@agentproto/runtime 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -1,18 +1,22 @@
 import { DoctypeSpec } from '@agentproto/manifest';
 import { B as BuildHeartbeatAgent } from './heartbeat-COGpMrJS.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-COGpMrJS.js';
-import { AcpMcpServer } from '@agentproto/acp';
+import { AcpPermissionResolution, AcpMcpServer } from '@agentproto/acp';
 import { ChildProcess } from 'node:child_process';
-import { D as DeclaredAdapterOption } from './spawn-defaults-d5gAhNkV.js';
+import { R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-DAbADRd4.js';
+export { a as AuthEcho, b as AuthResolutionError, C as CredentialSource, c as DefaultsAdapterAuthConfig, d as DefaultsAdapterConfig, e as ResolvedSpawnAuthMaterial, f as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, g as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, h as resolveSpawnDefaults } from './spawn-defaults-DAbADRd4.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, AdapterEntry } from '@agentproto/provider-kit';
 import { SandboxProvider } from '@agentproto/sandbox';
+import { FrameSink, E2eFrameSink } from '@agentproto/acp/tunnel';
+import { DaemonIdentity } from '@agentproto/secrets/identity';
 import { WorkspaceFs } from './workspace-fs.js';
 export { createWorkspaceFs } from './workspace-fs.js';
 export { ConversationMeta, ConversationStore, ConversationTurn, fileConversationStore } from './conversations.js';
 import { ProviderPreset } from '@agentproto/provider-presets';
 import { StepCache } from '@agentproto/workflow-runtime';
-export { PROVIDER_ENV_VARS, ProviderEntry, ProvidersFile, injectProviderKeysIntoEnv, loadProviders, providerEnvVar, providersPath, removeProviderKey, setProviderKey } from './providers-store.js';
+export { PROVIDER_ENV_VARS, ProviderEntry, ProvidersFile, getProviderKey, injectProviderKeysIntoEnv, loadProviders, providerEnvVar, providersPath, removeProviderKey, setProviderKey } from '@agentproto/providers-store';
+import '@agentproto/model-catalog';
 
 /**
  * Per-session JSONL record of a completed `command_execute` invocation
@@ -137,7 +141,7 @@ declare function projectSessionUsage(desc: UsageDescriptorFields): SessionUsage;
  * (fire-and-forget HTTP), RoutineRunner (state machine fan-in),
  * and session_monitor MCP tool (long-poll multiplexed).
  */
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:exited" | "session:command-done" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed";
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:command-done" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed";
 /**
  * Structured detail on why a session is awaiting input, when derivable.
  * `source: "structured"` — a driver-reported ACP-style prompt (e.g. a tool
@@ -168,6 +172,16 @@ interface SessionTurnEndEvent {
      * Absent for drivers that don't report a reason.
      */
     reason?: string;
+    /**
+     * True when the turn completed normally but produced ZERO assistant
+     * output AND zero tool calls (and wasn't awaiting input) — a silent
+     * no-op. Grok via hermes/OpenRouter, and any invalid/rejected model id,
+     * complete a turn this way: `turnsCompleted` bumps, `$0` cost, empty
+     * transcript. Surfaced so an orchestrator can flag it instead of
+     * treating a green turn-end as real progress. Absent (not `false`) on
+     * a normal, productive turn.
+     */
+    empty?: boolean;
 }
 interface SessionAwaitingInputEvent {
     type: "session:awaiting-input";
@@ -176,6 +190,34 @@ interface SessionAwaitingInputEvent {
     ts: string;
     question?: SessionAwaitingQuestion;
 }
+/**
+ * Emitted when a permission-hold session parks a `session/request_permission`
+ * (see the pending-permissions inbox in sessions.ts). `permissionId` is the
+ * stable id `permissions_respond` / `POST /permissions/:id` resolve it with.
+ */
+interface SessionPermissionRequestEvent {
+    type: "session:permission-request";
+    sessionId: string;
+    permissionId: string;
+    toolName?: string;
+    text: string;
+    label?: string;
+    ts: string;
+}
+/**
+ * Emitted when a parked permission is resolved — by an inbox
+ * approve/deny, or auto-`cancelled` when the session is torn down while the
+ * request is still pending.
+ */
+interface SessionPermissionResolvedEvent {
+    type: "session:permission-resolved";
+    sessionId: string;
+    permissionId: string;
+    decision: "approve" | "deny" | "cancelled";
+    optionId?: string;
+    label?: string;
+    ts: string;
+}
 interface SessionExitedEvent {
     type: "session:exited";
     sessionId: string;
@@ -183,6 +225,12 @@ interface SessionExitedEvent {
     status: "exited" | "killed" | "error";
     label?: string;
     ts: string;
+    /** Mirrors `SessionDescriptor.endedReason` — set when this exit was the
+     *  daemon dying underneath the session (crash-discovered-at-boot or a
+     *  forced shutdown kill), not an operator targeting it. Lets a watcher
+     *  (completion-policy supervisor, `session_monitor`) tell "my agent died
+     *  because the daemon did" apart from a deliberate kill. Absent otherwise. */
+    reason?: "daemon-restart";
 }
 /** Emitted when command_execute finishes. commandId matches the id
  *  returned by the command_execute MCP tool. */
@@ -257,7 +305,7 @@ interface CronFailedEvent {
     error: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionExitedEvent | SessionCommandDoneEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent;
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionCommandDoneEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -320,6 +368,13 @@ interface AgentSessionLike {
     pid?: number;
     send(message: unknown): AsyncIterable<AgentStreamEvent>;
     cancel(): Promise<void>;
+    /** Resolve a permission request the driver parked in permission-hold mode
+     *  (see the pending-permissions inbox below). `requestId` is the driver's
+     *  own stable id, surfaced on the `agent-prompt` event's `toolCallId`.
+     *  Returns true when a matching parked request was resolved. Absent for
+     *  drivers that don't model held permissions (sandbox proxy, future
+     *  transports). */
+    respondPermission?(requestId: string, resolution: AcpPermissionResolution): boolean | Promise<boolean>;
     close(): Promise<void>;
 }
 /**
@@ -358,6 +413,11 @@ interface AgentStreamEvent {
     toolName?: string;
     /** Tool-call input, e.g. an ACP `tool_call`'s `arguments` — see @agentproto/acp's `StreamEvent`. */
     arguments?: unknown;
+    /** True when a "tool-call" event ENRICHES one already announced under the
+     *  same `toolCallId` (the agent knew the input only after announcing the
+     *  call) rather than announcing a new one — see @agentproto/acp's
+     *  `StreamEvent`. Consumers merge by toolCallId; it is not a second call. */
+    isUpdate?: boolean;
     /** Tool-call output, e.g. an ACP `tool_call_update`'s `result` — see @agentproto/acp's `StreamEvent`. */
     result?: unknown;
     isError?: boolean;
@@ -399,6 +459,20 @@ interface AgentStreamEvent {
 }
 type SessionKind = "terminal" | "agent-cli" | "command" | "browser";
 type SessionStatus = "starting" | "running" | "exited" | "killed" | "error";
+/**
+ * The billing-auth resolver's OBSERVABLE echo, recorded on a session
+ * descriptor. `mode` + `fingerprint` are always present when recorded (a
+ * credential resolved); `provider` / `credentialSource` / `setEnv` are the
+ * multi-provider resolver's additions (DECISION 9③/10②) — optional for
+ * back-compat with descriptors from before that resolver shipped.
+ */
+interface SessionAuthEcho {
+    mode: "subscription" | "api-key";
+    fingerprint: string;
+    provider?: string;
+    credentialSource?: "explicit-config" | "providers-store" | "none";
+    setEnv?: string;
+}
 interface SessionDescriptor {
     id: string;
     kind: SessionKind;
@@ -411,6 +485,33 @@ interface SessionDescriptor {
     startedAt: string;
     endedAt?: string;
     exitCode?: number;
+    /** Set alongside `status: "killed"` when the session ended NOT because an
+     *  operator targeted it (`kill()`) but because the daemon process it lived
+     *  in went away out from under it — a hard crash discovered at next boot
+     *  (`loadHistorySnapshot`'s wasAlive reclassification), or a graceful
+     *  shutdown/restart that force-kills whatever's still busy
+     *  (`shutdownImpl`). Absent for every other terminal path (operator kill,
+     *  natural exit, turn error) — the session's own fault, or at least not
+     *  the daemon's. Lets the UI show "crashed with the daemon" instead of a
+     *  bare "killed" that reads as deliberate. */
+    endedReason?: "daemon-restart";
+    /** Whether a turn was actually in flight the INSTANT `status` flipped to
+     *  "killed" — captured before anything else runs, because `busy` itself
+     *  cannot be trusted after the fact: `runAgentTurn`'s `finally` is what
+     *  clears `busy`, and that `finally` never fires for a generator that's
+     *  never resumed (a killed child mid-tool-call, or a dead daemon), so a
+     *  post-hoc read of `busy` on a killed session may just be showing you
+     *  whatever it froze at. This field exists because `status: "killed"`
+     *  alone can't tell a human's Stop mid-turn apart from a supervisor
+     *  reaping a child that had already finished — both leave `exitCode:
+     *  null`, and `turnsCompleted` alone is too weak (a session killed
+     *  mid-SECOND-turn also has `turnsCompleted: 1`). `killedMidTurn: true`
+     *  paired with any `turnsCompleted` means interrupted; `false`/absent
+     *  alongside `turnsCompleted > 0` means the work was done before the
+     *  kill — see activityFor in the vscode package for the read. Set by
+     *  `kill()`, `shutdownImpl`'s force-kill, and `loadHistorySnapshot`'s
+     *  wasAlive reclassification; absent for every other terminal path. */
+    killedMidTurn?: boolean;
     /** Last time anything was written to stdout/stderr. Lets the UI
      *  spot stuck sessions ("running for 2h, last output 12min ago"). */
     lastOutputAt?: string;
@@ -430,6 +531,10 @@ interface SessionDescriptor {
     /** Free-text label the spawner can attach (e.g. conversation id,
      *  operator name) so the UI can group/filter. */
     label?: string;
+    /** Derived from the session's FIRST prompt — what this conversation is
+     *  about, for a UI that would otherwise show the adapter's argv. Distinct
+     *  from `label`, which the spawner supplies and which always wins. */
+    title?: string;
     /** True when the session was spawned under a real PTY (node-pty)
      *  instead of `child_process.spawn`. PTY sessions carry raw ANSI
      *  bytes (alt-screen, key bindings, colors); attach goes through
@@ -445,12 +550,50 @@ interface SessionDescriptor {
     argv?: readonly string[];
     /** Working directory the session was spawned in. Cloned by restart. */
     cwd?: string;
+    /** Root of the git worktree the session was spawned in — the session→
+     *  worktree edge, resolved from `cwd` at spawn time
+     *  (`resolveWorktreeIdentity`). Distinct from `cwd`, which may be a
+     *  subdirectory of it. Absent when `cwd` isn't inside a linked worktree (a
+     *  plain checkout, a non-repo dir) and for every session persisted before
+     *  this field existed.
+     *
+     *  Recorded rather than computed at read time because it can't be
+     *  recovered later: a worktree removed after the session ran leaves nothing
+     *  on disk to re-resolve. */
+    worktreePath?: string;
+    /** Generation id of that worktree, read at spawn from the provision marker
+     *  (`agentproto-worktree.json` in the worktree's private gitdir, written by
+     *  `worktree.provision`). Absent whenever `worktreePath` is, and also for a
+     *  worktree created by a bare `git worktree add` — nothing writes a marker
+     *  there. The marker is what distinguishes generations, so a
+     *  `worktreePath` without an id identifies a PATH, which a later worktree
+     *  may reuse; the pair identifies one specific worktree. */
+    worktreeId?: string;
     /** Adapter slug for agent-cli sessions — restart uses this with
      *  `/sessions/agent` to spin up a fresh ACP runtime. Undefined for
      *  pty/command kinds. */
     adapterSlug?: string;
     /** The model the session was requested to run (echoed back at spawn). */
     model?: string;
+    /**
+     * Deterministic billing-auth mode + a non-secret credential fingerprint,
+     * recorded at spawn time for adapters that resolved an explicit
+     * credential (today: claude-code — see `AgentCliAuth.modes` in
+     * `@agentproto/driver-agent-cli`). The "verifiability" answer to "what
+     * was used": `mode` is the resolved `"subscription" | "api-key"`;
+     * `fingerprint` is `credentialFingerprint(mode, credential)` — e.g.
+     * `"subscription · sk-ant-oat…3f9c"` — NEVER the raw credential. Absent
+     * when no credential resolved (every adapter besides claude-code, in
+     * practice) or for a sandboxed spawn (the box's own daemon resolves its
+     * own credential independently). Surfaced in `agentproto sessions
+     * --watch`'s DETAIL pane and `agent_sessions_list`.
+     *
+     * Carries the resolver's OBSERVABLE echo (DECISION 9③/10②): `provider`,
+     * `credentialSource`, and the `setEnv` actually set — so a verifier checks
+     * the RESOLUTION, not the model's self-report. These are optional for
+     * back-compat with descriptors persisted before the multi-provider resolver.
+     */
+    auth?: SessionAuthEcho;
     /** Cumulative estimated USD cost of the session — best-effort, refreshed
      *  on each turn-end from the adapter's usage reader (e.g. hermes reads its
      *  state.db). Absent for adapters with no usage source. */
@@ -508,6 +651,14 @@ interface SessionDescriptor {
      * drivers that don't report structured prompts. Cleared alongside
      * `awaitingInput` on the next turn start. */
     awaitingQuestion?: SessionAwaitingQuestion;
+    /** True while this session (spawned in permission-hold mode) has at least
+     *  one permission request parked in the inbox awaiting a human/orchestrator
+     *  decision. Distinct from `awaitingInput` (a conversational question) — a
+     *  held permission is resolved via `permissions_respond` / `agentproto
+     *  permissions approve|deny`, not a normal prompt. Set when a request is
+     *  registered, cleared when the last pending one for this session resolves.
+     *  Absent (never `false`) for sessions with no held permissions. */
+    awaitingPermission?: boolean;
     /** Count of turns that have fully completed (turn-end emitted) on this
      *  session. Lets `session_monitor` fast-return for a session that already
      *  finished its turn before the wait subscribed — a fast turn that ends
@@ -524,8 +675,12 @@ interface SessionDescriptor {
      *  from the pending tool call: a spawned sub-agent (`agent_start`) or a
      *  shell/terminal command. Deliberately NO "user" variant — waiting on
      *  the user is already covered by `awaitingInput`/`awaitingQuestion`.
-     *  Set on tool-call, cleared on the MATCHING tool-result (guarded by
-     *  `pendingToolCallId`), at turn start, and in the turn's finally. */
+     *
+     *  Set on tool-call; released (see `releaseBlockedOn`) on the MATCHING
+     *  tool-result, on `error` (a failing tool never emits a result), on the
+     *  next assistant `text-delta` (the model has the floor, so nothing is
+     *  pending), at turn start, and in the turn's finally. A claim about the
+     *  present tense — anything that disproves it must clear it. */
     blockedOn?: "subagent" | "command";
     /** toolCallId of the tool-call that set `blockedOn`. A tool-result only
      *  clears `blockedOn` when its toolCallId matches — so a nested or
@@ -574,6 +729,52 @@ interface SessionDescriptor {
      *  `agent_start.sandbox.reuse`). Only set when `remote` is true. */
     sandboxTeardown?: "kill" | "pause";
 }
+/**
+ * A `session/request_permission` request parked by a permission-hold session,
+ * awaiting a human/orchestrator decision through the cross-session inbox
+ * (`permissions_list` / `permissions_respond`, `GET /permissions` /
+ * `POST /permissions/:id`, `agentproto permissions ls|approve|deny`).
+ */
+interface PendingPermission {
+    /** Stable id — the driver's own request id, unique across sessions. Pass to
+     *  `respondPermission`. */
+    id: string;
+    sessionId: string;
+    /** ACP tool-call id the request was raised for (== `id` today; kept distinct
+     *  so a future driver can surface a separate correlation id). */
+    toolCallId: string;
+    /** Tool title/kind the agent is asking permission for, when known. */
+    toolName?: string;
+    /** Human-readable "Allow X?" line. */
+    text: string;
+    /** Options the agent offered (ACP `requestPermission` shape). */
+    options: Array<{
+        optionId: string;
+        name?: string;
+        kind?: string;
+    }>;
+    /** ISO timestamp the request was parked. */
+    requestedAt: string;
+}
+/** How a caller resolves a pending permission — an explicit `optionId` wins
+ *  over the `decision`→option mapping (approve → an allow-flavored option,
+ *  deny → a reject-flavored option). `scope: "always"` prefers an
+ *  allow-always option when the request offers one. */
+interface PermissionRespondInput {
+    decision: "approve" | "deny";
+    optionId?: string;
+    scope?: "once" | "always";
+}
+type PermissionRespondResult = {
+    ok: true;
+    permission: PendingPermission;
+    decision: "approve" | "deny";
+    optionId?: string;
+} | {
+    ok: false;
+    error: "not_found" | "session_gone" | "no_matching_option" | "unsupported";
+    message: string;
+};
 interface SessionsRegistry {
     spawn(input: SpawnSessionInput): SessionDescriptor;
     /** Adopt a ChildProcess that was spawned outside the registry —
@@ -621,12 +822,21 @@ interface SessionsRegistry {
      *  mints a fresh session id. The `stop` callback is invoked by
      *  `kill()` best-effort. */
     registerBrowser(input: RegisterBrowserInput): SessionDescriptor;
-    /** Send a follow-up turn to a live agent session. Throws when the
-     *  session is missing, not an agent-cli kind, dead (exited/killed/
-     *  error and unresumable — `SessionNotAliveError`), or busy
+    /** Send a follow-up turn to a live agent session and AWAIT it. Throws
+     *  when the session is missing, not an agent-cli kind, dead (exited/
+     *  killed/error and unresumable — `SessionNotAliveError`), or busy
      *  (mid-turn). The events stream into the existing ring buffer +
-     *  line emitter so /stream consumers see them as they arrive. */
-    sendPrompt(id: string, message: unknown): Promise<void>;
+     *  line emitter so /stream consumers see them as they arrive.
+     *
+     *  `opts.interrupt` behaves exactly as it does on `enqueuePrompt`:
+     *  a mid-turn session has its in-flight turn cancelled and settled
+     *  before admission, so this prompt redirects the SAME live session
+     *  instead of hitting the busy rejection. Ignored (identical to the
+     *  default) when the session is idle. Omitted or `false` reproduces
+     *  the previous mid-turn rejection byte-for-byte. */
+    sendPrompt(id: string, message: unknown, opts?: {
+        interrupt?: boolean;
+    }): Promise<void>;
     /** Fire-and-forget variant of `sendPrompt` for the TURN ITSELF only.
      *  Admission (resume attempt + the missing/wrong-kind/dead/busy
      *  checks `sendPrompt` throws) is AWAITED before this resolves, so a
@@ -648,6 +858,22 @@ interface SessionsRegistry {
     enqueuePrompt(id: string, message: unknown, opts?: {
         interrupt?: boolean;
     }): Promise<void>;
+    /** Cancel the in-flight turn on a live agent-cli session and leave the
+     *  session itself alive and idle — the bare "interrupt, no next prompt"
+     *  primitive `sendPrompt`/`enqueuePrompt`'s `opts.interrupt` arm lacks
+     *  on its own, since that arm always exists to redirect onto a NEW
+     *  prompt. Reuses the same `interruptInFlightTurn` helper those two
+     *  share.
+     *
+     *  Idempotent by design: idle, unknown-alive (starting/running only —
+     *  same liveness `validateAgentTurn` checks), or already-terminal
+     *  (exited/killed/error) all resolve `{ wasBusy: false }` rather than
+     *  throwing — a no-op interrupt is not an error. Throws only when the
+     *  id is unknown, or when `cancel()` itself rejects ("does not support
+     *  interrupt", propagated from `interruptInFlightTurn`). */
+    interruptSession(id: string): Promise<{
+        wasBusy: boolean;
+    }>;
     /** Stamp `lastActivityAt` on a live agent-cli session's descriptor
      *  and schedule a debounced persist. Called from the `onActivity`
      *  callback threaded down through the driver → ACP client, which
@@ -661,6 +887,14 @@ interface SessionsRegistry {
      *  Initial backfill: synchronously invokes `onLine` once for each
      *  line currently in the ring buffer so attaches show context. */
     attach(id: string, onLine: (line: string, stream: "stdout" | "stderr") => void): (() => void) | null;
+    /** Subscribe to a session's structured events.jsonl records as they're
+     *  written — the live-push half of `GET /sessions/:id/events/stream`'s
+     *  replay-then-subscribe handoff. Thin passthrough to the transcript
+     *  writer's own `subscribe` (see transcript-writer.ts for the exactly-
+     *  once contract this enables); no backfill, no existence check — a
+     *  session id with no writer state simply never calls back. Returns an
+     *  unsubscribe fn. */
+    subscribeToRecords(id: string, onRecord: (record: Record<string, unknown>) => void): () => void;
     /** Subscribe to a PTY session's byte stream. Returns a control
      *  handle (write/resize/detach) and null when the session is
      *  missing or not a PTY kind. Replays the ring buffer
@@ -692,6 +926,17 @@ interface SessionsRegistry {
      *  tail. Returns null when the session is missing or not a PTY. */
     readTerminalOutput(id: string, lastBytes?: number): Buffer | null;
     kill(id: string, signal?: NodeJS.Signals): boolean;
+    /** List permission requests currently parked in the pending-permissions
+     *  inbox across all permission-hold sessions, newest last. Optionally
+     *  filtered to one session. */
+    listPendingPermissions(filter?: {
+        sessionId?: string;
+    }): PendingPermission[];
+    /** Resolve a parked permission by id — maps the decision (or explicit
+     *  optionId) to one of the offered options, resolves the held driver RPC,
+     *  clears the session's awaiting-permission state, and emits
+     *  `session:permission-resolved`. */
+    respondPermission(id: string, input: PermissionRespondInput): Promise<PermissionRespondResult>;
     /** Stop tracking a session (after it exited and the user clicked
      *  "clear"). Doesn't kill — use `kill` first. */
     forget(id: string): boolean;
@@ -764,6 +1009,11 @@ interface SpawnAgentInput {
     depth?: number;
     /** Requested model id — recorded on the descriptor for display + echo. */
     model?: string;
+    /** Resolved auth echo (mode + fingerprint + provider/source/setEnv) —
+     *  recorded verbatim onto {@link SessionDescriptor.auth}. See that field's
+     *  doc for the full contract; the caller (`session-spawn.ts`) computes this
+     *  via the billing-auth resolver, never passing the raw credential here. */
+    auth?: SessionAuthEcho;
     /** Hard ceiling on cumulative session cost (USD). When set and the
      *  adapter's usage reader reports a higher cost at a turn-end, the session
      *  is stopped (best-effort, turn-granular — caps continuation, can't abort
@@ -790,6 +1040,11 @@ interface SpawnAgentInput {
     /** What session close does to the box, when `remote` is true — see
      *  `SessionDescriptor.sandboxTeardown`. */
     sandboxTeardown?: "kill" | "pause";
+    /** True when the driver session was started in permission-hold mode
+     *  (`AgentCliStartOptions.permissionHold`) — its `agent-prompt` events carry
+     *  respondable permission requests. Gates whether the registry registers
+     *  them in the pending-permissions inbox. Default false. */
+    permissionHold?: boolean;
 }
 interface SpawnSessionInput {
     kind: SessionKind;
@@ -1142,6 +1397,156 @@ declare class TunnelRegistry {
     private loadFromDisk;
 }
 
+/**
+ * Daemon-side pairing registry (design: DESIGN §3/§4, PLAN deliverable 2).
+ *
+ * Owns everything the daemon needs to be *paired with* over an untrusted
+ * rendezvous:
+ *
+ *   - **Offer store** — in-memory, single-use, expiry-checked one-time tokens
+ *     minted by `pair offer`. A daemon restart voids outstanding offers
+ *     (acceptable + documented). The P1 `verifyOfferToken` predicate plugs in
+ *     here and SPENDS the token on the first successful handshake.
+ *   - **Pairings store** — `~/.agentproto/pairings.json` (0600, atomic write),
+ *     one record per paired client: `{clientPub, name, fingerprint, createdAt,
+ *     lastSeen, pairRoot, rendezvousUrl}`. `pairRoot` is the long-term shared
+ *     secret (`derivePairRoot`) from which reconnect routing tokens derive.
+ *   - **Rendezvous connections** — for a fresh offer, and for every persisted
+ *     pairing on boot (autoconnect), the daemon dials the rendezvous *outbound*
+ *     (`side=daemon&t=<token>`), runs `daemonHandshakeOverSink` with the P1
+ *     crypto, and — on success — serves the spliced, E2E-wrapped channel exactly
+ *     like `serve --connect` serves a tunnel host. The serving path itself is
+ *     injected (`serve`) so this module stays free of pty/adapter concerns and
+ *     the CLI can reuse its `createTunnelServer` config verbatim.
+ *   - **Reconnect epochs** — a persisted pairing's standing connection uses the
+ *     pairing-derived routing token `t' = HKDF(pairRoot, "rv-route"‖epoch)`,
+ *     rotated per UTC day. The daemon parks on BOTH the current and previous
+ *     epoch tokens so a client whose clock straddles midnight still finds it;
+ *     reconnect-with-backoff keeps the standing connection alive.
+ *   - **Revocation** — removing a pairing drops its rendezvous connections and
+ *     stops the daemon parking on its tokens, so it can no longer be reached.
+ *
+ * ## Reconnect authentication (why no stable client key)
+ *
+ * P1's handshake carries only a client *ephemeral* key (regenerated per
+ * handshake) — there is no persistent client identity key, and the PLAN forbids
+ * changing the handshake. So a reconnect authenticates the client by
+ * **possession of the epoch routing token**, which derives from `pairRoot` — a
+ * secret only the paired client and daemon share (it fell out of the original
+ * ECDH). The daemon dials a pairing's epoch token, and on that connection the
+ * `verifyOfferToken` predicate accepts a hello whose offer-token field equals
+ * that same epoch token (constant-time). Token possession ⇒ paired party. The
+ * stored `fingerprint` (of the first handshake's ephemeral key) is a stable
+ * display/revocation handle, not an authentication input.
+ */
+
+declare const PAIRINGS_VERSION: 1;
+/** One persisted pairing. Written verbatim to `pairings.json`. */
+interface PairingRecord {
+    /** The client ephemeral public key from the FIRST handshake (a snapshot —
+     *  reconnects use fresh ephemerals; this is not an auth input). */
+    clientPub: string;
+    /** Human-facing label the client chose on `pair accept`. */
+    name: string;
+    /** `identityFingerprint(clientPub)` from the first handshake — the stable
+     *  display + revocation handle. */
+    fingerprint: string;
+    /** ISO-8601 first-pair timestamp. */
+    createdAt: string;
+    /** ISO-8601 of the most recent successful (re)connect. */
+    lastSeen: string;
+    /** Long-term shared secret (base64), from which epoch routing tokens derive. */
+    pairRoot: string;
+    /** Rendezvous endpoint to reconnect through. */
+    rendezvousUrl: string;
+}
+/** Mode of a served channel — first-contact offer vs. an established reconnect. */
+type PairingChannelMode = "offer" | "reconnect";
+/** Context handed to the injected `serve` when a channel comes up. */
+interface PairingChannelContext {
+    mode: PairingChannelMode;
+    /** Stable pairing fingerprint (present for reconnect; for an offer it's the
+     *  freshly-derived one). */
+    fingerprint: string;
+    /** Client label. */
+    name: string;
+}
+/** Handle to a live served channel — the registry closes it on teardown. */
+interface PairingChannelHandle {
+    close(): Promise<void>;
+}
+interface CreatedOffer {
+    /** The one-time offer token (base64url). */
+    token: string;
+    /** Offer expiry, unix seconds. */
+    exp: number;
+    /** The full `agentproto://pair?…` offer URL. */
+    url: string;
+    /** The daemon's identity fingerprint (shown to the human at accept time). */
+    fingerprint: string;
+    /** The rendezvous the offer routes through. */
+    rendezvousUrl: string;
+    /** True when `rendezvousUrl` is the hosted default — i.e. neither an explicit
+     *  `--rendezvous` nor a configured `pairing.rendezvous` applied, so the offer
+     *  falls back to `HOSTED_RENDEZVOUS_URL`. Surfaced so `pair offer` can flag,
+     *  never silently, that the daemon is relaying through our infrastructure. */
+    rendezvousIsHostedDefault: boolean;
+}
+interface CreateOfferInput {
+    /** Time-to-live in ms. Default 10 minutes. */
+    ttlMs?: number;
+    /** Rendezvous URL override; falls back to the configured default. */
+    rendezvousUrl?: string;
+}
+interface PairingRegistryDeps {
+    /** Lazily load (create on first use) the daemon identity. Kept lazy so a
+     *  daemon that never pairs never writes an identity file. */
+    loadIdentity: () => Promise<DaemonIdentity>;
+    /** Path to `pairings.json`. Defaults to `~/.agentproto/pairings.json`. */
+    pairingsPath?: string;
+    /** Configured rendezvous URL (from `config.pairing.rendezvous`). Three states:
+     *  - `undefined` (key absent) → `createOffer` falls back to the hosted default
+     *    (`HOSTED_RENDEZVOUS_URL`).
+     *  - a non-empty URL → that endpoint is the default for offers.
+     *  - `""` (explicitly empty) → an explicit opt-out: no default applies, so an
+     *    offer without `--rendezvous` fails closed. Wire it through verbatim (do
+     *    not coerce `""` to `undefined`) or the opt-out silently reverts to the
+     *    hosted default. */
+    defaultRendezvousUrl?: string;
+    /** Dial a rendezvous WS and adapt it to a FrameSink. Injected by the CLI
+     *  (uses `ws` + `wrapWebSocket`). Rejects if the dial fails. The `signal`
+     *  aborts on registry shutdown. */
+    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
+    /** Serve the E2E-wrapped channel (the CLI builds `createTunnelServer` over
+     *  it with the same config `serve --connect` uses). */
+    serve: (sink: E2eFrameSink, ctx: PairingChannelContext) => PairingChannelHandle;
+    /** Injectable clock (ms). Defaults to Date.now. */
+    now?: () => number;
+    /** Diagnostic log sink. */
+    log?: (line: string) => void;
+    /** Reconnect backoff floor / ceiling (ms). Defaults 1s / 30s. */
+    reconnectMinMs?: number;
+    reconnectMaxMs?: number;
+    /** How long a parked daemon socket waits for a client hello before recycling
+     *  the connection. Kept just under the broker's park timeout. Default 110s. */
+    handshakeTimeoutMs?: number;
+}
+interface PairingRegistry {
+    /** Mint a one-time offer + start dialing the rendezvous for it. */
+    createOffer(input?: CreateOfferInput): Promise<CreatedOffer>;
+    /** All persisted pairings (copies). Loads `pairings.json` on first call. */
+    list(): Promise<PairingRecord[]>;
+    /** Drop a pairing by fingerprint or name; stops its rendezvous connections.
+     *  Returns false when nothing matched. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Start standing reconnect connections for every persisted pairing. Call
+     *  after the gateway is up (so the injected `serve` can reach it). */
+    startAutoconnect(): Promise<void>;
+    /** Tear down every offer + reconnect connection and served channel. */
+    shutdown(): Promise<void>;
+}
+declare function createPairingRegistry(deps: PairingRegistryDeps): PairingRegistry;
+
 /**
  * Fire-and-forget webhook notifier for session lifecycle events.
  *
@@ -1440,6 +1845,19 @@ interface PolicyRunState {
     nextPolicyId?: string;
     error?: string;
 }
+/**
+ * Does `policy` watch `sessionId`? True when the id is the representative
+ * `sessionId` or appears anywhere in the fan-in `sessionIds` group — the two
+ * ways `AttachPolicyInput` can name a session.
+ *
+ * This is the reverse of the policy→session link, and it is deliberately
+ * computed on demand over `list()` rather than persisted: a session→policy
+ * index in policies.json (or a `policies` field on the session record) would
+ * be a second source of truth to keep in sync across attach, fan-in nudges,
+ * `next` chaining, and snapshot reload. A filtered pass is O(policies) on a
+ * set the daemon already holds in memory.
+ */
+declare function policyWatchesSession(policy: PolicyRunState, sessionId: string): boolean;
 interface CompletionPolicySupervisor {
     /**
      * Attach a completion policy to an already-running session.
@@ -1870,6 +2288,17 @@ type AgentAdapterResolver = (slug: string) => Promise<{
          *  handler, POST /sessions/agent) wires this to pulse
          *  `SessionDescriptor.lastActivityAt` via `registry.pulseActivity(id)`. */
         onActivity?: () => void;
+        /** Start the session in permission-hold mode — forwarded to the driver's
+         *  `runtime.start({ permissionHold })` so each ACP permission request is
+         *  surfaced + parked in the daemon's inbox instead of auto-answered.
+         *  Adapters/arms with no permission surface ignore it. Default false. */
+        permissionHold?: boolean;
+        /** FULLY-RESOLVED billing-auth spec forwarded from `agent_start` to the
+         *  driver's `runtime.start({ auth })`, computed by the runtime's
+         *  `resolveAuthSpec` (provider, ordered mode, setEnv/scrub, credential
+         *  source all pre-decided). The driver applies it mechanically. Absent
+         *  when the resolver produced no spec (ambient). */
+        auth?: ResolvedAuthSpec;
     }): Promise<AgentSessionLike>;
     /** Display label for the descriptor's `command` field. */
     commandPreview?: string;
@@ -1887,6 +2316,15 @@ type AgentAdapterResolver = (slug: string) => Promise<{
      *  documented no-op for that adapter (e.g. claude-code, which
      *  auto-discovers skills and declares no such option). */
     declaredOptions?: readonly DeclaredAdapterOption[];
+    /** Billing-auth descriptor projected from the adapter manifest
+     *  (`provider` / `authEnforce` / `authSubscription`) — the sole input the
+     *  runtime's `resolveAuthSpec` reads about the adapter's auth capability
+     *  (keeping the catalog coupling in the runtime, the driver mechanical).
+     *  Omitted ⇒ ambient (no credential injection). */
+    authDescriptor?: AdapterAuthDescriptor;
+    /** Adapter's default model id (`models.default`) — lets the resolver derive
+     *  a provider for a by-model spawn that omitted `model`. */
+    defaultModel?: string;
 } | null>;
 /**
  * UI-safe projection of an AIP-45 `modes[]` entry as surfaced by
@@ -2098,6 +2536,27 @@ interface McpCredentialDeps {
 declare function setMcpCredentialDeps(d: McpCredentialDeps): void;
 declare function getMcpCredentialDeps(): McpCredentialDeps;
 
+/**
+ * MCP tools that drive the pairing registry — the daemon's "let a client pair
+ * with me over an untrusted rendezvous" surface (design: DESIGN §6).
+ *
+ * Three tools, mirroring the CLI verbs:
+ *
+ *   pair_offer   — mint a one-time offer + start dialing the rendezvous; returns
+ *                  the `agentproto://pair?…` URL, fingerprint, and expiry.
+ *   pair_list    — list persisted pairings (name, fingerprint, lastSeen).
+ *   pair_revoke  — drop a pairing by fingerprint or name; stops its rendezvous
+ *                  connections so it can no longer reconnect.
+ *
+ * Registered beside `remote_*` (remote-tools.ts) — same closure-rebind pattern;
+ * the registry singleton lives on the gateway.
+ */
+
+interface RegisterPairingToolsOptions {
+    registry: PairingRegistry;
+}
+declare function registerPairingTools(server: McpServer, opts: RegisterPairingToolsOptions): void;
+
 /**
  * Provider-preset family on top of `@agentproto/provider-kit` — the *thin,
  * honest* lister (Option B). Unlike tunnels/sandboxes/eval-reporters, presets
@@ -2176,6 +2635,158 @@ declare function declaredPresetToProviderPreset(decl: DeclaredAdapterPreset): Pr
  */
 declare function listPresets(env?: Record<string, string | undefined>, adapterPresets?: readonly DeclaredAdapterPreset[]): AdapterEntry<PresetInfo>[];
 
+/**
+ * Per-workspace state buckets — AIP-46 §State partitioning.
+ *
+ * AIP-46's premise is "a single host serve many bound directories", and
+ * §Workspaces delivered the addressing half of it: a slug resolves to a
+ * path. The state those directories generate stayed pooled in one global
+ * `~/.agentproto/sessions.json` with `workspaceSlug` demoted to a column
+ * on each row — a label, not a boundary.
+ *
+ * What that costs is measurable rather than theoretical. `HISTORY_CAP`
+ * bounds retention across the *union* of every workspace, so the cap is
+ * spent by whoever was busiest. A store pooling a few hundred rows from
+ * several workspaces sits at that ceiling in ordinary use, and the
+ * workspace contributing a handful of them is one busy afternoon in a
+ * NEIGHBOUR away from losing all of them — having done nothing itself.
+ * The eviction is silent and lands on the quietest workspace.
+ *
+ * This module is the slug→bucket rule and nothing more:
+ *
+ *   ~/.agentproto/
+ *   ├── workspaces.json          # the registry (workspaces-config.ts)
+ *   └── workspaces/              # one bucket per workspace (here)
+ *       ├── agentik-studio/sessions.json
+ *       └── default/sessions.json
+ *
+ * The registry (a file) and the state (a directory) are deliberate
+ * siblings: one names the workspaces, the other holds what each
+ * accumulated.
+ *
+ * ## Membership is the validation
+ *
+ * `workspaceSlug` arrives on a spawn request — it is caller input
+ * (`session-spawn.ts` passes `input.workspaceSlug` straight through when
+ * an explicit `cwd` accompanies it, so nothing sanitises it on the way
+ * to the descriptor). A bucket is a directory name. Joining the two
+ * without a check hands the caller `../../` under the daemon's own state
+ * root, as the daemon's UID.
+ *
+ * So a slug does not become a directory name by being cleaned up — it
+ * becomes one by coming *back from* the registry lookup. The registry's
+ * slugs were sanitised by `sanitizeSlug` on the way in, so the only
+ * strings that ever reach the filesystem are ones the host itself
+ * minted. An unregistered slug isn't rejected or escaped; it fails to
+ * match and lands in `default` like any other unregistered work. This is
+ * why the rule is membership rather than sanitisation: you cannot forget
+ * to validate a value you never chose.
+ *
+ * ## What this does NOT buy
+ *
+ * Partitioning bounds what a workspace's state *costs* other workspaces.
+ * It does not bound who may read it — every bucket is still served to
+ * every authorised caller, because no workspace-scoped credential
+ * exists to serve them differently (pairings carry no workspace concept
+ * at all; the orchestrator scope-token's `session_list` is daemon-wide
+ * by documented debt, `orchestrator-gateway.ts`). The files moved; the
+ * access did not. AIP-46 §Security Considerations says this in the
+ * negative — do not read this module as an isolation control.
+ */
+/** The bucket every record lands in when its slug doesn't resolve —
+ *  absent, empty, or naming a workspace that isn't registered.
+ *
+ *  A real bucket, not an error state. Refusing to persist an
+ *  unregistered session would make this a breaking change for every
+ *  one-off `cwd` spawn, and the obvious workaround (auto-register)
+ *  turns a registry of the user's intent into a registry of everything
+ *  that ever ran. The cost is stated plainly in the AIP: `default`'s
+ *  occupants get no separation from *each other* — registering a
+ *  workspace is what buys that. */
+declare const DEFAULT_BUCKET = "default";
+/** Root of the per-workspace state buckets. Sibling of the
+ *  `workspaces.json` registry that names them. */
+declare const BUCKETS_ROOT: () => string;
+/** The pre-partition global snapshot. Still read (to migrate from) and
+ *  never written after the split — see `migrateLegacySessionsFile`. */
+declare const LEGACY_SESSIONS_FILE: () => string;
+/** Marker recording that the legacy split already ran. Its presence —
+ *  not the legacy file's absence — is what makes migration
+ *  once-and-only-once, so a user who deletes rows from a bucket doesn't
+ *  get them resurrected on the next boot. */
+declare const migrationMarkerPath: (root: string) => string;
+declare const bucketDir: (root: string, slug: string) => string;
+declare const bucketSessionsFile: (root: string, slug: string) => string;
+/** Per-bucket transcript directory (AIP-46 §Layout).
+ *
+ *  Not yet wired: the registry still writes transcripts to the shared
+ *  `~/.agentproto/sessions/`. Moving them needs the read side to move
+ *  too, and several readers currently ignore the configured base dir
+ *  entirely (`http-server.ts` and `transcript-export.ts` call
+ *  `sessionEventsPath(id)` with no `baseDir`, so they resolve off
+ *  `homedir()` regardless) — a pre-existing bug that a partial move
+ *  would turn into missing transcripts. Exported so the follow-up has
+ *  the path rule in one place. The AIP makes transcripts a SHOULD, not
+ *  a MUST, for exactly this reason. */
+declare const bucketTranscriptDir: (root: string, slug: string) => string;
+declare const isSafeBucketSlug: (slug: string) => boolean;
+/**
+ * The slug→bucket rule (AIP-46 §Bucket resolution).
+ *
+ * 1. non-empty AND registered → that workspace's bucket
+ * 2. otherwise → `default`
+ *
+ * `registered` must come from the workspaces registry. Passing a set
+ * built from caller input defeats the entire point of this function.
+ */
+declare function resolveBucketSlug(workspaceSlug: string | undefined | null, registered: ReadonlySet<string>): string;
+/** Registered slugs, read fresh. Cheap (the registry is <1KB) and read
+ *  per persist rather than cached at boot, so a workspace registered
+ *  while the daemon is up starts bucketing immediately instead of
+ *  silently pooling into `default` until restart. Never throws: a
+ *  missing/corrupt registry degrades to "nothing is registered", i.e.
+ *  everything lands in `default` — today's pooled behaviour, which is
+ *  the right failure direction. */
+declare function readRegisteredSlugs(configPath?: string): ReadonlySet<string>;
+/** Bucket directories that exist on disk. Order is not meaningful. */
+declare function listBuckets(root: string): string[];
+interface MigrationMarker {
+    version: 1;
+    migratedAt: string;
+    /** Absolute path of the legacy artifact this split read from. Left
+     *  untouched on disk — recorded so the provenance survives. */
+    from: string;
+    /** Total records read out of the legacy artifact. */
+    rows: number;
+    /** Records landed, per bucket. Sums to `rows` — the migration never
+     *  drops a record it cannot place; it sends it to `default`. */
+    byBucket: Record<string, number>;
+}
+/**
+ * Split the legacy global snapshot into buckets (AIP-46 §Migration).
+ *
+ * **Additive by mandate.** The legacy file is opened read-only and left
+ * exactly where it is — never deleted, truncated, or rewritten. It is
+ * the user's data and their only rollback; the buckets are a derivative
+ * until they decide otherwise. Reclaiming it is a separate, human-gated
+ * call, and this module deliberately ships no GC: a real store is backed
+ * by a transcript directory that can reach hundreds of megabytes and may
+ * be someone's only copy of months of work — a deleter that guesses
+ * wrong there is unrecoverable.
+ *
+ * Idempotent via the marker, not via the legacy file's absence — the
+ * file stays, so absence would never fire and every boot would re-import
+ * rows the user had since deleted from a bucket.
+ *
+ * Returns the marker it wrote, or `null` when there was nothing to do
+ * (already migrated, or no legacy file).
+ */
+declare function migrateLegacySessionsFile(opts: {
+    root: string;
+    legacyFile: string;
+    registered: ReadonlySet<string>;
+}): MigrationMarker | null;
+
 /** A journal-file StepCache scoped to one cacheKey. Best-effort: read/parse
  *  failures degrade to "no cache" (a miss), never throw into the run. */
 declare function createFileStepCache(cacheKey: string, opts?: {
@@ -2454,6 +3065,30 @@ interface CreateGatewayOptions {
      *  tool family, and the `/sessions/:id/pty` WebSocket. Without it,
      *  those routes return 501 / the MCP tools aren't registered. */
     spawnPty?: PtyFactory;
+    /** Enable filesystem persistence for every store this gateway owns —
+     *  the sessions registry plus the supervisor / routine / cron / workflow
+     *  / inbound-watcher run stores. Defaults to `true`, i.e. production is
+     *  unchanged.
+     *
+     *  Tests pass `false`. Without it, a test gateway writes its fake rows
+     *  into the *developer's real* `~/.agentproto/sessions.json` (and the
+     *  sibling `policies.json` / `routine-runs.json` / `cron-jobs.json` /
+     *  `workflow-runs.json`): those paths resolve off `homedir()`, and the
+     *  gateway opted each store into persistence unconditionally. Since
+     *  `loadHistorySnapshot` re-reads sessions.json at boot, the real daemon
+     *  then restores the fakes and shows them in the dashboard — and against
+     *  `HISTORY_CAP` (200) they evict genuine history.
+     *
+     *  The sibling stores already default to persist-off when constructed
+     *  directly (see `createRoutineRunner`); this knob is what lets a
+     *  gateway stop overriding that on their behalf. */
+    persist?: boolean;
+    /** Override the sessions-registry persistence path — tests pin a tmpdir
+     *  so an assertion can look at the file the gateway would have written
+     *  instead of the developer's real one. Defaults to
+     *  `~/.agentproto/sessions.json`. The structured-transcript dir follows
+     *  this path's parent, so pinning it isolates transcripts too. */
+    persistPath?: string;
     /** Override the per-boot bearer token. Default: `randomUUID()`.
      *  Tests can pin a known value; production should always let
      *  the gateway generate fresh. The token is written into
@@ -2491,6 +3126,16 @@ interface CreateGatewayOptions {
     /** Optional sandbox provider lister — mirrors `listAgentAdapters`.
      *  Overrides the default catalog-driven lister behind `list_sandbox_providers`. */
     listSandboxProviders?: SandboxProviderLister;
+    /**
+     * Optional E2E pairing registry (see `createPairingRegistry`). When wired,
+     * the gateway mounts the `/pairings/*` REST routes and the `pair_*` MCP
+     * tools, and exposes the registry on the handle. The CLI builds it (injecting
+     * the ws `dial` + a `createTunnelServer`-backed `serve`) and passes it here so
+     * the runtime stays free of pty/adapter concerns while the pairing surface is
+     * reachable over MCP + HTTP. Autoconnect is the caller's to start (after this
+     * returns) so the injected `serve` can capture the finished gateway.
+     */
+    pairingRegistry?: PairingRegistry;
 }
 interface GatewayHandle {
     url: string;
@@ -2505,6 +3150,10 @@ interface GatewayHandle {
      *  local port. Exposed so embedding hosts can open tunnels
      *  programmatically without going through the HTTP/MCP surface. */
     tunnels: TunnelRegistry;
+    /** E2E pairing registry, when one was wired via
+     *  `CreateGatewayOptions.pairingRegistry`. Undefined otherwise. Exposed so
+     *  the CLI can `startAutoconnect()` after boot and `shutdown()` it. */
+    pairing?: PairingRegistry;
     /** Per-boot bearer token required on mutating /sessions/* routes
      *  + WS PTY upgrades. Exposed so an embedding host (e.g. the CLI
      *  shell that hosts the gateway in-process) can pass it to child
@@ -2534,4 +3183,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CommitSpec, type CompletionPolicySupervisor, type CreateGatewayOptions, DEFAULT_ORCHESTRATOR_TOOLS, type DeclaredAdapterPreset, type GateSpec, type GatewayHandle, type InboundWatcher, type JudgeGateSpec, type McpCredentialDeps, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type PolicyRunState, type PolicyRunStatus, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterSessionInput, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createScopeTokenRegistry, daemonRegistryDir, declaredPresetToProviderPreset, deriveSessionUsage, formatToolCall, formatToolResult, getMcpCredentialDeps, listPresets, makeBrowserAdapterLister, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, projectSessionUsage, readDaemonRegistry, readRuntimeMeta, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };
+export { AdapterAuthDescriptor, type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CommitSpec, type CompletionPolicySupervisor, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DeclaredAdapterOption, type DeclaredAdapterPreset, type GateSpec, type GatewayHandle, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type McpCredentialDeps, type MigrationMarker, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, PAIRINGS_VERSION, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, ResolvedAuthSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, daemonRegistryDir, declaredPresetToProviderPreset, deriveSessionUsage, formatToolCall, formatToolResult, getMcpCredentialDeps, isSafeBucketSlug, listBuckets, listPresets, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, policyWatchesSession, projectSessionUsage, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, resolveBucketSlug, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };