@agentproto/runtime 0.7.0 → 0.8.0

package/dist/config.d.ts

@@ -1,273 +1,2 @@
-import { S as SpawnDefaultsConfig } from './spawn-defaults-DAbADRd4.js';
+export { i as AcpAgentConfigEntry, j as AgentprotoConfig, k as CONFIG_FILE_PATH, l as CONFIG_VERSION, m as DaemonConfig, F as FeaturesConfig, P as PairingConfig, o as ProfileConfig, T as TerminalPreset, p as TunnelConfig, W as WorktreeIsolationMode, q as WorktreesConfig, s as getConfigKey, t as loadConfig, u as saveConfig, v as setConfigKey } from './config-BRKy_SAF.js';
 import '@agentproto/model-catalog';
-
-/**
- * `~/.agentproto/config.json` — single hand-editable JSON for the
- * agentproto control plane's defaults. Sits alongside the existing
- * surface files (workspaces.json, credentials.json, sessions.json):
- *
- *   workspaces.json     which directories are workspaces + which is active
- *   credentials.json    tunnel host bearer tokens (mode 0600)
- *   sessions.json       last-known snapshot of the registry (informational)
- *   config.json         daemon defaults: port, bind, allowed origins,
- *                       tunnel host, feature toggles
- *
- * Resolution order for every daemon knob is:
- *   1. CLI flag (e.g. --port)
- *   2. Env var (where one exists, e.g. AGENTPROTO_TOKEN)
- *   3. config.json
- *   4. Hardcoded default
- *
- * This means a user can call `agentproto config set daemon.port 18791`
- * once and never re-pass `--port 18791` to `serve install` etc. CLI
- * flags still win for one-off overrides.
- *
- * Schema is intentionally narrow + extensible — unknown keys are
- * preserved on save (deep-merge), so a newer CLI writing a new
- * field won't drop one an older CLI doesn't know about. No secrets
- * here; credentials stay in credentials.json (mode 0600).
- */
-
-declare const CONFIG_VERSION: 1;
-interface DaemonConfig {
-    /** Absolute path to the workspace the daemon binds to at boot. */
-    workspace?: string;
-    /** HTTP port. Default 18790. */
-    port?: number;
-    /** Bind addr. Default 127.0.0.1. */
-    bind?: string;
-    /** Trusted browser origins for mutating /sessions/* routes (in
-     *  addition to the hardcoded localhost defaults). */
-    allowedOrigins?: string[];
-    /** When true, the daemon does NOT auto-trust localhost-on-any-port.
-     *  Only origins explicitly listed in `allowedOrigins` are allowed.
-     *  Pair with a curated list (e.g. `["http://localhost:3000"]`) for
-     *  hardened setups. Default false. */
-    strictOrigins?: boolean;
-    /** Server label sent in tunnel hello frames. */
-    label?: string;
-    /** Bearer token gating the gateway at boot (`AuthOptions` with
-     *  `mode: "bearer"`). Unlike `remote_enable`'s ephemeral quick-tunnel
-     *  token, this one lives in config.json and survives daemon restarts.
-     *  Set via `agentproto config set daemon.authToken <token>` (e.g.
-     *  `$(openssl rand -hex 32)`). Unset ⇒ the gateway boots with
-     *  `mode: "none"` — fully open on loopback, same as today. */
-    authToken?: string;
-}
-interface TunnelConfig {
-    /** Cloud WS URL. When set + autoconnect=true, `agentproto serve`
-     *  bootstraps with `--connect <host>`. */
-    host?: string;
-    /** apt_ daemon token to present at the tunnel upgrade. When set,
-     *  `agentproto serve` uses this BEFORE falling back to
-     *  credentials.json — handy in profiles where the token-per-host
-     *  mapping in credentials.json doesn't fit (e.g. host = tunnel URL
-     *  but credentials were minted against the api URL). */
-    token?: string;
-    /** Whether `agentproto daemon start` connects the tunnel by
-     *  default. v0 only — implementer can ignore until daemon needs it. */
-    autoconnect?: boolean;
-    /**
-     * Opt into end-to-end encryption of the outbound `serve --connect` tunnel
-     * (design: tunnel-e2e/v1). When true, the daemon negotiates a
-     * token-authenticated ephemeral handshake with the host and wraps the tunnel
-     * frames in an AEAD box, so even the trusted host loses plaintext visibility.
-     * The handshake authenticates both ends against the shared `tunnel.token`, so
-     * `token` MUST also be set. Fully backward-compatible: if the host doesn't
-     * advertise e2e (an older host), the daemon falls back to today's plaintext
-     * tunnel. Unset/false ⇒ plaintext, byte-identical to today. */
-    e2e?: boolean;
-}
-interface FeaturesConfig {
-    /** Hint that PTY is desired — informational; the daemon still
-     *  detects node-pty's presence at runtime. */
-    pty?: boolean;
-}
-/**
- * Policy for `agentproto worktree new` (PLAN.md §1.4 — config carries
- * policy, never state; git itself is the authority for which worktrees
- * exist). This is the fix for the sprawl the plan measured: 31 linked
- * worktrees across 6 different parent directories, because there was no
- * `worktree new` verb and therefore no convention to converge on.
- */
-interface WorktreesConfig {
-    /**
-     * Absolute path new worktrees are created under. Layout:
-     * `<root>/<repoName>/<slug>`. Resolution order (mirrors every other
-     * knob in this file, see the module docblock): `--root` flag >
-     * `AGENTPROTO_WORKTREES_ROOT` env > this field > the hardcoded default
-     * `~/.agentproto/worktrees`. The default is a real single root, not
-     * "unconfigured" — `worktree new` converges to one place with zero
-     * setup, which is the only way the sprawl actually stops (the 6 roots
-     * that exist today are 6 people each inventing a default by hand).
-     */
-    root?: string;
-}
-interface PairingConfig {
-    /** Rendezvous broker WS URL (ws:// or wss://) used by `pair offer` and by
-     *  autoconnect on boot. When unset, `pair offer` requires an explicit
-     *  `--rendezvous`. Mirrors `tunnel.host`. */
-    rendezvous?: string;
-    /** Whether the daemon opens standing rendezvous connections for every
-     *  persisted pairing on boot (so a paired client can reconnect anytime).
-     *  Mirrors `tunnel.autoconnect`. Default true when a rendezvous is set. */
-    autoconnect?: boolean;
-}
-/**
- * A user-defined generic ACP agent — the config-file half of
- * `AcpAgentSpec` (the slug is the record key in `acpAgents`, so it's
- * omitted here). Any CLI that already speaks the Agent Client Protocol
- * can be wired with zero code by declaring one of these under
- * `acpAgents.<slug>` in `~/.agentproto/config.json`; the CLI's
- * `acpHandleFromSpec` mints a runnable `AgentCliHandle` from it at
- * resolve time (see `packages/cli/src/registry/acp-generic.ts`). Kept
- * in this package (not the CLI's) so `config.ts` stays the single
- * source of truth for the config surface without a cli→runtime→cli
- * import cycle — the CLI's `AcpAgentSpec` extends this shape.
- */
-interface AcpAgentConfigEntry {
-    /** Display name. Defaults to the slug when omitted. */
-    name?: string;
-    /** One-line description surfaced in `agentproto acp ls`. */
-    description?: string;
-    /** Executable to spawn, e.g. "gemini". */
-    bin: string;
-    /** Extra argv appended after `bin`, e.g. ["--experimental-acp"]. */
-    bin_args?: string[];
-    /** Extra environment variables for the spawned process. */
-    env?: Record<string, string>;
-    /** Flag the CLI uses to receive the working directory, if it needs
-     *  one passed explicitly (most ACP agents take cwd over the wire). */
-    cwd_flag?: string;
-    /** When true, advertise resumable + native-resume continuation. */
-    resumable?: boolean;
-    /** Known model ids for the agent (informational + validation hints). */
-    models?: {
-        default?: string;
-        allowed?: string[];
-    };
-    /** Shown when `bin` is missing from PATH (how to install the CLI). */
-    install_hint?: string;
-}
-/**
- * Per-environment connection bundle. A profile overrides specific
- * fields of the top-level `daemon` / `tunnel` / `features` blocks
- * when selected via `--profile <name>` (or the top-level
- * `activeProfile` setting). Missing fields fall through to the
- * top-level config, so a profile only needs to declare what's
- * different — typically just `tunnel.host` + `tunnel.token`.
- *
- * Example:
- *   {
- *     "daemon": { "workspace": "/code", "port": 18790 },
- *     "activeProfile": "local",
- *     "profiles": {
- *       "local": { "tunnel": { "host": "ws://localhost:3200/connect",
- *                              "token": "apt_local", "autoconnect": true } },
- *       "prod":  { "tunnel": { "host": "wss://tunnel.guilde.work/connect",
- *                              "token": "apt_prod",  "autoconnect": true },
- *                  "daemon": { "port": 18791 } }
- *     }
- *   }
- *
- * Sandbox daemons generate per-sandbox profile entries at provision
- * time so the daemon inside the sandbox boots with
- * `agentproto serve --profile sandbox-<id>` and no extra plumbing.
- */
-interface ProfileConfig {
-    daemon?: DaemonConfig;
-    tunnel?: TunnelConfig;
-    features?: FeaturesConfig;
-}
-/**
- * A user-defined named terminal/TUI preset stored in
- * `~/.agentproto/config.json` under `terminalPresets`. Presets keep
- * local launch recipes (argv, env, cwd, name/label) out of shared
- * adapter manifests — e.g. pointing a Claude Code TUI at a local
- * LLM gateway without retyping proxy env vars every spawn.
- */
-interface TerminalPreset {
-    /** Command + args to spawn. When provided, `sessions terminal` can
-     *  be used without `-- <argv...>`. */
-    argv?: string[];
-    /** Extra environment variables layered on top of the daemon's
-     *  inherited process.env. Values MUST be strings. */
-    env?: Record<string, string>;
-    /** Working directory for the PTY session. Relative paths are
-     *  resolved against the current working directory at CLI time. */
-    cwd?: string;
-    /** Workspace slug used for cwd fallback when `cwd` is omitted. */
-    workspace?: string;
-    /** Stable session name passed to the registry (`name` field). */
-    name?: string;
-    /** Human-readable label surfaced in session listings. */
-    label?: string;
-}
-interface AgentprotoConfig {
-    version?: number;
-    daemon?: DaemonConfig;
-    tunnel?: TunnelConfig;
-    features?: FeaturesConfig;
-    /** E2E daemon-pairing defaults (rendezvous URL + autoconnect). */
-    pairing?: PairingConfig;
-    /** Where `agentproto worktree new` creates worktrees. See
-     *  {@link WorktreesConfig}. */
-    worktrees?: WorktreesConfig;
-    /** Named connection profiles. See `ProfileConfig` for the merge
-     *  semantics — a profile's fields shallow-override the top-level
-     *  defaults for the selected run. */
-    profiles?: Record<string, ProfileConfig>;
-    /** Profile name to use when `--profile` isn't passed. When unset,
-     *  the top-level `daemon` / `tunnel` blocks are used directly. */
-    activeProfile?: string;
-    /** Default `skills` + `options` auto-applied to every `agent_start`
-     *  spawn — global and per-adapter. See `resolveSpawnDefaults` in
-     *  `spawn-defaults.ts` for the merge precedence with an explicit call.
-     *  Absent ⇒ current behaviour exactly (no regression). */
-    defaults?: SpawnDefaultsConfig;
-    /** User-defined generic ACP agents, keyed by adapter slug. Each entry
-     *  is minted into a runnable handle by the CLI's `acpHandleFromSpec`
-     *  when `resolveAdapter(slug)` finds no npm adapter package. User
-     *  entries shadow the curated `ACP_CATALOG` on slug collision. */
-    acpAgents?: Record<string, AcpAgentConfigEntry>;
-    /** User-defined named terminal/TUI presets. Local-only; never
-     *  packaged in shared adapter manifests or defaults. */
-    terminalPresets?: Record<string, TerminalPreset>;
-    /** Unknown keys preserved across save round-trips. */
-    [unknown: string]: unknown;
-}
-declare const CONFIG_FILE_PATH: () => string;
-/**
- * Load config.json. Returns an empty object (NOT null) when the file
- * is missing, malformed, or unreadable — callers can `cfg.daemon?.port`
- * safely without null-guards. Errors during a malformed-read are
- * logged once so the user notices the file is broken without the
- * daemon refusing to boot.
- */
-declare function loadConfig(path?: string): Promise<AgentprotoConfig>;
-/**
- * Write config.json atomically (tmp + rename) so a concurrent
- * `agentproto config edit` can't half-truncate the file. Writes
- * `next` AS-IS — callers are expected to pass the full desired
- * state (loaded the existing config, mutated, passed it back).
- *
- * Earlier versions deep-merged with the on-disk file, but that made
- * deletions impossible: `setConfigKey(cfg, "x", undefined)` would
- * remove the key from memory, then the deep-merge would silently
- * re-add it from disk. The current design trusts the caller's
- * snapshot and uses atomic rename for crash safety.
- */
-declare function saveConfig(next: AgentprotoConfig, path?: string): Promise<void>;
-/**
- * Read a dot-notation key (`daemon.port`) out of a config. Returns
- * `undefined` when any segment is missing.
- */
-declare function getConfigKey(cfg: AgentprotoConfig, dotted: string): unknown;
-/**
- * Set a dot-notation key in a config. Returns a new object — does
- * NOT mutate. Creates intermediate objects as needed. Setting
- * `value: undefined` is treated as a delete.
- */
-declare function setConfigKey(cfg: AgentprotoConfig, dotted: string, value: unknown): AgentprotoConfig;
-
-export { type AcpAgentConfigEntry, type AgentprotoConfig, CONFIG_FILE_PATH, CONFIG_VERSION, type DaemonConfig, type FeaturesConfig, type PairingConfig, type ProfileConfig, type TerminalPreset, type TunnelConfig, type WorktreesConfig, getConfigKey, loadConfig, saveConfig, setConfigKey };

package/dist/config.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"names":["fs"],"mappings":";;;;;;;;;AAgCO,IAAM,cAAA,GAAiB;AAuNvB,IAAM,mBAAmB,MAC9B,IAAA,CAAK,OAAA,EAAQ,EAAG,eAAe,aAAa;AAW9C,SAAS,iBAAA,CACP,KACA,MAAA,EACiD;AACjD,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,oBAAoB,MAAM,CAAA,8CAAA;AAAA,KAC5B;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA2C,EAAC;AAClD,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AAC1E,IAAA,IACE,SACA,OAAO,KAAA,KAAU,QAAA,IACjB,CAAC,MAAM,OAAA,CAAQ,KAAK,CAAA,IACpB,OAAQ,MAA4B,GAAA,KAAQ,QAAA,IAC3C,KAAA,CAA0B,GAAA,CAAI,SAAS,CAAA,EACxC;AACA,MAAA,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,iBAAA,EAAoB,MAAM,CAAA,YAAA,EAAe,IAAI,CAAA,0CAAA;AAAA,OAC/C;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AASA,eAAsB,WAAW,IAAA,EAA0C;AACzE,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAiB;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMA,QAAA,CAAG,QAAA,CAAS,QAAQ,MAAM,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,MAAA,MAAM,GAAA,GAAM,MAAA;AAMZ,MAAA,IAAI,GAAA,CAAI,cAAc,KAAA,CAAA,EAAW;AAC/B,QAAA,GAAA,CAAI,SAAA,GAAY,iBAAA,CAAkB,GAAA,CAAI,SAAA,EAAW,MAAM,CAAA;AAAA,MACzD;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,oBAAoB,MAAM,CAAA,kDAAA;AAAA,KAC5B;AACA,IAAA,OAAO,EAAC;AAAA,EACV,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAC5C,IAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,gCAAA,EAAmC,MAAM,CAAA,EAAA,EACvC,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAcA,eAAsB,UAAA,CACpB,MACA,IAAA,EACe;AACf,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAiB;AACxC,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,IAAA,EAAM,SAAS,cAAA,EAAe;AACnD,EAAA,MAAM,GAAA,GAAM,QAAQ,MAAM,CAAA;AAC1B,EAAA,MAAMA,SAAG,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA,IAAA,CAAA;AACrB,EAAA,MAAMA,QAAA,CAAG,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,MAAM,CAAA;AACvE,EAAA,MAAMA,QAAA,CAAG,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA;AAC7B;AAMO,SAAS,YAAA,CACd,KACA,MAAA,EACS;AACT,EAAA,IAAI,GAAA,GAAe,GAAA;AACnB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AACnD,IAAA,GAAA,GAAO,IAAgC,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,YAAA,CACd,GAAA,EACA,MAAA,EACA,KAAA,EACkB;AAClB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AAC9B,EAAA,MAAM,GAAA,GAAwB,EAAE,GAAG,GAAA,EAAI;AACvC,EAAA,IAAI,GAAA,GAA+B,GAAA;AACnC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,IAAA,MAAM,IAAA,GAAO,IAAI,CAAC,CAAA;AAClB,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC5D,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,EAAE,GAAI,IAAA,EAAiC;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,CAAC,IAAI,EAAC;AAAA,IACZ;AACA,IAAA,GAAA,GAAM,IAAI,CAAC,CAAA;AAAA,EACb;AACA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACnC,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,OAAO,IAAI,IAAI,CAAA;AAAA,EACjB,CAAA,MAAO;AACL,IAAA,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,EACd;AACA,EAAA,OAAO,GAAA;AACT","file":"config.mjs","sourcesContent":["/**\n * `~/.agentproto/config.json` — single hand-editable JSON for the\n * agentproto control plane's defaults. Sits alongside the existing\n * surface files (workspaces.json, credentials.json, sessions.json):\n *\n *   workspaces.json     which directories are workspaces + which is active\n *   credentials.json    tunnel host bearer tokens (mode 0600)\n *   sessions.json       last-known snapshot of the registry (informational)\n *   config.json         daemon defaults: port, bind, allowed origins,\n *                       tunnel host, feature toggles\n *\n * Resolution order for every daemon knob is:\n *   1. CLI flag (e.g. --port)\n *   2. Env var (where one exists, e.g. AGENTPROTO_TOKEN)\n *   3. config.json\n *   4. Hardcoded default\n *\n * This means a user can call `agentproto config set daemon.port 18791`\n * once and never re-pass `--port 18791` to `serve install` etc. CLI\n * flags still win for one-off overrides.\n *\n * Schema is intentionally narrow + extensible — unknown keys are\n * preserved on save (deep-merge), so a newer CLI writing a new\n * field won't drop one an older CLI doesn't know about. No secrets\n * here; credentials stay in credentials.json (mode 0600).\n */\n\nimport { promises as fs } from \"node:fs\"\nimport { homedir } from \"node:os\"\nimport { dirname, join } from \"node:path\"\nimport type { SpawnDefaultsConfig } from \"./spawn-defaults.js\"\n\nexport const CONFIG_VERSION = 1 as const\n\nexport interface DaemonConfig {\n  /** Absolute path to the workspace the daemon binds to at boot. */\n  workspace?: string\n  /** HTTP port. Default 18790. */\n  port?: number\n  /** Bind addr. Default 127.0.0.1. */\n  bind?: string\n  /** Trusted browser origins for mutating /sessions/* routes (in\n   *  addition to the hardcoded localhost defaults). */\n  allowedOrigins?: string[]\n  /** When true, the daemon does NOT auto-trust localhost-on-any-port.\n   *  Only origins explicitly listed in `allowedOrigins` are allowed.\n   *  Pair with a curated list (e.g. `[\"http://localhost:3000\"]`) for\n   *  hardened setups. Default false. */\n  strictOrigins?: boolean\n  /** Server label sent in tunnel hello frames. */\n  label?: string\n  /** Bearer token gating the gateway at boot (`AuthOptions` with\n   *  `mode: \"bearer\"`). Unlike `remote_enable`'s ephemeral quick-tunnel\n   *  token, this one lives in config.json and survives daemon restarts.\n   *  Set via `agentproto config set daemon.authToken <token>` (e.g.\n   *  `$(openssl rand -hex 32)`). Unset ⇒ the gateway boots with\n   *  `mode: \"none\"` — fully open on loopback, same as today. */\n  authToken?: string\n}\n\nexport interface TunnelConfig {\n  /** Cloud WS URL. When set + autoconnect=true, `agentproto serve`\n   *  bootstraps with `--connect <host>`. */\n  host?: string\n  /** apt_ daemon token to present at the tunnel upgrade. When set,\n   *  `agentproto serve` uses this BEFORE falling back to\n   *  credentials.json — handy in profiles where the token-per-host\n   *  mapping in credentials.json doesn't fit (e.g. host = tunnel URL\n   *  but credentials were minted against the api URL). */\n  token?: string\n  /** Whether `agentproto daemon start` connects the tunnel by\n   *  default. v0 only — implementer can ignore until daemon needs it. */\n  autoconnect?: boolean\n  /**\n   * Opt into end-to-end encryption of the outbound `serve --connect` tunnel\n   * (design: tunnel-e2e/v1). When true, the daemon negotiates a\n   * token-authenticated ephemeral handshake with the host and wraps the tunnel\n   * frames in an AEAD box, so even the trusted host loses plaintext visibility.\n   * The handshake authenticates both ends against the shared `tunnel.token`, so\n   * `token` MUST also be set. Fully backward-compatible: if the host doesn't\n   * advertise e2e (an older host), the daemon falls back to today's plaintext\n   * tunnel. Unset/false ⇒ plaintext, byte-identical to today. */\n  e2e?: boolean\n}\n\nexport interface FeaturesConfig {\n  /** Hint that PTY is desired — informational; the daemon still\n   *  detects node-pty's presence at runtime. */\n  pty?: boolean\n}\n\n/**\n * Policy for `agentproto worktree new` (PLAN.md §1.4 — config carries\n * policy, never state; git itself is the authority for which worktrees\n * exist). This is the fix for the sprawl the plan measured: 31 linked\n * worktrees across 6 different parent directories, because there was no\n * `worktree new` verb and therefore no convention to converge on.\n */\nexport interface WorktreesConfig {\n  /**\n   * Absolute path new worktrees are created under. Layout:\n   * `<root>/<repoName>/<slug>`. Resolution order (mirrors every other\n   * knob in this file, see the module docblock): `--root` flag >\n   * `AGENTPROTO_WORKTREES_ROOT` env > this field > the hardcoded default\n   * `~/.agentproto/worktrees`. The default is a real single root, not\n   * \"unconfigured\" — `worktree new` converges to one place with zero\n   * setup, which is the only way the sprawl actually stops (the 6 roots\n   * that exist today are 6 people each inventing a default by hand).\n   */\n  root?: string\n}\n\nexport interface PairingConfig {\n  /** Rendezvous broker WS URL (ws:// or wss://) used by `pair offer` and by\n   *  autoconnect on boot. When unset, `pair offer` requires an explicit\n   *  `--rendezvous`. Mirrors `tunnel.host`. */\n  rendezvous?: string\n  /** Whether the daemon opens standing rendezvous connections for every\n   *  persisted pairing on boot (so a paired client can reconnect anytime).\n   *  Mirrors `tunnel.autoconnect`. Default true when a rendezvous is set. */\n  autoconnect?: boolean\n}\n\n/**\n * A user-defined generic ACP agent — the config-file half of\n * `AcpAgentSpec` (the slug is the record key in `acpAgents`, so it's\n * omitted here). Any CLI that already speaks the Agent Client Protocol\n * can be wired with zero code by declaring one of these under\n * `acpAgents.<slug>` in `~/.agentproto/config.json`; the CLI's\n * `acpHandleFromSpec` mints a runnable `AgentCliHandle` from it at\n * resolve time (see `packages/cli/src/registry/acp-generic.ts`). Kept\n * in this package (not the CLI's) so `config.ts` stays the single\n * source of truth for the config surface without a cli→runtime→cli\n * import cycle — the CLI's `AcpAgentSpec` extends this shape.\n */\nexport interface AcpAgentConfigEntry {\n  /** Display name. Defaults to the slug when omitted. */\n  name?: string\n  /** One-line description surfaced in `agentproto acp ls`. */\n  description?: string\n  /** Executable to spawn, e.g. \"gemini\". */\n  bin: string\n  /** Extra argv appended after `bin`, e.g. [\"--experimental-acp\"]. */\n  bin_args?: string[]\n  /** Extra environment variables for the spawned process. */\n  env?: Record<string, string>\n  /** Flag the CLI uses to receive the working directory, if it needs\n   *  one passed explicitly (most ACP agents take cwd over the wire). */\n  cwd_flag?: string\n  /** When true, advertise resumable + native-resume continuation. */\n  resumable?: boolean\n  /** Known model ids for the agent (informational + validation hints). */\n  models?: { default?: string; allowed?: string[] }\n  /** Shown when `bin` is missing from PATH (how to install the CLI). */\n  install_hint?: string\n}\n\n/**\n * Per-environment connection bundle. A profile overrides specific\n * fields of the top-level `daemon` / `tunnel` / `features` blocks\n * when selected via `--profile <name>` (or the top-level\n * `activeProfile` setting). Missing fields fall through to the\n * top-level config, so a profile only needs to declare what's\n * different — typically just `tunnel.host` + `tunnel.token`.\n *\n * Example:\n *   {\n *     \"daemon\": { \"workspace\": \"/code\", \"port\": 18790 },\n *     \"activeProfile\": \"local\",\n *     \"profiles\": {\n *       \"local\": { \"tunnel\": { \"host\": \"ws://localhost:3200/connect\",\n *                              \"token\": \"apt_local\", \"autoconnect\": true } },\n *       \"prod\":  { \"tunnel\": { \"host\": \"wss://tunnel.guilde.work/connect\",\n *                              \"token\": \"apt_prod\",  \"autoconnect\": true },\n *                  \"daemon\": { \"port\": 18791 } }\n *     }\n *   }\n *\n * Sandbox daemons generate per-sandbox profile entries at provision\n * time so the daemon inside the sandbox boots with\n * `agentproto serve --profile sandbox-<id>` and no extra plumbing.\n */\nexport interface ProfileConfig {\n  daemon?: DaemonConfig\n  tunnel?: TunnelConfig\n  features?: FeaturesConfig\n}\n\n/**\n * A user-defined named terminal/TUI preset stored in\n * `~/.agentproto/config.json` under `terminalPresets`. Presets keep\n * local launch recipes (argv, env, cwd, name/label) out of shared\n * adapter manifests — e.g. pointing a Claude Code TUI at a local\n * LLM gateway without retyping proxy env vars every spawn.\n */\nexport interface TerminalPreset {\n  /** Command + args to spawn. When provided, `sessions terminal` can\n   *  be used without `-- <argv...>`. */\n  argv?: string[]\n  /** Extra environment variables layered on top of the daemon's\n   *  inherited process.env. Values MUST be strings. */\n  env?: Record<string, string>\n  /** Working directory for the PTY session. Relative paths are\n   *  resolved against the current working directory at CLI time. */\n  cwd?: string\n  /** Workspace slug used for cwd fallback when `cwd` is omitted. */\n  workspace?: string\n  /** Stable session name passed to the registry (`name` field). */\n  name?: string\n  /** Human-readable label surfaced in session listings. */\n  label?: string\n}\n\nexport interface AgentprotoConfig {\n  version?: number\n  daemon?: DaemonConfig\n  tunnel?: TunnelConfig\n  features?: FeaturesConfig\n  /** E2E daemon-pairing defaults (rendezvous URL + autoconnect). */\n  pairing?: PairingConfig\n  /** Where `agentproto worktree new` creates worktrees. See\n   *  {@link WorktreesConfig}. */\n  worktrees?: WorktreesConfig\n  /** Named connection profiles. See `ProfileConfig` for the merge\n   *  semantics — a profile's fields shallow-override the top-level\n   *  defaults for the selected run. */\n  profiles?: Record<string, ProfileConfig>\n  /** Profile name to use when `--profile` isn't passed. When unset,\n   *  the top-level `daemon` / `tunnel` blocks are used directly. */\n  activeProfile?: string\n  /** Default `skills` + `options` auto-applied to every `agent_start`\n   *  spawn — global and per-adapter. See `resolveSpawnDefaults` in\n   *  `spawn-defaults.ts` for the merge precedence with an explicit call.\n   *  Absent ⇒ current behaviour exactly (no regression). */\n  defaults?: SpawnDefaultsConfig\n  /** User-defined generic ACP agents, keyed by adapter slug. Each entry\n   *  is minted into a runnable handle by the CLI's `acpHandleFromSpec`\n   *  when `resolveAdapter(slug)` finds no npm adapter package. User\n   *  entries shadow the curated `ACP_CATALOG` on slug collision. */\n  acpAgents?: Record<string, AcpAgentConfigEntry>\n  /** User-defined named terminal/TUI presets. Local-only; never\n   *  packaged in shared adapter manifests or defaults. */\n  terminalPresets?: Record<string, TerminalPreset>\n  /** Unknown keys preserved across save round-trips. */\n  [unknown: string]: unknown\n}\n\nexport const CONFIG_FILE_PATH = (): string =>\n  join(homedir(), \".agentproto\", \"config.json\")\n\n/**\n * Drop any `acpAgents` entries that aren't a shape we can turn into a\n * handle. The one hard requirement is a non-empty string `bin` (the\n * executable to spawn); everything else is optional and defaulted\n * downstream. Invalid entries are removed rather than throwing so the\n * daemon still boots — one warning names the offending slug so the\n * user can fix their config. Returns `undefined` when nothing valid\n * remains, keeping the key absent (== \"no generic agents\").\n */\nfunction sanitizeAcpAgents(\n  raw: unknown,\n  target: string,\n): Record<string, AcpAgentConfigEntry> | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n    console.warn(\n      `[runtime/config] ${target}: 'acpAgents' is not an object — ignoring`,\n    )\n    return undefined\n  }\n  const out: Record<string, AcpAgentConfigEntry> = {}\n  for (const [slug, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (\n      value &&\n      typeof value === \"object\" &&\n      !Array.isArray(value) &&\n      typeof (value as { bin?: unknown }).bin === \"string\" &&\n      (value as { bin: string }).bin.length > 0\n    ) {\n      out[slug] = value as AcpAgentConfigEntry\n    } else {\n      console.warn(\n        `[runtime/config] ${target}: acpAgents.${slug} is missing a string 'bin' — ignoring`,\n      )\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined\n}\n\n/**\n * Load config.json. Returns an empty object (NOT null) when the file\n * is missing, malformed, or unreadable — callers can `cfg.daemon?.port`\n * safely without null-guards. Errors during a malformed-read are\n * logged once so the user notices the file is broken without the\n * daemon refusing to boot.\n */\nexport async function loadConfig(path?: string): Promise<AgentprotoConfig> {\n  const target = path ?? CONFIG_FILE_PATH()\n  try {\n    const raw = await fs.readFile(target, \"utf8\")\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n      const cfg = parsed as AgentprotoConfig\n      // Sanitize `acpAgents` in the same tolerant spirit as the rest of\n      // this loader: a malformed entry is dropped (with one warning) so a\n      // single bad hand-edit can't make every generic ACP agent\n      // unresolvable. Full AIP-45 validation happens later, at\n      // `acpHandleFromSpec` time, with precise field-level messages.\n      if (cfg.acpAgents !== undefined) {\n        cfg.acpAgents = sanitizeAcpAgents(cfg.acpAgents, target)\n      }\n      return cfg\n    }\n    console.warn(\n      `[runtime/config] ${target}: top-level value is not an object — ignoring`,\n    )\n    return {}\n  } catch (err) {\n    // ENOENT is the common case; only warn on other shapes.\n    const code = (err as NodeJS.ErrnoException).code\n    if (code && code !== \"ENOENT\") {\n      console.warn(\n        `[runtime/config] failed to read ${target}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n    }\n    return {}\n  }\n}\n\n/**\n * Write config.json atomically (tmp + rename) so a concurrent\n * `agentproto config edit` can't half-truncate the file. Writes\n * `next` AS-IS — callers are expected to pass the full desired\n * state (loaded the existing config, mutated, passed it back).\n *\n * Earlier versions deep-merged with the on-disk file, but that made\n * deletions impossible: `setConfigKey(cfg, \"x\", undefined)` would\n * remove the key from memory, then the deep-merge would silently\n * re-add it from disk. The current design trusts the caller's\n * snapshot and uses atomic rename for crash safety.\n */\nexport async function saveConfig(\n  next: AgentprotoConfig,\n  path?: string,\n): Promise<void> {\n  const target = path ?? CONFIG_FILE_PATH()\n  const payload = { ...next, version: CONFIG_VERSION }\n  const dir = dirname(target)\n  await fs.mkdir(dir, { recursive: true })\n  const tmp = `${target}.tmp`\n  await fs.writeFile(tmp, JSON.stringify(payload, null, 2) + \"\\n\", \"utf8\")\n  await fs.rename(tmp, target)\n}\n\n/**\n * Read a dot-notation key (`daemon.port`) out of a config. Returns\n * `undefined` when any segment is missing.\n */\nexport function getConfigKey(\n  cfg: AgentprotoConfig,\n  dotted: string,\n): unknown {\n  let cur: unknown = cfg\n  for (const part of dotted.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") return undefined\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  return cur\n}\n\n/**\n * Set a dot-notation key in a config. Returns a new object — does\n * NOT mutate. Creates intermediate objects as needed. Setting\n * `value: undefined` is treated as a delete.\n */\nexport function setConfigKey(\n  cfg: AgentprotoConfig,\n  dotted: string,\n  value: unknown,\n): AgentprotoConfig {\n  const parts = dotted.split(\".\")\n  const out: AgentprotoConfig = { ...cfg }\n  let cur: Record<string, unknown> = out as Record<string, unknown>\n  for (let i = 0; i < parts.length - 1; i++) {\n    const k = parts[i]!\n    const next = cur[k]\n    if (next && typeof next === \"object\" && !Array.isArray(next)) {\n      cur[k] = { ...(next as Record<string, unknown>) }\n    } else {\n      cur[k] = {}\n    }\n    cur = cur[k] as Record<string, unknown>\n  }\n  const leaf = parts[parts.length - 1]!\n  if (value === undefined) {\n    delete cur[leaf]\n  } else {\n    cur[leaf] = value\n  }\n  return out\n}\n\n/**\n * Deep merge — objects are recursively combined, everything else\n * (arrays, primitives) is replaced wholesale by `b`. Mirrors what\n * `Object.assign({}, a, b)` does for shallow keys.\n */\nfunction deepMerge<A extends Record<string, unknown>, B extends Record<string, unknown>>(\n  a: A,\n  b: B,\n): A & B {\n  const out: Record<string, unknown> = { ...a }\n  for (const [k, v] of Object.entries(b)) {\n    const cur = out[k]\n    if (\n      v &&\n      typeof v === \"object\" &&\n      !Array.isArray(v) &&\n      cur &&\n      typeof cur === \"object\" &&\n      !Array.isArray(cur)\n    ) {\n      out[k] = deepMerge(\n        cur as Record<string, unknown>,\n        v as Record<string, unknown>,\n      )\n    } else {\n      out[k] = v\n    }\n  }\n  return out as A & B\n}\n"]}
+{"version":3,"sources":["../src/config.ts"],"names":["fs"],"mappings":";;;;;;;;;AAgCO,IAAM,cAAA,GAAiB;AAiPvB,IAAM,mBAAmB,MAC9B,IAAA,CAAK,OAAA,EAAQ,EAAG,eAAe,aAAa;AAW9C,SAAS,iBAAA,CACP,KACA,MAAA,EACiD;AACjD,EAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACzD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,oBAAoB,MAAM,CAAA,8CAAA;AAAA,KAC5B;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA2C,EAAC;AAClD,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AAC1E,IAAA,IACE,SACA,OAAO,KAAA,KAAU,QAAA,IACjB,CAAC,MAAM,OAAA,CAAQ,KAAK,CAAA,IACpB,OAAQ,MAA4B,GAAA,KAAQ,QAAA,IAC3C,KAAA,CAA0B,GAAA,CAAI,SAAS,CAAA,EACxC;AACA,MAAA,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,iBAAA,EAAoB,MAAM,CAAA,YAAA,EAAe,IAAI,CAAA,0CAAA;AAAA,OAC/C;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AASA,eAAsB,WAAW,IAAA,EAA0C;AACzE,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAiB;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMA,QAAA,CAAG,QAAA,CAAS,QAAQ,MAAM,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,MAAA,MAAM,GAAA,GAAM,MAAA;AAMZ,MAAA,IAAI,GAAA,CAAI,cAAc,KAAA,CAAA,EAAW;AAC/B,QAAA,GAAA,CAAI,SAAA,GAAY,iBAAA,CAAkB,GAAA,CAAI,SAAA,EAAW,MAAM,CAAA;AAAA,MACzD;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,oBAAoB,MAAM,CAAA,kDAAA;AAAA,KAC5B;AACA,IAAA,OAAO,EAAC;AAAA,EACV,SAAS,GAAA,EAAK;AAEZ,IAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAC5C,IAAA,IAAI,IAAA,IAAQ,SAAS,QAAA,EAAU;AAC7B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,gCAAA,EAAmC,MAAM,CAAA,EAAA,EACvC,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAcA,eAAsB,UAAA,CACpB,MACA,IAAA,EACe;AACf,EAAA,MAAM,MAAA,GAAS,QAAQ,gBAAA,EAAiB;AACxC,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,IAAA,EAAM,SAAS,cAAA,EAAe;AACnD,EAAA,MAAM,GAAA,GAAM,QAAQ,MAAM,CAAA;AAC1B,EAAA,MAAMA,SAAG,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA,IAAA,CAAA;AACrB,EAAA,MAAMA,QAAA,CAAG,SAAA,CAAU,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,MAAM,CAAA;AACvE,EAAA,MAAMA,QAAA,CAAG,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA;AAC7B;AAMO,SAAS,YAAA,CACd,KACA,MAAA,EACS;AACT,EAAA,IAAI,GAAA,GAAe,GAAA;AACnB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AACnD,IAAA,GAAA,GAAO,IAAgC,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,YAAA,CACd,GAAA,EACA,MAAA,EACA,KAAA,EACkB;AAClB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AAC9B,EAAA,MAAM,GAAA,GAAwB,EAAE,GAAG,GAAA,EAAI;AACvC,EAAA,IAAI,GAAA,GAA+B,GAAA;AACnC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,GAAS,GAAG,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,IAAA,MAAM,IAAA,GAAO,IAAI,CAAC,CAAA;AAClB,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC5D,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,EAAE,GAAI,IAAA,EAAiC;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,CAAC,IAAI,EAAC;AAAA,IACZ;AACA,IAAA,GAAA,GAAM,IAAI,CAAC,CAAA;AAAA,EACb;AACA,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACnC,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,OAAO,IAAI,IAAI,CAAA;AAAA,EACjB,CAAA,MAAO;AACL,IAAA,GAAA,CAAI,IAAI,CAAA,GAAI,KAAA;AAAA,EACd;AACA,EAAA,OAAO,GAAA;AACT","file":"config.mjs","sourcesContent":["/**\n * `~/.agentproto/config.json` — single hand-editable JSON for the\n * agentproto control plane's defaults. Sits alongside the existing\n * surface files (workspaces.json, credentials.json, sessions.json):\n *\n *   workspaces.json     which directories are workspaces + which is active\n *   credentials.json    tunnel host bearer tokens (mode 0600)\n *   sessions.json       last-known snapshot of the registry (informational)\n *   config.json         daemon defaults: port, bind, allowed origins,\n *                       tunnel host, feature toggles\n *\n * Resolution order for every daemon knob is:\n *   1. CLI flag (e.g. --port)\n *   2. Env var (where one exists, e.g. AGENTPROTO_TOKEN)\n *   3. config.json\n *   4. Hardcoded default\n *\n * This means a user can call `agentproto config set daemon.port 18791`\n * once and never re-pass `--port 18791` to `serve install` etc. CLI\n * flags still win for one-off overrides.\n *\n * Schema is intentionally narrow + extensible — unknown keys are\n * preserved on save (deep-merge), so a newer CLI writing a new\n * field won't drop one an older CLI doesn't know about. No secrets\n * here; credentials stay in credentials.json (mode 0600).\n */\n\nimport { promises as fs } from \"node:fs\"\nimport { homedir } from \"node:os\"\nimport { dirname, join } from \"node:path\"\nimport type { SpawnDefaultsConfig } from \"./spawn-defaults.js\"\n\nexport const CONFIG_VERSION = 1 as const\n\nexport interface DaemonConfig {\n  /** Absolute path to the workspace the daemon binds to at boot. */\n  workspace?: string\n  /** HTTP port. Default 18790. */\n  port?: number\n  /** Bind addr. Default 127.0.0.1. */\n  bind?: string\n  /** Trusted browser origins for mutating /sessions/* routes (in\n   *  addition to the hardcoded localhost defaults). */\n  allowedOrigins?: string[]\n  /** When true, the daemon does NOT auto-trust localhost-on-any-port.\n   *  Only origins explicitly listed in `allowedOrigins` are allowed.\n   *  Pair with a curated list (e.g. `[\"http://localhost:3000\"]`) for\n   *  hardened setups. Default false. */\n  strictOrigins?: boolean\n  /** Server label sent in tunnel hello frames. */\n  label?: string\n  /** Bearer token gating the gateway at boot (`AuthOptions` with\n   *  `mode: \"bearer\"`). Unlike `remote_enable`'s ephemeral quick-tunnel\n   *  token, this one lives in config.json and survives daemon restarts.\n   *  Set via `agentproto config set daemon.authToken <token>` (e.g.\n   *  `$(openssl rand -hex 32)`). Unset ⇒ the gateway boots with\n   *  `mode: \"none\"` — fully open on loopback, same as today. */\n  authToken?: string\n}\n\nexport interface TunnelConfig {\n  /** Cloud WS URL. When set + autoconnect=true, `agentproto serve`\n   *  bootstraps with `--connect <host>`. */\n  host?: string\n  /** apt_ daemon token to present at the tunnel upgrade. When set,\n   *  `agentproto serve` uses this BEFORE falling back to\n   *  credentials.json — handy in profiles where the token-per-host\n   *  mapping in credentials.json doesn't fit (e.g. host = tunnel URL\n   *  but credentials were minted against the api URL). */\n  token?: string\n  /** Whether `agentproto daemon start` connects the tunnel by\n   *  default. v0 only — implementer can ignore until daemon needs it. */\n  autoconnect?: boolean\n  /**\n   * Opt into end-to-end encryption of the outbound `serve --connect` tunnel\n   * (design: tunnel-e2e/v1). When true, the daemon negotiates a\n   * token-authenticated ephemeral handshake with the host and wraps the tunnel\n   * frames in an AEAD box, so even the trusted host loses plaintext visibility.\n   * The handshake authenticates both ends against the shared `tunnel.token`, so\n   * `token` MUST also be set. Fully backward-compatible: if the host doesn't\n   * advertise e2e (an older host), the daemon falls back to today's plaintext\n   * tunnel. Unset/false ⇒ plaintext, byte-identical to today. */\n  e2e?: boolean\n}\n\nexport interface FeaturesConfig {\n  /** Hint that PTY is desired — informational; the daemon still\n   *  detects node-pty's presence at runtime. */\n  pty?: boolean\n}\n\n/**\n * Policy for `agentproto worktree new` (PLAN.md §1.4 — config carries\n * policy, never state; git itself is the authority for which worktrees\n * exist). This is the fix for the sprawl the plan measured: 31 linked\n * worktrees across 6 different parent directories, because there was no\n * `worktree new` verb and therefore no convention to converge on.\n */\n/**\n * How the daemon isolates a freshly-spawned agent session into its own git\n * worktree (`agent_start.worktree`):\n *   - `\"always\"`      — every depth-0 spawn is provisioned into a worktree,\n *                       whether or not the caller asked. A cwd that is not in\n *                       a git repo has nothing to isolate, so it spawns plain.\n *   - `\"on-request\"`  — isolate ONLY when the caller passes `worktree`. This\n *                       is the default and the back-compatible behaviour:\n *                       today's callers pass nothing and spawn exactly where\n *                       they asked.\n *   - `\"never\"`       — isolation is off; an explicit `worktree` field is\n *                       REJECTED (loud, not silently ignored) so a caller\n *                       never believes it got an isolated tree it didn't.\n */\nexport type WorktreeIsolationMode = \"always\" | \"on-request\" | \"never\"\n\nexport interface WorktreesConfig {\n  /**\n   * Absolute path new worktrees are created under. Layout:\n   * `<root>/<repoName>/<slug>`. Resolution order (mirrors every other\n   * knob in this file, see the module docblock): `--root` flag >\n   * `AGENTPROTO_WORKTREES_ROOT` env > this field > the hardcoded default\n   * `~/.agentproto/worktrees`. The default is a real single root, not\n   * \"unconfigured\" — `worktree new` converges to one place with zero\n   * setup, which is the only way the sprawl actually stops (the 6 roots\n   * that exist today are 6 people each inventing a default by hand).\n   */\n  root?: string\n  /**\n   * Policy for `agent_start.worktree` isolation. Resolution order mirrors\n   * the module docblock (there is no CLI flag — this is a daemon-side\n   * policy read at spawn, not a per-invocation flag):\n   * `AGENTPROTO_WORKTREES_ISOLATION` env > this field > the hardcoded\n   * default `\"on-request\"`. `\"on-request\"` is deliberately the default:\n   * any other would break back-compat by isolating callers that never\n   * asked (see `worktree-isolation.ts`).\n   */\n  isolation?: WorktreeIsolationMode\n}\n\nexport interface PairingConfig {\n  /** Rendezvous broker WS URL (ws:// or wss://) used by `pair offer` and by\n   *  autoconnect on boot. When unset, `pair offer` requires an explicit\n   *  `--rendezvous`. Mirrors `tunnel.host`. */\n  rendezvous?: string\n  /** Whether the daemon opens standing rendezvous connections for every\n   *  persisted pairing on boot (so a paired client can reconnect anytime).\n   *  Mirrors `tunnel.autoconnect`. Default true when a rendezvous is set. */\n  autoconnect?: boolean\n}\n\n/**\n * A user-defined generic ACP agent — the config-file half of\n * `AcpAgentSpec` (the slug is the record key in `acpAgents`, so it's\n * omitted here). Any CLI that already speaks the Agent Client Protocol\n * can be wired with zero code by declaring one of these under\n * `acpAgents.<slug>` in `~/.agentproto/config.json`; the CLI's\n * `acpHandleFromSpec` mints a runnable `AgentCliHandle` from it at\n * resolve time (see `packages/cli/src/registry/acp-generic.ts`). Kept\n * in this package (not the CLI's) so `config.ts` stays the single\n * source of truth for the config surface without a cli→runtime→cli\n * import cycle — the CLI's `AcpAgentSpec` extends this shape.\n */\nexport interface AcpAgentConfigEntry {\n  /** Display name. Defaults to the slug when omitted. */\n  name?: string\n  /** One-line description surfaced in `agentproto acp ls`. */\n  description?: string\n  /** Executable to spawn, e.g. \"gemini\". */\n  bin: string\n  /** Extra argv appended after `bin`, e.g. [\"--experimental-acp\"]. */\n  bin_args?: string[]\n  /** Extra environment variables for the spawned process. */\n  env?: Record<string, string>\n  /** Flag the CLI uses to receive the working directory, if it needs\n   *  one passed explicitly (most ACP agents take cwd over the wire). */\n  cwd_flag?: string\n  /** When true, advertise resumable + native-resume continuation. */\n  resumable?: boolean\n  /** Known model ids for the agent (informational + validation hints). */\n  models?: { default?: string; allowed?: string[] }\n  /** Shown when `bin` is missing from PATH (how to install the CLI). */\n  install_hint?: string\n}\n\n/**\n * Per-environment connection bundle. A profile overrides specific\n * fields of the top-level `daemon` / `tunnel` / `features` blocks\n * when selected via `--profile <name>` (or the top-level\n * `activeProfile` setting). Missing fields fall through to the\n * top-level config, so a profile only needs to declare what's\n * different — typically just `tunnel.host` + `tunnel.token`.\n *\n * Example:\n *   {\n *     \"daemon\": { \"workspace\": \"/code\", \"port\": 18790 },\n *     \"activeProfile\": \"local\",\n *     \"profiles\": {\n *       \"local\": { \"tunnel\": { \"host\": \"ws://localhost:3200/connect\",\n *                              \"token\": \"apt_local\", \"autoconnect\": true } },\n *       \"prod\":  { \"tunnel\": { \"host\": \"wss://tunnel.guilde.work/connect\",\n *                              \"token\": \"apt_prod\",  \"autoconnect\": true },\n *                  \"daemon\": { \"port\": 18791 } }\n *     }\n *   }\n *\n * Sandbox daemons generate per-sandbox profile entries at provision\n * time so the daemon inside the sandbox boots with\n * `agentproto serve --profile sandbox-<id>` and no extra plumbing.\n */\nexport interface ProfileConfig {\n  daemon?: DaemonConfig\n  tunnel?: TunnelConfig\n  features?: FeaturesConfig\n}\n\n/**\n * A user-defined named terminal/TUI preset stored in\n * `~/.agentproto/config.json` under `terminalPresets`. Presets keep\n * local launch recipes (argv, env, cwd, name/label) out of shared\n * adapter manifests — e.g. pointing a Claude Code TUI at a local\n * LLM gateway without retyping proxy env vars every spawn.\n */\nexport interface TerminalPreset {\n  /** Command + args to spawn. When provided, `sessions terminal` can\n   *  be used without `-- <argv...>`. */\n  argv?: string[]\n  /** Extra environment variables layered on top of the daemon's\n   *  inherited process.env. Values MUST be strings. */\n  env?: Record<string, string>\n  /** Working directory for the PTY session. Relative paths are\n   *  resolved against the current working directory at CLI time. */\n  cwd?: string\n  /** Workspace slug used for cwd fallback when `cwd` is omitted. */\n  workspace?: string\n  /** Stable session name passed to the registry (`name` field). */\n  name?: string\n  /** Human-readable label surfaced in session listings. */\n  label?: string\n}\n\nexport interface AgentprotoConfig {\n  version?: number\n  daemon?: DaemonConfig\n  tunnel?: TunnelConfig\n  features?: FeaturesConfig\n  /** E2E daemon-pairing defaults (rendezvous URL + autoconnect). */\n  pairing?: PairingConfig\n  /** Where `agentproto worktree new` creates worktrees. See\n   *  {@link WorktreesConfig}. */\n  worktrees?: WorktreesConfig\n  /** Named connection profiles. See `ProfileConfig` for the merge\n   *  semantics — a profile's fields shallow-override the top-level\n   *  defaults for the selected run. */\n  profiles?: Record<string, ProfileConfig>\n  /** Profile name to use when `--profile` isn't passed. When unset,\n   *  the top-level `daemon` / `tunnel` blocks are used directly. */\n  activeProfile?: string\n  /** Default `skills` + `options` auto-applied to every `agent_start`\n   *  spawn — global and per-adapter. See `resolveSpawnDefaults` in\n   *  `spawn-defaults.ts` for the merge precedence with an explicit call.\n   *  Absent ⇒ current behaviour exactly (no regression). */\n  defaults?: SpawnDefaultsConfig\n  /** User-defined generic ACP agents, keyed by adapter slug. Each entry\n   *  is minted into a runnable handle by the CLI's `acpHandleFromSpec`\n   *  when `resolveAdapter(slug)` finds no npm adapter package. User\n   *  entries shadow the curated `ACP_CATALOG` on slug collision. */\n  acpAgents?: Record<string, AcpAgentConfigEntry>\n  /** User-defined named terminal/TUI presets. Local-only; never\n   *  packaged in shared adapter manifests or defaults. */\n  terminalPresets?: Record<string, TerminalPreset>\n  /** Unknown keys preserved across save round-trips. */\n  [unknown: string]: unknown\n}\n\nexport const CONFIG_FILE_PATH = (): string =>\n  join(homedir(), \".agentproto\", \"config.json\")\n\n/**\n * Drop any `acpAgents` entries that aren't a shape we can turn into a\n * handle. The one hard requirement is a non-empty string `bin` (the\n * executable to spawn); everything else is optional and defaulted\n * downstream. Invalid entries are removed rather than throwing so the\n * daemon still boots — one warning names the offending slug so the\n * user can fix their config. Returns `undefined` when nothing valid\n * remains, keeping the key absent (== \"no generic agents\").\n */\nfunction sanitizeAcpAgents(\n  raw: unknown,\n  target: string,\n): Record<string, AcpAgentConfigEntry> | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n    console.warn(\n      `[runtime/config] ${target}: 'acpAgents' is not an object — ignoring`,\n    )\n    return undefined\n  }\n  const out: Record<string, AcpAgentConfigEntry> = {}\n  for (const [slug, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (\n      value &&\n      typeof value === \"object\" &&\n      !Array.isArray(value) &&\n      typeof (value as { bin?: unknown }).bin === \"string\" &&\n      (value as { bin: string }).bin.length > 0\n    ) {\n      out[slug] = value as AcpAgentConfigEntry\n    } else {\n      console.warn(\n        `[runtime/config] ${target}: acpAgents.${slug} is missing a string 'bin' — ignoring`,\n      )\n    }\n  }\n  return Object.keys(out).length > 0 ? out : undefined\n}\n\n/**\n * Load config.json. Returns an empty object (NOT null) when the file\n * is missing, malformed, or unreadable — callers can `cfg.daemon?.port`\n * safely without null-guards. Errors during a malformed-read are\n * logged once so the user notices the file is broken without the\n * daemon refusing to boot.\n */\nexport async function loadConfig(path?: string): Promise<AgentprotoConfig> {\n  const target = path ?? CONFIG_FILE_PATH()\n  try {\n    const raw = await fs.readFile(target, \"utf8\")\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed && typeof parsed === \"object\" && !Array.isArray(parsed)) {\n      const cfg = parsed as AgentprotoConfig\n      // Sanitize `acpAgents` in the same tolerant spirit as the rest of\n      // this loader: a malformed entry is dropped (with one warning) so a\n      // single bad hand-edit can't make every generic ACP agent\n      // unresolvable. Full AIP-45 validation happens later, at\n      // `acpHandleFromSpec` time, with precise field-level messages.\n      if (cfg.acpAgents !== undefined) {\n        cfg.acpAgents = sanitizeAcpAgents(cfg.acpAgents, target)\n      }\n      return cfg\n    }\n    console.warn(\n      `[runtime/config] ${target}: top-level value is not an object — ignoring`,\n    )\n    return {}\n  } catch (err) {\n    // ENOENT is the common case; only warn on other shapes.\n    const code = (err as NodeJS.ErrnoException).code\n    if (code && code !== \"ENOENT\") {\n      console.warn(\n        `[runtime/config] failed to read ${target}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n    }\n    return {}\n  }\n}\n\n/**\n * Write config.json atomically (tmp + rename) so a concurrent\n * `agentproto config edit` can't half-truncate the file. Writes\n * `next` AS-IS — callers are expected to pass the full desired\n * state (loaded the existing config, mutated, passed it back).\n *\n * Earlier versions deep-merged with the on-disk file, but that made\n * deletions impossible: `setConfigKey(cfg, \"x\", undefined)` would\n * remove the key from memory, then the deep-merge would silently\n * re-add it from disk. The current design trusts the caller's\n * snapshot and uses atomic rename for crash safety.\n */\nexport async function saveConfig(\n  next: AgentprotoConfig,\n  path?: string,\n): Promise<void> {\n  const target = path ?? CONFIG_FILE_PATH()\n  const payload = { ...next, version: CONFIG_VERSION }\n  const dir = dirname(target)\n  await fs.mkdir(dir, { recursive: true })\n  const tmp = `${target}.tmp`\n  await fs.writeFile(tmp, JSON.stringify(payload, null, 2) + \"\\n\", \"utf8\")\n  await fs.rename(tmp, target)\n}\n\n/**\n * Read a dot-notation key (`daemon.port`) out of a config. Returns\n * `undefined` when any segment is missing.\n */\nexport function getConfigKey(\n  cfg: AgentprotoConfig,\n  dotted: string,\n): unknown {\n  let cur: unknown = cfg\n  for (const part of dotted.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") return undefined\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  return cur\n}\n\n/**\n * Set a dot-notation key in a config. Returns a new object — does\n * NOT mutate. Creates intermediate objects as needed. Setting\n * `value: undefined` is treated as a delete.\n */\nexport function setConfigKey(\n  cfg: AgentprotoConfig,\n  dotted: string,\n  value: unknown,\n): AgentprotoConfig {\n  const parts = dotted.split(\".\")\n  const out: AgentprotoConfig = { ...cfg }\n  let cur: Record<string, unknown> = out as Record<string, unknown>\n  for (let i = 0; i < parts.length - 1; i++) {\n    const k = parts[i]!\n    const next = cur[k]\n    if (next && typeof next === \"object\" && !Array.isArray(next)) {\n      cur[k] = { ...(next as Record<string, unknown>) }\n    } else {\n      cur[k] = {}\n    }\n    cur = cur[k] as Record<string, unknown>\n  }\n  const leaf = parts[parts.length - 1]!\n  if (value === undefined) {\n    delete cur[leaf]\n  } else {\n    cur[leaf] = value\n  }\n  return out\n}\n\n/**\n * Deep merge — objects are recursively combined, everything else\n * (arrays, primitives) is replaced wholesale by `b`. Mirrors what\n * `Object.assign({}, a, b)` does for shallow keys.\n */\nfunction deepMerge<A extends Record<string, unknown>, B extends Record<string, unknown>>(\n  a: A,\n  b: B,\n): A & B {\n  const out: Record<string, unknown> = { ...a }\n  for (const [k, v] of Object.entries(b)) {\n    const cur = out[k]\n    if (\n      v &&\n      typeof v === \"object\" &&\n      !Array.isArray(v) &&\n      cur &&\n      typeof cur === \"object\" &&\n      !Array.isArray(cur)\n    ) {\n      out[k] = deepMerge(\n        cur as Record<string, unknown>,\n        v as Record<string, unknown>,\n      )\n    } else {\n      out[k] = v\n    }\n  }\n  return out as A & B\n}\n"]}

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { B as BuildHeartbeatAgent } from './heartbeat-COGpMrJS.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-COGpMrJS.js';
 import { AcpPermissionResolution, AcpMcpServer } from '@agentproto/acp';
 import { ChildProcess } from 'node:child_process';
-import { R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-DAbADRd4.js';
-export { a as AuthEcho, b as AuthResolutionError, C as CredentialSource, c as DefaultsAdapterAuthConfig, d as DefaultsAdapterConfig, e as ResolvedSpawnAuthMaterial, f as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, g as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, h as resolveSpawnDefaults } from './spawn-defaults-DAbADRd4.js';
+import { W as WorktreeIsolationMode, R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './config-BRKy_SAF.js';
+export { a as AuthEcho, b as AuthResolutionError, C as CredentialSource, c as DefaultsAdapterAuthConfig, d as DefaultsAdapterConfig, e as ResolvedSpawnAuthMaterial, f as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, g as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, h as resolveSpawnDefaults } from './config-BRKy_SAF.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, AdapterEntry } from '@agentproto/provider-kit';
 import { SandboxProvider } from '@agentproto/sandbox';
@@ -2222,6 +2222,127 @@ type SandboxProviderResolver = AdapterResolver<SandboxProviderHandle>;
 /** List every sandbox provider with its live status + capabilities. */
 type SandboxProviderLister = AdapterLister<SandboxAdapterInfo>;
 
+/**
+ * Policy layer for `agent_start.worktree` — the config-driven decision of
+ * WHETHER to isolate a spawn into its own git worktree, kept deliberately
+ * separate from HOW one is provisioned.
+ *
+ * This module holds no dependency on `@agentproto/worktree`. Same reasoning
+ * as `worktree-identity.ts`'s docblock, only stronger: provisioning runs the
+ * `worktree.provision` TOOL (git + the base tree's `agentproto.json` setup
+ * hooks), which would drag the driver/harness/provider graph into
+ * `@agentproto/runtime` for a capability the runtime only ever *triggers*.
+ * So the concrete provisioner is an INJECTED PORT ({@link WorktreeProvisioner})
+ * wired at the composition root by a host that already depends on the
+ * worktree package (the CLI). The runtime owns only the pure decision
+ * ({@link decideWorktreeIsolation}) and the config/env resolution
+ * ({@link loadWorktreeIsolation}) — both trivially unit-testable without git.
+ *
+ * Mirrors `agent_start.sandbox`'s `resolveSandboxProvider` injection shape,
+ * except sandbox can default its resolver inside the runtime (the runtime
+ * depends on `@agentproto/sandbox`); worktree cannot, so an unwired daemon
+ * simply has no provisioner and a spawn that would need one fails loud rather
+ * than silently spawning unisolated.
+ */
+
+/** Env override for the isolation policy. Highest-priority source, ahead of
+ *  the `worktrees.isolation` config field — see `loadWorktreeIsolation`. */
+declare const WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
+/** The default when nothing is configured. Back-compat-preserving: a caller
+ *  that passes no `worktree` field spawns exactly where it asked. */
+declare const DEFAULT_WORKTREE_ISOLATION: WorktreeIsolationMode;
+/**
+ * The `agent_start.worktree` field. `true` isolates with an auto-minted slug;
+ * an object additionally pins the slug and/or base ref; `false` (or omitted)
+ * is "no explicit request" — the policy mode decides.
+ */
+type WorktreeField = boolean | {
+    slug?: string;
+    base?: string;
+};
+/** The caller's explicit request, normalized — `undefined` when the field is
+ *  absent or `false`, otherwise the (possibly empty) slug/base overrides. */
+interface WorktreeRequest {
+    slug?: string;
+    base?: string;
+}
+/** What the runtime hands the provisioner. `cwd` is where the session would
+ *  otherwise spawn; the provisioner resolves the owning repo from it. */
+interface WorktreeProvisionRequest {
+    cwd: string;
+    /** Explicit slug from the caller; omitted ⇒ the provisioner mints a
+     *  collision-free one (see the host implementation). */
+    slug?: string;
+    /** Base ref the worktree branch is cut from; omitted ⇒ the provisioner's
+     *  default (`origin/main`). */
+    base?: string;
+    /** Free-text label (the session's `label`) the provisioner may fold into a
+     *  minted slug for human readability. Never load-bearing for correctness. */
+    labelHint?: string;
+}
+/** The provisioner's outcome. `isolated: false` is NOT a failure — it means
+ *  there was nothing to isolate (`cwd` sits in no git repo), and the caller
+ *  should spawn plain at the original cwd. A genuine failure throws. */
+type WorktreeProvisionOutcome = {
+    isolated: true;
+    cwd: string;
+    branch: string;
+} | {
+    isolated: false;
+    reason: "not-a-git-repo";
+};
+/**
+ * Injected port: provision a git worktree for `req.cwd` and return the
+ * worktree's own cwd for the spawn to land in. Wired at the composition root
+ * by the CLI (over `@agentproto/worktree`); absent on a bare runtime.
+ */
+type WorktreeProvisioner = (req: WorktreeProvisionRequest) => Promise<WorktreeProvisionOutcome>;
+/** The pure decision's three outcomes. */
+type WorktreeDecision = {
+    action: "spawn-in-place";
+} | {
+    action: "provision";
+    request: WorktreeRequest;
+} | {
+    action: "reject";
+    message: string;
+};
+/**
+ * Normalize the raw field into an explicit request, or `undefined` when the
+ * caller made no request (`false` / omitted). An object with no overrides
+ * still counts as a request (`{}`) — the caller opted in, just without pins.
+ */
+declare function normalizeWorktreeField(field: WorktreeField | undefined): WorktreeRequest | undefined;
+/**
+ * The resolution matrix — mode × explicit-request × depth — with no side
+ * effects. Every branch is exercised in `worktree-isolation.test.ts`.
+ *
+ * Depth-0 gate: a nested spawn (`depth > 0`, i.e. made through the scoped
+ * orchestrator sub-gateway) NEVER provisions — it inherits its parent's
+ * ground, per AIP-46 §Delegation. This bites before the mode is even
+ * consulted, so `always` too provisions only at the root and an explicit
+ * request from a nested spawn is a silent no-op (spawn-in-place), not a
+ * reject: the child is meant to share the parent's tree.
+ */
+declare function decideWorktreeIsolation(input: {
+    mode: WorktreeIsolationMode;
+    field: WorktreeField | undefined;
+    depth: number;
+}): WorktreeDecision;
+/** Parse a raw string into a valid mode, or `undefined` when it isn't one. */
+declare function parseWorktreeIsolationMode(raw: string | undefined): WorktreeIsolationMode | undefined;
+/**
+ * Resolve the effective isolation mode: env > config field > default. Mirrors
+ * `resolveWorktreesRoot`'s precedence (there's no flag layer — this is read
+ * daemon-side at spawn, not from an invocation). Never throws: an unreadable
+ * config falls through to the default.
+ */
+declare function loadWorktreeIsolation(loadCfg?: () => Promise<{
+    worktrees?: {
+        isolation?: WorktreeIsolationMode;
+    };
+}>): Promise<WorktreeIsolationMode>;
+
 /**
  * Pluggable adapter resolver — keeps the runtime package free of any
  * @agentproto/cli dep. The host (cli `serve`, playground, embedding
@@ -2911,6 +3032,26 @@ declare function readRuntimeMeta(workspace: string): Promise<{
  */
 declare function sweepStaleRuntimeMetas(workspaces: readonly string[], currentWorkspace: string): Promise<string[]>;
 
+/**
+ * Read-only probe: does a credential actually RESOLVE for an adapter slug's
+ * billing auth? Used by `adapter_list` to report an HONEST status instead of
+ * claiming "ready" on a host with zero credentials for an adapter that hard-
+ * fails every spawn (claude-code, `authEnforce: "always"`).
+ *
+ * THE TRAP (see the money regression test in `__tests__/auth-probe.test.ts`):
+ * a probe that answers "is auth configured?" by checking `providers.json`
+ * alone would report `true` for a spawn that still throws
+ * `missing_auth_credential` — the store lookup at `session-spawn.ts:612-617`
+ * is gated on `explicit` (PR #321: an unconfigured `always`-enforcing adapter
+ * must never pick up a leftover store key and bill org credits instead of the
+ * Max subscription). So this mirrors `session-spawn.ts`'s resolution exactly
+ * — same `resolveSpawnDefaults` + `resolveAuthSpec`, same explicit gate on
+ * the store lookup — rather than reimplementing the precedence: a second
+ * copy of this logic WILL drift, and the drift is denominated in money.
+ */
+
+declare function isAgentCliAuthConfigured(slug: string, descriptor: AdapterAuthDescriptor, model?: string): Promise<boolean>;
+
 /**
  * MCP tools for event-driven orchestration:
  *   - session_events_poll — cheap cursor-based snapshot of session events
@@ -3126,6 +3267,16 @@ interface CreateGatewayOptions {
     /** Optional sandbox provider lister — mirrors `listAgentAdapters`.
      *  Overrides the default catalog-driven lister behind `list_sandbox_providers`. */
     listSandboxProviders?: SandboxProviderLister;
+    /**
+     * Optional git-worktree provisioner powering `agent_start.worktree` and the
+     * `worktrees.isolation` policy. Injected here (rather than defaulted inside
+     * the runtime like `resolveSandboxProvider`) because provisioning runs the
+     * `@agentproto/worktree` TOOL, a dependency the runtime deliberately does
+     * NOT take — see `worktree-identity.ts` / `worktree-isolation.ts`. The CLI
+     * wires it. Omitted → a spawn the policy says to isolate is rejected with
+     * `worktree_provisioner_not_enabled` (never silently spawned unisolated).
+     */
+    provisionWorktree?: WorktreeProvisioner;
     /**
      * Optional E2E pairing registry (see `createPairingRegistry`). When wired,
      * the gateway mounts the `/pairings/*` REST routes and the `pair_*` MCP
@@ -3183,4 +3334,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { AdapterAuthDescriptor, type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CommitSpec, type CompletionPolicySupervisor, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DeclaredAdapterOption, type DeclaredAdapterPreset, type GateSpec, type GatewayHandle, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type McpCredentialDeps, type MigrationMarker, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, PAIRINGS_VERSION, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, ResolvedAuthSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, daemonRegistryDir, declaredPresetToProviderPreset, deriveSessionUsage, formatToolCall, formatToolResult, getMcpCredentialDeps, isSafeBucketSlug, listBuckets, listPresets, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, policyWatchesSession, projectSessionUsage, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, resolveBucketSlug, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };
+export { AdapterAuthDescriptor, type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CommitSpec, type CompletionPolicySupervisor, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type GateSpec, type GatewayHandle, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type McpCredentialDeps, type MigrationMarker, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, PAIRINGS_VERSION, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, ResolvedAuthSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listPresets, loadWorktreeIsolation, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeWorktreeField, parseWorktreeIsolationMode, policyWatchesSession, projectSessionUsage, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, resolveBucketSlug, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };