@tencent-ai/agent-sdk 0.3.231 → 0.3.233-dev.7c8d633.202607292147

package/cli/dist/web-ui/docs/cn/cli/env-vars.md

@@ -216,7 +216,7 @@ CodeBuddy Code 支持把内部 traces 通过 OTLP 协议上报到用户自有的
 | `CODEBUDDY_DISABLE_REQUEST_VALIDATION` | 设置为 `1` 关闭 Gateway 自定义请求头校验（`X-CodeBuddy-Request`）。详见 [HTTP API 安全](./http-api.md#安全) |
 | `CODEBUDDY_CODE_CORS_ORIGINS` | 额外的 CORS 允许来源（逗号分隔）。支持精确 origin、`*.domain` 子域通配和 `*` 全开。如 `https://*.example.com,https://specific.com`。未设置时，若服务绑定 `0.0.0.0`（`--host 0.0.0.0`）则自动允许所有来源 |
 | `SERVER__HOST` | `--serve` 模式监听地址（默认：`127.0.0.1`） |
-| `SERVER__PORT` | `--serve` 模式监听端口 |
+| `SERVER__PORT` | `--serve` 模式监听端口；设为 `0` 时由内核自选端口，服务绑定后该变量会被更新为实际监听端口 |
 
 ## 企业微信集成
 

package/cli/dist/web-ui/docs/en/cli/env-vars.md

@@ -216,7 +216,7 @@ CodeBuddy Code supports reporting internal traces to your own Collector via the
 | `CODEBUDDY_DISABLE_REQUEST_VALIDATION` | Set to `1` to disable Gateway custom request header validation (`X-CodeBuddy-Request`). See [HTTP API Security](./http-api.md#security) |
 | `CODEBUDDY_CODE_CORS_ORIGINS` | Additional CORS allowed origins (comma-separated). Supports exact origins, `*.domain` subdomain wildcards, and `*` for all. E.g., `https://*.example.com,https://specific.com`. When unset, if the service is bound to `0.0.0.0` (`--host 0.0.0.0`), all origins are automatically allowed |
 | `SERVER__HOST` | Listen address for `--serve` mode (default: `127.0.0.1`) |
-| `SERVER__PORT` | Listen port for `--serve` mode |
+| `SERVER__PORT` | Listen port for `--serve` mode; set to `0` for a kernel-assigned port — the variable is updated to the actual listening port once the server is bound |
 
 ## WeCom Integration
 

package/cli/dist/web-ui/index.html

@@ -15,7 +15,7 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
     <meta name="mobile-web-app-capable" content="yes">
     <link rel="apple-touch-icon" href="/pwa-icon.svg">
-  <script type="module" crossorigin src="/assets/index-B1eoHSk4.js"></script>
+  <script type="module" crossorigin src="/assets/index-Dl8Dlnne.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/markdown-CP9awqWt.js">
   <link rel="modulepreload" crossorigin href="/assets/vendor-iLJwFVtf.js">
   <link rel="stylesheet" crossorigin href="/assets/index-BmV1Q3hC.css">

package/cli/dist/web-ui/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const o=(o,n)=>(o=new URL(o+".js",n).href,s[o]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=o,e.onload=s,document.head.appendChild(e)}else e=o,importScripts(o),s()}).then(()=>{let e=s[o];if(!e)throw new Error(`Module ${o} didn’t register its module`);return e}));self.define=(n,i)=>{const l=e||("document"in self?document.currentScript.src:"")||location.href;if(s[l])return;let r={};const t=e=>o(e,l),f={module:{uri:l},exports:r,require:t};s[l]=Promise.all(n.map(e=>f[e]||t(e))).then(e=>(i(...e),r))}}define(["./workbox-fed2bdfe"],function(e){"use strict";self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"sandbox_proxy.html",revision:"e54bd087bf8b90d87d84c3cd8f2c22e9"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"index.html",revision:"d7fc2675e07bd95d7b599f2888f36a9d"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/vendor-iLJwFVtf.js",revision:null},{url:"assets/octicons-CaZ_fok2.woff2",revision:null},{url:"assets/mfixx-CpAhKOZz.woff2",revision:null},{url:"assets/markdown-CP9awqWt.js",revision:null},{url:"assets/index-DixJ0kqk.js",revision:null},{url:"assets/index-BmV1Q3hC.css",revision:null},{url:"assets/index-B1eoHSk4.js",revision:null},{url:"assets/fontawesome-B-jkhYfk.woff2",revision:null},{url:"assets/file-icons-C0jOugUK.woff2",revision:null},{url:"assets/devopicons-QN4QXivI.woff2",revision:null},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"manifest.webmanifest",revision:"7a003d0094122eb3e607566c757e9885"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api/,/^\/gateway/,/^\/docs\//]})),e.registerRoute(/^https:\/\/fonts\.googleapis\.com/,new e.StaleWhileRevalidate({cacheName:"google-fonts-stylesheets",plugins:[]}),"GET"),e.registerRoute(/^https:\/\/fonts\.gstatic\.com/,new e.CacheFirst({cacheName:"google-fonts-webfonts",plugins:[new e.ExpirationPlugin({maxEntries:20,maxAgeSeconds:31536e3})]}),"GET")});
+if(!self.define){let e,s={};const n=(n,o)=>(n=new URL(n+".js",o).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(o,i)=>{const l=e||("document"in self?document.currentScript.src:"")||location.href;if(s[l])return;let r={};const t=e=>n(e,l),f={module:{uri:l},exports:r,require:t};s[l]=Promise.all(o.map(e=>f[e]||t(e))).then(e=>(i(...e),r))}}define(["./workbox-fed2bdfe"],function(e){"use strict";self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"sandbox_proxy.html",revision:"e54bd087bf8b90d87d84c3cd8f2c22e9"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"index.html",revision:"384e5ef8d717460fa7e6dd3c9b11493b"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/vendor-iLJwFVtf.js",revision:null},{url:"assets/octicons-CaZ_fok2.woff2",revision:null},{url:"assets/mfixx-CpAhKOZz.woff2",revision:null},{url:"assets/markdown-CP9awqWt.js",revision:null},{url:"assets/index-Dl8Dlnne.js",revision:null},{url:"assets/index-DixJ0kqk.js",revision:null},{url:"assets/index-BmV1Q3hC.css",revision:null},{url:"assets/fontawesome-B-jkhYfk.woff2",revision:null},{url:"assets/file-icons-C0jOugUK.woff2",revision:null},{url:"assets/devopicons-QN4QXivI.woff2",revision:null},{url:"logo.svg",revision:"269aa921a3f446f8e17843c89ed7bf35"},{url:"pwa-icon.svg",revision:"673adddf1548f59682764258005b6034"},{url:"manifest.webmanifest",revision:"7a003d0094122eb3e607566c757e9885"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api/,/^\/gateway/,/^\/docs\//]})),e.registerRoute(/^https:\/\/fonts\.googleapis\.com/,new e.StaleWhileRevalidate({cacheName:"google-fonts-stylesheets",plugins:[]}),"GET"),e.registerRoute(/^https:\/\/fonts\.gstatic\.com/,new e.CacheFirst({cacheName:"google-fonts-webfonts",plugins:[new e.ExpirationPlugin({maxEntries:20,maxAgeSeconds:31536e3})]}),"GET")});

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-ai/codebuddy-code",
-  "version": "2.127.3",
+  "version": "2.128.1-dev.7c8d633.202607292146",
   "description": "Use CodeBuddy, Tencent's AI assistant, right from your terminal. CodeBuddy can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.",
   "main": "lib/node/index.js",
   "typings": "lib/node/index.d.ts",
@@ -19,9 +19,9 @@
     "@lydell/node-pty-linux-x64": "1.2.0-beta.14",
     "@lydell/node-pty-win32-arm64": "1.2.0-beta.14",
     "@lydell/node-pty-win32-x64": "1.2.0-beta.14",
-    "@tencent-ai/sandbox-cli-darwin-arm64": "5.4.0-beta.6",
-    "@tencent-ai/sandbox-cli-darwin-x64": "5.4.0-beta.6",
-    "@tencent-ai/sandbox-cli-win32-x64": "5.4.0-beta.6"
+    "@tencent-ai/sandbox-cli-darwin-arm64": "5.4.0-beta.9",
+    "@tencent-ai/sandbox-cli-darwin-x64": "5.4.0-beta.9",
+    "@tencent-ai/sandbox-cli-win32-x64": "5.4.0-beta.9"
   },
   "keywords": [
     "codebuddy",
@@ -43,7 +43,8 @@
     "url": "https://cnb.cool/codebuddy/codebuddy-code/-/issues"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "dev"
   },
   "scripts": {},
   "devDependencies": {}

package/cli/product.cloudhosted.json

@@ -52,6 +52,7 @@
         "LSP",
         "ImageGen",
         "ShareLink",
+        "ShareLinkUnpublish",
         "EnterWorktree",
         "LeaveWorktree",
         "CronCreate",
@@ -60,11 +61,14 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers",
-        "Workflow"
+        "Workflow",
+        "Monitor"
       ],
       "tags": [
         "cli",
@@ -104,6 +108,7 @@
         "ImageGen",
         "ImageEdit",
         "ShareLink",
+        "ShareLinkUnpublish",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers"
@@ -830,6 +835,6 @@
     "SelectImage": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.324Z"
+  "commit": "7c8d6338245871bdf2c8e62f483cdf1d8e34e6e0",
+  "date": "2026-07-29T13:45:53.195Z"
 }

package/cli/product.internal.json

@@ -66,6 +66,7 @@
         "ImageGen",
         "VideoGen",
         "ShareLink",
+        "ShareLinkUnpublish",
         "EnterWorktree",
         "LeaveWorktree",
         "CronCreate",
@@ -74,11 +75,14 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers",
-        "Workflow"
+        "Workflow",
+        "Monitor"
       ],
       "tags": [
         "cli",
@@ -119,6 +123,7 @@
         "ImageEdit",
         "VideoGen",
         "ShareLink",
+        "ShareLinkUnpublish",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers"
@@ -813,6 +818,6 @@
       }
     }
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.317Z"
+  "commit": "7c8d6338245871bdf2c8e62f483cdf1d8e34e6e0",
+  "date": "2026-07-29T13:45:53.128Z"
 }

package/cli/product.ioa.json

@@ -87,6 +87,7 @@
         "ImageGen",
         "ImageEdit",
         "ShareLink",
+        "ShareLinkUnpublish",
         "VideoGen",
         "EnterWorktree",
         "LeaveWorktree",
@@ -96,11 +97,14 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers",
-        "Workflow"
+        "Workflow",
+        "Monitor"
       ],
       "tags": [
         "cli",
@@ -141,6 +145,7 @@
         "ImageGen",
         "ImageEdit",
         "ShareLink",
+        "ShareLinkUnpublish",
         "VideoGen",
         "ListMcpResources",
         "ReadMcpResource",
@@ -1309,6 +1314,6 @@
       }
     }
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.320Z"
+  "commit": "7c8d6338245871bdf2c8e62f483cdf1d8e34e6e0",
+  "date": "2026-07-29T13:45:53.100Z"
 }

package/cli/product.json

@@ -31,7 +31,9 @@
         "copilot.tencent.com",
         "staging-copilot.tencent.com",
         "www.codebuddy.cn",
-        "staging.codebuddy.cn"
+        "staging.codebuddy.cn",
+        "www.workbuddy.cn",
+        "staging.workbuddy.cn"
       ],
       "externalDomain": [
         "www.codebuddy.ai",
@@ -733,7 +735,7 @@
     },
     {
       "name": "tool-websearch-description",
-      "template": "\n- Searches the web and uses the results to inform responses\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n- Use this tool for accessing information beyond the knowledge cutoff\n- Searches are performed automatically within a single API call\n\nUsage notes:\n  - Domain filtering is supported to include or block specific websites\n  - Must use the current date provided in the context for search queries.\n  - Use `query_keyword_groups` when comparisons, explicit multi-topic research, or coverage-improving query variants across phrasings/languages/sub-angles are helpful; keep `query` as the main intent, max 5 groups.\n    Example: \"NVIDIA stock and AI chip market latest news\" → query_keyword_groups: [\"NVIDIA stock latest news\", \"AI chip market latest news\", \"英伟达 股价 AI芯片 最新动态\"]\n  - Use the `topic` parameter to specify the search domain for better relevance. Supported values: general (default), news, programming, documentation, academic, finance, technology, legal, medical.\n"
+      "template": "\n- Searches the web and uses the results to inform responses\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n- Use this tool for accessing information beyond the knowledge cutoff\n- Searches are performed automatically within a single API call\n- You MUST use the current_time provided in the user message when searching for recent information.\n\nWhen to search:\n  - For any factual question about the present-day world, you MUST search before answering; search before EVERY such question.\n  - Your confidence on a topic is NOT an excuse to skip search. Present-day facts — who holds a role, what something costs, whether a law still applies, what's newest in a category — cannot come from training data.\n  - Even seemingly familiar questions — for example asking about the price of a product or who currently leads a country — can be outdated, because prices and officeholders change frequently.\n  - Proactively search instead of answering from your priors and offering to check.\n\nUsage notes:\n  - The query must preserve the meaning of the user's request; keep the entity names, versions, dates and terms the user mentioned, and do not substitute or fill them in from prior knowledge.\n  - Domain filtering is supported to include or block specific websites.\n"
     },
     {
       "name": "tool-enterplanmode-description",
@@ -831,6 +833,10 @@
       "name": "tool-sharelink-description",
       "template": "Upload a local HTML file and return a shareable public link that renders the page.\n\nUse this tool when the user wants a shareable link (分享链接) or public URL for a single local HTML document — e.g. \"give me a shareable link\", \"publish this HTML\", \"把这个页面分享出去\".\n\nParameters:\n- filePath (required): absolute path to the local .html file to share.\n\nBehavior:\n- Deploys the HTML as a static site using your current session's credentials and returns a public link that opens/renders the page in a browser.\n- Only supports a single HTML file. For multi-file sites or build directories, this tool is not applicable.\n\nPresent only the returned shareLink to the user; do not expose internal identifiers.\n"
     },
+    {
+      "name": "tool-sharelinkunpublish-description",
+      "template": "Revoke a previously shared link so it is no longer publicly accessible.\n\nUse this tool when the user wants to unpublish / take down / revoke / 取消分享 / 下线 a link that was created with the ShareLink tool — e.g. \"unpublish that link\", \"取消这个分享\", \"make it private again\", \"I shared a sensitive file, take it down\".\n\nParameters (provide at least one):\n- shareLink: the full share link URL returned by ShareLink (e.g. \"https://workbuddy.link/p/abc123\"). This is the easiest option — just pass back the link.\n- nodeId: alternatively, the bare identifier (the segment after \"/p/\" in the share link).\n\nBehavior:\n- Cancels the public website publication for the referenced page using your current session's credentials. After this succeeds, the link stops rendering publicly.\n- Works for links created in this session or earlier sessions, since the identifier is derivable from the link URL — no session history is required.\n\nIf the user only has the link text, pass it as shareLink; you do not need to ask them for an internal id.\n"
+    },
     {
       "name": "tool-computeruse-description",
       "template": "Control the macOS desktop by taking screenshots and simulating mouse/keyboard\ninput. This tool follows Anthropic's `computer_20250124` parameter schema.\n\n**Experimental.** This tool is macOS-only and disabled unless\n`CODEBUDDY_COMPUTER_USE_ENABLED=1` is set in the environment. Behavior may\nchange in future releases. Each action requires the user's approval unless an\nallow rule is configured.\n\n## Actions\n\n- `screenshot` — Capture the current display. The image is returned\n  directly in the tool_result so you can see it immediately — you do NOT\n  need a separate Read call. Images are downscaled to 1280px on the longest\n  edge and returned as JPEG to keep context costs low.\n\n  **MANDATORY observation protocol (防幻视):**\n  After EVERY screenshot, BEFORE any click/type/key action, your first\n  response MUST be a literal pixel-level observation of what is actually\n  visible in the returned image:\n    - Top menu bar: which app name, which menu items\n    - Active window: title bar text, which app owns it\n    - Key regions: what text, buttons, input fields are visible; what is\n      in each input; where the cursor/focus is\n    - For list/candidate UIs (search results, contact lists, file pickers):\n      describe the items near the coordinate you plan to click, including\n      ±20px neighbors\n  Do NOT skip observation and jump to the next action based on an expected\n  workflow. Do NOT describe the screen from memory or assumption. If you\n  cannot see an element you expected, say so and take another screenshot\n  rather than guessing coordinates.\n\n- `left_click` / `right_click` / `middle_click` / `double_click` /\n  `triple_click` / `mouse_move` — Interact with a point. Requires\n  `coordinate: [x, y]` in logical pixels (top-left origin). Before any\n  irreversible click (send message, confirm, submit), take a fresh\n  screenshot and observe again.\n\n- `left_click_drag` — Press at `start_coordinate`, drag to `coordinate`,\n  release. Both are `[x, y]` arrays.\n\n- `type` — Type arbitrary text (`text` field) at the current focus.\n  Supports Unicode (including CJK). Do NOT use this for keyboard shortcuts.\n\n- `key` — Press a key or shortcut with xdotool syntax in the `text` field:\n  `\"escape\"`, `\"return\"`, `\"cmd+shift+a\"`, `\"ctrl+c\"`. Supported modifiers:\n  `cmd`, `ctrl`, `alt`/`option`, `shift`, `fn`. Supported named keys: return,\n  tab, space, delete/backspace, escape, left, right, up, down, home, end,\n  pageup, pagedown, f1-f12. Single characters use the character directly.\n\n- `hold_key` — Hold a single named key (`text`) for `duration` seconds.\n  Modifiers are not supported in hold_key.\n\n- `scroll` — Scroll at `coordinate: [x, y]` in `scroll_direction`\n  (up/down/left/right) for `scroll_amount` ticks (default 3). Requires\n  cliclick (`brew install cliclick`).\n\n- `wait` — Pause for `duration` seconds. Use this to let UI transitions\n  settle before another action.\n\n- `cursor_position` — Return the current mouse position.\n\n## Usage notes\n\n- Coordinates use LOGICAL pixels, not physical. Always take a fresh\n  `screenshot` first — never reuse old coordinates.\n\n- Launching an app: prefer `key: \"cmd+space\"` (Spotlight) → `type: \"<app>\"`\n  → `key: \"return\"` over hunting for Dock/desktop icons, which depends on\n  unreliable UI layout.\n\n- Brand confusion on macOS: searching \"WeChat\" in Spotlight opens **企业\n  微信 (WeCom)**, not personal 微信 (WeChat). Search \"微信\" for personal\n  WeChat. Always confirm the opened app by reading the top menu bar app\n  name in the next screenshot.\n\n- First-time invocation may trigger macOS Accessibility / Screen Recording\n  permission prompts. If an action returns a permission error, ask the user\n  to open System Settings → Privacy & Security → Accessibility and enable\n  their terminal application, then restart it.\n\n- `cliclick` is an optional dependency. When installed, it provides faster\n  and more reliable mouse control and is required for `mouse_move`,\n  `middle_click`, `triple_click`, `left_click_drag`, and `scroll`. Without\n  it, the other actions fall back to AppleScript (osascript).\n"
@@ -949,7 +955,7 @@
     },
     {
       "name": "code-review-trigger-reminder",
-      "template": "<system-reminder data-role=\"code-review-trigger\">\nThe user invoked `/code-review`{{target}} to review code for bugs and quality issues.\n{%- if fix %}\nThe user requested --fix: after the review, apply the findings to the working tree.\n{%- endif %}\n{%- if comment %}\nThe user requested --comment: after the review, post findings as inline PR comments.\n{%- endif %}\n\nReview the current diff for correctness bugs and reuse/simplification/efficiency cleanups.\n\n## Steps\n\n1. Run `git diff` (or `git diff HEAD` if there are staged changes) to see what changed. If a specific PR number or target is provided, run `gh pr diff <number>` instead.\n\n2. Analyze the changes thoroughly, looking for:\n   - **Correctness bugs**: logic errors, off-by-one, null/undefined handling, race conditions, missing error handling\n   - **Security issues**: injection vulnerabilities, improper input validation, exposed secrets\n   - **Performance problems**: unnecessary work, N+1 patterns, missing concurrency, hot-path bloat\n   - **Code quality**: duplicated code, leaky abstractions, parameter sprawl, stringly-typed code\n   - **Test coverage gaps**: untested edge cases, missing error path tests\n\n3. For each finding, provide:\n   - File and line number\n   - Severity (critical / warning / suggestion)\n   - One-line summary of the issue\n   - Suggested fix\n\n4. Present findings ranked most-severe first. Group by file when multiple findings are in the same file.\n{%- if fix %}\n\nAfter the review, apply all fixable findings to the working tree directly.\n{%- endif %}\n{%- if comment %}\n\nAfter the review, post each finding as an inline PR comment using `gh api` or `gh pr review`.\n{%- endif %}\n</system-reminder>\n"
+      "template": "<system-reminder data-role=\"code-review-trigger\">\nThe user invoked `/code-review`{{target}} to review code for bugs and quality issues.\n{%- if fix %}\nThe user requested --fix: after the review, apply the findings to the working tree.\n{%- endif %}\n{%- if comment %}\nThe user requested --comment: after the review, post findings as inline PR comments.\n{%- endif %}\n\nReview the current diff for correctness bugs and reuse/simplification/efficiency cleanups.\n\n## Steps\n\n1. Run `git diff` (or `git diff HEAD` if there are staged changes) to see what changed. If a specific PR number or target is provided, run `gh pr diff <number>` instead.\n\n2. Analyze the changes thoroughly, looking for:\n   - **Correctness bugs**: logic errors, off-by-one, null/undefined handling, race conditions, missing error handling\n   - **Security issues**: injection vulnerabilities, improper input validation, exposed secrets\n   - **Performance problems**: unnecessary work, N+1 patterns, missing concurrency, hot-path bloat\n   - **Code quality**: duplicated code, leaky abstractions, parameter sprawl, stringly-typed code\n   - **Test coverage gaps**: untested edge cases, missing error path tests\n\n3. For each finding, determine:\n   - File and line number\n   - Severity (critical / warning / suggestion)\n   - One-line summary of the issue\n   - A concrete failure scenario (how/when this would actually break or cause harm)\n   - Suggested fix\n\n4. Call the `ReportFindings` tool once with all findings (most-severe first), mapping each to\n   `file` (path + line), `summary` (one-line issue + suggested fix), and `failureScenario`\n   (the concrete scenario from step 3). If `ReportFindings` is not available, present findings\n   ranked most-severe first in prose instead, grouped by file when multiple findings share a file.\n{%- if fix %}\n\nAfter the review, apply all fixable findings to the working tree directly.\n{%- endif %}\n{%- if comment %}\n\nAfter the review, post each finding as an inline PR comment using `gh api` or `gh pr review`.\n{%- endif %}\n</system-reminder>\n"
     },
     {
       "name": "verify-trigger-reminder",
@@ -1057,7 +1063,6 @@
         "LSP",
         "ImageGen",
         "ImageEdit",
-        "ShareLink",
         "VideoGen",
         "EnterWorktree",
         "LeaveWorktree",
@@ -1067,11 +1072,14 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers",
-        "Workflow"
+        "Workflow",
+        "Monitor"
       ],
       "tags": [
         "cli",
@@ -1493,7 +1501,6 @@
     "DeferToolLoading": true,
     "ImageEdit": false,
     "VideoGen": true,
-    "ShareLink": true,
     "ScheduledTasks": true,
     "SkillManage": false,
     "SkipToolCallSupportCheck": true,
@@ -1714,6 +1721,11 @@
       "description": "tool-sharelink-description",
       "deferLoading": true
     },
+    {
+      "name": "ShareLinkUnpublish",
+      "description": "tool-sharelinkunpublish-description",
+      "deferLoading": true
+    },
     {
       "name": "ComputerUse",
       "description": "tool-computeruse-description",
@@ -1770,12 +1782,27 @@
       "name": "WeComReply",
       "description": "Send a reply to a WeCom (企业微信) user. For text: pass text (markdown supported)."
     },
+    {
+      "name": "PushNotification",
+      "description": "tool-pushnotification-description",
+      "deferLoading": true
+    },
+    {
+      "name": "ReportFindings",
+      "description": "tool-reportfindings-description",
+      "deferLoading": true
+    },
     {
       "name": "Workflow",
       "description": "workflow-tool-description",
       "deferLoading": true
+    },
+    {
+      "name": "Monitor",
+      "description": "tool-monitor-description",
+      "deferLoading": true
     }
   ],
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.331Z"
+  "commit": "7c8d6338245871bdf2c8e62f483cdf1d8e34e6e0",
+  "date": "2026-07-29T13:45:53.113Z"
 }

package/cli/product.selfhosted.json

@@ -53,11 +53,14 @@
         "DelegateTool",
         "WeChatReply",
         "WeComReply",
+        "PushNotification",
+        "ReportFindings",
         "ComputerUse",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers",
-        "Workflow"
+        "Workflow",
+        "Monitor"
       ],
       "tags": [
         "cli",
@@ -97,6 +100,7 @@
         "ImageGen",
         "ImageEdit",
         "ShareLink",
+        "ShareLinkUnpublish",
         "ListMcpResources",
         "ReadMcpResource",
         "WaitForMcpServers"
@@ -344,6 +348,6 @@
     "ScheduledTasks": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "04b0be91111616019aa1edadaa0a1a108c577c2c",
-  "date": "2026-07-27T13:09:05.318Z"
+  "commit": "7c8d6338245871bdf2c8e62f483cdf1d8e34e6e0",
+  "date": "2026-07-29T13:45:53.128Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-ai/agent-sdk",
-  "version": "0.3.231",
+  "version": "0.3.233-dev.7c8d633.202607292147",
   "description": "CodeBuddy Code SDK for JavaScript/TypeScript",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -31,6 +31,7 @@
     "zod": "^4.0.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "dev"
   }
 }