@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-defaults.d.ts

@@ -0,0 +1,16 @@
+import { AutoModeRules } from './auto-mode-protocol';
+/**
+ * Built-in default auto mode rules — single source of truth.
+ *
+ * Ported VERBATIM from Claude Code 2.1.179 `auto-mode defaults` with only
+ * product-specific substitutions (Claude -> CodeBuddy, ~/.claude -> ~/.codebuddy,
+ * .claude/ -> .codebuddy/, CLAUDE.md -> CODEBUDDY.md). The security wording is
+ * intentionally NOT summarised or trimmed: the classifier is an LLM that reads
+ * these as policy, so every qualifying clause changes its judgement. The only
+ * deliberate divergence is the "CodeBuddy Scheduling" allow rule, narrowed
+ * because CodeBuddy has no RemoteTrigger / cloud routine registration (see note).
+ *
+ * Consumed by: the classifier prompt builder AND `codebuddy auto-mode defaults`
+ * (Phase 3 CLI) — both must read from here to avoid doc/runtime drift.
+ */
+export declare const AUTO_MODE_DEFAULTS: AutoModeRules;

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-denial-tracker.d.ts

@@ -0,0 +1,114 @@
+/**
+ * After this many consecutive classifier *call failures* (model errors /
+ * unavailability — NOT block verdicts), the failure breaker opens and the
+ * service short-circuits the classifier + kicks the session out of auto. Kept
+ * distinct from the denial-limit counters below (decision D3-A #1): one tracks a
+ * flaky model, the other tracks the model deliberately blocking actions.
+ *
+ * Deliberately far above the denial limits: leaving auto mode is disruptive and
+ * classifier call failures are usually transient, so the breaker should only
+ * open for a model that is persistently broken — not for a short blip. Claude
+ * Code never leaves auto on classifier failures at all (its own session-level
+ * auto breaker fires when the *server* rejects auto mode outright), so a low
+ * threshold here drops users out of auto far more eagerly than Claude does.
+ */
+export declare const AUTO_MODE_CIRCUIT_BREAKER_THRESHOLD = 5;
+/**
+ * Classifier-BLOCK denial limits (Claude Code 2.1.181 `I_m`, research §11):
+ *  - 3 consecutive blocks, OR 20 total blocks in a session → auto pauses.
+ * Interactive sessions fall back to a prompt; headless runs abort. On exceed,
+ * both counters reset so the session can resume after the pause (Claude resets).
+ *
+ * "Block" here means any outcome that blocked the action: a real block verdict,
+ * or a classifier run that produced NO verdict (Claude bumps the same counters
+ * for `parse_failure`). That way a classifier model which can never answer stops
+ * blocking every action once the limit trips.
+ */
+export declare const AUTO_MODE_MAX_CONSECUTIVE_DENIALS = 3;
+export declare const AUTO_MODE_MAX_TOTAL_DENIALS = 20;
+/** Max number of recent denials kept per session for subsequent-approval dedup. */
+export declare const AUTO_MODE_RECENT_DENIALS_MAX = 20;
+/**
+ * A single classifier denial, kept so a later approval of the SAME action
+ * (toolName + inputKey) can be detected as a subsequent approval and the stale
+ * record dropped (Claude `recordDenial` / `removeDenial`).
+ */
+export interface AutoModeDenialRecord {
+    toolName: string;
+    /** Human-readable label (`toolName <short projection>`), for views. */
+    display: string;
+    /** Dedup key — the classifier projection of the action (decision D3-A #2). */
+    inputKey: string;
+    reason: string;
+    timestamp: number;
+}
+/**
+ * Outcome of recording a classifier block, used by the host to decide whether to
+ * keep denying or pause auto (Claude denial-limit handler).
+ */
+export interface AutoModeDenialLimitState {
+    consecutiveDenials: number;
+    totalDenials: number;
+    /** True once consecutive ≥ 3 or total ≥ 20 — auto should pause this turn. */
+    exceeded: boolean;
+    /** Which threshold tripped, for the fallback message. */
+    kind?: 'consecutive' | 'total';
+}
+export declare const AutoModeDenialTracker: unique symbol;
+/**
+ * Per-session auto-mode bookkeeping, aligned with Claude Code. Three independent
+ * concerns (do not conflate — decision D3-A #1):
+ *
+ *  1. Recent denials — `toolName + inputKey + reason` of blocked actions, capped
+ *     at 20. Used to detect when the user later approves the same action so the
+ *     stale denial is dropped (subsequent approval). Pure record-keeping.
+ *  2. Denial limit — counts classifier outcomes that BLOCKED the action (a block
+ *     verdict, or a run that produced no verdict). `recordClassifierBlock`
+ *     bumps consecutive + total and reports when 3-consecutive / 20-total trips;
+ *     `resetConsecutiveDenials` is called on any allow.
+ *  3. Failure breaker — counts CONSECUTIVE classifier CALL failures (errors /
+ *     unavailability). After the threshold the breaker opens; a successful call
+ *     resets it.
+ *
+ * Makes no permission decisions itself.
+ */
+export interface AutoModeDenialTracker {
+    /** Record a classifier denial for the recent-denials / subsequent-approval view. */
+    recordDenial(sessionId: string, record: AutoModeDenialRecord): void;
+    /** Find a recent denial matching toolName + inputKey, if any. */
+    findDenial(sessionId: string, toolName: string, inputKey: string): AutoModeDenialRecord | undefined;
+    /** Drop a recent denial matching toolName + inputKey; returns true if one was removed. */
+    removeDenial(sessionId: string, toolName: string, inputKey: string): boolean;
+    /** Recent denials for a session, newest last. */
+    getRecentDenials(sessionId: string): AutoModeDenialRecord[];
+    /**
+     * Record a classifier block: bumps consecutive + total. Returns the limit
+     * state; when `exceeded`, both counters are reset to 0 so auto can resume
+     * after the pause (Claude resets on exceed).
+     */
+    recordClassifierBlock(sessionId: string): AutoModeDenialLimitState;
+    /** Reset the consecutive-denial counter (called on any allow). */
+    resetConsecutiveDenials(sessionId: string): void;
+    /** Record a classifier call failure; returns true if the breaker is now open. */
+    recordClassifierFailure(sessionId: string): boolean;
+    /** Record a successful classifier call; resets the consecutive-failure counter. */
+    recordClassifierSuccess(sessionId: string): void;
+    /** Whether the failure breaker is currently open (classifier should be short-circuited). */
+    isCircuitOpen(sessionId: string): boolean;
+    /** Drop all tracking for a finished session. */
+    clear(sessionId: string): void;
+}
+export declare class AutoModeDenialTrackerImpl implements AutoModeDenialTracker {
+    private readonly entries;
+    private entry;
+    recordDenial(sessionId: string, record: AutoModeDenialRecord): void;
+    findDenial(sessionId: string, toolName: string, inputKey: string): AutoModeDenialRecord | undefined;
+    removeDenial(sessionId: string, toolName: string, inputKey: string): boolean;
+    getRecentDenials(sessionId: string): AutoModeDenialRecord[];
+    recordClassifierBlock(sessionId: string): AutoModeDenialLimitState;
+    resetConsecutiveDenials(sessionId: string): void;
+    recordClassifierFailure(sessionId: string): boolean;
+    recordClassifierSuccess(sessionId: string): void;
+    isCircuitOpen(sessionId: string): boolean;
+    clear(sessionId: string): void;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-permission-service.d.ts

@@ -0,0 +1,51 @@
+import { Logger } from '../../../workspace/telemetry/lib/common/index.js';
+import { SettingsManager } from '../../settings';
+import { AutoModeClassifierClientImpl } from './auto-mode-classifier-client';
+import { AutoModeDenialTracker } from './auto-mode-denial-tracker';
+import { AutoModeProjectInstructionsResolver } from './auto-mode-project-instructions';
+import { AutoModeAvailability, AutoModePermissionRequest, AutoModePermissionResult, AutoModePermissionService } from './auto-mode-protocol';
+import { AutoModeSettingsResolver } from './auto-mode-settings';
+/**
+ * Auto mode permission service — the single entry point host code depends on.
+ *
+ * Orchestrates: availability gate -> rule resolution -> classifier -> verdict
+ * mapping with interactive/non-interactive fallback. Owns no host-flow state;
+ * `tool-permission-service` calls `classifyAsk` once when an ask would occur in
+ * auto mode.
+ *
+ * Circuit breaker: consecutive classifier *failures* (not block verdicts) open
+ * the breaker; while open we skip the classifier and fall back directly, so a
+ * failing model is not hammered. A successful call resets it.
+ */
+export declare class AutoModePermissionServiceImpl implements AutoModePermissionService {
+    protected readonly settingsManager: SettingsManager;
+    protected readonly classifier: AutoModeClassifierClientImpl;
+    protected readonly rulesResolver: AutoModeSettingsResolver;
+    protected readonly denialTracker: AutoModeDenialTracker;
+    protected readonly projectInstructionsResolver: AutoModeProjectInstructionsResolver;
+    protected readonly logger: Logger;
+    isAutoModeAvailable(): Promise<AutoModeAvailability>;
+    isSettingsAutoGrantAllowed(): Promise<boolean>;
+    classifyAsk(request: AutoModePermissionRequest): Promise<AutoModePermissionResult>;
+    /** Short human-readable label for a blocked action (toolName + truncated projection). */
+    private buildDisplay;
+    /**
+     * Reason text for a tripped denial limit. Shared by the two outcomes that
+     * count toward it — a real block verdict and a no-verdict failure — so both
+     * read the same way; the `reason` tail is what distinguishes them.
+     */
+    private buildDenialLimitReason;
+    /**
+     * Breaker-open short-circuit: the classifier has failed repeatedly, so leave
+     * auto mode and let the action go through normal default-mode handling (a
+     * prompt interactively, deny headless) — Claude `kickOutOfAuto`. Not the
+     * per-error fail-closed path.
+     */
+    private fallback;
+    /**
+     * Per-error fail-closed result (Claude §10): a classifier error blocks the
+     * action for safety regardless of interactivity. `kickOutOfAuto` is set when
+     * the failure just opened the breaker, so subsequent actions leave auto.
+     */
+    private failClosed;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-project-instructions.d.ts

@@ -0,0 +1,26 @@
+import { Logger } from '../../../workspace/telemetry/lib/common/index.js';
+import { MemoryManager } from '../../memory';
+export declare const AutoModeProjectInstructionsResolver: unique symbol;
+/**
+ * Resolves the CODEBUDDY.md / rule-layer text injected into the classifier as a
+ * separate user context message (decision D2, aligned with Claude's CLAUDE.md
+ * injection).
+ *
+ * The text is framed in the classifier client as context about user intent — it
+ * may authorize the SPECIFIC action under review, but generic encouragement is
+ * never authorization. We therefore only need to surface the rule-layer content;
+ * the "not a blanket grant" framing lives in the prompt wrapper.
+ *
+ * Sources: USER + PROJECT scoped memory (the CODEBUDDY.md rule layer). We do NOT
+ * include the auto-memory directory or PROJECT_LOCAL here — only the instruction
+ * layer the user authored as project/user guidance.
+ */
+export interface AutoModeProjectInstructionsResolver {
+    /** Combined rule-layer text, or empty string when none is configured. */
+    resolve(): Promise<string>;
+}
+export declare class AutoModeProjectInstructionsResolverImpl implements AutoModeProjectInstructionsResolver {
+    protected readonly memoryManager?: MemoryManager;
+    protected readonly logger: Logger;
+    resolve(): Promise<string>;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-protocol.d.ts

@@ -0,0 +1,140 @@
+import { PermissionMode } from '../../../vendor/cbc-shared/node/index.js';
+/**
+ * Auto mode permission subsystem — public protocol.
+ *
+ * All auto-mode-specific logic is aggregated under `tools/auto-mode/`. Host files
+ * (tool-permission-service, interruption-service, agent-task, session-middleware)
+ * only depend on the symbols exported here, never on the internals.
+ */
+/** DI symbol for the auto mode permission service. */
+export declare const AutoModePermissionService: unique symbol;
+/** Classifier verdict categories, aligned with Claude Code auto mode. */
+export type AutoModeDenyCategory = 'soft_deny' | 'hard_deny' | 'unknown' | 'unavailable';
+/**
+ * Result of classifying a tool call that would otherwise prompt the user.
+ *
+ * The classifier verdict is binary (allow | block, mapped to allow | deny here).
+ * There is no `ask` result — "requires confirmation" is the host's decision when
+ * the classifier is `unavailable` (see fallback). `unavailable.failClosed`
+ * tells the host whether to deny (non-interactive) or fall back to a prompt.
+ * `unavailable.kickOutOfAuto` is set once the circuit breaker trips — the host
+ * should switch the session out of auto mode (back to default), aligned with
+ * Claude Code's `kickOutOfAutoIfNeeded`.
+ *
+ * `unavailable.noVerdict` marks the case where the classifier RAN but returned
+ * nothing usable (Claude `parse_failure`): always fail-closed, and the host uses
+ * the "no verdict" deny message instead of the "temporarily unavailable" one. It
+ * counts toward the denial limit below, so an unusable classifier model does not
+ * block every action for the rest of the session.
+ *
+ * `transcriptTooLong` is produced when the serialized transcript exceeds the
+ * classifier model's context window (Claude `transcript_too_long`). The host
+ * falls back to normal permission handling (prompt) when interactive, and
+ * ABORTS the agent run when headless (`headlessAbort`), aligned with Claude's
+ * "exceeded context window in headless mode".
+ *
+ * `denialLimitExceeded` is produced when classifier outcomes that blocked the
+ * action (block verdicts, or runs that produced no verdict) hit the
+ * 3-consecutive / 20-total denial limit (Claude `I_m`). Interactive sessions
+ * fall back to a prompt (auto pauses); headless runs abort (`headlessAbort`),
+ * aligned with Claude's "too many classifier denials in headless mode".
+ */
+export type AutoModePermissionResult = {
+    behavior: 'allow';
+    reason: string;
+    source: 'fastPath' | 'classifier';
+} | {
+    behavior: 'deny';
+    reason: string;
+    category: AutoModeDenyCategory;
+} | {
+    behavior: 'unavailable';
+    reason: string;
+    failClosed: boolean;
+    kickOutOfAuto?: boolean;
+    noVerdict?: boolean;
+} | {
+    behavior: 'transcriptTooLong';
+    reason: string;
+    headlessAbort: boolean;
+    actualTokens: number;
+    limitTokens: number;
+} | {
+    behavior: 'denialLimitExceeded';
+    reason: string;
+    headlessAbort: boolean;
+};
+/** Availability of auto mode for the current session/environment. */
+export interface AutoModeAvailability {
+    available: boolean;
+    reason?: 'disabledBySettings' | 'modelUnavailable';
+    message?: string;
+}
+/** Resolved auto mode rules (after $defaults expansion). */
+export interface AutoModeRules {
+    environment: string[];
+    allow: string[];
+    soft_deny: string[];
+    hard_deny: string[];
+}
+/**
+ * A classification request. The host passes the raw tool call plus the
+ * conversation transcript and user deny rules; the service owns all prompt
+ * assembly (system prompt + two-stage classifier).
+ */
+export interface AutoModePermissionRequest {
+    /** Session id, for per-session circuit-breaker / recent-denials bookkeeping. */
+    sessionId: string;
+    toolName: string;
+    toolInput: unknown;
+    /** The runtime mode (always Auto when this is invoked). */
+    currentMode: PermissionMode;
+    /** Abort signal tied to the host run; classifier must not outlive it. */
+    signal?: AbortSignal;
+    /** Whether the session can prompt the user (interactive) — drives fallback. */
+    canPrompt: boolean;
+    /**
+     * Whether the session is headless (outputFormat json / stream-json). On a
+     * transcript-too-long it drives ABORT instead of a prompt fallback.
+     */
+    headless?: boolean;
+    /**
+     * Conversation history to serialize into the `<transcript>` the classifier
+     * reads. The action being classified (toolName/toolInput) is appended as the
+     * most-recent entry by the serializer. History is DATA — it never grants
+     * permission. Loosely typed (AgentInputItem[]) to keep the protocol from
+     * depending on the agent runtime types.
+     */
+    transcript?: unknown[];
+    /** User-configured `permissions.deny` rules, injected into the classifier prompt. */
+    settingsDenyRules?: string[];
+}
+/**
+ * Auto mode permission service — the single entry point host code depends on.
+ */
+export interface AutoModePermissionService {
+    /** Gate: is auto mode usable right now (settings + model)? */
+    isAutoModeAvailable(): Promise<AutoModeAvailability>;
+    /**
+     * Whether `defaultMode: auto` may be granted by the settings sources present.
+     * Auto is privileged: only user / CLI scopes may grant it; project / project-local
+     * are ignored (anti repo self-grant). Enterprise policy/flag sources are not
+     * implemented in this product.
+     */
+    isSettingsAutoGrantAllowed(): Promise<boolean>;
+    /** Classify a tool call that would otherwise prompt. */
+    classifyAsk(request: AutoModePermissionRequest): Promise<AutoModePermissionResult>;
+}
+/**
+ * Per-stage local timeouts for a classifier call (ms), aligned with Claude Code
+ * 2.1.181: Stage 1 = 60s (`§9.2`), Stage 2 = 120s (`§9.3`). Stage 2 gets the
+ * longer budget because it runs the thinking pass with the large output budget.
+ */
+export declare const AUTO_MODE_CLASSIFIER_STAGE1_TIMEOUT_MS_DEFAULT = 60000;
+export declare const AUTO_MODE_CLASSIFIER_STAGE2_TIMEOUT_MS_DEFAULT = 120000;
+/**
+ * Env override for the classifier timeout. When set, it overrides BOTH stages
+ * (single knob — we do not expose per-stage env). Kept for backward compat with
+ * the previously single-timeout behaviour.
+ */
+export declare const AUTO_MODE_CLASSIFIER_TIMEOUT_ENV = "CODEBUDDY_AUTO_MODE_CLASSIFIER_TIMEOUT_MS";

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-settings.d.ts

@@ -0,0 +1,36 @@
+import { Logger } from '../../../workspace/telemetry/lib/common/index.js';
+import { AutoModeSettings, SettingsManager } from '../../settings';
+import { AutoModeRules } from './auto-mode-protocol';
+export declare const AutoModeSettingsResolver: unique symbol;
+export interface AutoModeSettingsResolver {
+    /** Effective auto mode rules after merging allowed sources and expanding $defaults. */
+    resolve(): Promise<AutoModeRules>;
+    /**
+     * Merged-but-UNEXPANDED custom rules (the `$defaults` token is preserved).
+     * Used by critique to (a) detect whether a section replaces or extends the
+     * defaults, and (b) filter out `$defaults` so only the user's own custom
+     * entries are reviewed — mirrors Claude `HDH()` + `is6()`.
+     */
+    resolveRaw(): Promise<AutoModeSettings>;
+}
+/**
+ * Resolves effective auto mode rules.
+ *
+ * Source policy (no enterprise policy/flag sources in this product):
+ *  - reads `autoMode` from user / project-local / CLI scopes
+ *  - shared project settings are NOT read (prevents checked-in repos injecting allow rules)
+ *
+ * `$defaults` semantics per section:
+ *  - section unset                  -> use built-in defaults
+ *  - array containing `$defaults`    -> expand defaults in place
+ *  - array without `$defaults`       -> replace built-in defaults (warns for soft/hard_deny)
+ */
+export declare class AutoModeSettingsResolverImpl implements AutoModeSettingsResolver {
+    protected readonly settingsManager: SettingsManager;
+    protected readonly logger: Logger;
+    resolve(): Promise<AutoModeRules>;
+    resolveRaw(): Promise<AutoModeSettings>;
+    /** Merge `autoMode` from allowed scopes (later scopes append after earlier ones). */
+    private mergeAllowedSources;
+    private expandSection;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-strategy.d.ts

@@ -0,0 +1,21 @@
+import { RunContext, ToolExecuteArgument } from '../../../vendor/cbc-shared/node/index.js';
+import { Session } from '../../../vendor/cbc-core/node/index.js';
+import { PermissionMode } from '../../../vendor/cbc-shared/node/index.js';
+import { SettingsManager } from '../../settings';
+import { BaseTool } from '../base-tool';
+import { ToolArg } from '../../../vendor/cbc-shared/node/index.js';
+import { ToolPermissionStrategy } from '../tool-protocol';
+/**
+ * Auto permission strategy — deterministic fast paths only.
+ *
+ * 1. acceptEdits fast path: anything acceptEdits would auto-allow, auto allows too.
+ * 2. safe tool allowlist: read-only / metadata built-ins auto-allow.
+ * 3. everything else returns `ask` → the service's unified outlet routes it into
+ *    the classifier (AutoModePermissionService). The classifier call deliberately
+ *    lives outside the strategy so the permission chain stays synchronous/testable.
+ */
+export declare class ToolPermissionAutoStrategy implements ToolPermissionStrategy {
+    mode: PermissionMode;
+    protected readonly settingsManager: SettingsManager;
+    needApproval(tool: BaseTool, runContext: RunContext<Session>, input: ToolExecuteArgument<any>, checkArgs: ToolArg[], callId?: string): Promise<boolean>;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-system-prompt-builder.d.ts

@@ -0,0 +1,28 @@
+import { PromptManager } from '../../../workspace/prompts/lib/common/index.js';
+import { AutoModeRules } from './auto-mode-protocol';
+export declare const AutoModeSystemPromptBuilder: unique symbol;
+/**
+ * Assembles the classifier system prompt by substituting resolved rules and the
+ * user's `permissions.deny` rules into the framework template.
+ *
+ * Mirrors Claude Code 2.1.179: the framework lives in the template with
+ * `<user_*_to_replace>` and `<settings_deny_rules>` placeholders; the rule lists
+ * and deny-rule section are injected at call time (binary `Pb_` / `QLK`). The
+ * framework text (Default Rule / Scope / User Intent Rule / Evaluation Rules /
+ * Classification Process / Definitions / Output Format) is NOT duplicated here.
+ */
+export interface AutoModeSystemPromptBuilder {
+    build(rules: AutoModeRules, settingsDenyRules: string[]): Promise<string>;
+}
+export declare class AutoModeSystemPromptBuilderImpl implements AutoModeSystemPromptBuilder {
+    protected readonly promptManager: PromptManager;
+    build(rules: AutoModeRules, settingsDenyRules: string[]): Promise<string>;
+    /** Replace `<tag>...</tag>` (default content included) with the formatted rule list. */
+    private replaceTag;
+    /**
+     * Render the user's `permissions.deny` rules as a classifier instruction
+     * (binary `QLK`): list the deny rules and tell the classifier to catch
+     * circumvention via a different tool. Empty when there are no deny rules.
+     */
+    private renderSettingsDenyRules;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-timeout.d.ts

@@ -0,0 +1,16 @@
+/** Which classifier stage a timeout applies to. */
+export type AutoModeStage = 1 | 2;
+/**
+ * Resolve the local timeout (ms) for an auto-mode classifier stage call.
+ * Aligned with Claude Code 2.1.181: Stage 1 = 60s, Stage 2 = 120s.
+ *
+ * `CODEBUDDY_AUTO_MODE_CLASSIFIER_TIMEOUT_MS`, when set, overrides BOTH stages
+ * (single knob, backward-compatible with the previous single-timeout behaviour).
+ */
+export declare function resolveAutoModeTimeoutMs(stage: AutoModeStage): number;
+/**
+ * Race a promise against a local timeout. Rejects with `${label} timed out after Nms`
+ * if the timeout fires first. Prevents lite-model calls from hanging forever when
+ * the model stream never completes.
+ */
+export declare function withAutoModeTimeout<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T>;

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-transcript-limit.d.ts

@@ -0,0 +1,29 @@
+import { AgentManager } from '../../../vendor/cbc-core/node/index.js';
+import { ProductManager } from '../../../workspace/product/lib/common/index.js';
+import { Logger } from '../../../workspace/telemetry/lib/common/index.js';
+export declare const AutoModeTranscriptLimit: unique symbol;
+export interface TranscriptLimitCheck {
+    tooLong: boolean;
+    actualTokens: number;
+    limitTokens: number;
+}
+/**
+ * Resolves the classifier model's usable transcript-token budget and checks a
+ * serialized transcript against it.
+ *
+ * Mirrors Claude Code 2.1.179 `transcript_too_long`: before calling the model,
+ * compare the transcript token estimate against the classifier model's context
+ * window (minus system-prompt and output reserves). The transcript is the whole
+ * conversation, so on long sessions this is a real limit — exceeding it must NOT
+ * hard-call the model (which would just error); the host falls back / aborts.
+ */
+export interface AutoModeTranscriptLimit {
+    check(transcript: string): Promise<TranscriptLimitCheck>;
+}
+export declare class AutoModeTranscriptLimitImpl implements AutoModeTranscriptLimit {
+    protected readonly agentManager: AgentManager;
+    protected readonly productManager: ProductManager;
+    protected readonly logger: Logger;
+    check(transcript: string): Promise<TranscriptLimitCheck>;
+    private resolveLimit;
+}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-transcript.d.ts

@@ -0,0 +1,50 @@
+import { AgentInputItem } from '../../../vendor/cbc-shared/node/index.js';
+/**
+ * Serializes session history + the action being classified into the single
+ * `<transcript>` text the classifier consumes.
+ *
+ * Aligned with Claude Code 2.1.181 `whK`/`$Pa` projection (NOT a verbatim dump):
+ *
+ *  - `user` text          → `User: <text>` (kept — it is the user-intent signal).
+ *  - `assistant` text     → DROPPED.
+ *  - `tool_result`        → DROPPED, except a non-error result answering a prior
+ *                           `AskUserQuestion` → `[User answered AskUserQuestion]: …`
+ *                           (the one tool_result Claude keeps, per User Intent #6).
+ *  - `tool_use`           → projected via the tool's `toAutoClassifierInput`;
+ *                           an empty projection or a read-only history tool
+ *                           (`HISTORY_READONLY_TOOLS`) is skipped entirely.
+ *
+ * Everything is text the model reads as DATA — it never grants permission (the
+ * framework system prompt states this explicitly). The last entry is the action
+ * being evaluated, appended by the caller via `action`.
+ *
+ * The per-tool projection is supplied by the caller (`projectToolUse`) so this
+ * module stays decoupled from the tool registry; the classifier client owns the
+ * `toolName → BaseTool.toAutoClassifierInput` lookup.
+ */
+/**
+ * History tool_use entries for these read-only tools are dropped from the
+ * classifier transcript (Claude `$gp`): they add no risk signal and only inflate
+ * the prompt. The *current action* is never filtered here — only history.
+ */
+export declare const HISTORY_READONLY_TOOLS: ReadonlySet<string>;
+/**
+ * JSONL transcript format toggle (Claude `jsonlTranscript`). Claude defaults to
+ * the compact text format; the JSONL variant is a server-flag-only path we do
+ * not enable. Kept as a const (not config) so the branch is exercised/visible
+ * without introducing an unused product setting (decision D1.3).
+ */
+export declare const AUTO_MODE_JSONL_TRANSCRIPT = false;
+/** The action being classified — projected to its security-relevant text by the caller. */
+export interface TranscriptAction {
+    toolName: string;
+    /** Result of the tool's `toAutoClassifierInput(input)` for this action. */
+    projected: string;
+}
+/**
+ * Projects a history tool_use into its classifier text, or `undefined` to skip
+ * the entry (empty projection / unknown tool). Read-only history tools are
+ * filtered by the serializer before this is consulted.
+ */
+export type HistoryToolProjector = (toolName: string, toolInput: unknown) => string | undefined;
+export declare function serializeTranscript(history: AgentInputItem[], action: TranscriptAction, projectToolUse: HistoryToolProjector): string;

package/cli/dist-server/types/node/tools/auto-mode/index.d.ts

@@ -0,0 +1,15 @@
+export * from './auto-mode-protocol';
+export * from './permission-mode-policy';
+export * from './auto-mode-timeout';
+export * from './auto-mode-defaults';
+export * from './auto-mode-allow-filter';
+export * from './auto-mode-denial-tracker';
+export * from './auto-mode-settings';
+export * from './auto-mode-project-instructions';
+export * from './auto-mode-system-prompt-builder';
+export * from './auto-mode-transcript';
+export * from './auto-mode-transcript-limit';
+export * from './auto-mode-classifier-client';
+export * from './auto-mode-critique-client';
+export * from './auto-mode-permission-service';
+export * from './auto-mode-strategy';

package/cli/dist-server/types/node/tools/auto-mode/permission-mode-policy.d.ts

@@ -0,0 +1,63 @@
+import { PermissionMode } from '../../../vendor/cbc-shared/node/index.js';
+/**
+ * Pure, shared judgments about the auto / dontAsk permission modes.
+ *
+ * Aggregated here so host files don't each re-implement `mode === Auto || mode === DontAsk`.
+ * These are the "restricted" modes: they never auto-approve via interruption-layer
+ * short-circuits, and sub-agents under them are clamped to a permission ceiling.
+ */
+/** Modes that must NOT be bypassed by interruption-layer direct-approve short-circuits. */
+export { isRestrictedDirectApproveMode } from '../../../vendor/cbc-shared/node/index.js';
+/**
+ * Whether a parent mode imposes a permission ceiling on sub-agents.
+ * Returns the ceiling mode to clamp to, or undefined when no clamp applies.
+ */
+export declare function permissionCeilingForParent(parentMode: PermissionMode | undefined): PermissionMode | undefined;
+/**
+ * Denial message shown when a tool is denied solely because mode is dontAsk.
+ *
+ * Wording aligned with Claude Code 2.1.181 (binary `yBl` + `jIo`): name the tool,
+ * surface the reason, then the `jIo` guidance — the agent MAY accomplish the goal
+ * with other natural tools but MUST NOT maliciously work around the denial, and
+ * should stop + explain to the user if the capability is essential. We also keep
+ * CodeBuddy's "add a permission rule" hint (user-helpful, not in conflict).
+ * `reason` is the underlying "why this needed approval" text.
+ */
+export declare function buildDontAskDenyMessage(toolName: string, reason: string): string;
+/**
+ * Message shown when the auto mode classifier is unavailable AND prompts cannot
+ * be shown (non-interactive), so the action is denied fail-closed.
+ *
+ * Wording aligned with Claude Code 2.1.179 (binary): the classifier is
+ * temporarily unavailable, retry later, and read-only operations still work
+ * without it.
+ */
+export declare function buildClassifierUnavailableDenyMessage(toolName: string, reason: string): string;
+/**
+ * Message shown when the classifier RAN but produced no usable verdict — e.g. a
+ * model whose reasoning cannot be disabled spent the whole classifier output
+ * budget on hidden thinking and returned nothing parseable.
+ *
+ * Distinct from `buildClassifierUnavailableDenyMessage` on purpose (Claude keeps
+ * the same split: `a9d` for an outage vs `x8s(reason, { refused: false })` for a
+ * `parse_failure`): the model is up, so "temporarily unavailable, wait and retry"
+ * would be wrong advice. Retrying an unsuitable classifier model reproduces the
+ * same empty answer, so the guidance is to stop and let the user pick a model.
+ * `reason` already names the model that ran and the setting that changes it.
+ */
+export declare function buildClassifierNoVerdictDenyMessage(toolName: string, reason: string): string;
+/**
+ * Message returned to the model when the auto mode classifier BLOCKS an action
+ * (a real `deny` verdict, not an outage). Aligned with Claude Code 2.1.196
+ * (binary `Qpc`): name the classifier + reason, tell the agent it may keep
+ * working on unrelated tasks, then append the shared PERMISSION_DENIED_GUIDANCE
+ * — the agent may accomplish the goal via other natural tools but MUST NOT try
+ * to bypass the intent of the denial, and if the capability is essential it
+ * should STOP and explain to the user and let the user decide.
+ *
+ * Without this guidance the deny result is a bare "denied" line, and some models
+ * fill the gap by popping an AskUserQuestion "shall I run it anyway?" prompt —
+ * effectively a one-click override of a SOFT BLOCK. The guidance steers the model
+ * toward explaining and deferring to the user instead of soliciting a rubber-stamp.
+ */
+export declare function buildClassifierDenyMessage(reason: string): string;

package/cli/dist-server/types/node/tools/bash-output-tool.d.ts

@@ -0,0 +1,34 @@
+import type { RunContext } from '@openai/agents';
+import { z } from 'zod';
+import { Session } from '../../vendor/cbc-core/node/index.js';
+import { BaseTool } from './base-tool';
+import { Tool } from './tool-protocol';
+import { ToolNames } from '../../vendor/cbc-shared/node/index.js';
+declare const BashOutputParameters: z.ZodObject<{
+    shell_id: z.ZodString;
+    filter: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    shell_id: string;
+    filter?: string | undefined;
+}, {
+    shell_id: string;
+    filter?: string | undefined;
+}>;
+export declare class BashOutputTool extends BaseTool implements Tool {
+    name: ToolNames;
+    aliases: string[];
+    needsApproval: boolean;
+    parameters: z.ZodObject<{
+        shell_id: z.ZodString;
+        filter: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        shell_id: string;
+        filter?: string | undefined;
+    }, {
+        shell_id: string;
+        filter?: string | undefined;
+    }>;
+    execute(input: z.infer<typeof BashOutputParameters>, context: RunContext<Session>): Promise<any>;
+    private formatDuration;
+}
+export {};