@theokit/sdk 4.21.1 → 4.23.0

package/dist/sandbox/linux-sandbox.d.ts

@@ -33,6 +33,20 @@ export declare class LinuxSandbox extends LocalSandbox {
     });
     /** Extracted for test visibility — delegates to the pure `wrapCommandForSandbox` (M57, single wrap SoT). */
     wrapCommand(command: string): string | null;
+    /**
+     * M75 review (arquitetura, HIGH) — sem este override a classe MENTIA.
+     *
+     * `LinuxSandbox` se documenta como "kernel-enforced sandbox backend", mas sobrescrevia apenas
+     * `execute`. `uploadFile` continuava o herdado de `LocalSandbox`, que escreve direto no host via
+     * `fs/promises` e aceita caminho ABSOLUTO — sem bwrap, sem seccomp, sem restrição de caminho. E
+     * `SandboxBackend.writeFile` delega a ele. O resultado era uma classe incoerente: ler, buscar e
+     * listar passavam pelo confinamento; escrever, não.
+     *
+     * Rotear pelo `execute` embrulhado resolve na raiz: a escrita passa a viver sob a MESMA política
+     * do resto — se o bwrap nega o caminho, a escrita falha, como deve. O conteúdo vai por stdin (não
+     * por argv) porque argv tem limite de tamanho e conteúdo de arquivo não tem.
+     */
+    uploadFile(caminho: string, conteudo: string | Buffer): Promise<void>;
     execute(command: string, opts?: {
         timeoutMs?: number;
     }): Promise<import("./types.js").ExecuteResult>;
@@ -102,14 +116,10 @@ export interface InteractiveWrapOptions {
  *
  * `createSandboxBackend` resolve isto para o caminho não-interativo devolvendo um BACKEND pronto. O
  * PTY não aceita um backend: ele é dono do spawn e só admite transformar o comando. Esta função
- * entrega a MESMA decisão na forma que o PTY aceita — `(command, cwd) => string | null` —, pronta
- * para `new PtyInteractiveBackend({ wrapCommand: interactiveWrapCommand({ mode }) })`.
+ * entrega a MESMA decisão na forma que o PTY aceita — `(command, cwd) => string | null`.
  *
  * A detecção é consultada **a cada wrap**, não congelada na construção: uma sessão interativa vive
  * por horas, e uma detecção positiva obsoleta continuaria afirmando confinamento depois de o binário
- * sumir (a revalidação por `existsSync` vive dentro de `detectBwrapMemoizado`).
- *
- * As duas rotas que devolvem `null` são semanticamente diferentes e o código não as funde:
- * `danger-full-access` é opt-out explícito e NÃO avisa; bwrap indisponível é falha e avisa uma vez.
+ * sumir.
  */
 export declare function interactiveWrapCommand(opts: InteractiveWrapOptions): (command: string, cwd: string) => string | null;

package/dist/types/agent.d.ts

@@ -332,6 +332,20 @@ export interface AgentOptions {
     local?: LocalOptions;
     cloud?: CloudOptions;
     mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * M77 — how long an MCP client lives.
+     *
+     * `'run'` (DEFAULT, and the historical behaviour) spawns a client per `send` and drops it when the
+     * run ends. `'session'` pools clients per `(agentId, server, config)` and keeps them across turns,
+     * which is what the reference does — Codex holds its connection manager in `SessionServices`
+     * (`core/src/state/service.rs:116`). Measured cost of the per-run path: 193 / 138 / 134 ms of
+     * spawn + handshake on every turn.
+     *
+     * Opt-in rather than default because it changes the FAILURE model: a server that dies mid-session
+     * becomes a reachable state. One-shot and cron runs gain nothing from pooling and would pay that
+     * risk, so they keep `'run'` unless they ask otherwise.
+     */
+    mcpLifecycle?: "run" | "session";
     agents?: Record<string, AgentDefinition>;
     agentId?: string;
     /** Context manager configuration. See `agent.context`. */

package/dist/types/run-events.d.ts

@@ -16,7 +16,7 @@
  *
  * @public
  */
-export type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunTripwireEvent | RunCompletionCheckEvent;
+export type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunCompactionFallbackEvent | RunTripwireEvent | RunCompletionCheckEvent;
 /**
  * SE24 — a guardrail processor called `abort()`; the run stops with a tripwire.
  * Delivered via {@link SendOptions.onRunEvent} (mirrors the `RunResult.tripwire`
@@ -91,6 +91,25 @@ export interface RunCompactBoundaryEvent {
     /** Token count before compaction, when known. */
     readonly preTokens?: number;
 }
+/**
+ * M77 — auto-compaction is budgeting against a FLOOR, because neither the catalog nor the caller
+ * supplied a context window for this model.
+ *
+ * The prior behaviour was to disable auto-compaction entirely and write one line to stderr per
+ * process. That is fail-OPEN: the conversation grows until the provider rejects it. This event exists
+ * so a surface can say "I am running without a real budget" instead of the user discovering it at the
+ * moment of failure.
+ *
+ * Not emitted when the window came from the catalog (the normal path) or from an explicit caller
+ * override (the caller already knows).
+ */
+export interface RunCompactionFallbackEvent {
+    readonly type: "compaction_fallback";
+    /** The model whose window is unknown — what the user needs to fix in configuration. */
+    readonly model: string;
+    /** The floor being budgeted against, after the safety margin. */
+    readonly window: number;
+}
 /**
  * SE2 — the opt-in sink for {@link RunEvent}s. Supplied via `SendOptions.onRunEvent`.
  * Synchronous + best-effort: a throwing sink must never break the run (the emitter