@tencent-ai/agent-sdk 0.3.263-dev.90f0e98.202609190050 → 0.3.263

package/cli/dist-server/types/node/tools/ask-user-question-tool.d.ts

@@ -1,237 +0,0 @@
-import { Workspace } from '@genie/runtime';
-import type { RunContext } from '@openai/agents';
-import { z } from 'zod';
-import { type FunctionCallItem, type ToolExecuteArgument } from '../../vendor/cbc-shared/node/index.js';
-import { AskService } from '../ask';
-import { SdkHooksManager } from '../control-signal/control-signal-protocol';
-import { Session } from '../../vendor/cbc-core/node/index.js';
-import { BaseTool } from './base-tool';
-import { Tool, ToolCallArgumentRenderer, ToolResult } from './tool-protocol';
-import { ToolNames } from '../../vendor/cbc-shared/node/index.js';
-/**
- * Normalize AskUserQuestion input to handle common model mistakes:
- * - Using "answers" field instead of "options"
- * - Passing plain string arrays instead of {label, description} objects
- * - Missing "header" field
- *
- * Call this before passing input to UI layers or tool execution.
- */
-export declare function normalizeAskUserQuestionInput(input: Record<string, any>): Record<string, any>;
-declare const AskUserQuestionParameters: z.ZodEffects<z.ZodObject<{
-    questions: z.ZodArray<z.ZodObject<{
-        question: z.ZodString;
-        header: z.ZodString;
-        options: z.ZodArray<z.ZodObject<{
-            label: z.ZodString;
-            description: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            label: string;
-            description: string;
-        }, {
-            label: string;
-            description: string;
-        }>, "many">;
-        multiSelect: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect: boolean;
-    }, {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect?: boolean | undefined;
-    }>, "many">;
-    answers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    metadata: z.ZodOptional<z.ZodObject<{
-        source: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        source?: string | undefined;
-    }, {
-        source?: string | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    questions: {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect: boolean;
-    }[];
-    answers?: Record<string, string> | undefined;
-    metadata?: {
-        source?: string | undefined;
-    } | undefined;
-}, {
-    questions: {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect?: boolean | undefined;
-    }[];
-    answers?: Record<string, string> | undefined;
-    metadata?: {
-        source?: string | undefined;
-    } | undefined;
-}>, {
-    questions: {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect: boolean;
-    }[];
-    answers?: Record<string, string> | undefined;
-    metadata?: {
-        source?: string | undefined;
-    } | undefined;
-}, {
-    questions: {
-        question: string;
-        header: string;
-        options: {
-            label: string;
-            description: string;
-        }[];
-        multiSelect?: boolean | undefined;
-    }[];
-    answers?: Record<string, string> | undefined;
-    metadata?: {
-        source?: string | undefined;
-    } | undefined;
-}>;
-export declare class AskUserQuestionTool extends BaseTool implements Tool {
-    protected readonly workspace: Workspace;
-    protected readonly askService: AskService;
-    protected readonly sdkHooksManager: SdkHooksManager;
-    name: ToolNames;
-    description: string;
-    parameters: z.ZodEffects<z.ZodObject<{
-        questions: z.ZodArray<z.ZodObject<{
-            question: z.ZodString;
-            header: z.ZodString;
-            options: z.ZodArray<z.ZodObject<{
-                label: z.ZodString;
-                description: z.ZodString;
-            }, "strip", z.ZodTypeAny, {
-                label: string;
-                description: string;
-            }, {
-                label: string;
-                description: string;
-            }>, "many">;
-            multiSelect: z.ZodDefault<z.ZodBoolean>;
-        }, "strip", z.ZodTypeAny, {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect: boolean;
-        }, {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect?: boolean | undefined;
-        }>, "many">;
-        answers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        metadata: z.ZodOptional<z.ZodObject<{
-            source: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            source?: string | undefined;
-        }, {
-            source?: string | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        questions: {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect: boolean;
-        }[];
-        answers?: Record<string, string> | undefined;
-        metadata?: {
-            source?: string | undefined;
-        } | undefined;
-    }, {
-        questions: {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect?: boolean | undefined;
-        }[];
-        answers?: Record<string, string> | undefined;
-        metadata?: {
-            source?: string | undefined;
-        } | undefined;
-    }>, {
-        questions: {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect: boolean;
-        }[];
-        answers?: Record<string, string> | undefined;
-        metadata?: {
-            source?: string | undefined;
-        } | undefined;
-    }, {
-        questions: {
-            question: string;
-            header: string;
-            options: {
-                label: string;
-                description: string;
-            }[];
-            multiSelect?: boolean | undefined;
-        }[];
-        answers?: Record<string, string> | undefined;
-        metadata?: {
-            source?: string | undefined;
-        } | undefined;
-    }>;
-    argumentRenderer: ToolCallArgumentRenderer;
-    isEnabled: (args: {
-        runContext: RunContext<Session>;
-    }) => boolean;
-    needsApproval: (_runContext: RunContext<Session>, input: ToolExecuteArgument<any>, _callId?: string) => Promise<boolean>;
-    execute(input: z.infer<typeof AskUserQuestionParameters>, context?: RunContext<Session>, details?: {
-        toolCall: FunctionCallItem;
-    }): Promise<ToolResult>;
-    /**
-     * 把 execute 捕获的异常映射到结构化错误码：
-     * - ToolExecutionError：保留其码（missing toolCallId=19201 / no answers=19202）
-     * - acquireAnswers 超时（'timed out'）→ ToolTimeoutError(90003)
-     * - 中断/abort（'Aborted'）→ ToolCancelledError(90004)
-     * - 其余（rejectAsk 的 'User declined'）→ AskFollowupUserDeclinedError(19204)
-     */
-    private resolveAskErrorCode;
-}
-export {};

package/cli/dist-server/types/node/tools/ask-user-question-validation.d.ts

@@ -1,22 +0,0 @@
-export declare const ASK_USER_QUESTION_SHAPE_HINT = "Expected shape: {\"questions\": [{\"question\": \"...\", \"header\": \"...\", \"options\": [{\"label\": \"...\", \"description\": \"...\"}, {\"label\": \"...\", \"description\": \"...\"}]}]}.";
-/**
- * Copy-paste payload for REPL / Code Mode. Catalog schema collapses `questions`
- * to `object`; without this the model returns a placeholder string instead of
- * calling the sandbox global.
- */
-export declare const ASK_USER_QUESTION_CALL_EXAMPLE = "AskUserQuestion({ questions: [{ question: \"Which approach?\", header: \"Approach\", options: [{ label: \"Explore first\", description: \"Read the code\" }, { label: \"Try it\", description: \"Run the CLI\" }] }] })";
-/**
- * Validate AskUserQuestion params before normalization / UI rendering.
- *
- * Enforces only required fields, types, >= 1 non-empty option label, and
- * unique question texts / option labels (both are answer-map keys). Count /
- * length limits (minItems >= 2, maxItems, maxLength) are NOT enforced — per
- * issue #63973 they aren't runtime constraints, so blocking rejects valid
- * calls (e.g. a single-option question).
- *
- * Multiple issues are aggregated (Read-tool error format) so the model can fix
- * everything in one round-trip.
- *
- * @returns the error message, or `undefined` when params are valid.
- */
-export declare function validateAskUserQuestionParams(input: any): string | undefined;

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-critique-client.d.ts

@@ -1,51 +0,0 @@
-import { PromptManager } from '@genie/prompts';
-import { AutoModeSettings } from '../../settings';
-import { AutoModeRules } from './auto-mode-protocol';
-import { AutoModeSystemPromptBuilder } from './auto-mode-system-prompt-builder';
-export declare const AutoModeCritiqueClient: unique symbol;
-/** True if any section has a custom entry beyond the `$defaults` token (Claude `is6`). */
-export declare function hasCustomRules(raw: AutoModeSettings | undefined): boolean;
-/**
- * Runs the auto mode rule critique (read-only).
- *
- * Implementation: spawns a standard `codebuddy -p` (print/headless) subprocess.
- * This reuses the project's canonical "cold-start, run once, exit" path — the
- * child waits for its own runtime to be fully ready, so the critique command
- * never races agent registration during startup (which a direct in-process
- * `runOneTime` would, since this runs from a short-lived dispatch strategy).
- *
- * Prompt / context assembly is aligned with Claude Code 2.1.179 `MIT`/`rs6`:
- *  - system prompt = the "expert reviewer" critique instructions template
- *  - the user message embeds the FULL classifier system prompt plus the user's
- *    custom rules, each section annotated as replacing or extending the defaults
- *  - only the user's CUSTOM rules are reviewed (the strategy gates on
- *    `hasCustomRules` before calling this)
- *
- * Does not participate in permission decisions.
- */
-export declare class AutoModeCritiqueClientImpl {
-    protected readonly systemPromptBuilder: AutoModeSystemPromptBuilder;
-    protected readonly promptManager: PromptManager;
-    /**
-     * @param resolved  effective rules after `$defaults` expansion — used to render
-     *                  the classifier system prompt the critique reviews against.
-     * @param raw       merged-but-unexpanded custom rules (`$defaults` preserved) —
-     *                  used to show only the user's own entries with replace/extend
-     *                  annotations.
-     */
-    critique(resolved: AutoModeRules, raw: AutoModeSettings): Promise<string>;
-    /** Load the critique "expert reviewer" system prompt template text. */
-    private loadCritiqueSystemPrompt;
-    /**
-     * Spawn `codebuddy -p --model lite --system-prompt <critique> -` with the
-     * critique user message on stdin, and return the printed text.
-     */
-    private runPrintSubprocess;
-    protected buildCritiqueInput(resolved: AutoModeRules, raw: AutoModeSettings): Promise<string>;
-    /**
-     * Format one section's custom rules, noting whether they extend (contain
-     * `$defaults`) or replace the built-in defaults. Mirrors Claude `rs6`.
-     * Returns '' when the section has no custom entries.
-     */
-    private formatSection;
-}

package/cli/dist-server/types/node/tools/auto-mode/auto-mode-strategy.d.ts

@@ -1,21 +0,0 @@
-import { RunContext, ToolExecuteArgument } from '../../../vendor/cbc-shared/node/index.js';
-import { Session } from '../../../vendor/cbc-core/node/index.js';
-import { PermissionMode } from '../../../vendor/cbc-shared/node/index.js';
-import { SettingsManager } from '../../settings';
-import { BaseTool } from '../base-tool';
-import { ToolArg } from '../../../vendor/cbc-shared/node/index.js';
-import { ToolPermissionStrategy } from '../tool-protocol';
-/**
- * Auto permission strategy — deterministic fast paths only.
- *
- * 1. acceptEdits fast path: anything acceptEdits would auto-allow, auto allows too.
- * 2. safe tool allowlist: read-only / metadata built-ins auto-allow.
- * 3. everything else returns `ask` → the service's unified outlet routes it into
- *    the classifier (AutoModePermissionService). The classifier call deliberately
- *    lives outside the strategy so the permission chain stays synchronous/testable.
- */
-export declare class ToolPermissionAutoStrategy implements ToolPermissionStrategy {
-    mode: PermissionMode;
-    protected readonly settingsManager: SettingsManager;
-    needApproval(tool: BaseTool, runContext: RunContext<Session>, input: ToolExecuteArgument<any>, checkArgs: ToolArg[], callId?: string): Promise<boolean>;
-}

package/cli/dist-server/types/node/tools/auto-mode/index.d.ts

@@ -1,15 +0,0 @@
-export * from './auto-mode-protocol';
-export * from './permission-mode-policy';
-export * from './auto-mode-timeout';
-export * from './auto-mode-defaults';
-export * from './auto-mode-allow-filter';
-export * from './auto-mode-denial-tracker';
-export * from './auto-mode-settings';
-export * from './auto-mode-project-instructions';
-export * from './auto-mode-system-prompt-builder';
-export * from './auto-mode-transcript';
-export * from './auto-mode-transcript-limit';
-export * from './auto-mode-classifier-client';
-export * from './auto-mode-critique-client';
-export * from './auto-mode-permission-service';
-export * from './auto-mode-strategy';

package/cli/dist-server/types/node/tools/background-output-files.d.ts

@@ -1,39 +0,0 @@
-/**
- * 后台任务文件 fd 模式下，给一个 task 分配一对 stdout/stderr 文件 + fd。
- *
- * 抽离成独立 module 而不是 BashTool 的 private 方法，是为了：
- *  - **可测试性**：单测里可以注入 fake `dirProvider`、监控 fd 是否泄漏，不用 mock 整个 IoC
- *  - **跨平台关注点集中**：Windows 上 numeric flags 经 libuv 可能 EINVAL（已用字符串 'w' 兜底），
- *    O_NOFOLLOW 在 Windows 不存在（用 `?? 0` 兜底），mode 0o700 在 NTFS 是 no-op……
- *    所有这些 footgun 集中在这里
- */
-/** 单个 task 的 stdout/stderr 文件 + 父侧 fd（spawn 完调用方应立即关 fd）。 */
-export interface BackgroundOutputFiles {
-    stdoutPath: string;
-    stderrPath: string;
-    /** 父侧 fd，调用方负责在 spawn 之后立刻 close（child 已 dup 自己的副本）。 */
-    stdoutFd: number;
-    stderrFd: number;
-}
-export interface PrepareBackgroundOutputFilesOptions {
-    /** task id，作为文件名前缀（`{taskId}.stdout.log` / `{taskId}.stderr.log`）。 */
-    taskId: string;
-    /**
-     * 输出目录提供者。生产代码传 `() => PathUtils.getSessionBgTasksDir(sessionId)`，
-     * 测试代码可传一个 mkdtemp 出来的临时目录。
-     */
-    dirProvider: () => string;
-    /**
-     * 是否在 Windows 平台。默认 `process.platform === 'win32'`；
-     * 测试可显式传值绕开真实平台判断，从而在 macOS 上验证 Windows 分支的 flags 选择。
-     */
-    isWindows?: boolean;
-}
-/**
- * 创建文件并返回 fd。**spawn 完成后调用方必须立即关 fd**，否则父进程持有写端
- * 会让"子进程退出 → 文件 EOF"的语义出问题（虽然在文件 fd 模式下 EOF 不重要，
- * 但 fd 泄漏永远是个风险）。
- *
- * 失败时抛错；调用方应捕获并回退到 pipe 模式。
- */
-export declare function prepareBackgroundOutputFiles(options: PrepareBackgroundOutputFilesOptions): Promise<BackgroundOutputFiles>;

package/cli/dist-server/types/node/tools/background-output-tail-poller.d.ts

@@ -1,60 +0,0 @@
-import type { TruncateBuffer } from '../shell';
-/**
- * 把后台任务的 stdout/stderr 落盘文件按增量同步到内存 TruncateBuffer。
- *
- * 后台任务路径下，子进程的 stdout/stderr 直接写文件 fd（不通过父进程 pipe），
- * 这样孙进程（nohup/守护脚本等）即使继承 fd 也不会卡父进程的 EOF。但 codebuddy
- * 现有的 UI（bash-output-section.tsx）和 TaskOutput 工具都消费 BackgroundTask
- * 上的 TruncateBuffer，所以需要这个 poller 把文件增量回填到 buffer，保持契约不变。
- *
- * 实现要点：
- *  - 500ms 一次 stat + 增量 read，offset 单调递增
- *  - 单次 tick 最多读 1MB，超过则下次 tick 继续追，不阻塞
- *  - {@link drain} 在子进程退出后调用一次，把最后的尾巴读完
- *  - {@link stop} 仅停定时器，不删文件（清理由 tool-manager 在 session 结束时统一做）
- */
-export interface BackgroundOutputTailPollerOptions {
-    /** 每次 stat + read 间隔，默认 500ms。 */
-    intervalMs?: number;
-    /** 单次 tick 读取上限，默认 1MB。文件超大时分多次 tick 追上来。 */
-    readChunkLimit?: number;
-    /** poller 内部 stat/read 失败的日志钩子（可选）。 */
-    onError?: (where: 'stat' | 'read', error: unknown) => void;
-    /**
-     * 每次成功读到新增内容时的回调（增量文本，与 `buffer.push` 同一份数据）。
-     *
-     * 仅用于需要"增量触发响应"的场景（如 MonitorTool 的反应式推送，issue #74426）；
-     * BashTool/PowerShellTool 的常规后台任务不传，行为不变——buffer 仍是唯一契约。
-     */
-    onChunk?: (chunk: string) => void;
-    /**
-     * 同 {@link onChunk}，但交出的是**未经解码的原始字节**。
-     *
-     * 为什么必须单独开一条回调而不复用 `onChunk`：`onChunk` 拿到的是本 tick 按 utf-8
-     * 解码后的字符串，而读取边界落在任意字节位置，跨 tick 的多字节字符会被切坏成
-     * U+FFFD（见 tickOnce 里的说明）。把那个字符串再编码回字节，等于把损坏**固化**下来，
-     * 接收端无论怎么保留解析状态都救不回来。
-     *
-     * ACP v2 的 `terminal_output_chunk` 要求 base64 的是原始字节流，正是为了容纳
-     * 「分片切断 UTF-8 码点」这种情况——由客户端的终端模拟器跨 chunk 保留解析状态去还原。
-     * 所以推送链路必须消费本回调，不能走 `onChunk`。
-     *
-     * 传入的 Buffer 是本次读取缓冲区的 subarray（零拷贝视图），**回调必须同步消费完**：
-     * 本方法返回后 poller 不再持有它，但调用方若要跨 tick 留存必须自己复制。
-     */
-    onChunkBytes?: (chunk: Buffer) => void;
-}
-export interface BackgroundOutputTailPoller {
-    /** 立即触发一次同步（用于子进程退出后的最终 drain）。 */
-    drain(): Promise<void>;
-    /** 停止定时器；幂等，重复调用安全。 */
-    stop(): void;
-}
-/**
- * 启动一个文件 tail poller，把 `filePath` 的新内容追加到 `buffer`。
- *
- * @param filePath 要追踪的文件路径（可能尚未创建，poller 会容忍 ENOENT）
- * @param buffer   接收增量数据的 buffer
- * @param options  可选配置
- */
-export declare function startBackgroundOutputTailPoller(filePath: string, buffer: TruncateBuffer, options?: BackgroundOutputTailPollerOptions): BackgroundOutputTailPoller;

package/cli/dist-server/types/node/tools/bash-output-tool.d.ts

@@ -1,34 +0,0 @@
-import type { RunContext } from '@openai/agents';
-import { z } from 'zod';
-import { Session } from '../../vendor/cbc-core/node/index.js';
-import { BaseTool } from './base-tool';
-import { Tool } from './tool-protocol';
-import { ToolNames } from '../../vendor/cbc-shared/node/index.js';
-declare const BashOutputParameters: z.ZodObject<{
-    shell_id: z.ZodString;
-    filter: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    shell_id: string;
-    filter?: string | undefined;
-}, {
-    shell_id: string;
-    filter?: string | undefined;
-}>;
-export declare class BashOutputTool extends BaseTool implements Tool {
-    name: ToolNames;
-    aliases: string[];
-    needsApproval: boolean;
-    parameters: z.ZodObject<{
-        shell_id: z.ZodString;
-        filter: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        shell_id: string;
-        filter?: string | undefined;
-    }, {
-        shell_id: string;
-        filter?: string | undefined;
-    }>;
-    execute(input: z.infer<typeof BashOutputParameters>, context: RunContext<Session>): Promise<any>;
-    private formatDuration;
-}
-export {};

package/cli/dist-server/types/node/tools/bash-sandbox-approval-requester.d.ts

@@ -1,48 +0,0 @@
-import { Logger } from '@celljs/core';
-import { Session } from '../../vendor/cbc-core/node/index.js';
-import { FunctionCallItem } from '../../vendor/cbc-shared/node/index.js';
-import type { RunContext } from '@openai/agents';
-import { type SandboxApprovalRequest, type SandboxApprovalRequester } from '../permission';
-/**
- * Session-related context required to surface a sandbox approval request.
- *
- * This mirrors `BashToolSessionInfo` in `bash-tool.ts`; we accept the minimal
- * subset (`runContext` + `details.toolCall`) that the requester actually needs,
- * so the tool side keeps the wider type for its other call paths.
- */
-export interface SandboxApprovalRequesterContext {
-    runContext: RunContext<Session>;
-    details?: {
-        toolCall: FunctionCallItem;
-    };
-    /** Tool name shown by the shared sandbox approval UI. Defaults to Bash. */
-    toolName?: string;
-}
-/**
- * Build a SandboxApprovalRequester that surfaces SandboxOrchestrator approval
- * prompts through the standard InterruptionService flow.
- *
- * Behavior (unchanged from the original inline implementation in BashTool):
- *
- * 1. Unrestricted sessions (`fullAccess`, or bypass + `CODEBUDDY_IS_SANDBOX`)
- *    auto-allow every sandbox approval, including HIGH/CRITICAL and
- *    sandbox policy-classified / 安全中心 ask-list requests. `disableBypassPermissionsMode`
- *    still blocks the CLI bypass path.
- * 2. sandbox policy-classified requests skip the legacy `CommandUtils.checkCommandSafety`
- *    auto-approval and always surface the UI — sandbox policy is more precise.
- * 3. In Bypass permission mode, non-HIGH/CRITICAL commands are auto-approved
- *    without surfacing the UI (mirrors tool-permission-service Phase 5).
- * 4. Otherwise we synthesise a `RunToolApprovalItem` carrying a `_sandboxResolve`
- *    callback in `providerData`, push it through InterruptionService (or fall
- *    back to direct `interruptionSubject.next`), and resolve when the user picks.
- *
- * The InterruptionService is resolved **once** at the top of each request: it's
- * a singleton DI service whose identity does not change during a sandbox
- * approval, so per-branch lookups would just be noise. If DI is unavailable we
- * degrade to direct-push fallback for every branch in this request.
- */
-export declare function createSandboxApprovalRequester(logger: Logger, sessionInfo?: SandboxApprovalRequesterContext, abortSignal?: AbortSignal): SandboxApprovalRequester;
-export declare function buildSandboxApprovalItem(request: SandboxApprovalRequest, toolCall: FunctionCallItem, settle: (choice: 'allow_once' | 'allow_session' | 'deny') => void, toolName: string, options?: {
-    displayCommand?: string;
-    describeSensitiveCommand?: boolean;
-}): any;

package/cli/dist-server/types/node/tools/bash-security-windows.d.ts

@@ -1,34 +0,0 @@
-/**
- * Windows-specific security checker for the Bash tool.
- *
- * On Windows, the Bash tool runs inside Git Bash (MSYS2) which can invoke
- * any Windows executable directly. This creates a cross-tool bypass:
- * commands that would be BLOCKed by checkPowerShellSecurity() if sent
- * through the PowerShell tool execute unimpeded through the Bash tool.
- *
- * This module applies a focused set of BLOCK rules that detect the
- * PowerShell / cmd / LOLBin invocation patterns described in issue #42605.
- *
- * Design principles:
- *   - Only active on Windows (process.platform === 'win32')
- *   - Does NOT duplicate all of checkPowerShellSecurity (different syntax)
- *   - Targets the "cross-chain" escape: Bash → Windows executable
- *   - Read-only subcommands (reg query, sc query, schtasks /Query) are
- *     not blocked — only write/create/execute actions
- *   - wsl.exe 已移至 SystemToolPolicy 统一管控（见 sandbox-orchestrator.ts）
- *   - Normal Unix commands (ls, git, grep, etc.) are unaffected
- */
-export type SecurityBehavior = 'allow' | 'ask' | 'block';
-export interface SecurityCheckResult {
-    /** Whether the command is safe to run */
-    behavior: SecurityBehavior;
-    /** Human-readable reason for the decision */
-    reason?: string;
-}
-/**
- * Check whether a command submitted to the Bash tool on Windows invokes
- * dangerous Windows executables that would bypass PowerShell security.
- *
- * On non-Windows platforms, always returns `{ behavior: 'allow' }`.
- */
-export declare function checkBashSecurityWindows(command: string): SecurityCheckResult;