆弱，且 CLI markdown 分享大多本就是 doc 节点）。
+     *   两者都失败时返回权限接口的失败详情（更可能是真实路径），并注明 page 也已尝试。
+     */
+    private revoke;
+    /** page/unpublish（html 页面节点）：body `{ fileId }`，code===0 成功。 */
+    private unpublishPage;
+    /**
+     * 把 markdown doc 节点设为**完全私密**：关闭公开档位 + 移除所有人类协作人。
+     *
+     * 仅关公开档位（public.role=invalid）只堵住「互联网公开」这道门；此前通过邀请/协作
+     * 加入的成员仍能访问。真正的「设为私密」必须连协作人一起撤掉，因此本方法：
+     *   1. 先查当前协作人：POST /space/api/permission/collaborators `{ recordId }`
+     *      → `{ collaborators: [{ uid, role, type }] }`（type='public' 是公开档位占位条目、
+     *      role='owner' 是所有者，二者都要跳过）。查失败不致命——仍继续关公开档位，
+     *      只是附警告说明协作人可能未清干净。
+     *   2. 一次原子调用 POST /space/api/permission/set-permission
+     *      `{ recordId, public:{role:'invalid'}, members:[{uid, role:'invalid'}...] }`
+     *      （后端 role='invalid' → permission.None，即移除成员；见 spaceengine
+     *      set_permission.go / protocol.go）。code===0 成功。
+     *
+     * 这是 ArtifactTool 上传时 set-permission(reader) 的逆操作，但覆盖面更全（含协作人）。
+     * agent override 条目（响应里的 agents）不在此处理：CLI 分享链路不会产生它们。
+     */
+    private makeDocPrivate;
+}
+export {};

package/cli/dist-server/types/node/tools/artifact-tool.d.ts

@@ -0,0 +1,96 @@
+import { AuthenticationManager } from '../../workspace/authentication/lib/common/index.js';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { Agent, ToolNames } from '../../vendor/cbc-shared/node/index.js';
+import { AbTestService, ProductManager } from '../../workspace/product/lib/common/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { BaseTool } from './base-tool';
+import { Tool, ToolResult } from './tool-protocol';
+/**
+ * Artifact 工具参数：上传本地单个 HTML / Markdown 文件，发布为可分享的公网链接。
+ *
+ * `existingShareLink` 为空时新建节点；给定既有链接 / nodeId 时覆盖同一节点，
+ * 因而 republish 到同一个 URL（语义与「不给标识就是新建」一致）。
+ */
+declare const ArtifactParameters: z.ZodObject<{
+    filePath: z.ZodString;
+    existingShareLink: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    filePath: string;
+    existingShareLink?: string | undefined;
+}, {
+    filePath: string;
+    existingShareLink?: string | undefined;
+}>;
+/**
+ * 上传失败详情由 `space-upload` 以返回值传递，不落在实例字段：工具是 CellJS 单例，
+ * Agents SDK 会在同一轮内并行执行多个工具调用（见 `@openai/agents-core` 的
+ * `Promise.all(toolRuns...)`），若用实例字段暂存失败原因，两个并发的 execute()
+ * 会互相覆盖对方的诊断信息 / 错误码。
+ */
+/**
+ * Artifact 工具 —— 把本地 HTML / Markdown 发布为可渲染的公网分享链接（issue #81031 更名自 ShareLink）。
+ *
+ * 当前仅面向国内 / iOA / 内部 endpoint 开启，走【知识空间上传】
+ * （/space/api/view/import/*，与 WorkBuddy uploadToKnowledge 对齐）。国际 endpoint 暂不提供：
+ * 国际网关缺少 spaceengine 接口，暂不作为 CLI 分享链路。
+ *
+ * Markdown 由**服务端**渲染成样式化页面（后端按扩展名分流，`.md` 与 `.html` 同为一等公民），
+ * 客户端不做任何预渲染，只负责给出正确的 Content-Type。
+ *
+ * 全程仅用 CBC 自身会话的 access token（authManager.buildAuthHeaders）+
+ * productManager.getEndpoint()，无需额外 env / token。
+ *
+ * 开关见 artifact-common.isArtifactToolEnabled（env 新旧名 → 云端 feature 新旧 key → 缺省开）。
+ */
+export declare class ArtifactTool extends BaseTool implements Tool {
+    protected readonly authManager: AuthenticationManager;
+    protected readonly productManager: ProductManager;
+    protected readonly abTestService?: AbTestService;
+    protected readonly logger: Logger;
+    name: ToolNames;
+    aliases: string[];
+    description: string;
+    parameters: z.ZodObject<{
+        filePath: z.ZodString;
+        existingShareLink: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        filePath: string;
+        existingShareLink?: string | undefined;
+    }, {
+        filePath: string;
+        existingShareLink?: string | undefined;
+    }>;
+    isEnabled: (_args: {
+        runContext: RunContext<Session>;
+        agent: Agent;
+    }) => Promise<boolean>;
+    execute(input: z.infer<typeof ArtifactParameters>, _context: RunContext<Session>): Promise<ToolResult>;
+    /**
+     * 把上传失败转成用户可读结果。
+     *
+     * 后端已把「文件过大 / 内容审核未通过」明确成业务错误码（见 WorkBuddy `share/facade.ts`
+     * 对 56040 / 619610 的 errorCode 回传），这里按同一口径给出精准文案，其余保留通用文案 +
+     * 诊断片段，确保任何失败都不会静默。
+     *
+     * 失败详情由 `space-upload` 以返回值传入，不落在实例字段——工具是单例，
+     * 若两次 execute() 并发（Agents SDK 一轮内并行跑多个工具调用），实例字段会被彼此覆盖，
+     * 导致一次调用报出另一次调用的错误码/诊断文案。
+     */
+    private buildFailureResult;
+    /**
+     * 把节点设为「互联网公开可读」（对齐 WorkBuddy `setPublicPermission` 的 public_read→reader）。
+     *
+     * 后端契约 POST /space/api/permission/set-permission：
+     *   body `{ recordId: <nodeId>, public: { role: "reader" } }`，成功判据 code === 0
+     *   （见 workbuddy-server `share/facade.ts` setPublicPermission）。
+     *
+     * markdown 导入的 doc 节点默认私有，必须补这一步分享链接才对外可读。
+     * 失败不视为致命错误：返回 `{ ok: false, detail }`，由调用方降级为「链接已生成但可能仍私有」的警告。
+     */
+    private setPublicRead;
+    /** 归一化本地路径（兼容 file:// 与 Windows 盘符）。 */
+    private normalizeLocalPath;
+}
+export {};

package/cli/dist-server/types/node/tools/ask-user-for-structured-input-tool.d.ts

@@ -0,0 +1,127 @@
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { type FunctionCallItem } from '../../vendor/cbc-shared/node/index.js';
+import { SdkHooksManager } from '../control-signal/control-signal-protocol';
+import { ElicitationService } from '../elicitation/elicitation-service';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { BaseTool } from './base-tool';
+import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
+import { ToolNames } from '../../vendor/cbc-shared/node/index.js';
+/**
+ * 是否启用本 tool 的 env 开关。
+ * - 缺省 / 空串 / '0' / 'false' 视为关闭；
+ * - 其他任意非空值视为开启（与 CBC 其它 `CODEBUDDY_ENABLE_*` 家族保持一致）。
+ * 读取放在运行时方法内、每次调用时 live 读，遵循 packages/agent-cli/CODEBUDDY.md
+ * 的 prewarm env 契约（禁止模块顶层 / 构造函数固化 per-session env）。
+ */
+export declare const ASK_STRUCTURED_INPUT_ENV_FLAG = "CODEBUDDY_ENABLE_ASK_USER_FOR_STRUCTURED_INPUT";
+export declare function isAskUserForStructuredInputEnvEnabled(): boolean;
+declare const AskUserForStructuredInputParameters: z.ZodObject<{
+    message: z.ZodString;
+    requestedSchema: z.ZodObject<{
+        type: z.ZodLiteral<"object">;
+        properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        additionalProperties: z.ZodOptional<z.ZodBoolean>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        type: z.ZodLiteral<"object">;
+        properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        additionalProperties: z.ZodOptional<z.ZodBoolean>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        type: z.ZodLiteral<"object">;
+        properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        additionalProperties: z.ZodOptional<z.ZodBoolean>;
+    }, z.ZodTypeAny, "passthrough">>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    requestedSchema: {
+        type: "object";
+        properties: Record<string, Record<string, unknown>>;
+        required?: string[] | undefined;
+        additionalProperties?: boolean | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+}, {
+    message: string;
+    requestedSchema: {
+        type: "object";
+        properties: Record<string, Record<string, unknown>>;
+        required?: string[] | undefined;
+        additionalProperties?: boolean | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+}>;
+export type AskUserForStructuredInputInput = z.infer<typeof AskUserForStructuredInputParameters>;
+export declare class AskUserForStructuredInputTool extends BaseTool implements Tool {
+    protected readonly elicitationService: ElicitationService;
+    protected readonly sdkHooksManager: SdkHooksManager;
+    name: ToolNames;
+    /**
+     * Description 保持精简 + 泛化，只讲"是什么、什么时候用"，不绑定业务场景。
+     * 具体场景的用法（例如 MCP 授权征询）通过 `--append-system-prompt` 追加，
+     * 详见 `packages/agent-cli/prompts/examples/mcp-auth-elicitation.md`。
+     */
+    description: string;
+    parameters: z.ZodObject<{
+        message: z.ZodString;
+        requestedSchema: z.ZodObject<{
+            type: z.ZodLiteral<"object">;
+            properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            additionalProperties: z.ZodOptional<z.ZodBoolean>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            type: z.ZodLiteral<"object">;
+            properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            additionalProperties: z.ZodOptional<z.ZodBoolean>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            type: z.ZodLiteral<"object">;
+            properties: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            additionalProperties: z.ZodOptional<z.ZodBoolean>;
+        }, z.ZodTypeAny, "passthrough">>;
+    }, "strip", z.ZodTypeAny, {
+        message: string;
+        requestedSchema: {
+            type: "object";
+            properties: Record<string, Record<string, unknown>>;
+            required?: string[] | undefined;
+            additionalProperties?: boolean | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+    }, {
+        message: string;
+        requestedSchema: {
+            type: "object";
+            properties: Record<string, Record<string, unknown>>;
+            required?: string[] | undefined;
+            additionalProperties?: boolean | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+    }>;
+    /**
+     * Tool 本身就是"征询用户答复"，弹 UI 的语义已经内建在 elicitation/create
+     * 上；再走一层 session/request_permission 只会让用户点两次（先"允许"、
+     * 再填表单）。与 AskUserQuestion 同款处理：不走审批门。
+     */
+    needsApproval: boolean;
+    argumentRenderer: ToolCallArgumentRenderer;
+    /**
+     * 门控：env + capability + 可用通道。任一未满足即从模型可见工具列表中移除。
+     * 与 AskUserQuestion 保持相同的写法风格，便于日后维护。
+     */
+    isEnabled: (args: {
+        runContext: RunContext<Session>;
+    }) => boolean;
+    execute(input: AskUserForStructuredInputInput, context?: RunContext<Session>, details?: {
+        toolCall: FunctionCallItem;
+    }): Promise<ToolResult>;
+    private errorResult;
+}
+export {};