@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/cli/dist-server/types/vendor/cbc-core/node/utils/input-item-utils.d.ts

@@ -254,6 +254,33 @@ export declare abstract class InputItemUtils {
     static isAssistantMessage(item: AgentInputItem): boolean;
     static isSessionSeparatorItem(item: AgentInputItem): boolean;
     static isUserInterrupted(item: AgentInputItem): boolean;
+    static readonly TURN_ABORTED_TAG_OPEN = "<turn_aborted>";
+    static readonly TURN_ABORTED_TAG_CLOSE = "</turn_aborted>";
+    /**
+     * 取消轮在模型输入里的说明文案。
+     *
+     * 逐字沿用 Codex `core/src/context/turn_aborted.rs` 的 INTERRUPTED_GUIDANCE，
+     * 只把它自家的 "unified exec processes" 换成本 CLI 真实存在的 "background tasks"
+     * （Bash 的 run_in_background、后台 Agent）——照抄不存在的概念会误导模型。
+     */
+    static readonly TURN_ABORTED_GUIDANCE: string;
+    /**
+     * 把一条已落史的取消边界（assistant "Interrupted by user"）投影成模型可见的
+     * user 角色中断标记，对齐 Codex：原 prompt 留在历史里，后面紧跟一条
+     * `<turn_aborted>` 说明，下一轮用户输入再接在后面。
+     *
+     * 只用于构造当轮模型输入，不落盘：transcript 与 UI 继续显示原来那条 assistant
+     * 占位（见 `interruption-service`），所以 id / parentId 沿用边界项——既让
+     * 父链遍历仍然成立，也保证同一段历史每轮投影出的 id 稳定（换成随机 id 会让
+     * 模型输入每轮都变，破坏 prompt 缓存）。
+     *
+     * providerData 整体继承而不是重建：投影只改"角色 + 文本"这两件事，边界上的
+     * 结构化标记（`agent` / `truncated` 等）仍被后续管线用来做过滤决策
+     * （`replaceCompactWithSummary` 认 `agent`、`filterTruncatedHistory` 认
+     * `truncated`），重建一个干净 providerData 会让这些决策静默改变。
+     */
+    static createTurnAbortedMarker(boundaryItem: AgentInputItem): UserMessageItem;
+    static isTurnAbortedMarker(item: AgentInputItem): item is UserMessageItem;
     static isSuccessfulFunctionCallResultItem(item: AgentInputItem): item is FunctionCallResultItem;
     static isCompactBoundaryMessage(item: AgentInputItem): boolean;
     /**
@@ -266,6 +293,7 @@ export declare abstract class InputItemUtils {
     static isStructuredCompactBoundaryMessage(item: AgentInputItem): boolean;
     static isReplayRecoverableCompactMessage(item: AgentInputItem): item is UserMessageItem;
     static isCompactUserMessage(item: AgentInputItem): item is UserMessageItem;
+    static isCompactEnvelopeMessage(item: AgentInputItem): item is UserMessageItem;
     private static hasCompactBoundaryContent;
     static isCompactContinuePromptMessage(item: AgentInputItem): item is UserMessageItem;
     private static hasTeammateMessageContent;

package/cli/dist-server/types/vendor/cbc-core/node/utils/message-utils.d.ts

@@ -12,6 +12,7 @@ export declare abstract class MessageUtils {
      * @returns 合并后的消息列表
      */
     static mergeConsecutiveUserMessages(messages: AgentInputItem[]): AgentInputItem[];
+    private static shouldKeepUserMessageSeparate;
     /**
      * 合并用户消息组
      *

package/cli/dist-server/types/vendor/cbc-core/node/utils/model-utils.d.ts

@@ -69,14 +69,18 @@ export declare abstract class ModelUtils {
      * 各写一份 `||` 顺序漂移。
      */
     private static readRuntimeModelId;
-    static isHunyuanModel(session: Session): Promise<boolean>;
     /**
-     * ImageGen 实际使用的图片模型是否为混元。
+     * 从模型配置的 credits 字段解析计费倍率；未配置或无法解析时返回 undefined。
+     * 兼容 `x0.00` / `0.00x` / `x2.20 credits` 等格式，取首个数字。
+     */
+    private static parseCreditsValue;
+    /**
+     * 当前会话模型是否为免费模型。
      *
-     * 取「产品配置里第一个带 text-to-image tag 的模型」，与 image-service 的解析顺序一致；
-     * 配置里没有图片模型时会走客户端的混元兜底模型，同样按混元处理。
+     * 判据是模型计费（credits）：明确收费（> 0）不算免费；计费为 0、未配置或
+     * 无法解析时按免费处理。免费模型会话下生图会额外消耗积分，需要前置提醒。
      */
-    static isHunyuanImageModel(): Promise<boolean>;
+    static isFreeModel(session: Session): Promise<boolean>;
     static isMandatoryApprovalTarget(session: Session, targetToolName: string): Promise<boolean>;
 }
 export {};

package/cli/dist-server/types/vendor/cbc-shared/node/agent/custom-input-item-types.d.ts

@@ -1,4 +1,24 @@
 export declare const CUSTOM_INPUT_ITEM_TYPES: string[];
+/**
+ * 主模型自身响应之外结算的积分（子代理 / 团队成员、生图等生成工具），按主对话轮次记账。
+ * Metadata only：不送模型、不渲染。主模型的积分仍记在其输出条目的 `rawUsage.credit` 上，
+ * 两者相加即该轮总消耗，与 ACP `usage_update.cost` 推送口径一致。
+ */
+export interface CreditUsageItem {
+    type: 'credit-usage';
+    id: string;
+    parentId?: string;
+    timestamp: number;
+    providerData: Record<string, unknown> & {
+        /** 积分归属的主对话轮次（与 `usage_update._meta['codebuddy.ai/requestId']` 同源） */
+        conversationRequestId: string;
+        credit: number;
+        source: 'team_member' | 'generation_tool';
+        /** 结算阶段唯一标识，回放按它去重 */
+        stageId: string;
+        messageId?: string;
+    };
+}
 /** A completed model response whose usage has no committed output item.
  * Metadata only: never submitted to the model or displayed as a message.
  * Uses the same provider usage and generation identity as normal output items.

package/cli/dist-server/types/vendor/cbc-shared/node/agent/openai-agents-types.d.ts

@@ -29,7 +29,7 @@
 import type { addTraceProcessor as addTraceProcessorFn, Agent as AgentTypeCtor, AgentConfiguration, AgentInputItem as OriginalAgentInputItem, AgentOptions, AssistantMessageItem as OriginalAssistantMessageItem, ComputerCallResultItem as OriginalComputerCallResultItem, ComputerUseCallItem as OriginalComputerUseCallItem, FunctionCallItem as OriginalFunctionCallItem, FunctionCallResultItem as OriginalFunctionCallResultItem, FunctionTool as FunctionToolTypeCtor, Handoff as HandoffTypeCtor, handoff as handoffFn, HostedToolCallItem as OriginalHostedToolCallItem, Model as ModelType, ModelProvider as ModelProviderType, NonStreamRunOptions, OpenAIChatCompletionsModel as OpenAIChatCompletionsModelTypeCtor, ReasoningItem as OriginalReasoningItem, ResponseStreamEvent, RunConfig, RunContext as RunContextTypeCtor, RunItem, Runner as RunnerTypeCtor, RunResult as RunResultTypeCtor, RunState as RunStateTypeCtor, RunToolApprovalItem as RunToolApprovalItemTypeCtor, setTraceProcessors as setTraceProcessorsFn, StreamedRunResult as RawStreamedRunResultTypeCtor, StreamRunOptions, SystemMessageItem as OriginalSystemMessageItem, Tool as OpenAIToolType, tool as toolTypeCtor, ToolExecuteArgument, UnknownItem as OriginalUnknownItem, Usage as UsageTypeCtor, UserMessageItem as OriginalUserMessageItem } from '@openai/agents';
 import type { AgentOutputType, getAllMcpTools as getAllMcpToolsFn, MaxTurnsExceededError as MaxTurnsExceededErrorTypeCtor, ModelBehaviorError as ModelBehaviorErrorTypeCtor } from '@openai/agents-core';
 import type { TextOutput, UnknownContext, UserContent } from '@openai/agents-core/types';
-import type { AcpTerminalStateItem, FileHistorySnapshotItem, ModelUsageItem, ResendForkNoticeItem } from './custom-input-item-types';
+import type { AcpTerminalStateItem, CreditUsageItem, FileHistorySnapshotItem, ModelUsageItem, ResendForkNoticeItem } from './custom-input-item-types';
 export * from './custom-input-item-types';
 export type { RunStreamEvent } from '@openai/agents-core';
 export type Agent<TContext = UnknownContext, TOutput extends AgentOutputType = TextOutput> = AgentTypeCtor<TContext, TOutput>;
@@ -98,7 +98,7 @@ export type UnknownItem = OriginalUnknownItem & ExtendedProperties;
 /**
  * Extended AgentInputItem with additional properties for conversation tree structure
  */
-export type AgentInputItem = (OriginalAgentInputItem | CustomTitleItem | TopicItem | AiTitleItem | FileHistorySnapshotItem | SummaryItem | GoalResultItem | GoalProgressItem | TurnMetricsItem | ResendForkNoticeItem | AcpTerminalStateItem | ModelUsageItem) & ExtendedProperties;
+export type AgentInputItem = (OriginalAgentInputItem | CustomTitleItem | TopicItem | AiTitleItem | FileHistorySnapshotItem | SummaryItem | GoalResultItem | GoalProgressItem | TurnMetricsItem | ResendForkNoticeItem | AcpTerminalStateItem | ModelUsageItem | CreditUsageItem) & ExtendedProperties;
 export interface CustomTitleItem {
     type: 'custom-title';
     customTitle: string;

package/cli/dist-server/types/vendor/cbc-shared/node/index.d.ts

@@ -1,6 +1,7 @@
 export * from './agent/openai-agents-types';
 export * from './agent-home/agent-home-envelope-body';
 export * from './utils/abort-utils';
+export * from './utils/concurrency-utils';
 export * from './utils/retry-backoff';
 export * from './utils/retry-policy';
 export * from './settings/settings-types';

package/cli/dist-server/types/vendor/cbc-shared/node/model/model-errors.d.ts

@@ -95,6 +95,14 @@ export declare class ModelConfigError extends CustomError {
  * 详见 `docs/error-codes.md` 的「文案来源：后端下发优先，前端 i18n 兜底」。
  */
 export declare const customModelMissingUrlMessage: (modelId: string) => string;
+/**
+ * 自定义模型缺少 API Key 时的 message 模板。
+ *
+ * 与 {@link customModelMissingUrlMessage} 同构、同一个错误码（4100）——两者都是
+ * 「本地自定义模型请求前必需字段缺失」，前端按 4100 统一展示合并文案（不区分具体
+ * 缺哪个字段），本 message 只面向日志 / CLI 终端排障。
+ */
+export declare const customModelMissingApiKeyMessage: (modelId: string) => string;
 /**
  * 本地拉起模型（`local: true`，GGUF + llama-server）缺少接入地址时的 message 模板。
  *
@@ -109,19 +117,28 @@ export declare const CUSTOM_MODEL_CONFIG_ERROR_CATEGORY = "custom_model_config";
 /**
  * 自定义模型配置错误
  *
- * 自定义模型没有可用的接入地址时抛出。这类请求既不能发往用户自己的端点（地址就是缺的那一项），
+ * 自定义模型缺少 id / url / apiKey 三项必需字段任一时抛出。这类请求既不能发往用户自己的
+ * 端点（地址本身就缺，或缺 key 发出去也只会把 accessToken 泄露给第三方端点后收到 401），
  * 也**不允许**回落到产品默认网关：裸模型名在我方模型表里必然查不到，只会换回一个 11102
  * 「当前模型不可用，请切换其他模型」，把用户的配置问题误导成模型问题，且用户无法自助修复。
  *
  * `data` 由 ACP 层的 `extractStructuredErrorData` 读取后透传到客户端（headless 的
- * `errors_info[]` 同样会带上），前端按 4100 查 i18n 给出本地化的可操作文案。
+ * `errors_info[]` 同样会带上），前端按 4100 查 i18n 给出本地化的合并文案（不区分具体缺
+ * 哪个字段）。
  *
- * message 请用 {@link customModelMissingUrlMessage} 构造，保持与同族错误一致的英文口径。
+ * message 请用 {@link customModelMissingUrlMessage} / {@link customModelMissingApiKeyMessage}
+ * 构造，保持与同族错误一致的英文口径。
+ *
+ * `modelId` 是本轮出错的模型身份（issue #136649）：4100 在模型调用前拦截，本轮不会有任何
+ * 带 `requestModelId` 的响应行落盘，唯一落到 JSONL 的是 InterruptionService 的 skipRun 错误
+ * 行，它只从本错误的 `data` 里取得到模型 id。缺了它，重启后客户端恢复出的「前往配置」提示卡
+ * 拿不到 modelId，跳转会退化成打开模型设置列表，而不是该模型的编辑页。
  */
 export declare class CustomModelConfigError extends CustomError {
     readonly data: Readonly<{
-        code: 4100;
-        category: "custom_model_config";
+        code: number;
+        category: string;
+        modelId?: string;
     }>;
-    constructor(message: string);
+    constructor(message: string, modelId?: string);
 }

package/cli/dist-server/types/vendor/cbc-shared/node/tools/tool-names.d.ts

@@ -35,6 +35,8 @@ export declare enum ToolNames {
     IMAGE_EDIT = "ImageEdit",
     ARTIFACT = "Artifact",
     ARTIFACT_CONTROL = "ArtifactControl",
+    /** 资料库上传：把本地单个文件上传为资料库节点。工具名按既有外部契约固定为下划线风格。 */
+    LIBRARY_UPLOAD = "LibraryUpload",
     TEAM_CREATE = "TeamCreate",
     TEAM_DELETE = "TeamDelete",
     SEND_MESSAGE = "SendMessage",

package/cli/dist-server/types/vendor/cbc-shared/node/utils/concurrency-utils.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Map items with a bounded number of async workers while preserving input
+ * order in the returned results.
+ */
+export declare function mapWithConcurrency<T, R>(items: readonly T[], concurrency: number, mapper: (item: T, index: number) => Promise<R>): Promise<R[]>;

package/cli/dist-server/types/workspace/agent-client-protocol/lib/common/prompt-codec.d.ts

@@ -103,6 +103,8 @@ export declare function parseLexiangUri(uri: string): ParsedLexiangUri | undefin
  *  - `Hello @ima:"KB" world` → `Hello KB world`
  */
 export declare function stripInlineBadgesFromText(text: string): string;
+/** 只清理标题里的微信/企微隐藏上下文，不修改发给模型或用于回放的原始消息。 */
+export declare function stripWechatContextFromTitle(text: string): string;
 /**
  * Extract human-readable text from a flattened prompt for use as a conversation title.
  * This is the single title-display policy for typed badges:

package/cli/dist-server/types/workspace/agent-client-protocol/lib/common/security-review-reason-code.d.ts

@@ -1,27 +1,17 @@
 export declare const ToolRiskReasonCode: {
     readonly NoMaterialRisk: 'no_material_risk';
-    readonly UnrequestedMaterialChange: 'unrequested_material_change';
-    readonly ExternalCodeExecution: 'external_code_execution';
     readonly SensitiveDataAccess: 'sensitive_data_access';
     readonly DataEgress: 'data_egress';
-    /** 仅兼容历史审批，不接受为当前 Reviewer 的输出。 */
-    readonly DestructiveChange: 'destructive_change';
     readonly SecurityOrPersistenceChange: 'security_or_persistence_change';
-    readonly RemoteStateChange: 'remote_state_change';
     readonly CustomRuleViolation: 'custom_rule_violation';
 };
 export type ToolRiskReasonCode = typeof ToolRiskReasonCode[keyof typeof ToolRiskReasonCode];
 /** Host 自身的确认原因不属于 Reviewer 模型输出协议。 */
 export declare const ToolRiskApprovalReasonCode: {
     readonly NoMaterialRisk: 'no_material_risk';
-    readonly UnrequestedMaterialChange: 'unrequested_material_change';
-    readonly ExternalCodeExecution: 'external_code_execution';
     readonly SensitiveDataAccess: 'sensitive_data_access';
     readonly DataEgress: 'data_egress';
-    /** 仅兼容历史审批，不接受为当前 Reviewer 的输出。 */
-    readonly DestructiveChange: 'destructive_change';
     readonly SecurityOrPersistenceChange: 'security_or_persistence_change';
-    readonly RemoteStateChange: 'remote_state_change';
     readonly CustomRuleViolation: 'custom_rule_violation';
     readonly ActionIncomplete: 'action_incomplete';
     readonly ContentInjection: 'content_injection';

package/cli/dist-server/types/workspace/cbc-checkpoint/lib/node/checkpoint/checkpoint-path-utils.d.ts

@@ -6,6 +6,16 @@ export declare class CheckpointRestoreValidationError extends Error {
 export declare function assertSafeCheckpointSessionId(sessionId: unknown): string;
 /** Resolve a backup only after proving it stays inside this session's store. */
 export declare function resolveCheckpointBackupPath(sessionId: string, backupFileName: string): string;
+/**
+ * Drop snapshot entries whose destination resolves outside the restore roots.
+ *
+ * File tools may legitimately write outside the workspace (scratch files under
+ * /tmp, user-level memory files), and those writes are tracked. They carry no
+ * restore authority, so restore must never write them — but one scratch file
+ * must not block restoring the workspace either. Entries that cannot be
+ * resolved are kept so assertCheckpointRestoreSafe still rejects them.
+ */
+export declare function scopeCheckpointToWorkspace(session: Session, checkpoint: Checkpoint): Checkpoint;
 /**
  * Validate the complete file snapshot before preview or restore performs I/O.
  * The durable cwd is authoritative; live sessions may additionally grant their

package/cli/dist-server/types/workspace/cbc-checkpoint/lib/node/checkpoint/checkpoint-service.d.ts

@@ -42,6 +42,8 @@ export declare class CheckpointServiceImpl implements CheckpointService {
     hasRewindableCheckpoint(session: Session): boolean;
     getLatestCheckpoint(session: Session): Checkpoint;
     private getLatestCheckpointForRestore;
+    /** 当前快照中可恢复的部分；不修改 session.checkpoint。 */
+    private getWorkspaceCheckpointForRestore;
     private getLatestCheckpointAtCwd;
     shouldSkipCheckpoint(session: Session): Promise<boolean>;
     compareWithCurrentFiles(session: Session, targetCheckpoint: Checkpoint): Promise<CheckpointFileChangeStats>;

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/agent-protocol.d.ts

@@ -1,6 +1,6 @@
 import { Agent, type AgentInputItem, type AgentOptions, type NonStreamRunOptions, type RunConfig, Runner, RunState, type StreamRunOptions, type Usage } from '../../../../cbc-shared/lib/node/index.js';
 import { Agent as ProductAgentConfiguration, Command, LanguageModel, ModelVariantType } from '../../../../product/lib/common/index.js';
-import type { SecurityReviewFailureReason, W3CTraceContextMeta } from '../../../../telemetry/lib/common/index.js';
+import type { SecurityReviewFailureReason, SecurityReviewModelCallPayload, SecurityReviewType, W3CTraceContextMeta } from '../../../../telemetry/lib/common/index.js';
 import type { Session, SessionOptions } from '../session/session-protocol.js';
 import type { AgentPurpose } from './agent-purpose-protocol.js';
 import type { AgentRunContinuation, AgentRunOrigin } from './agent-run-scope.js';
@@ -614,10 +614,15 @@ export interface ReviewerOneTimeRequest {
     temperature: number;
     signal?: AbortSignal;
     purpose: AgentPurpose.SecurityReviewer | AgentPurpose.ContentSecurityReviewer;
-    /** 只用于解析当前主模型，不向审查调用复制历史、工具或权限。 */
+    /** 只用于解析当前主模型和关联上报，不向审查调用复制历史、工具或权限。 */
     callerSession?: Session;
     /** 首次失败时立即通知，整体超时也能保留回退前的错误。 */
     onRecovery?: (recovery: ReviewerRecovery) => void;
+    reviewType: SecurityReviewType;
+    /** 模型已返回但输出不构成有效结论时返回失败原因，用于判定本次调用是否成功。 */
+    validateResult?: (result: ReviewerOneTimeResult) => SecurityReviewFailureReason | undefined;
+    /** 每次模型调用结算一次；signal 以 'timeout' 为 reason 中止时记为超时。 */
+    onModelCall?: (call: SecurityReviewModelCallPayload, callerSession?: Session) => void;
 }
 export interface ReviewerOneTimeResult {
     output: string;
@@ -760,6 +765,11 @@ export interface AgentRunRequest<TContext = Session> extends SessionOptions {
     skipAddHistory?: boolean;
     bypassMessageQueue?: boolean;
     inputOrigin?: AgentRunOrigin;
+    /**
+     * Whether the batch admitted by MessageQueue contains an external user prompt.
+     * Captured before History replaces input with the active conversation history.
+     */
+    hasExternalUserPromptAtAdmission?: boolean;
     /** Process-local arrival callback; never passed to the SDK. */
     onResult?: AgentStandardRunOptions['onResult'];
     traceId?: string;

package/cli/dist-server/types/workspace/cbc-core/lib/node/agent/reviewer-recovery.d.ts

@@ -16,4 +16,11 @@ export declare class ReviewerModelError extends Error {
     constructor(failureReason: SecurityReviewFailureReason, circuitFailureReason?: SecurityReviewFailureReason | undefined);
 }
 export declare function classifyReviewerError(error: unknown, timedOut?: boolean, cancelled?: boolean): SecurityReviewFailureReason;
+type ReviewerAbortReason = Extract<SecurityReviewFailureReason, 'timeout' | 'cancelled'>;
+/** 中止 reason 即失败原因，模型调用上报经 {@link reviewerAbortReason} 读回以区分超时与取消。 */
+export declare function abortReviewer(controller: AbortController, timedOut: boolean): void;
+export declare function reviewerAbortReason(signal: AbortSignal): ReviewerAbortReason;
+/** 输出被截断无法得到完整结论，按输出不合规处理；网关两种 content filter 拼写都会出现。 */
+export declare function classifyReviewerFinishReason(finishReason: string | undefined): Extract<SecurityReviewFailureReason, 'schema_invalid' | 'content_filter'> | undefined;
 export declare function canRetryReviewer(reason: SecurityReviewFailureReason): boolean;
+export {};

package/cli/dist-server/types/workspace/cbc-core/lib/node/context/mods-bridge.d.ts

@@ -1,8 +1,35 @@
-import type { AgentInputItem } from '../../../../cbc-shared/lib/node/index.js';
+import { type AgentInputItem } from '../../../../cbc-shared/lib/node/index.js';
 import type { PromptContext } from './context-protocol.js';
 export interface ModsPromptSubmitResult {
     text?: string;
     drop?: string;
+    context?: readonly string[];
+}
+export interface ModsPromptAttachment {
+    readonly type: 'image' | 'audio' | 'document';
+    readonly mediaType?: string;
+    readonly filename?: string;
+}
+export interface ModsExecutionContext {
+    readonly sessionId: string;
+    readonly cwd: string;
+    readonly signal?: AbortSignal;
+}
+export interface ModsToolCall {
+    readonly name: string;
+    readonly input: unknown;
+    readonly callId?: string;
+    readonly agentId?: string;
+    readonly signal?: AbortSignal;
+    readonly onResult?: (result: {
+        context?: readonly string[];
+        isError?: boolean;
+    }) => void;
+}
+export interface ModsToolDescription {
+    readonly description: string;
+    /** Omission keeps the Agent's existing placement policy. */
+    readonly isDeferred?: boolean;
 }
 /** Host-only provenance: a mod initiated submission has already traversed the fold. */
 export declare const MODS_PROMPT_SUBMITTED_KEY = "modsPromptSubmitted";
@@ -29,6 +56,11 @@ export declare const MODS_PROMPT_SUBMITTED_KEY = "modsPromptSubmitted";
  * 不构造对象、不进 async、不改变任何既有行为。
  */
 export interface ModsBridge {
+    /** Host middleware; the execution callback retains validation and permission checks. */
+    toolCall?<T>(input: ModsToolCall, execute: (input: unknown) => Promise<T>): Promise<T>;
+    toolDescription?(name: string, description: string, isDeferred?: boolean): Promise<ModsToolDescription>;
+    /** First-message context, cached by the owning Session until its history resets. */
+    initialContext?(context: PromptContext, render: (context: PromptContext) => Promise<string | undefined>): Promise<readonly string[]>;
     /**
      * 上下文装配完成、尚未拼成最终 prompt 时问一句。
      *
@@ -53,6 +85,7 @@ export interface ModsBridge {
      */
     promptSubmit(input: {
         text: string;
+        attachments?: readonly ModsPromptAttachment[];
         sessionId?: string;
         signal?: AbortSignal;
     }): Promise<ModsPromptSubmitResult | undefined>;
@@ -81,6 +114,9 @@ export interface ModsBridge {
         plugin: string;
     }): void;
 }
+/** A Server query owns its bridge; child work inherits the originating execution. */
+export declare function withModsBridge<T>(bridge: ModsBridge | undefined, context: ModsExecutionContext, run: () => T): T;
+export declare function currentModsExecutionContext(): ModsExecutionContext | undefined;
 /**
  * 注入桥。宿主在 mods 运行时起来之后调用一次。
  *
@@ -101,7 +137,7 @@ export declare function currentModsBridge(): ModsBridge | undefined;
  */
 export declare function throughModsPromptContext(context: PromptContext): Promise<PromptContext>;
 /** A failed third-party fold must not corrupt or lose the original input. */
-export declare function throughModsPromptSubmit(text: string, sessionId?: string, signal?: AbortSignal): Promise<ModsPromptSubmitResult | undefined>;
+export declare function throughModsPromptSubmit(text: string, sessionId?: string, signal?: AbortSignal, attachments?: readonly ModsPromptAttachment[]): Promise<ModsPromptSubmitResult | undefined>;
 /** Mutates only user text, before the shared history/model consumers see these items. */
 export declare function applyModsPromptSubmit(items: AgentInputItem[], sessionId: string, signal?: AbortSignal): Promise<string | undefined>;
 /**

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/background-task-protocol.d.ts

@@ -1,8 +1,22 @@
 import type { AcpTerminalEndReason } from '../../../../cbc-shared/lib/node/index.js';
+export interface BackgroundTaskOutputRead {
+    /** Absolute character offset requested for this read, clamped to the current output range. */
+    fromOffset: number;
+    /** Absolute character offset immediately after the returned snapshot. */
+    nextOffset: number;
+    /** Preserved output for the requested range, including an omission marker when needed. */
+    content: string;
+    /** Unread characters no longer retained by the bounded buffer. */
+    omittedLength: number;
+}
 /** Output buffer capabilities used by task producers and consumers. */
 export interface BackgroundTaskOutputBuffer {
     push(data: string): void;
     toString(withMarker?: boolean): string;
+    /** Absolute character offset at the current end of the output stream. */
+    getEndOffset(): number;
+    /** Read output retained after an absolute character offset. */
+    readSince(offset: number): BackgroundTaskOutputRead;
     isEmpty(): boolean;
     getHead(): string;
     getTail(): string;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/interruption-service.d.ts

@@ -132,6 +132,7 @@ export declare class InterruptionServiceImpl implements InterruptionService {
     reject(item: RunToolApprovalItem, options?: {
         decision?: 'deny' | 'rejectAndExitPlan';
         cancelTurn?: boolean;
+        interrupted?: boolean;
     }): void;
     /**
      * 取消指定 session 上所有未决的 interruption Deferred。
@@ -168,6 +169,9 @@ export declare class InterruptionServiceImpl implements InterruptionService {
      */
     releaseSession(target: string | Session): void;
     protected handleInterruptions(session: Session, interruptions: RunToolApprovalItem[], result?: RunResult<any, any> | StreamedRunResult<any, any> | undefined): Promise<void>;
+    /** An in-process middleware continuation waits here without finishing the SDK run. */
+    requestHostToolApproval(session: Session, item: RunToolApprovalItem): Promise<void>;
+    private autoApproveTool;
     private processInterruptions;
     protected executePendingManualPostCompactHook(session: Session, result: RunResult<any, any> | StreamedRunResult<any, any>): Promise<void>;
     waitFor(session: Session): Promise<void>;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-hook-host-protocol.d.ts

@@ -5,7 +5,8 @@ export interface SessionHookHost {
     readonly notificationTitle: string;
     getWorkDir(): string;
     sendNotification(message: string, notificationType: NotificationType | undefined, session: Session | undefined): Promise<void>;
-    registerWatchPaths(paths: unknown, onChange: (path: string, event: 'change' | 'add' | 'unlink') => void): {
+    /** onChange 返回的 Promise 会被等待，用于对批量文件变更做背压。 */
+    registerWatchPaths(paths: unknown, onChange: (path: string, event: 'change' | 'add' | 'unlink') => void | Promise<void>): {
         watcherCount: number;
         dispose(): void;
     };

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-interruption-host-protocol.d.ts

@@ -80,6 +80,8 @@ export interface SessionInterruptionSecurityHost {
         assistedMode: TurnSecurityReviewPolicy['assistedApprovalMode'];
     }): void;
     reportAutomaticApprovalOutcome?(input: {
+        session: Session;
+        toolCallId?: string;
         reviewType: 'tool_call' | 'tool_result' | 'sandbox';
         toolName: string;
         decision: 'allow_once' | 'cancel';
@@ -93,6 +95,7 @@ export interface SessionInterruptionSecurityHost {
         scope: 'sandbox';
         decision: 'allow' | 'deny';
         decidedBy: 'ai' | 'user';
+        assistedMode?: 'manual' | 'silent' | 'risk_hint';
         reason?: string;
         reviewDecision?: 'allow' | 'deny';
         reviewReason?: string;

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-protocol.d.ts

@@ -955,6 +955,8 @@ export interface InputText {
 export interface SessionOptions {
     /** Host workspace for local transcript reads/writes; omitted uses the CLI working directory. */
     cwd?: string;
+    /** Set by the native TUI loopback request; ACP sessions set this to false. */
+    interactive?: boolean;
     debug?: boolean | string;
     debugToStderr?: boolean;
     verbose?: boolean;
@@ -1062,13 +1064,13 @@ export interface SessionFactory {
 /**
  * 传给 SessionManager/SessionStore.get() 的选项。
  *
- * 默认情况下，session 反序列化会施加一个逆序截断（仅读最近 ~1000 条历史），
+ * 默认情况下，session 反序列化会从尾部截断（仅读最近 ~1000 条历史），
  * 目的是保证正常运行时（会话续聊、模型上下文装配）的性能与内存占用。
  * 展示型场景（如历史回放给前端完整聊天视图）可以通过 `historyLimit` 放大上限。
  */
 export interface SessionGetOptions {
     /**
-     * 从 jsonl 逆序读取的历史 item 数上限。
+     * 从 jsonl 尾部加载的历史 item 数上限。
      *
      * - 未传：沿用默认 1000（服务于续聊、checkpoint、模型上下文等场景）。
      * - 显式传值：按该值截断（如展示型 replay 传 10000）。
@@ -1561,10 +1563,14 @@ export interface PendingApprovalView {
     queueTotal: number;
 }
 export interface InterruptionService {
+    /** Host middleware may wait for the existing approval path inside a running tool. */
+    requestHostToolApproval(session: Session, item: RunToolApprovalItem): Promise<void>;
     approve(item: RunToolApprovalItem, options?: ApprovalOptions): void;
+    /** `interrupted`：非用户决策的收尾（会话中止、请求异常等），只结算审批状态，不计入审批决策。 */
     reject(item: RunToolApprovalItem, options?: {
         decision?: 'deny' | 'rejectAndExitPlan';
         cancelTurn?: boolean;
+        interrupted?: boolean;
     }): void;
     waitFor(session: Session): Promise<void>;
     /** Resolve the main/leader session for a given session (returns self if already main). */

package/cli/dist-server/types/workspace/cbc-core/lib/node/session/session-store.d.ts

@@ -5,6 +5,12 @@ import { LocalJsonlSessionStore } from './local-jsonl-session-store.js';
 import { type Session, SessionFactory, type SessionForkMutationOptions, type SessionGetOptions, type SessionRewindMutationOptions, SessionStore, type TranscriptPersistenceMetrics } from './session-protocol.js';
 import type { Lane, LanePointer, SessionKey, SessionStoreEntry } from './session-store-contract.js';
 import { SessionImageStorage as ImageBlobService, SessionRestoreHost, SessionStoragePaths, SessionToolOutputStorage as ToolResultBlobService } from './session-store-host-protocol.js';
+/**
+ * Read transcript tails in moderately sized blocks. Small files naturally use
+ * one read, while large files stop as soon as the requested history window is
+ * complete instead of retaining the entire transcript in memory.
+ */
+export declare const SESSION_REVERSE_READ_CHUNK_BYTES: number;
 /**
  * session/load 回放时 history 的默认最大条数。
  * 达到此阈值且遇到 user message 时停止逆序读取，避免启动时全量读 JSONL。
@@ -31,6 +37,23 @@ export declare const DEFAULT_SESSION_MAX_ITEMS = 1000;
 export declare const SESSION_META_TAIL_REFRESH_LINES = 200;
 /** 文件头 session-meta 兜底读取的字节窗口（存量会话用，不做全量回扫）。与上者配对，见其注释。导出以便 spec 钉住配对约束。 */
 export declare const SESSION_META_HEAD_SCAN_BYTES: number;
+/**
+ * 会话标题事实在 session-meta 里的键（#138181）。
+ *
+ * 标题 item（`custom-title` / `ai-title` / `topic`）只在生成/重命名那一刻写一次，通常在
+ * 文件头；history 逆序读封顶 {@link DEFAULT_SESSION_MAX_ITEMS}，长会话 resume 读不到它
+ * → 标题服务判为未命名、拿窗口内的中途消息重新生成，覆盖原任务名。
+ *
+ * 值是 `SessionTitleFact` 数组（session-title-utils）：标题服务判定所依赖的两条事实 ——
+ * `hasCustomTitle` 看的最新非空 `custom-title`，`hasGeneratedTitle` 看的最新真实
+ * `ai-title`（没有时是 `topic`）。跟着 session-meta 走，就复用了 #128860 的尾部刷新与
+ * 文件头兜底，且 session-meta 是 off-tree 行，不进 history、不会被 replay 再发一次。
+ * 读侧把窗口里缺的事实合成回 history 最前面，按 history 判标题的调用方无需改动。
+ *
+ * 标题事实只增不删（空 custom-title 不覆盖更早的非空项，见 `hasCustomTitle`），
+ * 所以按键继承、不登记 {@link SNAPSHOT_ONLY_SESSION_META_KEYS}。
+ */
+export declare const SESSION_TITLE_META_KEY = "codebuddy.ai/sessionTitle";
 /**
  * Keys of session.meta that persist across processes (the off-tree
  * session-meta line; bin resume only — served sessions never write). A
@@ -38,11 +61,12 @@ export declare const SESSION_META_HEAD_SCAN_BYTES: number;
  * never lands on disk. Literals kept in sync with MAIN_AGENT_META_KEY /
  * MAIN_AGENT_HOST_KIND_KEY (agent/main-agent-session.ts, #97166) and
  * MULTITASK_MODE_META_KEY (multitask overlay) and A2A_CONTEXTS_META_KEY
- * (a2a/a2a-context-store.ts). The spec asserts the sync. Growing this list is
- * a review decision, not a side effect of putting a key on session.meta.
+ * (a2a/a2a-context-store.ts), plus SESSION_TITLE_META_KEY above (#138181).
+ * The spec asserts the sync. Growing this list is a review decision, not a
+ * side effect of putting a key on session.meta.
  * Role / locks / parentSessionId stay runtime-only.
  */
-export declare const PERSISTED_SESSION_META_KEYS: readonly ['codebuddy.ai/mainAgent', 'codebuddy.ai/hostKind', 'multitaskMode', 'codebuddy.ai/a2aContexts'];
+export declare const PERSISTED_SESSION_META_KEYS: readonly ['codebuddy.ai/mainAgent', 'codebuddy.ai/hostKind', 'multitaskMode', 'codebuddy.ai/a2aContexts', "codebuddy.ai/sessionTitle"];
 /**
  * 白名单里「缺席即删除」的键：只认最新那一行的存在性，不向更早的行按键继承。
  *
@@ -244,6 +268,12 @@ export declare class SessionStoreImpl implements SessionStore {
      * 写了，另外三份没写，导致 fork 后关掉多任务写不出墓碑、行数计数带着旧值）。
      */
     private markTailMetaPersisted;
+    /**
+     * 读侧发现尾部快照不全（事实只能从文件头 / 窗口外拼回来）：标记过期并把计数播种成
+     * 阈值，下一批 append 立即补一条完整快照。冷启动 resume 的进程内计数从 0 开始，
+     * 若不播种、本次又没补写就重启，长会话会长期不刷新尾部 meta。
+     */
+    private markTailMetaStale;
     /**
      * 让「最新 session-meta」始终留在读侧的逆序窗口内（#128860 根治的写入侧）。
      *
@@ -255,17 +285,32 @@ export declare class SessionStoreImpl implements SessionStore {
      */
     private refreshTailSessionMeta;
     /**
-     * 文件头的 session-meta 兜底读取。
+     * 把本批追加的标题 item 并进 `session.meta` 的标题事实（#138181 的写入侧）。
+     *
+     * 增量合并「已知事实 + 本批标题」：标题只在生成/重命名时出现，其余批次直接跳过，
+     * 不回扫 history。meta 里还没有这个键（经别的加载路径拿到的 session）时才从内存
+     * history 起底一次。落盘交给紧随其后的 {@link refreshTailSessionMeta}：行距内
+     * 原始标题 item 本身就在尾部窗口里，之后每 {@link SESSION_META_TAIL_REFRESH_LINES}
+     * 行的快照都带着这份事实 —— session-meta 是 off-tree 行，补写不受同 id 响应组约束。
+     */
+    private trackSessionTitleFacts;
+    /**
+     * 文件头的 off-tree 事实兜底读取：session-meta 行与标题 item。
      *
      * `session-meta` 创建行通常在文件靠前的位置（新建会话是第 1 行；子会话/迁移过的
      * 会话可能更靠后），而 history 逆序读有 item 上限——长会话倒着读到不了那里
-     * （#128860）。这里只读文件头一小段，不做全量回扫：
+     * （#128860）。首轮的 `ai-title` 同理，落盘在文件头几行（#138181）。这里只读文件头
+     * 一小段，不做全量回扫：
      * 29MB 的会话里末尾 1100 行只占 20% 字节，回扫到头会把 resume 的读 I/O 放大 5×。
      *
      * 返回窗口内所有 session-meta 的 meta（文件序，旧→新），由
-     * {@link composeSessionMeta} 统一合并。
+     * {@link composeSessionMeta} 统一合并；标题时间线（标题 item 与快照里的标题键混排）
+     * 同为文件序，由 {@link resolveSessionTitleFacts} 折叠。
      */
-    protected readHeadSessionMeta(filePath: string): Promise<SessionMetaLine[] | undefined>;
+    protected readHeadOffTreeFacts(filePath: string): Promise<{
+        metaLines: SessionMetaLine[];
+        titleTimeline: AgentInputItem[];
+    } | undefined>;
     /**
      * 合并去重用的行身份。
      *
@@ -291,6 +336,13 @@ export declare class SessionStoreImpl implements SessionStore {
      */
     protected deserializeSessionFromPath(filePath: string, options?: SessionGetOptions): Promise<Session | undefined>;
     protected getSessionId(filePath: string): string;
+    /**
+     * Read complete UTF-8 JSONL records from newest to oldest with bounded I/O.
+     * Newline bytes are safe boundaries in UTF-8; a record is decoded only
+     * after all of its cross-chunk Buffer fragments have been assembled.
+     */
+    protected readLinesFromEnd(filePath: string, fileSize: number, consumeLine: (line: string) => boolean): Promise<number>;
+    private decodeReverseLine;
     private getPreferredProjectDirs;
     get(id: string, options?: SessionGetOptions): Promise<Session | undefined>;
     getAcrossProjects(id: string, options?: SessionGetOptions): Promise<Session | undefined>;