@tencent-ai/codebuddy-code 2.135.0-dev.370ef22.202608130803 → 2.135.0-dev.653084e.202608161247

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-ai/codebuddy-code",
-  "version": "2.135.0-dev.370ef22.202608130803",
+  "version": "2.135.0-dev.653084e.202608161247",
   "description": "Use CodeBuddy, Tencent's AI assistant, right from your terminal. CodeBuddy can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.",
   "main": "lib/node/index.js",
   "typings": "lib/node/index.d.ts",

package/product.cloudhosted.json

@@ -68,7 +68,8 @@
         "ReadMcpResource",
         "WaitForMcpServers",
         "Workflow",
-        "Monitor"
+        "Monitor",
+        "REPL"
       ],
       "tags": [
         "cli",
@@ -812,6 +813,6 @@
     "SelectImage": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "370ef221b6047edd035343ef71d80f5d765ee9cc",
-  "date": "2026-08-13T00:02:30.800Z"
+  "commit": "653084ed5fed636e8ca5efe038959001d5e56c24",
+  "date": "2026-08-16T04:46:35.745Z"
 }

package/product.internal.json

@@ -82,7 +82,8 @@
         "ReadMcpResource",
         "WaitForMcpServers",
         "Workflow",
-        "Monitor"
+        "Monitor",
+        "REPL"
       ],
       "tags": [
         "cli",
@@ -819,6 +820,6 @@
       }
     }
   },
-  "commit": "370ef221b6047edd035343ef71d80f5d765ee9cc",
-  "date": "2026-08-13T00:02:30.793Z"
+  "commit": "653084ed5fed636e8ca5efe038959001d5e56c24",
+  "date": "2026-08-16T04:46:35.699Z"
 }

package/product.ioa.json

@@ -104,7 +104,8 @@
         "ReadMcpResource",
         "WaitForMcpServers",
         "Workflow",
-        "Monitor"
+        "Monitor",
+        "REPL"
       ],
       "tags": [
         "cli",
@@ -1315,6 +1316,6 @@
       }
     }
   },
-  "commit": "370ef221b6047edd035343ef71d80f5d765ee9cc",
-  "date": "2026-08-13T00:02:30.755Z"
+  "commit": "653084ed5fed636e8ca5efe038959001d5e56c24",
+  "date": "2026-08-16T04:46:35.683Z"
 }

package/product.json

@@ -919,7 +919,7 @@
     },
     {
       "name": "tool-repl-description",
-      "template": "Execute JavaScript to orchestrate a task, with programmatic access to capability bridges. Supports top-level await. State persists across calls within the session (variables, imported bridges) — like a notebook kernel.\n\nSurface a result by returning it (`return x`) or leaving it as the last expression — like a notebook kernel. To show an image, return an image value `{ $media: \"image/png\", data: <base64-or-data-url> }`, or an array mixing text and images (e.g. `return [summary, screenshot]`). Use `nodeRepl.write(text)` for additional text output.\n\n## Capability bridges\n\nCapabilities (browser control, computer use, …) are provided as importable bridges, NOT as separate tools. Import a bridge, then read its documentation before using it:\n\n```js\nconst { browser } = await import(\"@wb/browser\");\nnodeRepl.write(await browser.documentation());   // ALWAYS read this first, in full\n```\n\nThe set of available bridges is provided by the host and may change; if an import throws \"not available\", that bridge is not offered in this session. You cannot import arbitrary Node modules (`node:fs`, npm packages, …) — only host-provided bridges.\n\n## When to use\n\nPrefer the REPL when a task needs several capability calls composed with control flow (loops, conditionals, waiting, retry) in one turn — e.g. driving a browser through a multi-step flow — instead of one model round-trip per action. For a single one-off action, call the relevant tool directly.\n\nEach bridge call is subject to the same permission checks as any tool. Keep scripts focused; long-running scripts are bounded by `timeout` (default 30s, max 600s).\n"
+      "template": "Execute JavaScript to orchestrate a task in one turn. Session tools are preloaded as async globals — call them directly, no import needed. Supports top-level await. Variables persist across calls within the session — like a notebook kernel.\n\n## When to use this instead of calling tools one by one\n\nUse the REPL when a task takes **more than two tool calls** and those calls are related — that is the single most useful signal. Concretely:\n\n- **Same operation over many items** — read/grep/edit N files, query N records, check N URLs. One loop replaces N round-trips.\n- **A later call depends on an earlier result** — glob then read each hit; list issues then update the matching ones; run a command then branch on its output.\n- **You only need a summary of a large result** — filter/count/aggregate inside the sandbox and return just the conclusion, instead of pulling every intermediate result into the conversation.\n- **Control flow** — conditionals, retry, early exit, `Promise.all` for independent calls.\n\nWorked example — \"read the first line of every spec file\". One REPL call, not 1 + N:\n\n```js\nconst files = await Glob({ pattern: \"src/**/*.spec.ts\" });\nconst heads = [];\nfor (const f of files) {\n    heads.push({ file: f.split(\"/\").pop(), head: await Read({ file_path: f, limit: 1 }) });\n}\nreturn heads;                      // only the summary reaches the conversation\n```\n\nCall a tool directly (not via REPL) for a genuine one-off action: a single `Read`, a single `Bash`, one MCP call. Wrapping one call in JavaScript only adds noise.\n\n## Tools are preloaded (no import)\n\nBuilt-in tools (`Bash`, `Read`, `Write`, `Edit`, `Grep`, `Glob`, `WebSearch`, …) and connected MCP tools are already global functions. MCP tools live on their server object:\n\n```js\nawait Bash({ command: \"git status --short\" });\nawait Read({ file_path: \"src/a.ts\", limit: 30 });\nawait github.list_pull_requests({ owner: \"alice\", repo: \"hello-world\" });\n```\n\nThe catalog in the `code` parameter description lists every tool available this session, with its parameter shape. Built-in tool names and `REPL` are reserved — do not shadow them with your own variables. If an MCP server name collides with a reserved name it is prefixed `mcp_`; the catalog shows the exact callable name.\n\n## Discovering tools and parameters\n\nThe catalog already lists everything, so you rarely need these — reach for them only when it is not enough:\n\n- `await REPL.searchTools(\"pull request\", { server: \"github\" })` — when the catalog shows a server as an index line without its tools, or you cannot find a tool by name. Pass an array to widen recall (`[\"issue\", \"议题\"]`); mixing English and the user's language helps.\n- `await REPL.describeTool(\"github.search_issues\")` — full JSON Schema. Needed when the catalog shows a parameter as `object` (nested shapes are collapsed there) or when a call was rejected for a bad argument. Returns `null` for an unknown name — then use `searchTools` rather than guessing.\n- `await REPL.describeTools([...])` — same, for up to 10 named tools at once.\n\nDiscovery results are for your code to branch on. Do not `return` or log them wholesale — both the return value and stdout enter the conversation. Return a conclusion instead.\n\n## Tool results are raw, human-formatted output\n\nA tool call returns exactly what that tool produces for a human reader — not a normalized\nstruct. Three consequences worth knowing before you parse anything:\n\n- **MCP tools return a *string*, never a parsed object.** Whether that string holds JSON or\n  plain text is up to each server — MCP only guarantees text. Even one server mixes both:\n  `directory_tree` returns JSON, while `list_directory` returns `[FILE] a.ts` lines and\n  `read_text_file` returns the file verbatim. So **try-parse instead of assuming**, and don't\n  burn a round trip probing the shape:\n\n  ```js\n  const parse = r => { try { return JSON.parse(r); } catch { return String(r); } };\n  const tree = parse(await fs.directory_tree({ path }));   // → array\n  const list = parse(await fs.list_directory({ path }));   // → still a string, fine\n  ```\n\n- **`Read` prefixes every line** with `   1→`. Strip it with `.replace(/^\\s*\\d+→/gm, \"\")`\n  — the `m` flag is required; without it only the first line loses its prefix.\n- When you only need matching lines, **prefer `Grep`** over reading whole files and\n  filtering in JS: less text to clean up, and far less of it flows through the sandbox.\n\nTwo different failure shapes, don't confuse them: a **permission denial** arrives as a real\nobject with an `error` field (`r.error`), whereas a tool's own business error is text inside\nits normal string result (e.g. `'{\"error\":\"not found\"}'`, or a plain `Error: ENOENT ...`) —\ncheck `r.error` first, then inspect the string.\n\n## Handle permission denials\n\nA tool call returns `{ error: \"...\" }` instead of throwing when permission is denied, so one refused call does not kill the script. Check `error` before using a result:\n\n```js\nconst r = await Bash({ command: \"rm -rf /tmp/build\" });\nif (r.error) { /* denied → change approach, skip, or report it back */ }\n```\n\nEvery call goes through the same permission checks as calling the tool directly.\n\n## Sandbox limits\n\nOnly the preloaded session tools plus host-provided capability bridges are available. `import()` is reserved for those bridges: call `REPL.listBridges()` to see which specifiers this session actually offers (often none — then any import fails), and `<bridge>.documentation()` for a bridge's API. Nothing else is importable — `node:fs` and npm packages always fail.\n\n## Surfacing results\n\nReturn a value (`return x`) or leave it as the last expression — that becomes the tool result. To show an image, return `{ $media: \"image/png\", data: <base64-or-data-url> }`, or an array mixing text and images (`return [summary, screenshot]`). Use `nodeRepl.write(text)` for extra text output.\n\nKeep scripts focused; execution is bounded by `timeout` (default 30s, max 600s).\n"
     },
     {
       "name": "workflow-subagent-system-preamble",
@@ -1083,7 +1083,8 @@
         "ReadMcpResource",
         "WaitForMcpServers",
         "Workflow",
-        "Monitor"
+        "Monitor",
+        "REPL"
       ],
       "tags": [
         "cli",
@@ -1812,6 +1813,6 @@
       "description": "tool-repl-description"
     }
   ],
-  "commit": "370ef221b6047edd035343ef71d80f5d765ee9cc",
-  "date": "2026-08-13T00:02:30.800Z"
+  "commit": "653084ed5fed636e8ca5efe038959001d5e56c24",
+  "date": "2026-08-16T04:46:35.757Z"
 }

package/product.selfhosted.json

@@ -60,7 +60,8 @@
         "ReadMcpResource",
         "WaitForMcpServers",
         "Workflow",
-        "Monitor"
+        "Monitor",
+        "REPL"
       ],
       "tags": [
         "cli",
@@ -349,6 +350,6 @@
     "ScheduledTasks": true,
     "SkipToolCallSupportCheck": true
   },
-  "commit": "370ef221b6047edd035343ef71d80f5d765ee9cc",
-  "date": "2026-08-13T00:02:30.745Z"
+  "commit": "653084ed5fed636e8ca5efe038959001d5e56c24",
+  "date": "2026-08-16T04:46:35.684Z"
 }