@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/node/tools/ask-user-question-tool.d.ts

@@ -0,0 +1,237 @@
+import { Workspace } from '../../workspace/runtime/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { type FunctionCallItem, type ToolExecuteArgument } from '../../vendor/cbc-shared/node/index.js';
+import { AskService } from '../ask';
+import { SdkHooksManager } from '../control-signal/control-signal-protocol';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { BaseTool } from './base-tool';
+import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
+import { ToolNames } from '../../vendor/cbc-shared/node/index.js';
+/**
+ * Normalize AskUserQuestion input to handle common model mistakes:
+ * - Using "answers" field instead of "options"
+ * - Passing plain string arrays instead of {label, description} objects
+ * - Missing "header" field
+ *
+ * Call this before passing input to UI layers or tool execution.
+ */
+export declare function normalizeAskUserQuestionInput(input: Record<string, any>): Record<string, any>;
+declare const AskUserQuestionParameters: z.ZodEffects<z.ZodObject<{
+    questions: z.ZodArray<z.ZodObject<{
+        question: z.ZodString;
+        header: z.ZodString;
+        options: z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            description: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            description: string;
+            label: string;
+        }, {
+            description: string;
+            label: string;
+        }>, "many">;
+        multiSelect: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect: boolean;
+    }, {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect?: boolean | undefined;
+    }>, "many">;
+    answers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        source?: string | undefined;
+    }, {
+        source?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    questions: {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect: boolean;
+    }[];
+    answers?: Record<string, string> | undefined;
+    metadata?: {
+        source?: string | undefined;
+    } | undefined;
+}, {
+    questions: {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect?: boolean | undefined;
+    }[];
+    answers?: Record<string, string> | undefined;
+    metadata?: {
+        source?: string | undefined;
+    } | undefined;
+}>, {
+    questions: {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect: boolean;
+    }[];
+    answers?: Record<string, string> | undefined;
+    metadata?: {
+        source?: string | undefined;
+    } | undefined;
+}, {
+    questions: {
+        question: string;
+        options: {
+            description: string;
+            label: string;
+        }[];
+        header: string;
+        multiSelect?: boolean | undefined;
+    }[];
+    answers?: Record<string, string> | undefined;
+    metadata?: {
+        source?: string | undefined;
+    } | undefined;
+}>;
+export declare class AskUserQuestionTool extends BaseTool implements Tool {
+    protected readonly workspace: Workspace;
+    protected readonly askService: AskService;
+    protected readonly sdkHooksManager: SdkHooksManager;
+    name: ToolNames;
+    description: string;
+    parameters: z.ZodEffects<z.ZodObject<{
+        questions: z.ZodArray<z.ZodObject<{
+            question: z.ZodString;
+            header: z.ZodString;
+            options: z.ZodArray<z.ZodObject<{
+                label: z.ZodString;
+                description: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                description: string;
+                label: string;
+            }, {
+                description: string;
+                label: string;
+            }>, "many">;
+            multiSelect: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect: boolean;
+        }, {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect?: boolean | undefined;
+        }>, "many">;
+        answers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            source: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            source?: string | undefined;
+        }, {
+            source?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        questions: {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect: boolean;
+        }[];
+        answers?: Record<string, string> | undefined;
+        metadata?: {
+            source?: string | undefined;
+        } | undefined;
+    }, {
+        questions: {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect?: boolean | undefined;
+        }[];
+        answers?: Record<string, string> | undefined;
+        metadata?: {
+            source?: string | undefined;
+        } | undefined;
+    }>, {
+        questions: {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect: boolean;
+        }[];
+        answers?: Record<string, string> | undefined;
+        metadata?: {
+            source?: string | undefined;
+        } | undefined;
+    }, {
+        questions: {
+            question: string;
+            options: {
+                description: string;
+                label: string;
+            }[];
+            header: string;
+            multiSelect?: boolean | undefined;
+        }[];
+        answers?: Record<string, string> | undefined;
+        metadata?: {
+            source?: string | undefined;
+        } | undefined;
+    }>;
+    argumentRenderer: ToolCallArgumentRenderer;
+    isEnabled: (args: {
+        runContext: RunContext<Session>;
+    }) => boolean;
+    needsApproval: (_runContext: RunContext<Session>, input: ToolExecuteArgument<any>, _callId?: string) => Promise<boolean>;
+    execute(input: z.infer<typeof AskUserQuestionParameters>, context?: RunContext<Session>, details?: {
+        toolCall: FunctionCallItem;
+    }): Promise<ToolResult>;
+    /**
+     * 把 execute 捕获的异常映射到结构化错误码：
+     * - ToolExecutionError：保留其码（missing toolCallId=19201 / no answers=19202）
+     * - acquireAnswers 超时（'timed out'）→ ToolTimeoutError(90003)
+     * - 中断/abort（'Aborted'）→ ToolCancelledError(90004)
+     * - 其余（rejectAsk 的 'User declined'）→ AskFollowupUserDeclinedError(19204)
+     */
+    private resolveAskErrorCode;
+}
+export {};

package/cli/dist-server/types/node/tools/audio-transcribe-service.d.ts

@@ -0,0 +1,61 @@
+import { RestOperations } from '@celljs/http';
+import { AuthenticationManager } from '../../workspace/authentication/lib/common/index.js';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { ProductManager } from '../../workspace/product/lib/common/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { AudioTranscribeResult, AudioTranscribeService, AudioTranscribeSource } from './tool-protocol';
+/**
+ * 录音文件识别服务实现。
+ *
+ * 本地文件经后端预签名上传 COS 换取 download_url；调用方给的公网 URL 直接用。
+ * 两者都以 `audio_url` 提交异步转写并轮询（从不用 `audio_data`）。
+ * 与 VideoServiceImpl 同源的鉴权（run identity 优先、bootstrap 兜底）与会话归因头。
+ */
+export declare class AudioTranscribeServiceImpl implements AudioTranscribeService {
+    protected readonly restOperations: RestOperations;
+    protected readonly authenticationManager: AuthenticationManager;
+    protected readonly productManager: ProductManager;
+    protected readonly logger: Logger;
+    transcribe(source: AudioTranscribeSource, context: RunContext<Session>): Promise<AudioTranscribeResult>;
+    /**
+     * URL 来源直接用；本地文件走预签名 → PUT 上传 → download_url。
+     *
+     * URL 的可达性与格式由上游判定：下载失败的任务以 `failed` 结束，
+     * `error.message`（如 `Failed to download audio file!`）由 pollTask 透传。
+     */
+    private resolveAudioSource;
+    /**
+     * 通过后端预签名接口获取 upload/download URL，PUT 文件字节到 COS，返回 download_url。
+     *
+     * 预签名需服务端持有的 COS secretID/secretKey，本地不得内嵌平台密钥（BL-CLI-12）。
+     * COS PUT 走裸 fetch，仅带 Content-Type，绝不把 bearer 或身份头发给 COS（BL-CLI-11）。
+     */
+    private presignAndUpload;
+    /** COS 预签名 PUT：只带 Content-Type（绝不带 bearer/身份头），失败时抛出明确错误。 */
+    private putToCos;
+    /**
+     * 提交转写任务：POST /v2/async/tasks/create，返回 task_id。
+     *
+     * 识别参数不暴露给 Agent（#128310）：16k 音频只支持单声道，`channel_num` 固定 1；
+     * 工具面向会议/访谈等长音频，`speaker_diarization` 默认开启（需 `channel_num=1`）。
+     */
+    private submitTask;
+    /** 轮询任务状态直到 completed / failed / 超时。 */
+    private pollTask;
+    /**
+     * 组装一次 ASR 请求的头。
+     *
+     * ASR 对 6 个必需 header 缺任意一个（或为空）都返回 400/10001：
+     * X-Conversation-ID / X-Conversation-Request-ID / X-Conversation-Message-ID /
+     * User-Agent / X-IDE-Type / X-IDE-Name。buildConversationHeaders 可能把
+     * X-IDE-Name 置空，这里强制兜底为非空，并补上 buildConversationHeaders 不产出的 User-Agent。
+     */
+    private buildAsrHeaders;
+    /** 生成上传 objectKey：`uploads/{ts}-{rand}-{sanitizedName}`（内联，避免依赖 agent-provider）。 */
+    private generateObjectKey;
+    /** 准备请求所需的认证与配置（run identity 优先、bootstrap 兜底），与 VideoServiceImpl 同源。 */
+    private prepareRequest;
+    /** 可中断的 sleep。 */
+    private sleep;
+}

package/cli/dist-server/types/node/tools/audio-transcribe-tool.d.ts

@@ -0,0 +1,66 @@
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { Agent, ToolNames } from '../../vendor/cbc-shared/node/index.js';
+import { AbTestService, ProductManager } from '../../workspace/product/lib/common/index.js';
+import { Logger } from '../../workspace/telemetry/lib/common/index.js';
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { BaseTool } from './base-tool';
+import { AudioTranscribeService, Tool, ToolResult } from './tool-protocol';
+/**
+ * 只暴露音频文件地址（#128310 §3）。说话人分离、COS 上传、异步转写与结果轮询
+ * 全部由工具内部处理，不向 Agent 暴露额外参数。
+ */
+declare const AudioTranscribeParameters: z.ZodObject<{
+    filePath: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    filePath: string;
+}, {
+    filePath: string;
+}>;
+/**
+ * 录音文件识别（长音频转文本）工具。
+ *
+ * 延迟加载 + 高积分前置审批（与 VideoGen 同机制，见 ModelUtils.isMandatoryApprovalTarget）。
+ * 本地音频经后端预签名上传 COS 换取下载地址；调用方给的公网 URL 直接提交，省掉一次上传。
+ * 成功返回完整转写文本，失败返回可理解的错误文案（#128310 §7）。
+ */
+export declare class AudioTranscribeTool extends BaseTool implements Tool {
+    protected readonly audioTranscribeService: AudioTranscribeService;
+    protected readonly productManager: ProductManager;
+    protected readonly abTestService?: AbTestService;
+    protected readonly logger: Logger;
+    name: ToolNames;
+    description: string;
+    parameters: z.ZodObject<{
+        filePath: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        filePath: string;
+    }, {
+        filePath: string;
+    }>;
+    isEnabled: (_args: {
+        runContext: RunContext<Session>;
+        agent: Agent;
+    }) => Promise<boolean>;
+    execute(input: z.infer<typeof AudioTranscribeParameters>, context: RunContext<Session>): Promise<ToolResult>;
+    /**
+     * 判定 `filePath` 是本地路径还是公网 URL，并做各自的前置校验。
+     *
+     * `file://` 仍按本地路径处理；其余非 http(s) 的 scheme 要显式报错，否则会掉进
+     * 本地分支报 "Audio file not found"，把模型误导去重试路径。
+     */
+    private resolveSource;
+    /**
+     * URL 来源：只校验 scheme 与目标不是内网地址。
+     *
+     * 下载由云端 ASR 发起、本机不连这个地址，所以按字面量判定即可，不做 DNS 解析。
+     * 音频格式、时长、可达性同样交给上游：下载失败的任务以 `failed` 结束，
+     * `error.message`（如 `Failed to download audio file!`）由 service 透传回来。
+     */
+    private resolveUrlSource;
+    /** 本地来源：校验存在、非目录、大小上限（BL-CLI-01）与扩展名。 */
+    private resolveLocalSource;
+    /** 归一化本地路径（兼容 file:// 与 Windows 盘符），与 ArtifactTool 同款。 */
+    private normalizeLocalPath;
+}
+export {};

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-allow-filter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Auto mode dangerous-allow-rule filtering.
+ *
+ * In auto mode, an allow rule that covers a dangerous action (e.g. `Bash(*)`,
+ * `Bash(sudo *)`, `PowerShell(iex *)`, `Agent(*)`) would let that action bypass
+ * the classifier entirely, defeating auto mode's safety check. We strip such
+ * rules from the in-memory rule set for the current permission check, forcing the
+ * action through the classifier instead.
+ *
+ * This never mutates settings on disk — callers pass a copied rule array. We use
+ * read-time filtering (not Claude's enter-auto strip + exit-auto restore
+ * lifecycle): it is behaviourally equivalent but needs no mutable lifecycle
+ * state and cannot leak a stripped rule if an exit path is missed.
+ *
+ * The danger predicate is a faithful port of Claude Code 2.1.181's
+ * `isDangerousClassifierPermission` (`bqe = isDangerousBashPermission ||
+ * isDangerousPowerShellPermission || isDangerousTaskPermission`). The command /
+ * cmdlet sets below are copied verbatim from the 2.1.181 binary; do NOT trim
+ * them — each entry changes which allow rules can bypass the classifier.
+ */
+/**
+ * Whether an allow rule would dangerously bypass the auto classifier
+ * (faithful port of Claude `isDangerousClassifierPermission`):
+ *   dangerous Bash command || dangerous PowerShell cmdlet || any Agent/Task rule.
+ */
+export declare function isDangerousAllowRule(rule: string): boolean;
+/**
+ * Filter out dangerous allow rules that would bypass the auto classifier,
+ * returning the kept (safe) rules. If `onRemoved` is provided, it is called once
+ * per stripped rule (used by the host to emit a debug log) — keeps logging at the
+ * single place that owns this domain rule.
+ */
+export declare function filterDangerousAllowRules(rules: string[], onRemoved?: (rule: string) => void): string[];

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-classifier-client.d.ts

@@ -0,0 +1,230 @@
+import { AgentManager, AgentService } from '../../../vendor/cbc-core/node/index.js';
+import { Logger } from '../../../workspace/telemetry/lib/common/index.js';
+import { BaseTool } from '../base-tool';
+import { AutoModeRules } from './auto-mode-protocol';
+import { AutoModeSystemPromptBuilder } from './auto-mode-system-prompt-builder';
+import { AutoModeTranscriptLimit } from './auto-mode-transcript-limit';
+export declare const AutoModeClassifierClient: unique symbol;
+/**
+ * Raw classifier verdict, aligned with Claude Code 2.1.179.
+ *
+ * The classifier model emits a BINARY decision via `<block>yes/no</block>`:
+ *  - `<block>no</block>`  → allow
+ *  - `<block>yes</block><reason>…</reason>` → block
+ * There is no `ask` verdict — "requires confirmation" is a host-side fallback
+ * when the classifier is unavailable / fails, not a model output.
+ *
+ * `noClassifierRelevantInput` short-circuits BEFORE any model call: when the
+ * action's own projection is empty (Claude "Tool declares no classifier-relevant
+ * input"), auto mode allows it with zero LLM cost.
+ */
+export interface ClassifierVerdict {
+    decision: 'allow' | 'block';
+    reason: string;
+    /** True when allowed purely because the action had no classifier-relevant input (no model call). */
+    noClassifierRelevantInput?: boolean;
+    /**
+     * The action's projection (Claude `toAutoClassifierInput`) — the dedup key
+     * for denial tracking (decision D3-A #2). Empty for the no-input short-circuit.
+     */
+    inputKey: string;
+}
+export interface ClassifyInput {
+    toolName: string;
+    toolInput: unknown;
+    rules: AutoModeRules;
+    /** Conversation history (AgentInputItem[]); action is appended as the last entry. */
+    transcript?: unknown[];
+    /** User `permissions.deny` rules injected into the system prompt. */
+    settingsDenyRules?: string[];
+    /**
+     * Optional CODEBUDDY.md / rule-layer text injected as a separate user
+     * context message (Claude CLAUDE.md injection, decision D2). Treated as
+     * context about user intent, never as blanket authorization.
+     */
+    projectInstructions?: string;
+    /** Session id — used only to name the error-dump file on classifier failure. */
+    sessionId?: string;
+}
+/** Thrown when a classifier STAGE 1 call fails before Stage 2 runs (Claude: block "for safety"). */
+export declare class ClassifierUnavailableError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Thrown when the classifier model was reachable and answered, but its response
+ * is unusable — e.g. a reasoning-only model (gpt-5.5 via the Responses API) spent
+ * the whole small output budget on hidden thinking, leaving an empty visible
+ * answer, so the Agents SDK threw while reading an empty content array.
+ *
+ * Distinct from ClassifierUnavailableError (a genuine transport/model outage):
+ * the model is up, it's just a poor fit for the tiny classifier budget. The host
+ * still blocks the action fail-closed (Claude `parse_failure` → `shouldBlock`),
+ * but with "no verdict" wording that points at the classifier model instead of
+ * claiming a transient outage, and it must NOT trip the failure circuit breaker.
+ */
+export declare class ClassifierResponseUnusableError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Heuristic: does a Stage-1 error look like "the model answered but the response
+ * was empty / unparseable" rather than a transport/model outage?
+ *
+ * Two known shapes, both meaning "the model is up, its visible answer is empty":
+ *  - The Agents SDK reads `content[last].type` on the assistant message; an empty
+ *    content array (no visible text — the reasoning-only case above) makes
+ *    `content[last]` undefined and throws `TypeError: Cannot read properties of
+ *    undefined (reading 'type')`.
+ *  - A reasoning model that spends the whole output budget on hidden thinking
+ *    produces a turn with no visible answer, so the run ends without a final
+ *    output and the SDK throws `MaxTurnsExceededError` (`maxTurns` is 1 here).
+ *    Matched on `name` because the SDK error class may come from a second copy
+ *    of `@openai/agents-core` (dual-dist), making `instanceof` unreliable — the
+ *    same reason `session-manager` matches this error by name.
+ */
+export declare function isClassifierResponseUnusable(err: unknown): boolean;
+/**
+ * Thrown when STAGE 2 errors after Stage 1 already ran (both-mode, Stage 1 did
+ * not return `<block>no`). Claude blocks based on the Stage 1 assessment rather
+ * than failing open — the reason names this so it is auditable. Distinct from
+ * ClassifierUnavailableError so the host can use the Stage-1-based reason.
+ */
+export declare class ClassifierStage2Error extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Thrown when the serialized transcript exceeds the classifier model's context
+ * window (Claude `transcript_too_long`). Distinct from ClassifierUnavailableError
+ * because the host handles it differently (prompt fallback interactive, abort
+ * headless) and it must NOT trip the failure circuit breaker.
+ */
+export declare class TranscriptTooLongError extends Error {
+    readonly actualTokens: number;
+    readonly limitTokens: number;
+    constructor(actualTokens: number, limitTokens: number);
+}
+/**
+ * Invokes the lite model for risk classification, using the real Claude Code
+ * two-stage `<block>` mechanism.
+ *
+ *  - Stage 1 (fast): system prompt + transcript + STAGE1_SUFFIX, tiny budget +
+ *    `</block>` stop, no user-intent / ALLOW. `<block>no</block>` → allow
+ *    immediately. Otherwise continue to Stage 2.
+ *  - Stage 2 (thinking): system prompt + transcript + STAGE2_SUFFIX, large
+ *    budget, NO stop sequence (so `<reason>` after `</block>` is preserved),
+ *    full rules incl. user intent + ALLOW.
+ *
+ * The system prompt (framework + injected rules + settings deny rules) is built
+ * per call; the transcript is the serialized conversation history with the action
+ * being classified as the last entry. The model is the one configured for this
+ * agent (`settings.subagents.agents.autoModeClassifier.model`) and otherwise the
+ * shipped `lite` default; isolation is owned by
+ * AgentService.runOneTimeWithOverrides; the output budget is widened for models
+ * that cannot disable reasoning (see `runStage`).
+ */
+export declare class AutoModeClassifierClientImpl {
+    protected readonly agentService: AgentService;
+    protected readonly agentManager: AgentManager;
+    protected readonly systemPromptBuilder: AutoModeSystemPromptBuilder;
+    protected readonly transcriptLimit: AutoModeTranscriptLimit;
+    /** All registered tools — used only to look up per-tool classifier projections. */
+    protected readonly tools: BaseTool[];
+    protected readonly logger: Logger;
+    /** Lazy `toolName → BaseTool` index for projection lookup. */
+    private toolIndex?;
+    classify(input: ClassifyInput): Promise<ClassifierVerdict>;
+    /**
+     * Project the action being classified. Returns `''` (short-circuit-to-allow)
+     * only when the tool's own projection is empty; an unknown tool projects to
+     * its raw input so a tool we cannot reason about is never auto-allowed by the
+     * empty-projection path (it still goes to the classifier).
+     */
+    private projectAction;
+    /**
+     * Project a history tool_use. Unknown tools are dropped from history (return
+     * undefined) — Claude skips tools it has no projection for; in history this
+     * is safe because the missing context only weakens, never bypasses, a check.
+     */
+    private projectHistory;
+    /** Call a tool's projection, treating any throw as malformed input (Claude raw-input fallback). */
+    private safeProject;
+    private fallbackProjection;
+    private getToolIndex;
+    /**
+     * CODEBUDDY.md / rule-layer context message (decision D2). Prepended to the
+     * classifier messages with the same framing Claude uses: it is context about
+     * the user's environment and intent, and only an explicit authorization of
+     * the SPECIFIC action under review may be weighed — generic "be autonomous"
+     * encouragement is NOT authorization.
+     */
+    private buildContextMessages;
+    /**
+     * Whether the classifier model keeps reasoning no matter what we ask
+     * (Claude 2.1.226 `Xpr`). Two existing product signals carry that meaning:
+     *  - `onlyReasoning`: the model only has a reasoning mode;
+     *  - `reasoning.canDisableThinking === false`: no "off" switch is offered.
+     *
+     * Models whose capabilities we cannot read are treated as forcing reasoning.
+     * That covers both "no model at all" and the `{ id, name }` placeholders
+     * AgentManager builds for ids only the gateway knows (env
+     * `CODEBUDDY_SMALL_FAST_MODEL`, `settings.variantModels`, a session model
+     * outside `modelMap`): those carry no capability fields, so the two signals
+     * above would silently read as "reasoning can be disabled". `supportsReasoning`
+     * is the marker — every text model in the product config declares it, the
+     * placeholders declare nothing.
+     *
+     * Erring this way is cheap (a model that can turn reasoning off just gets
+     * budget it never uses) while the opposite breaks the classifier outright, so
+     * unknown models take the headroom. Claude's `Xpr` falls back to a
+     * provider-level check for the same reason.
+     */
+    private forcesReasoning;
+    /**
+     * Resolve the model the classifier stages run on:
+     *  1. an explicitly picked classifier model — `CODEBUDDY_CODE_SUBAGENT_MODEL`,
+     *     then `settings.subagents.agents.autoModeClassifier.model`
+     *     (project > user), i.e. the shared per-Agent priority chain so `/agents`
+     *     shows what actually runs; pinned onto the run via the `model` override;
+     *  2. otherwise the shipped default — `product.json` declares `lite`, whose
+     *     resolution stays with `AgentService.resolveRunOneTimeModel` (its
+     *     session-aware variant resolution, #82146); we only mirror it here to
+     *     decide the output budget.
+     *
+     * Read-only; a resolution failure yields an empty choice, which
+     * `forcesReasoning` treats as "assume reasoning" (grant the headroom).
+     */
+    private resolveClassifierModel;
+    /** The user's configured classifier model, or undefined when they configured none. */
+    private resolveConfiguredClassifierModel;
+    /**
+     * Failure text for "the model answered but produced no usable verdict". Names
+     * the model that ran and the knob that changes it: the cause is model fit (a
+     * model that spends the small output budget on hidden reasoning), which only
+     * the user can fix by pointing the classifier at another model.
+     *
+     * Which knob is named follows whichever source actually won. Telling the user
+     * to edit settings while `CODEBUDDY_CODE_SUBAGENT_MODEL` is set would be wrong
+     * advice — the env var outranks settings for every sub-agent, so the edit
+     * would have no effect.
+     */
+    private describeUnusableResponse;
+    private runStage;
+    /**
+     * Best-effort error dump (Claude `auto-mode-classifier-errors/<session>.txt`):
+     * write the failing error + action + system prompt + transcript so a flaky
+     * classifier can be diagnosed. Never throws — diagnostics must not mask the
+     * original failure.
+     */
+    private dumpError;
+    /**
+     * Parse `<block>yes|no</block>` after stripping `<thinking>` (Claude nLK/jhK).
+     * Returns true=block, false=allow, null=unparseable.
+     */
+    private parseBlock;
+    /** Parse the first `<reason>…</reason>` after stripping `<thinking>` (Claude iLK). */
+    private parseReason;
+    /** Remove `<thinking>…</thinking>` blocks (and an unterminated trailing one). */
+    private stripThinking;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-critique-client.d.ts

@@ -0,0 +1,51 @@
+import { PromptManager } from '../../../workspace/prompts/lib/common/index.js';
+import { AutoModeSettings } from '../../settings';
+import { AutoModeRules } from './auto-mode-protocol';
+import { AutoModeSystemPromptBuilder } from './auto-mode-system-prompt-builder';
+export declare const AutoModeCritiqueClient: unique symbol;
+/** True if any section has a custom entry beyond the `$defaults` token (Claude `is6`). */
+export declare function hasCustomRules(raw: AutoModeSettings | undefined): boolean;
+/**
+ * Runs the auto mode rule critique (read-only).
+ *
+ * Implementation: spawns a standard `codebuddy -p` (print/headless) subprocess.
+ * This reuses the project's canonical "cold-start, run once, exit" path — the
+ * child waits for its own runtime to be fully ready, so the critique command
+ * never races agent registration during startup (which a direct in-process
+ * `runOneTime` would, since this runs from a short-lived dispatch strategy).
+ *
+ * Prompt / context assembly is aligned with Claude Code 2.1.179 `MIT`/`rs6`:
+ *  - system prompt = the "expert reviewer" critique instructions template
+ *  - the user message embeds the FULL classifier system prompt plus the user's
+ *    custom rules, each section annotated as replacing or extending the defaults
+ *  - only the user's CUSTOM rules are reviewed (the strategy gates on
+ *    `hasCustomRules` before calling this)
+ *
+ * Does not participate in permission decisions.
+ */
+export declare class AutoModeCritiqueClientImpl {
+    protected readonly systemPromptBuilder: AutoModeSystemPromptBuilder;
+    protected readonly promptManager: PromptManager;
+    /**
+     * @param resolved  effective rules after `$defaults` expansion — used to render
+     *                  the classifier system prompt the critique reviews against.
+     * @param raw       merged-but-unexpanded custom rules (`$defaults` preserved) —
+     *                  used to show only the user's own entries with replace/extend
+     *                  annotations.
+     */
+    critique(resolved: AutoModeRules, raw: AutoModeSettings): Promise<string>;
+    /** Load the critique "expert reviewer" system prompt template text. */
+    private loadCritiqueSystemPrompt;
+    /**
+     * Spawn `codebuddy -p --model lite --system-prompt <critique> -` with the
+     * critique user message on stdin, and return the printed text.
+     */
+    private runPrintSubprocess;
+    protected buildCritiqueInput(resolved: AutoModeRules, raw: AutoModeSettings): Promise<string>;
+    /**
+     * Format one section's custom rules, noting whether they extend (contain
+     * `$defaults`) or replace the built-in defaults. Mirrors Claude `rs6`.
+     * Returns '' when the section has no custom entries.
+     */
+    private formatSection;
+}