qlogicagent 2.10.22 → 2.10.23

package/dist/types/orchestration/dag-scheduler.d.ts

@@ -1,118 +1,167 @@
 /**
- * DAG Scheduler — topological task scheduling for Product Mode.
+ * DAG Scheduler v2 — unified scheduling for Product + Automation modes.
  *
- * Manages a directed acyclic graph of tasks with dependencies.
- * Ensures tasks only execute when all prerequisites are satisfied.
+ * Single-track model: one algorithm, no compat shims, no legacy paths.
+ * Product mode = flat DAG (kind:"agent", no conditions, no loops) — strict subset.
  *
- * Supports dynamic mutations: leader can add/remove/retry tasks at runtime.
+ * Spec: docs/dag-scheduler-v2-spec.md
  */
-import type { ProductTaskDef, ProductTaskStatus } from "../runtime/infra/acp-types.js";
-export interface TaskNode {
-    taskId: string;
-    assignee: string;
-    prompt: string;
-    dependsOn: string[];
-    status: ProductTaskStatus;
-    result?: string;
+import type { ProductTaskStatus } from "../protocol/wire/acp-agent-management.js";
+/**
+ * Loop safety hard ceiling (plan D15): a loop controller's `maxIterations` is required and may
+ * never exceed this. Unattended/triggered runs must not be able to declare an effectively
+ * unbounded loop, so a value above the cap is rejected fail-loud at construction — not clamped.
+ */
+export declare const LOOP_MAX_ITERATIONS_HARD_CAP = 1000;
+/** Unified node status; "skipped" is a terminal success (intentionally not run). */
+export type NodeStatus = ProductTaskStatus;
+/**
+ * Fully-materialized runtime node (constructed from NodeDef, never partial).
+ * Internal to the scheduler — do not mutate directly outside DagScheduler.
+ */
+export interface Node {
+    id: string;
+    kind: string;
+    params: Record<string, unknown>;
+    status: NodeStatus;
+    outPorts: string[];
+    joinPolicy: "all" | "any";
+    firedPorts?: string[];
+    output?: unknown;
     error?: string;
     startedAt?: number;
     completedAt?: number;
+    runIndex: number;
+    maxIterations?: number;
+    iteration?: number;
+}
+/** Declarative input for the constructor. Edges derived from dependsOn. */
+export interface NodeDef {
+    id: string;
+    kind?: string;
+    params?: Record<string, unknown>;
+    dependsOn?: string[];
+    outPorts?: string[];
+    joinPolicy?: "all" | "any";
+    maxIterations?: number;
+}
+export interface Edge {
+    from: string;
+    to: string;
+    fromPort?: string;
+    loopBack?: boolean;
 }
 export declare class DagScheduler {
     private nodes;
-    constructor(tasks: ProductTaskDef[]);
-    /** Get all task nodes. */
-    getAllTasks(): TaskNode[];
-    /** Get a single task node by ID. */
-    getTask(taskId: string): TaskNode | undefined;
+    private edges;
+    constructor(defs: NodeDef[]);
+    getNode(id: string): Node | undefined;
+    getAllNodes(): Node[];
     /**
-     * Get tasks ready to run: status=pending and all dependencies completed.
+     * Ready = pending + all forward incoming edges satisfied (or no incoming edges).
+     * Spec §3.1.
      */
-    getReadyTasks(): TaskNode[];
-    /** Mark a task as running. */
-    markRunning(taskId: string): void;
-    /** Mark a task as completed with result. */
-    markCompleted(taskId: string, result: string): void;
-    /** Mark a task as failed with error. */
-    markFailed(taskId: string, error: string): void;
-    /** Mark a task as paused. */
-    markPaused(taskId: string): void;
-    /** Resume a paused task back to pending. */
-    resumePaused(taskId: string): void;
-    /** Check if all tasks are terminal (completed, failed, or blocked by failed deps). */
+    getReadyNodes(): Node[];
     isFinished(): boolean;
-    /** Check if the product completed successfully (all tasks completed). */
+    /** All nodes completed or skipped (skipped = intentionally not run, counts as success). */
     isAllCompleted(): boolean;
-    /** Get tasks that are blocked by failed dependencies. */
-    getBlockedTasks(): TaskNode[];
-    /** Pause all running tasks. */
-    pauseAll(): void;
-    /** Resume all paused tasks back to pending. */
-    resumeAll(): void;
-    /** Serialize for persistence. */
-    serialize(): Array<{
-        taskId: string;
-        assignee: string;
-        prompt: string;
-        dependsOn: string[];
-        status: ProductTaskStatus;
-        result?: string;
-        error?: string;
-        startedAt?: number;
-        completedAt?: number;
-    }>;
-    /** Restore from persisted data. */
-    restore(data: Array<{
-        taskId: string;
-        status: ProductTaskStatus;
-        result?: string;
-        error?: string;
-        startedAt?: number;
-        completedAt?: number;
-    }>): void;
+    getBlockedNodes(): Node[];
+    getProgress(): {
+        total: number;
+        completed: number;
+        running: number;
+        failed: number;
+        pending: number;
+        paused: number;
+        skipped: number;
+    };
+    markRunning(id: string): void;
     /**
-     * Add a new task to the DAG at runtime.
-     * Used by leader agent when it discovers new work is needed.
-     * Validates that the addition doesn't create cycles.
+     * Mark completed. firedPorts omitted → all outPorts fire (agent/tool nodes).
+     * Triggers skip propagation (§3.2).
      */
-    addTask(task: ProductTaskDef): void;
+    markCompleted(id: string, out: {
+        output?: unknown;
+        firedPorts?: string[];
+    }): void;
+    markFailed(id: string, error: string): void;
+    markPaused(id: string): void;
+    resumePaused(id: string): void;
+    markSkipped(id: string): void;
+    pauseAll(): void;
+    resumeAll(): void;
     /**
-     * Add multiple tasks atomically. All-or-nothing.
+     * Loop controller decision (§3.3).
+     * If again && iterations remain → reset loop body, fire "loop" port.
+     * Otherwise → fire "done" port (exit).
      */
-    addTasks(tasks: ProductTaskDef[]): void;
+    decideLoop(loopId: string, again: boolean): void;
+    addNode(def: NodeDef): void;
+    /** Add multiple nodes atomically. All-or-nothing. */
+    addNodes(defs: NodeDef[]): void;
     /**
-     * Remove a pending task from the DAG.
-     * Cannot remove running/completed tasks.
-     * Removes the task from other tasks' dependsOn lists.
+     * Remove a pending node. Cannot remove running or completed nodes.
+     * Removes all edges incident to this node.
      */
-    removeTask(taskId: string): void;
+    removeNode(id: string): void;
     /**
-     * Retry a failed task: reset it to pending for re-execution.
-     * Optionally update the prompt (leader may refine instructions).
+     * Reset a failed node to pending. Optionally patches params (e.g. revised prompt).
      */
-    retryTask(taskId: string, newPrompt?: string): void;
+    retryNode(id: string, paramsPatch?: Record<string, unknown>): void;
+    /** Merge patch into node.params. Node must be pending. */
+    updateNodeParams(id: string, patch: Record<string, unknown>): void;
+    /** Add an explicit edge. Validates no cycle. Validates ports exist on source. */
+    addEdge(edge: Edge): void;
+    removeEdge(from: string, to: string, fromPort?: string): void;
+    serialize(): SerializedNode[];
     /**
-     * Update a pending task's prompt (leader refines instructions before execution).
+     * Restore status from persisted snapshot.
+     * Running nodes become pending (need re-execution after crash).
+     * Missing fields use defaults.
      */
-    updateTaskPrompt(taskId: string, prompt: string): void;
+    restore(data: SerializedNode[]): void;
+    /** §3.1 edge predicate: source completed AND this port fired. */
+    private edgeSatisfied;
+    /** An edge is "dead" if the source is skipped, OR source completed but did NOT fire this port. */
+    private edgeDead;
+    private incomingForwardEdges;
+    private isBlockedByFailed;
+    /** A pending node is "skippable" if all its forward edges are dead. */
+    private isSkippable;
     /**
-     * Re-assign a pending task to a different instance.
+     * §3.2 Skip propagation.
+     * After markCompleted/markFailed/markSkipped, repeatedly mark pending nodes
+     * whose incoming edges are all dead as skipped.
+     * Product mode (no conditional edges) → no-op.
      */
-    reassignTask(taskId: string, newAssignee: string): void;
+    private propagateSkips;
     /**
-     * Add a dependency edge. Validates no cycle is introduced.
+     * §3.3 Reset all loop-body nodes back to pending for next iteration.
      */
-    addDependency(taskId: string, dependsOnTaskId: string): void;
+    private resetLoopScope;
     /**
-     * Get statistics for progress tracking.
+     * Compute the loop body: nodes reachable from the loop controller's "loop" outPort
+     * via non-loopBack forward edges, up to (but not including) the loop controller itself.
+     * The controller's "done" port leads OUT of the loop and is not part of the body.
      */
-    getProgress(): {
-        total: number;
-        completed: number;
-        running: number;
-        failed: number;
-        pending: number;
-        paused: number;
-    };
+    private loopBodyNodes;
     private validateDag;
+    private requireNode;
+}
+export interface SerializedNode {
+    id: string;
+    kind: string;
+    params: Record<string, unknown>;
+    dependsOn: string[];
+    outPorts: string[];
+    joinPolicy: "all" | "any";
+    status: NodeStatus;
+    firedPorts?: string[];
+    output?: unknown;
+    error?: string;
+    startedAt?: number;
+    completedAt?: number;
+    runIndex: number;
+    maxIterations?: number;
+    iteration?: number;
 }

package/dist/types/orchestration/index.d.ts

@@ -1,7 +1,7 @@
 export { buildAssistantToolCallMessage, buildToolResultMessage, type FunctionToolDefinition, } from "./tool-loop/tool-schema.js";
 export { classifyError, isRetryableCategory, type ErrorCategory, } from "./error-handling/error-classification.js";
-export { composeStrategies, composeAsyncStrategies, SlidingWindowStrategy, SummarizeOldStrategy, ToolResultTrimStrategy, HeadTailProtectedStrategy, IncrementalCompactStrategy, CacheAwareCompressionStrategy, CompressionMetricsCollector, ContextEngineRegistry, MicroCompactStrategy, postCompactFileRecovery, type PostCompactRecoveryConfig, buildStructuredSummaryPrompt, computeAdaptiveBudget, isAsyncCompressionStrategy, selectCompressionTier, DEFAULT_ADAPTIVE_BUDGET_CONFIG, type AdaptiveBudgetConfig, type AsyncCompressionStrategy, type CacheAwareCompressionConfig, type CompressibleMessage, type CompressionEvent, type CompressionMetrics, type CompressionMetricsSnapshot, type CompressionResult, type CompressionStrategy, type CompressionTier, type ContextEngine, type HeadTailProtectionConfig, type IncrementalCompactConfig, type SummarizeFn, } from "./context/context-compression.js";
-export { snipCompactIfNeeded, type SnipResult, } from "./context/context-compression.js";
+export { composeStrategies, composeAsyncStrategies, SlidingWindowStrategy, SummarizeOldStrategy, ToolResultTrimStrategy, HeadTailProtectedStrategy, IncrementalCompactStrategy, CacheAwareCompressionStrategy, CompressionMetricsCollector, ContextEngineRegistry, MicroCompactStrategy, postCompactFileRecovery, type PostCompactRecoveryConfig, buildStructuredSummaryPrompt, computeAdaptiveBudget, isAsyncCompressionStrategy, selectCompressionTier, DEFAULT_ADAPTIVE_BUDGET_CONFIG, type AdaptiveBudgetConfig, type AsyncCompressionStrategy, type CacheAwareCompressionConfig, type CompressibleMessage, type CompressionEvent, type CompressionMetrics, type CompressionMetricsSnapshot, type CompressionResult, type CompressionStrategy, type CompressionTier, type ContextEngine, type HeadTailProtectionConfig, type IncrementalCompactConfig, type SummarizeFn, } from "../runtime/context/context-compression-strategies.js";
+export { snipCompactIfNeeded, type SnipResult, } from "../runtime/context/context-compression-strategies.js";
 export { applyCollapsesIfNeeded as applyContextCollapsesIfNeeded, recoverFromOverflow as recoverContextCollapseFromOverflow, createCollapseStore, type CollapseStore, type CollapseStage, } from "./context/context-collapse.js";
 export { buildSkillInstruction, recordPatternAndCheckThreshold, getPatternStats, buildToolSignature, type SkillCreateInstruction, type SkillImproveInstruction, type SkillInstruction, type SkillTurnResult, } from "./skill-improvement.js";
 export { applyToolChoicePolicy, type ApplyToolChoicePolicyInput, type ApplyToolChoicePolicyResult, } from "./tool-loop/tool-choice-policy.js";

package/dist/types/orchestration/product-budget.d.ts

@@ -4,7 +4,7 @@
  * Tracks cumulative token usage and elapsed time across all agent instances.
  * Emits 80% warning and enforces 100% hard limit.
  */
-import type { ProductBudget } from "../runtime/infra/acp-types.js";
+import type { ProductBudget } from "../protocol/wire/acp-agent-management.js";
 import type { AcpUsageTracker } from "../runtime/infra/acp-usage-tracker.js";
 /** Budget state and enforcement result. */
 export type BudgetAction = "ok" | "warning" | "exceeded";

package/dist/types/orchestration/product-persistence.d.ts

@@ -4,24 +4,15 @@
  * State is stored at `<project>/.qlogicagent/products/<productId>/product-state.json`.
  * Product listing is done by enumerating subdirectories.
  */
-import type { ProductPhase, ProductTaskStatus, ProductInstanceDef } from "../runtime/infra/acp-types.js";
+import type { ProductPhase, ProductInstanceDef } from "../protocol/wire/acp-agent-management.js";
+import type { SerializedNode } from "./dag-scheduler.js";
 export interface PersistedProductState {
     productId: string;
     name: string;
     phase: ProductPhase;
     cwd: string;
     instances: ProductInstanceDef[];
-    tasks: Array<{
-        taskId: string;
-        assignee: string;
-        prompt: string;
-        dependsOn: string[];
-        status: ProductTaskStatus;
-        result?: string;
-        error?: string;
-        startedAt?: number;
-        completedAt?: number;
-    }>;
+    tasks: SerializedNode[];
     budget: {
         maxTotalTokens?: number;
         maxDuration?: number;

package/dist/types/orchestration/product-planner.d.ts

@@ -26,7 +26,7 @@
 import type { AgentProcessManager } from "../runtime/infra/agent-process.js";
 import type { AcpDetector } from "../runtime/infra/acp-detector.js";
 import type { AgentConfigStore } from "../runtime/infra/agent-config-store.js";
-import type { ProductPlanParams, ProductPlan, ProductConfirmParams } from "../runtime/infra/acp-types.js";
+import type { ProductPlanParams, ProductPlan, ProductConfirmParams } from "../protocol/wire/acp-agent-management.js";
 export type PlanningPhase = "planning" | "awaiting_confirmation" | "confirmed" | "executing" | "paused" | "completed" | "cancelled";
 export interface PlanningMessage {
     role: "leader" | "user";

package/dist/types/orchestration/skill-improvement.d.ts

@@ -9,7 +9,7 @@
  * - Dedup check: compares tool-set signature against existing skills
  * - Cooldown: prevents rapid-fire creation within a session
  */
-import { MAX_SKILLS_PER_PROJECT, MAX_SKILLS_GLOBAL } from "../agent/tunable-defaults.js";
+import { MAX_SKILLS_PER_PROJECT, MAX_SKILLS_GLOBAL } from "../runtime/config/tunable-defaults.js";
 export { MAX_SKILLS_PER_PROJECT, MAX_SKILLS_GLOBAL };
 export interface SkillTurnResult {
     ok: boolean;

package/dist/types/orchestration/solo-evaluator.d.ts

@@ -21,7 +21,7 @@
 import type { AgentProcessManager } from "../runtime/infra/agent-process.js";
 import type { AcpDetector } from "../runtime/infra/acp-detector.js";
 import type { AgentConfigStore } from "../runtime/infra/agent-config-store.js";
-import type { SoloAgentState, SoloEvaluation, SoloStatus, SoloStartParams, SoloSelectParams } from "../runtime/infra/acp-types.js";
+import type { SoloAgentState, SoloEvaluation, SoloStatus, SoloStartParams, SoloSelectParams } from "../protocol/wire/acp-agent-management.js";
 export interface SoloCallbacks {
     log?: {
         info(msg: string): void;

package/dist/types/orchestration/solo-persistence.d.ts

@@ -4,7 +4,7 @@
  * State is stored at `<project>/.qlogicagent/solos/<soloId>/solo-state.json`.
  * Mirrors the product-persistence.ts pattern.
  */
-import type { SoloState, SoloAgentState, SoloEvaluation } from "../runtime/infra/acp-types.js";
+import type { SoloState, SoloAgentState, SoloEvaluation } from "../protocol/wire/acp-agent-management.js";
 export interface PersistedSoloState {
     soloId: string;
     state: SoloState;

package/dist/types/orchestration/subagent/fork-subagent.d.ts

@@ -9,7 +9,7 @@
  * 5. Depth control via in-memory counter (not DB-based)
  */
 import type { AgentDefinition } from "./agent-registry.js";
-import { MAX_FORK_DEPTH } from "../../agent/tunable-defaults.js";
+import { MAX_FORK_DEPTH } from "../../runtime/config/tunable-defaults.js";
 /** Sentinel tag injected into fork children to prevent recursive forking. */
 export declare const FORK_SENTINEL_TAG = "<fork-child-context>";
 /** Placeholder text used for all tool_results in shared prefix (ensures byte-identical prefix). */

package/dist/types/orchestration/subagent/task-types.d.ts

@@ -1,146 +1 @@
-/**
- * Task Type Taxonomy — CC-aligned sub-agent task state system.
- *
- * CC defines 7 task types for sub-agent dispatch. Each type has different:
- *   - Execution model (in-process, subprocess, remote)
- *   - Isolation level (shared, worktree, container)
- *   - Permission handling (interactive, coordinator, worker)
- *   - Tool access (full, restricted, read-only)
- *
- * Reference: claude-code src/tasks/types.ts
- */
-/**
- * The 7 task types from CC's sub-agent architecture.
- *
- * - local_bash: Subprocess shell execution (bash/powershell)
- * - local_agent: Background forked Node process with its own tool loop
- * - remote_agent: Cloud environment (polling-based, e.g., CCR sandbox)
- * - in_process_teammate: Same process, AsyncLocalStorage-isolated agent
- * - local_workflow: DAG/pipeline execution (planned)
- * - monitor_mcp: MCP server monitoring agent (planned)
- * - dream: Background memory consolidation agent
- */
-export type TaskType = "local_bash" | "local_agent" | "remote_agent" | "in_process_teammate" | "local_workflow" | "monitor_mcp" | "dream";
-/**
- * How a sub-agent is isolated from the parent execution.
- *
- * - shared: Same working directory, same filesystem (default fork)
- * - worktree: Git worktree checkout — separate branch, merges back
- * - container: Container sandbox (docker/remote)
- */
-export type IsolationMode = "shared" | "worktree" | "container";
-/**
- * Permission context for sub-agent execution.
- * Determines which PermissionChecker variant is used.
- *
- * CC reference: 3 permission handler variants
- * - interactive: User-facing agent, prompts for approval
- * - coordinator: Orchestrator agent, auto-approves most non-destructive ops
- * - worker: Headless worker, classifier-only (no user prompts)
- */
-export type PermissionRole = "interactive" | "coordinator" | "worker";
-/** Common state fields shared by all task types. */
-export interface TaskStateBase {
-    /** Unique task ID. */
-    taskId: string;
-    /** Task type discriminant. */
-    type: TaskType;
-    /** Human-readable label. */
-    label: string;
-    /** The permission role for this task's agent. */
-    permissionRole: PermissionRole;
-    /** Isolation mode. */
-    isolation: IsolationMode;
-    /** Current lifecycle state. */
-    lifecycle: TaskLifecycle;
-    /** Parent task ID (for nested sub-agents). */
-    parentTaskId?: string;
-    /** Execution depth (0 = root). */
-    depth: number;
-    /** Maximum turns before forced stop. */
-    maxTurns: number;
-    /** Token budget for this task. */
-    tokenBudget: number;
-    /** Start timestamp (ms). */
-    startedAt: number;
-    /** End timestamp (ms), set when completed/failed. */
-    endedAt?: number;
-}
-export type TaskLifecycle = "pending" | "running" | "completed" | "failed" | "cancelled" | "timeout";
-/** Local bash task — subprocess shell execution. */
-export interface LocalBashTaskState extends TaskStateBase {
-    type: "local_bash";
-    command: string;
-    cwd: string;
-    pid?: number;
-}
-/** Local agent task — forked agent with its own tool loop. */
-export interface LocalAgentTaskState extends TaskStateBase {
-    type: "local_agent";
-    agentName: string;
-    systemPrompt: string;
-    /** Restricted tool set (empty = inherit parent). */
-    allowedTools: string[];
-    /** Worktree branch name (if isolation === "worktree"). */
-    worktreeBranch?: string;
-}
-/** Remote agent task — cloud sandbox execution. */
-export interface RemoteAgentTaskState extends TaskStateBase {
-    type: "remote_agent";
-    /** Remote session/environment ID. */
-    remoteSessionId: string;
-    /** Polling endpoint for status checks. */
-    pollEndpoint?: string;
-}
-/** In-process teammate — AsyncLocalStorage-isolated, same process. */
-export interface InProcessTeammateTaskState extends TaskStateBase {
-    type: "in_process_teammate";
-    teamName: string;
-    agentName: string;
-    /** Teammate's independent permission mode. */
-    permissionMode: string;
-    /** Async mailbox for coordinator ↔ worker communication. */
-    mailboxId?: string;
-    /** Isolated git worktree path for this teammate (CC team worktree parity). */
-    worktreePath?: string;
-    /** Worktree branch name (for cleanup). */
-    worktreeBranch?: string;
-}
-/** A single dream agent turn — text output + tool use count. */
-export interface DreamTurn {
-    text: string;
-    toolUseCount: number;
-}
-/** Dream phase lifecycle — CC alignment. */
-export type DreamPhase = "starting" | "updating" | "completed" | "failed";
-/** Dream task — background memory consolidation agent (CC autoDream parity). */
-export interface DreamTaskState extends TaskStateBase {
-    type: "dream";
-    sessionId: string;
-    /** Current dream phase. */
-    phase: DreamPhase;
-    /** Number of sessions being reviewed. */
-    sessionsReviewing: number;
-    /** Memory files touched by the dream agent. */
-    filesTouched: string[];
-    /** Dream agent turn history (capped). */
-    turns: DreamTurn[];
-    /** Stashed lock mtime for rollback on failure. */
-    priorLockMtime: number;
-}
-/** Placeholder for planned task types. */
-export interface PlannedTaskState extends TaskStateBase {
-    type: "local_workflow" | "monitor_mcp";
-}
-/** Union of all concrete task states. */
-export type TaskState = LocalBashTaskState | LocalAgentTaskState | RemoteAgentTaskState | InProcessTeammateTaskState | DreamTaskState | PlannedTaskState;
-/**
- * Filter available tools by permission role.
- *
- * @param role - The agent's permission role
- * @param availableTools - Full set of tool names
- * @returns Filtered tool names appropriate for the role
- */
-export declare function filterToolsByRole(role: PermissionRole, availableTools: string[]): string[];
-/** Create a new task state with defaults populated. */
-export declare function createTaskState(overrides: Pick<TaskStateBase, "taskId" | "type" | "label"> & Partial<TaskStateBase>): TaskStateBase;
+export * from "../../runtime/tasks/task-types.js";

package/dist/types/orchestration/tool-cascade.d.ts

@@ -31,10 +31,10 @@
  * ```
  */
 import type { ProviderToolAPI } from "@xiaozhiclaw/provider-core";
-import type { WebSearchToolDeps } from "../skills/tools/web-search-tool.js";
+import type { WebSearchBackend } from "../runtime/ports/web-search-contracts.js";
 /**
  * Cascade web search: provider-native search → host fallback.
  * Returns a WebSearchToolDeps.search function that tries the provider's
  * webSearch API first, falling back to the host's search on error.
  */
-export declare function cascadeWebSearch(providerApi: ProviderToolAPI | undefined, fallbackSearch: WebSearchToolDeps["search"]): WebSearchToolDeps["search"];
+export declare function cascadeWebSearch(providerApi: ProviderToolAPI | undefined, fallbackSearch: WebSearchBackend["search"]): WebSearchBackend["search"];

package/dist/types/orchestration/workflow/budget-permission-gate.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Budget + permission ExecutionGate — the engine half of plan D15 ("无人值守触发须过 budget+权限闸门")
+ * and the M2 acceptance "触发式运行受 budget+权限闸门拦截".
+ *
+ * A workflow run is either ATTENDED (trigger "manual": a human is present and authorizes
+ * interactively) or UNATTENDED (trigger "schedule" / "im-message" / "webhook": fired by the
+ * trigger layer with nobody watching). This gate enforces two independent guarantees on every
+ * node, before it executes:
+ *
+ *   1. Permission (security, HARD fail-loud) — an unattended run may only execute side-effecting
+ *      ("sensitive") node kinds that were EXPLICITLY authorized via `allowUnattendedKinds`. A
+ *      sensitive kind that was not pre-authorized throws `WorkflowPermissionDenied` and halts the
+ *      run (status "failed"). Pure / control-flow kinds (set/if/loop/merge/passthrough/trigger)
+ *      are always allowed. Manual runs skip permission entirely (the user is the authorization).
+ *   2. Budget (resumable pause) — every node must pass the per-run budget (D15 "每轮过 budget"):
+ *      a hard cap on node executions and an optional wall-clock cap. Exceeding either throws
+ *      `WorkflowBudgetExceeded`, which extends the runtime's pause signal, so the run SUSPENDS
+ *      with its cache intact (raise the budget, then resume) rather than failing — mirroring the
+ *      existing ProductBudgetTracker "exceeded → pause" semantics.
+ *
+ * Pure and deterministic: no I/O, an injectable clock. fail-loud construction: a non-positive
+ * `maxNodeExecutions` (or non-positive `maxDurationMs`) throws — a budget with no ceiling is a
+ * silent way to disable the gate, which D15 forbids.
+ */
+import { WorkflowPauseSignal, type ExecutionGate } from "./workflow-runtime.js";
+/** The trigger kinds that can start a run. Single source of the union (consumed by the controller). */
+export type WorkflowTriggerKind = "manual" | "schedule" | "im-message" | "webhook";
+/**
+ * Node kinds that reach the outside world (network calls, channel sends, agent/tool/mcp side
+ * effects). These require explicit authorization to run unattended. Control / data-shaping kinds
+ * (set / if / loop / merge / passthrough / trigger) are NOT here — they cannot escape the engine.
+ */
+export declare const SENSITIVE_KINDS: ReadonlySet<string>;
+/** Hard, non-resumable denial: an unauthorized side-effecting kind under an unattended trigger. */
+export declare class WorkflowPermissionDenied extends Error {
+    readonly nodeId: string;
+    readonly kind: string;
+    readonly trigger: WorkflowTriggerKind;
+    constructor(nodeId: string, kind: string, trigger: WorkflowTriggerKind);
+}
+/**
+ * Budget ceiling reached. Extends WorkflowPauseSignal so the runtime treats it as a graceful,
+ * resumable suspension (cache retained) rather than a failure — the caller raises the budget and
+ * resumes, and already-completed nodes hit cache.
+ */
+export declare class WorkflowBudgetExceeded extends WorkflowPauseSignal {
+    readonly reason: "executions" | "duration";
+    readonly limit: number;
+    constructor(atNodeId: string, reason: "executions" | "duration", limit: number);
+}
+export interface BudgetPermissionGateOptions {
+    /** Trigger kind of THIS run. "manual" = attended (permission skipped); others = unattended. */
+    trigger: WorkflowTriggerKind;
+    /** Hard cap on node executions per run (D15 loop hard-cap is separate, in the scheduler). */
+    maxNodeExecutions: number;
+    /** Optional wall-clock cap in ms; the run pauses once elapsed reaches it. */
+    maxDurationMs?: number;
+    /** Sensitive kinds an UNATTENDED run is allowed to execute. Ignored for manual runs. */
+    allowUnattendedKinds?: readonly string[];
+    /** Injectable clock (ms epoch) for deterministic tests. */
+    now?: () => number;
+}
+export declare class BudgetPermissionGate implements ExecutionGate {
+    private readonly trigger;
+    private maxNodeExecutions;
+    private maxDurationMs?;
+    private readonly allow;
+    private readonly now;
+    private executions;
+    private startedAt;
+    constructor(opts: BudgetPermissionGateOptions);
+    private get unattended();
+    /** Invoked by the runtime before each node executes. Throws to deny (hard) or pause (budget). */
+    check(nodeId: string, kind: string): void;
+    /**
+     * Raise the remaining allowance so a budget-paused run can resume (D15 "抬预算后 resume").
+     * Deltas are ADDED to the current ceilings. fail-loud: a non-positive delta is rejected, and
+     * extending duration is only valid when a duration cap exists (extending an absent cap is a
+     * silent no-op the caller likely did not intend).
+     */
+    extend(delta: {
+        executions?: number;
+        durationMs?: number;
+    }): void;
+}

package/dist/types/orchestration/workflow/builtin-executors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Built-in deterministic NodeExecutors (M2).
+ *
+ * These are REAL node implementations (not mocks): pure data transforms used by automation
+ * workflows. Host-backed kinds (agent/tool/http/mcp/channel) are injected separately so the
+ * engine stays a pure executor (plan D12/D13).
+ *
+ * Note: "loop" is NOT here — loop control is owned by the runtime (DagScheduler.decideLoop),
+ * not a user executor.
+ */
+import type { NodeExecutor } from "./node-schema.js";
+export declare const builtinExecutors: Record<string, NodeExecutor>;