@agentproto/runtime 0.8.0 → 1.0.0

package/dist/index.d.ts

@@ -2,9 +2,12 @@ import { DoctypeSpec } from '@agentproto/manifest';
 import { B as BuildHeartbeatAgent } from './heartbeat-COGpMrJS.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-COGpMrJS.js';
 import { AcpPermissionResolution, AcpMcpServer } from '@agentproto/acp';
+import { SessionMode } from '@agentproto/acp/client';
+export { SessionMode } from '@agentproto/acp/client';
 import { ChildProcess } from 'node:child_process';
-import { W as WorktreeIsolationMode, R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './config-BRKy_SAF.js';
+import { W as WorktreeIsolationMode, A as AdapterAuthDescriptor, R as ResolvedAuthSpec, D as DeclaredAdapterOption } from './config-BRKy_SAF.js';
 export { a as AuthEcho, b as AuthResolutionError, C as CredentialSource, c as DefaultsAdapterAuthConfig, d as DefaultsAdapterConfig, e as ResolvedSpawnAuthMaterial, f as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, g as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, h as resolveSpawnDefaults } from './config-BRKy_SAF.js';
+import { AuthProfile } from '@agentproto/auth';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, AdapterEntry } from '@agentproto/provider-kit';
 import { SandboxProvider } from '@agentproto/sandbox';
@@ -132,6 +135,177 @@ interface UsageDescriptorFields {
  */
 declare function projectSessionUsage(desc: UsageDescriptorFields): SessionUsage;
 
+/**
+ * SessionConfig — the unified per-session config surface, decomposed into
+ * orthogonal axes (SPEC §3.1, out-of-repo design doc
+ * `agentproto-session-config-axes/SPEC.md`). Pure types + a `decomposeMode`/
+ * `composeMode` shim over the legacy AIP-45 `mode` string — no I/O, no runtime
+ * wiring, no adapter behavior change. This is the additive type foundation
+ * (SPEC §7.2 build step 1); the live spawn-path extraction (deleting gateway
+ * modes, sourcing posture from the ACP registry) is a separate later step.
+ *
+ * Boundary note: this module deliberately does NOT import from
+ * `@agentproto/auth`. `packages/runtime` intentionally has no dependency on
+ * that package (`mcp-credential-deps.ts:1-9`), so the named-profile record it
+ * owns — `AuthProfile` (`packages/auth/src/profile-types.ts:24`, shipped in
+ * #470) — is referenced by citation, never redefined here: the `access` axis
+ * only needs a `profileRef` string, and the profile record itself stays in
+ * `@agentproto/auth`. The narrow `AuthMethod` *facet*, by contrast, is
+ * structurally mirrored below (§3.1) — the descriptor's `accessProfile` echo
+ * (§3.7) names it, and mirroring a two-value string union is cheaper than
+ * taking a package dependency on `@agentproto/auth` for it, the same
+ * structural-mirror rationale as `DeclaredAdapterMode` (below) and
+ * `DeclaredAdapterOption` (`spawn-defaults.ts:447`).
+ *
+ * It DOES, however, import a VALUE — the legacy AIP-45 mode-id classification
+ * (`inferLegacyModeKind`) — from `@agentproto/driver-agent-cli` (a lean,
+ * acyclic runtime → driver edge; the driver never depends back on the runtime).
+ * Unlike the type mirrors above (a mirror can't silently break — the compiler
+ * still checks structural compatibility), the gateway/posture id SET is a value
+ * list needed on BOTH sides of the driver/runtime boundary — here for
+ * `decomposeMode` and in the driver's `composeSpawn` back-compat shim — so it
+ * is single-sourced in the driver (its AIP-45 home) rather than copied, which
+ * for a value list WOULD silently drift. Only the daemon-domain canonical-
+ * posture VALUE mapping (`POSTURE_MODE_VALUES`) stays local.
+ */
+/**
+ * Reasoning / compute budget label.
+ *
+ * SUPERSET ONLY — this flat union is the documented ceiling, NOT the valid set.
+ * The real accepted values are a function of (adapter × model), resolved at
+ * runtime (SPEC §3.9): the same label maps to a different compute budget across
+ * models, and `"max"` / `"ultracode"` are session-only and model-gated (opus
+ * offers `ultracode`, haiku does not —
+ * `adapters/claude-code/src/index.ts:310-321`). Consumers must resolve the
+ * offerable set per session/model, never treat this enum as authoritative.
+ */
+type EffortLevel = "low" | "medium" | "high" | "xhigh" | "max" | "ultracode";
+/**
+ * agentproto-canonical posture — a portable, normalized vocabulary for "what
+ * the agent may DO" (SPEC §3.1/§3.4a). A canonical posture resolves to a
+ * harness `SessionModeId` when the session's advertised `availableModes` has an
+ * equivalent (native, enforced, live via `setSessionMode`); otherwise it is
+ * applied as an injected system-prompt preamble (advisory, not a permission
+ * boundary — SPEC risk Rw).
+ */
+type CanonicalPosture = "default" | "plan" | "accept-edits" | "bypass" | "read-only";
+/**
+ * The posture axis: either an agentproto-canonical posture OR a raw harness
+ * mode id sourced directly from the harness's own ACP mode registry
+ * (`SessionModeState.availableModes` — SDK `types.gen.d.ts:4227`). Postures are
+ * NOT a manifest mode list going forward (SPEC §3.4a); the `{ harnessModeId }`
+ * form carries a native mode the canonical vocabulary doesn't name.
+ */
+type Posture = CanonicalPosture | {
+    harnessModeId: string;
+};
+/**
+ * Endpoint / billing rail — model/route config, NOT a mode (SPEC §3.4a). A
+ * gateway is reached by resolving the model's `@route` against the catalog
+ * (`packages/model-catalog/src/route-identity/index.ts:1-46`) and applying its
+ * base_url + credential-scrub on the route apply-path; `access` (which profile
+ * is eligible) is downstream of THIS axis (SPEC §1c).
+ */
+interface RouteSpec {
+    /** Preset id ("anthropic"/direct, "moonshot", "openrouter", "requesty",
+     *  "deepseek") or a custom id paired with an explicit `baseUrl`. */
+    gateway: string;
+    /** Resolved base URL; carried only for a custom gateway the catalog can't
+     *  resolve. The attached profile's credential is resolved separately (§1c),
+     *  never inlined here. */
+    baseUrl?: string;
+}
+/**
+ * What enters context. `"lean"` drops bundled skills
+ * (`adapters/claude-code/src/index.ts:196-204`); `"full"` is the default. The
+ * `(string & {})` arm keeps a future adapter-declared context profile from
+ * being blocked while preserving literal autocompletion for the known values.
+ */
+type ContextProfile = "full" | "lean" | (string & {});
+/**
+ * How an attached auth profile authenticates — the narrow eligibility gate,
+ * a *facet* of a named profile (SPEC §1c/§3.1), NOT a session-level enum. A
+ * structural mirror of `@agentproto/auth`'s `AuthMethod`
+ * (`packages/auth/src/profile-types.ts:21`, #470): `"api-key"` ↔ `tokenKind
+ * "pat"`, `"oauth-bearer"` ↔ `tokenKind "oat"` (a subscription bearer). Kept
+ * here — rather than imported — because `packages/runtime` has no dependency
+ * on `@agentproto/auth` (see the boundary note above); only the descriptor's
+ * `accessProfile` echo (§3.7) needs to name it.
+ */
+type AuthMethod = "oauth-bearer" | "api-key";
+/**
+ * The complete per-session config surface, decomposed into orthogonal axes
+ * (SPEC §3.1). Every field optional; omission = "adapter default" for that
+ * axis. The decomposed axes are the canonical form — persistence and transport
+ * use these fields, never a recomposed legacy `mode` string (SPEC §3.8).
+ */
+interface SessionConfig {
+    /** Route-identity ref: `[route:]vendor/product[:pin][@route]`
+     *  (`packages/model-catalog/src/route-identity/index.ts:1-46`). */
+    model?: string;
+    effort?: EffortLevel;
+    /** Attach a NAMED auth profile by id (SPEC §1c). The profile record —
+     *  `AuthProfile { id, vendor, method, credentialRef, label? }` — lives in
+     *  `@agentproto/auth` (`packages/auth/src/profile-types.ts:24`, #470), NOT on
+     *  the session and NOT in `providers.json`. Omit ⇒ default profile. */
+    access?: {
+        profileRef?: string;
+    };
+    /** Endpoint / gateway rail; `access` is downstream of this (SPEC §1c). */
+    route?: RouteSpec;
+    /** What the agent may DO. */
+    posture?: Posture;
+    /** What enters context. */
+    contextProfile?: ContextProfile;
+}
+/**
+ * Manifest-declared AIP-45 mode id + axis discriminant — the minimum
+ * `decomposeMode`/`composeMode` need from `AgentCliMode` (driver `types.ts`).
+ * Mirrors its `id`/`kind` fields structurally rather than importing the full
+ * `AgentCliMode` TYPE surface from `@agentproto/driver-agent-cli` — the same
+ * structural-mirror pattern as `DeclaredAdapterOption` (`spawn-defaults.ts:447`)
+ * and `DeclaredAdapterPreset` (`preset-tools.ts`). (The module does take a
+ * value-level import — `inferLegacyModeKind` — from that package; see the
+ * boundary note at the top for why a shared value list is single-sourced, not
+ * mirrored.)
+ *
+ * `kind` narrows to a single meaningful value going forward — `"context"` (the
+ * one axis with no ACP-protocol home); routes come from the catalog and
+ * postures from the harness's ACP registry (SPEC §3.4a). `"posture"`/`"route"`
+ * remain accepted so `decomposeMode` can still classify a LEGACY tagged
+ * manifest during migration.
+ */
+interface DeclaredAdapterMode {
+    id: string;
+    kind?: "posture" | "route" | "context";
+}
+/**
+ * Map ONE legacy `mode` id (AIP-45 `modes[]`) onto its orthogonal axis
+ * (SPEC §3.5). Classification order: (1) the mode's own explicit `kind` tag;
+ * (2) inference over well-known ids (gateway ids ⇒ route, known posture ids ⇒
+ * posture); (3) a truly-unknown id defaults to `contextProfile` —
+ * least-privilege, since defaulting to `posture` or `route` could silently
+ * grant elevated permissions or reroute billing (SPEC risk R4).
+ *
+ * Always yields a `CanonicalPosture` for the posture axis, never a
+ * `{ harnessModeId }` — the shim speaks the portable vocabulary only; raw
+ * harness modes come from the ACP registry, not a legacy `mode` id.
+ */
+declare function decomposeMode(modes: readonly DeclaredAdapterMode[], modeId: string): Partial<SessionConfig>;
+/**
+ * The reverse of `decomposeMode` — picks the single legacy mode id whose
+ * decomposition matches `cfg`.
+ *
+ * LOSSY / display-and-back-compat ONLY (SPEC §3.8). A single legacy `mode`
+ * string cannot represent an orthogonal combination — `{ posture: "plan",
+ * route: { gateway: "moonshot" } }` has no single legacy id — so `composeMode`
+ * returns the FIRST declared mode whose axis matches and silently drops the
+ * rest. It is NEVER a storage or transport form: the driver applies each axis's
+ * env/argv patch directly, and anything that must persist/transmit config uses
+ * the decomposed axes. Returns undefined when no declared mode matches.
+ */
+declare function composeMode(cfg: Partial<SessionConfig>, modes: readonly DeclaredAdapterMode[]): string | undefined;
+
 /**
  * In-process pub/sub bus for session lifecycle events. Separate from
  * RuntimeEvents (global daemon bus) — session events are scoped to
@@ -141,7 +315,8 @@ declare function projectSessionUsage(desc: UsageDescriptorFields): SessionUsage;
  * (fire-and-forget HTTP), RoutineRunner (state machine fan-in),
  * and session_monitor MCP tool (long-poll multiplexed).
  */
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:command-done" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed";
+
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:command-done" | "session:model-changed" | "session:config-changed" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed";
 /**
  * Structured detail on why a session is awaiting input, when derivable.
  * `source: "structured"` — a driver-reported ACP-style prompt (e.g. a tool
@@ -241,6 +416,60 @@ interface SessionCommandDoneEvent {
     exitCode: number;
     ts: string;
 }
+/**
+ * Emitted when `SessionsRegistry.setModel` successfully switches a LIVE
+ * agent-cli session's model (`POST /sessions/:id/model`, `session_set_model`
+ * MCP tool). Only fires on `applied: true` — a rejected switch changes
+ * nothing about the session, so there's nothing to announce. `model` is the
+ * new value now reflected on `SessionDescriptor.model` (and therefore on the
+ * next `session_list` / SSE `sessionUpdate` a client sees). Consumers:
+ * `session_events_poll`, the webhook notifier, and the routine engine —
+ * same distribution as every other lifecycle event on this bus.
+ */
+interface SessionModelChangedEvent {
+    type: "session:model-changed";
+    sessionId: string;
+    model: string;
+    label?: string;
+    ts: string;
+}
+/**
+ * The `SessionConfig` axis a `session:config-changed` event reports. Reuses
+ * the axis vocabulary of `SessionConfig` itself (`session-config.ts`, SPEC
+ * §3.1) so there's a single source of truth for the axis names — model /
+ * effort / access / route / posture / contextProfile.
+ */
+type SessionConfigAxis = keyof SessionConfig;
+/**
+ * Emitted when a SINGLE `SessionConfig` axis is changed on a session and the
+ * change actually took effect (SPEC §7.2 build step 4). This is the shared,
+ * axis-generic successor to `session:model-changed`: the live config verbs
+ * (`agent_set_effort` / `agent_set_posture`, step 5) and restart-with-override
+ * (step 6) all announce their single-axis change through THIS event, carrying
+ * which axis moved and the new value now reflected on the descriptor.
+ *
+ * A model change still ALSO emits `session:model-changed` as a back-compat
+ * alias (`sessions.ts` `setModel`) so existing subscribers keep working; new
+ * consumers should prefer this event and switch on `axis`.
+ *
+ * Discriminated by `axis`, with `value` typed to that axis's `SessionConfig`
+ * field — a `model` change carries a `string`, an `effort` change an
+ * `EffortLevel`, a `route` change a `RouteSpec`, and so on. Same bus
+ * distribution as every other lifecycle event (`session_events_poll`, the
+ * webhook notifier, the routine engine).
+ */
+type SessionConfigChangedEvent = {
+    [A in SessionConfigAxis]: {
+        type: "session:config-changed";
+        sessionId: string;
+        /** Which `SessionConfig` axis changed. */
+        axis: A;
+        /** The axis's new value, as now reflected on `SessionDescriptor`. */
+        value: NonNullable<SessionConfig[A]>;
+        label?: string;
+        ts: string;
+    };
+}[SessionConfigAxis];
 /** Emitted by the supervisor when a completion policy's gate passes. */
 interface PolicyPassedEvent {
     type: "policy:passed";
@@ -305,7 +534,7 @@ interface CronFailedEvent {
     error: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionCommandDoneEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent;
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -375,8 +604,117 @@ interface AgentSessionLike {
      *  drivers that don't model held permissions (sandbox proxy, future
      *  transports). */
     respondPermission?(requestId: string, resolution: AcpPermissionResolution): boolean | Promise<boolean>;
+    /**
+     * Switch the active model on this LIVE session — mirrors
+     * `@agentproto/driver-agent-cli`'s `AgentCliRuntimeSession.setModel`
+     * without importing it (this package stays driver-decoupled, same
+     * reasoning as the rest of this structural interface). Optional: absent
+     * for a session shape that doesn't support live model switching (a
+     * sandboxed proxy session, or a future non-agent-cli transport) —
+     * `SessionsRegistry.setModel` treats a missing method as
+     * `{applied:false, reason:"not-supported"}` rather than throwing.
+     */
+    setModel?(modelId: string): Promise<SetSessionModelResult>;
+    /**
+     * Switch the reasoning/compute budget on this LIVE session — mirrors
+     * `@agentproto/driver-agent-cli`'s `AgentCliRuntimeSession.setEffort`
+     * (ACP `session/set_config_option(configId:"effort")`), same driver-decoupled
+     * structural-mirror reasoning as `setModel` above. Optional: absent for a
+     * session shape with no live config surface (sandboxed proxy, future
+     * transport) — `SessionsRegistry.setEffort` treats a missing method as
+     * `{applied:false, reason:"not-supported"}` rather than throwing.
+     */
+    setEffort?(effort: string): Promise<SetSessionEffortResult>;
+    /**
+     * Switch the native posture (harness mode) on this LIVE session — mirrors
+     * `@agentproto/driver-agent-cli`'s `AgentCliRuntimeSession.setSessionMode`
+     * (ACP `session/set_mode`). Optional, same treatment as `setModel`/`setEffort`.
+     */
+    setSessionMode?(modeId: string): Promise<SetSessionModeResult>;
+    /**
+     * The harness's advertised session modes captured at connect time
+     * (`SessionModeState.availableModes`, #482 ACP capability read-surface).
+     * `SessionsRegistry.setPosture` resolves a requested posture against this to
+     * decide native-live vs restart (SPEC §3.4a). Absent/empty for arms with no
+     * native mode registry — treated as "no native mode", so any posture pick
+     * routes to restart.
+     */
+    readonly availableModes?: readonly SessionMode[];
     close(): Promise<void>;
 }
+/** Result of `SessionsRegistry.setModel` — see that method's doc comment. */
+interface SetSessionModelResult {
+    applied: boolean;
+    /** The model id now active. Present only when `applied` is true. */
+    model?: string;
+    /** Present only when `applied` is false — see
+     *  `@agentproto/driver-agent-cli`'s `SetModelResult` for the reason
+     *  vocabulary this passes through verbatim. */
+    reason?: string;
+    /**
+     * Present only on the model↔route guard refusal (SPEC risk R2 / §4.4): the
+     * requested model's route-identity crosses the session's current route/vendor
+     * boundary, which a live `setModel` cannot perform (route is a spawn-time
+     * `ANTHROPIC_BASE_URL`, not a live ACP config option). The daemon refuses the
+     * live switch (`applied:false, reason:"requires-restart"`) rather than
+     * silently keeping the old endpoint, and hands back the override a
+     * restart-with-override (step 6) should carry to apply model + route together.
+     */
+    suggestedOverride?: {
+        route: RouteSpec;
+        model: string;
+    };
+}
+/**
+ * Result of `SessionsRegistry.setEffort` — mirrors the driver's
+ * `SetEffortResult` (see `AgentSessionLike.setEffort`). Effort is a per-model
+ * capability (SPEC §3.9); a rejected label is a soft `{applied:false, reason}`
+ * (SPEC risk R7), never thrown.
+ */
+interface SetSessionEffortResult {
+    applied: boolean;
+    /** The effort label now active. Present only when `applied` is true. */
+    effort?: string;
+    /** Present only when `applied` is false — passes the driver's reason through
+     *  verbatim (`"not-supported"`, or the wrapper's own rejection detail). */
+    reason?: string;
+}
+/** Result of a mid-session `setSessionMode` attempt on the driver session —
+ *  structural mirror of `@agentproto/driver-agent-cli`'s `SetSessionModeResult`,
+ *  used by {@link AgentSessionLike.setSessionMode}. */
+interface SetSessionModeResult {
+    applied: boolean;
+    /** The mode id that took effect. Present only when `applied` is true. */
+    modeId?: string;
+    /** Present only when `applied` is false — the driver's reason verbatim. */
+    reason?: string;
+}
+/**
+ * Result of `SessionsRegistry.setPosture` (SPEC §4.2, build step 5). A posture
+ * that maps to a native advertised harness mode is switched LIVE via
+ * `setSessionMode` (`applied:true`); one with no native mode (prompt-injected /
+ * env-applied) is NOT forced live — it resolves
+ * `{applied:false, reason:"requires-restart"}` so the caller routes it through
+ * the restart-with-override path (step 6, not implemented here).
+ */
+interface SetSessionPostureResult {
+    applied: boolean;
+    /** The posture now active. Present only when `applied` is true. */
+    posture?: Posture;
+    /** The native harness mode id switched to — present only on a native
+     *  (`applied:true`) switch, so a caller can echo exactly what took effect. */
+    modeId?: string;
+    /** Present only when `applied` is false — `"requires-restart"` when the
+     *  posture has no native mode (prompt/env apply-path needs a fresh spawn),
+     *  `"not-supported"` for a session with no live mode surface, or the harness's
+     *  own rejection detail when a native switch was attempted and refused. */
+    reason?: string;
+    /** How the requested posture resolved against the harness's advertised modes
+     *  (`native` | `prompt` | `noop` | `unavailable`, from `resolvePosture`) —
+     *  lets the caller distinguish "needs restart because prompt-injected" from a
+     *  genuine native-switch rejection. */
+    resolution?: "native" | "prompt" | "noop" | "unavailable";
+}
 /**
  * Minimal PTY surface — structurally compatible with
  * @agentproto/acp/tunnel's PtyProcess (node-pty's IPty wrapper). The
@@ -473,6 +811,24 @@ interface SessionAuthEcho {
     credentialSource?: "explicit-config" | "providers-store" | "none";
     setEnv?: string;
 }
+/**
+ * The `access` axis's descriptor ECHO (SPEC §3.6/§3.7) — a non-secret
+ * description of the NAMED auth profile attached to the session, recorded so a
+ * client chip can NAME the wallet ("Jeremy Max") without re-resolving it. This
+ * is deliberately separate from {@link SessionAuthEcho}, which stays as-is: the
+ * `auth` echo is the resolver's observable output (mode + credential
+ * fingerprint), this is the profile IDENTITY the operator selected. NEVER the
+ * credential — `profileRef` resolves through `@agentproto/auth` at read time
+ * (`packages/auth/src/profile-types.ts:24`, #470). `profileRef` is always set
+ * when this object is present (the profile is the reason it exists); the rest
+ * mirror the `AuthProfile` fields the chip renders.
+ */
+interface SessionAccessProfileEcho {
+    profileRef: string;
+    label?: string;
+    vendor: string;
+    method: AuthMethod;
+}
 interface SessionDescriptor {
     id: string;
     kind: SessionKind;
@@ -535,6 +891,19 @@ interface SessionDescriptor {
      *  about, for a UI that would otherwise show the adapter's argv. Distinct
      *  from `label`, which the spawner supplies and which always wins. */
     title?: string;
+    /** Housekeeping-only visibility flag: hides the session from `list()`'s
+     *  default view (`session_list`, `GET /sessions`, panels) once set. Never
+     *  touches the daemon otherwise — the process is already gone by the time
+     *  this is set (see the terminal-status guard on `archiveSession`), the
+     *  transcript stays fully readable via `get()`/`findByIdOrName` (neither
+     *  filters on it), and `list({ includeArchived: true })` still returns it.
+     *  Set by `archiveSession`/`unarchiveSession` (session-tools.ts's
+     *  `session_archive`/`session_unarchive`), persisted like every other
+     *  descriptor field, and round-trips through `loadHistorySnapshot` on
+     *  reboot since it's carried by the same `...desc` spread every other
+     *  field is. Absent (not `false`) for every descriptor from before this
+     *  field existed — treated the same as `false` everywhere it's read. */
+    archived?: boolean;
     /** True when the session was spawned under a real PTY (node-pty)
      *  instead of `child_process.spawn`. PTY sessions carry raw ANSI
      *  bytes (alt-screen, key bindings, colors); attach goes through
@@ -573,8 +942,38 @@ interface SessionDescriptor {
      *  `/sessions/agent` to spin up a fresh ACP runtime. Undefined for
      *  pty/command kinds. */
     adapterSlug?: string;
+    /**
+     * AIP-45 mode the session was spawned with (`AgentCliStartOptions.config.
+     * mode` — e.g. claude-code's `plan`/`accept-edits`, a gateway preset mode
+     * like `moonshot`). Undefined for the adapter's default/native mode.
+     * Recorded so a client can tell whether a candidate model switch stays
+     * within THIS mode (live-switchable via `setModel`) or needs a different
+     * one (`AgentCliModelEntry.mode` on the target) — a mode change is
+     * spawn-time env/argv rewiring (e.g. `ANTHROPIC_BASE_URL`), which
+     * `POST /sessions/:id/model` cannot perform on a live process; that case
+     * is surfaced to clients as `requires-restart`, never silently attempted.
+     */
+    mode?: string;
     /** The model the session was requested to run (echoed back at spawn). */
     model?: string;
+    /** Reasoning / compute budget the session resolved to (SPEC §3.1 axis 2).
+     *  A LIVE-switchable axis; echoed here so the effort chip re-opens on it. */
+    effort?: EffortLevel;
+    /** What the agent may DO (SPEC §3.1 axis 5) — an agentproto-canonical
+     *  posture or a raw `{ harnessModeId }` sourced from the harness's ACP mode
+     *  registry (SPEC §3.4a). */
+    posture?: Posture;
+    /** Endpoint / gateway rail (SPEC §3.1 axis 4). `baseUrl` is carried only
+     *  for a custom gateway the catalog can't resolve; `access` is downstream
+     *  of this axis (SPEC §1c). */
+    route?: RouteSpec;
+    /** What enters context (SPEC §3.1 axis 5b) — `"lean"` drops bundled skills. */
+    contextProfile?: ContextProfile;
+    /** The `access` axis echo (SPEC §3.6/§3.7): the NAMED auth profile attached
+     *  to the session, so the access chip can name the wallet. Distinct from the
+     *  `auth` fingerprint echo below, which stays as-is — see
+     *  {@link SessionAccessProfileEcho}. NEVER the credential. */
+    accessProfile?: SessionAccessProfileEcho;
     /**
      * Deterministic billing-auth mode + a non-secret credential fingerprint,
      * recorded at spawn time for adapters that resolved an explicit
@@ -710,6 +1109,26 @@ interface SessionDescriptor {
      *  matching command session; absent otherwise (including for legacy
      *  rows persisted before this field existed). */
     priorCommandSessionId?: string;
+    /** Id of the prior session this one continues from — set when this
+     *  session was spawned by `session_restart` (or the cron scheduler's
+     *  `prompt-session` action), even when the resume attempt itself
+     *  couldn't establish continuity: a fresh fallback spawn (adapter
+     *  rejected the resume id as "not found") is still "restarted from"
+     *  the prior session, just without conversation history carried over.
+     *  Absent for a session spawned directly (not via restart). Persisted
+     *  on the STORED descriptor (not just grafted onto the restart
+     *  result's JSON, as it used to be) so it survives a `list()`/`get()`
+     *  poll refresh and a daemon restart — see `resumeVia` for how the
+     *  continuity was (or wasn't) established, and the transcript panel's
+     *  chain-walk (vscode package) for the read side. */
+    resumedFrom?: string;
+    /** Human-readable resume path used to arrive at `resumedFrom` — e.g.
+     *  "resumed via claude --resume" (provider-native PTY resume) or
+     *  "resumed via ACP" (adapter-level resume), or `""` when no
+     *  continuity was established (a fresh fallback spawn — see
+     *  `resumedFrom`). Only meaningful alongside `resumedFrom`; absent
+     *  (never `""`) for a session that wasn't spawned via restart. */
+    resumeVia?: string;
     /** Adapter id that drives this session (e.g. "camofox", "bureau"). */
     browserAdapterId?: string;
     /** Port the browser service listens on. */
@@ -874,6 +1293,67 @@ interface SessionsRegistry {
     interruptSession(id: string): Promise<{
         wasBusy: boolean;
     }>;
+    /**
+     * Switch the model on a LIVE agent-cli session without restarting it —
+     * the mid-session counterpart to `spawnAgent`'s `input.model` (which
+     * only applies at spawn time). Delegates to the driver session's own
+     * `setModel` (see `AgentSessionLike.setModel`), which dispatches on the
+     * adapter's `models.apply` strategy (`config`/`command`/`arg`) and never
+     * throws on a rejected switch.
+     *
+     * On `{applied:true}`, updates `SessionDescriptor.model` so
+     * `session_list`/SSE reflect the switch and emits a
+     * `session:config-changed {axis:"model"}` event on the session event bus
+     * (plus a back-compat `session:model-changed` alias). On `{applied:false}`
+     * the descriptor and event bus are untouched — nothing changed, so nothing
+     * to announce.
+     *
+     * Throws (not a structured result) for the two "this request doesn't
+     * even make sense" cases: an unknown session id, or a session that
+     * isn't an agent-cli kind (or whose driver session predates `setModel`
+     * entirely) — both are caller errors, not an adapter's refusal.
+     */
+    setModel(id: string, modelId: string): Promise<SetSessionModelResult>;
+    /**
+     * Announce a single `SessionConfig` axis change on the session event bus
+     * (SPEC step 6). `setModel` emits its `session:config-changed` event inline,
+     * but restart-with-override (`restartAgentSession`, session-restart-core.ts)
+     * lives OUTSIDE the registry — it re-resolves auth and re-spawns a fresh
+     * session — so it announces each changed axis (access/route/posture/…) of the
+     * new session through this one method rather than reaching into the private
+     * event bus. No-op when the registry was constructed without a `sessionEvents`
+     * bus (the emit is best-effort observability, never load-bearing). The caller
+     * builds the fully-typed event (axis + value already reflected on the new
+     * descriptor); the registry only forwards it. */
+    emitConfigChanged(ev: SessionConfigChangedEvent): void;
+    /**
+     * Switch the reasoning/compute budget (effort) on a LIVE agent-cli session
+     * without restarting it — the live-effort verb (SPEC §4.2, build step 5),
+     * `POST /sessions/:id/effort` + `agent_set_effort`. Delegates to the driver
+     * session's `setEffort` (ACP `set_config_option(configId:"effort")`); effort
+     * is model-dependent (SPEC §3.9), so a label the current model rejects is a
+     * soft `{applied:false, reason}` (SPEC risk R7), never thrown.
+     *
+     * On `{applied:true}` updates `SessionDescriptor.effort` and emits
+     * `session:config-changed {axis:"effort"}`; on `{applied:false}` the
+     * descriptor and bus are untouched. Throws (caller error, not an adapter
+     * refusal) for an unknown session id or a non-agent-cli session — same
+     * contract as `setModel`.
+     */
+    setEffort(id: string, effort: string): Promise<SetSessionEffortResult>;
+    /**
+     * Switch the posture on a LIVE agent-cli session (SPEC §4.2, build step 5),
+     * `POST /sessions/:id/posture` + `agent_set_posture`. When the requested
+     * posture maps to a NATIVE advertised harness mode (`resolvePosture` →
+     * `native`), it's switched live via the driver's `setSessionMode`
+     * (`applied:true`, descriptor + `session:config-changed {axis:"posture"}`
+     * emitted). When there is NO native mode (prompt-injected / env-applied /
+     * a raw mode the session no longer advertises), it is NOT forced live — it
+     * resolves `{applied:false, reason:"requires-restart"}` so the caller routes
+     * it through restart-with-override (step 6, not implemented here). Throws for
+     * an unknown session id or a non-agent-cli session, same as `setModel`.
+     */
+    setPosture(id: string, posture: Posture): Promise<SetSessionPostureResult>;
     /** Stamp `lastActivityAt` on a live agent-cli session's descriptor
      *  and schedule a debounced persist. Called from the `onActivity`
      *  callback threaded down through the driver → ACP client, which
@@ -881,8 +1361,36 @@ interface SessionsRegistry {
      *  output) — see `SessionDescriptor.lastActivityAt`. No-op when the
      *  id is unknown (session already forgotten). */
     pulseActivity(id: string): void;
-    list(): SessionDescriptor[];
+    /** Every non-archived session, newest `startedAt` first — the daemon's
+     *  canonical lister (`session_list`, `GET /sessions`, panels, subtree
+     *  scoping). Archived sessions are excluded UNLESS `includeArchived` is
+     *  true — the default keeps a housekeeping flag from becoming a second,
+     *  silent filter every caller has to know about, while
+     *  `{ includeArchived: true }` is there for `session_list`'s own opt-in
+     *  and for any subtree/authorization computation (`collectSubtree`) that
+     *  needs the FULL parent→child graph to stay connected — a subtree BFS
+     *  fed the filtered list would silently orphan the non-archived
+     *  descendants of an archived ancestor, since each edge is keyed off the
+     *  CHILD's own record. `get()`/`findByIdOrName()` are unaffected by this
+     *  flag entirely — a transcript stays directly openable by id no matter
+     *  how it's archived. */
+    list(opts?: {
+        includeArchived?: boolean;
+    }): SessionDescriptor[];
     get(id: string): SessionDescriptor | undefined;
+    /** Archive a TERMINAL-status session (exited/killed/error) — sets
+     *  `archived: true` and persists. Pure housekeeping: hides the row from
+     *  `list()`'s default view, nothing else. Refuses (throws) a still-alive
+     *  session (running/starting) — archiving one would hide it from the
+     *  daemon's own default view while it keeps working unattended, which is
+     *  a worse foot-gun than the flag is trying to solve. Idempotent: already
+     *  archived is a no-op success. Throws when the id is unknown. */
+    archiveSession(id: string): SessionDescriptor;
+    /** Unarchive — the inverse, no status guard (an archived session was
+     *  terminal when archived, and archiving never touched daemon state, so
+     *  there is nothing to re-validate). Throws only when the id is
+     *  unknown. */
+    unarchiveSession(id: string): SessionDescriptor;
     /** Subscribe to a session's output. Returns an unsubscribe fn.
      *  Initial backfill: synchronously invokes `onLine` once for each
      *  line currently in the ring buffer so attaches show context. */
@@ -1009,11 +1517,35 @@ interface SpawnAgentInput {
     depth?: number;
     /** Requested model id — recorded on the descriptor for display + echo. */
     model?: string;
+    /** AIP-45 mode the session was spawned with — recorded onto
+     *  {@link SessionDescriptor.mode}. See that field's doc for why a client
+     *  needs it (mode-mismatch detection for mid-session model switching). */
+    mode?: string;
     /** Resolved auth echo (mode + fingerprint + provider/source/setEnv) —
      *  recorded verbatim onto {@link SessionDescriptor.auth}. See that field's
      *  doc for the full contract; the caller (`session-spawn.ts`) computes this
      *  via the billing-auth resolver, never passing the raw credential here. */
     auth?: SessionAuthEcho;
+    /** Decomposed config-axis echoes (SPEC §3.7) — recorded verbatim onto the
+     *  matching {@link SessionDescriptor} fields, the same optional-spread way
+     *  `model`/`mode`/`auth` are. All optional; a caller that resolved an axis
+     *  passes its echo so the descriptor round-trips it and the picker re-opens
+     *  on it. See each descriptor field's doc for the axis contract. */
+    effort?: EffortLevel;
+    posture?: Posture;
+    route?: RouteSpec;
+    contextProfile?: ContextProfile;
+    /** Named auth-profile echo for the `access` axis (SPEC §3.6). Non-secret —
+     *  see {@link SessionAccessProfileEcho}. */
+    accessProfile?: SessionAccessProfileEcho;
+    /** Prior session id this spawn continues from — set by `restartAgentSession`
+     *  (session-restart-core.ts) when this is a restart, recorded verbatim onto
+     *  {@link SessionDescriptor.resumedFrom}. Absent for a direct (non-restart)
+     *  spawn. */
+    resumedFrom?: string;
+    /** Human-readable resume path, recorded onto {@link SessionDescriptor.resumeVia}.
+     *  Threaded through alongside `resumedFrom` — see that field's doc. */
+    resumeVia?: string;
     /** Hard ceiling on cumulative session cost (USD). When set and the
      *  adapter's usage reader reports a higher cost at a turn-end, the session
      *  is stopped (best-effort, turn-granular — caps continuation, can't abort
@@ -1087,6 +1619,17 @@ interface SpawnPtyInput {
      *  collide with an existing session's name. */
     name?: string;
     label?: string;
+    /** Parent attribution + depth — same semantics as `SpawnAgentInput`
+     *  (orchestrator WP4): set when the spawn came through a scoped
+     *  sub-gateway so `session_tree` shows the PTY under its spawner. */
+    parentSessionId?: string;
+    depth?: number;
+    /** Restart lineage — same semantics as `SpawnAgentInput.resumedFrom` /
+     *  `resumeVia`, recorded onto {@link SessionDescriptor.resumedFrom} /
+     *  {@link SessionDescriptor.resumeVia}. Set by `session_restart` for the
+     *  pty-native/pty-plain branches (session-tools.ts). */
+    resumedFrom?: string;
+    resumeVia?: string;
 }
 interface RecordCommandInput {
     workspaceSlug: string;
@@ -1568,6 +2111,95 @@ interface WebhookNotifier {
     onSessionEvent(ev: SessionEvent): void;
 }
 
+/**
+ * Shared types for pluggable sandbox providers.
+ *
+ * The sandbox family is a `@agentproto/provider-kit` consumer, same shape as
+ * the tunnel family (`remote-providers/types.ts`): {@link SandboxProviderHandle}
+ * extends the kit's generic `AdapterHandle` (slug/name/version/description/
+ * requiresSetup/check) with the AIP-36 capability namespace and the concrete
+ * `@agentproto/sandbox` `SandboxProvider` (`boot()`) the handle wraps.
+ */
+
+/**
+ * Declared capabilities of a sandbox provider — pure metadata, surfaced in
+ * `list_sandbox_providers`. Never carries secrets. Namespace mirrors AIP-36
+ * SANDBOX.md (`network.egress`, `mounts`, `lifecycle.pause_after_idle`,
+ * `read_only`, `limits.timeout_ms`).
+ */
+interface SandboxProviderCapabilities {
+    /** Sandbox can be given a network egress allowlist (AIP-36 `network.egress`). */
+    networkEgress: boolean;
+    /** Sandbox supports mounting external filesystems (AIP-36 `mounts`). */
+    mounts: boolean;
+    /** Sandbox can be paused (not just killed) between turns (AIP-36 `lifecycle.pause_after_idle`). */
+    lifecyclePause: boolean;
+    /** Sandbox can be started read-only (AIP-36 `read_only`). */
+    readOnly: boolean;
+    /** Hard cap on `limits.timeout_ms`, when the provider enforces one. */
+    maxTimeoutMs?: number;
+}
+/**
+ * A sandbox provider as an adapter-kit handle. Rides on the kit's generic
+ * {@link AdapterHandle} and adds the sandbox-specific `capabilities` plus
+ * the `@agentproto/sandbox` `SandboxProvider` the handle wraps — the thing
+ * `createSandboxAgentSessionHost` actually boots.
+ */
+interface SandboxProviderHandle extends AdapterHandle {
+    readonly provider: SandboxProvider;
+    readonly capabilities: SandboxProviderCapabilities;
+    /**
+     * Credential fields this provider accepts via `setup_sandbox_provider`
+     * (e.g. e2b's `apiKey`). Omit (or empty) when the provider needs no
+     * credentials (e.g. `local`).
+     */
+    readonly setupFields?: readonly SetupField[];
+}
+
+/**
+ * Sandbox family on top of `@agentproto/provider-kit` — mirrors
+ * `tunnel-adapters.ts`. This module is the entire bridge between the
+ * generic kit and `@agentproto/sandbox`'s `SandboxProvider` concept: it
+ * contributes nothing the kit already owns (catalog/status/creds/ledger/
+ * list/MCP-tool plumbing); it only supplies the sandbox-family `TInfo`
+ * (`SandboxAdapterInfo`), the static `SANDBOX_CATALOG`, and the resolver
+ * that maps a catalog slug to a concrete {@link SandboxProviderHandle}
+ * (`./sandbox-providers/registry.js`).
+ *
+ * Kit primitives used:
+ *   - `makeCredsStore`      → per-slug 0600 creds under `~/.agentproto/sandbox-creds/`
+ *   - `makeSetupLedger`     → `~/.agentproto/setup/<slug>.json`
+ *   - `makeAdapterResolver` → wraps the throwing `load` into null-on-miss
+ *   - `makeAdapterLister`   → catalog → status-classified `AdapterEntry[]`
+ *   - `makeListTool`        → registers `list_sandbox_providers`
+ *   - `makeSetupTool`       → registers `setup_sandbox_provider` (multi-field
+ *                             form: e2b's `apiKey`, sensitive)
+ *
+ * This is pure additive plumbing (introspection + setup) — it does NOT wire
+ * a `sandbox` field into `agent_start`. That lands in a follow-up PR; the
+ * `resolveSandboxProvider`/`listSandboxProviders` overrides below exist now
+ * so that later wiring can inject the same resolver/lister this module
+ * builds by default, mirroring `resolveAgentAdapter`/`listAgentAdapters`.
+ *
+ * Security: `toSandboxInfo` exposes only `capabilities` — never a cred
+ * value (Appendix B). The setup tool's fields are marked SENSITIVE and the
+ * result NEVER echoes any field value back.
+ */
+
+/**
+ * Family descriptor (`TInfo`). Pure metadata surfaced in
+ * `list_sandbox_providers`. The kit's `AdapterEntry` already carries
+ * slug/name/description/status/version, so the only sandbox-specific field
+ * is the declared capability set. NEVER carries a cred value.
+ */
+interface SandboxAdapterInfo {
+    capabilities: SandboxProviderCapabilities;
+}
+/** Resolve a sandbox provider slug to a handle, or null when unavailable. */
+type SandboxProviderResolver = AdapterResolver<SandboxProviderHandle>;
+/** List every sandbox provider with its live status + capabilities. */
+type SandboxProviderLister = AdapterLister<SandboxAdapterInfo>;
+
 /**
  * Cursor-based ring buffer for session events. Bridges the in-process
  * SessionEventBus (push) to the session_events_poll MCP tool (pull).
@@ -2133,95 +2765,6 @@ type OrchestratorInjector = (opts?: {
  */
 declare function createOrchestratorInjector(deps: OrchestratorInjectorDeps): OrchestratorInjector;
 
-/**
- * Shared types for pluggable sandbox providers.
- *
- * The sandbox family is a `@agentproto/provider-kit` consumer, same shape as
- * the tunnel family (`remote-providers/types.ts`): {@link SandboxProviderHandle}
- * extends the kit's generic `AdapterHandle` (slug/name/version/description/
- * requiresSetup/check) with the AIP-36 capability namespace and the concrete
- * `@agentproto/sandbox` `SandboxProvider` (`boot()`) the handle wraps.
- */
-
-/**
- * Declared capabilities of a sandbox provider — pure metadata, surfaced in
- * `list_sandbox_providers`. Never carries secrets. Namespace mirrors AIP-36
- * SANDBOX.md (`network.egress`, `mounts`, `lifecycle.pause_after_idle`,
- * `read_only`, `limits.timeout_ms`).
- */
-interface SandboxProviderCapabilities {
-    /** Sandbox can be given a network egress allowlist (AIP-36 `network.egress`). */
-    networkEgress: boolean;
-    /** Sandbox supports mounting external filesystems (AIP-36 `mounts`). */
-    mounts: boolean;
-    /** Sandbox can be paused (not just killed) between turns (AIP-36 `lifecycle.pause_after_idle`). */
-    lifecyclePause: boolean;
-    /** Sandbox can be started read-only (AIP-36 `read_only`). */
-    readOnly: boolean;
-    /** Hard cap on `limits.timeout_ms`, when the provider enforces one. */
-    maxTimeoutMs?: number;
-}
-/**
- * A sandbox provider as an adapter-kit handle. Rides on the kit's generic
- * {@link AdapterHandle} and adds the sandbox-specific `capabilities` plus
- * the `@agentproto/sandbox` `SandboxProvider` the handle wraps — the thing
- * `createSandboxAgentSessionHost` actually boots.
- */
-interface SandboxProviderHandle extends AdapterHandle {
-    readonly provider: SandboxProvider;
-    readonly capabilities: SandboxProviderCapabilities;
-    /**
-     * Credential fields this provider accepts via `setup_sandbox_provider`
-     * (e.g. e2b's `apiKey`). Omit (or empty) when the provider needs no
-     * credentials (e.g. `local`).
-     */
-    readonly setupFields?: readonly SetupField[];
-}
-
-/**
- * Sandbox family on top of `@agentproto/provider-kit` — mirrors
- * `tunnel-adapters.ts`. This module is the entire bridge between the
- * generic kit and `@agentproto/sandbox`'s `SandboxProvider` concept: it
- * contributes nothing the kit already owns (catalog/status/creds/ledger/
- * list/MCP-tool plumbing); it only supplies the sandbox-family `TInfo`
- * (`SandboxAdapterInfo`), the static `SANDBOX_CATALOG`, and the resolver
- * that maps a catalog slug to a concrete {@link SandboxProviderHandle}
- * (`./sandbox-providers/registry.js`).
- *
- * Kit primitives used:
- *   - `makeCredsStore`      → per-slug 0600 creds under `~/.agentproto/sandbox-creds/`
- *   - `makeSetupLedger`     → `~/.agentproto/setup/<slug>.json`
- *   - `makeAdapterResolver` → wraps the throwing `load` into null-on-miss
- *   - `makeAdapterLister`   → catalog → status-classified `AdapterEntry[]`
- *   - `makeListTool`        → registers `list_sandbox_providers`
- *   - `makeSetupTool`       → registers `setup_sandbox_provider` (multi-field
- *                             form: e2b's `apiKey`, sensitive)
- *
- * This is pure additive plumbing (introspection + setup) — it does NOT wire
- * a `sandbox` field into `agent_start`. That lands in a follow-up PR; the
- * `resolveSandboxProvider`/`listSandboxProviders` overrides below exist now
- * so that later wiring can inject the same resolver/lister this module
- * builds by default, mirroring `resolveAgentAdapter`/`listAgentAdapters`.
- *
- * Security: `toSandboxInfo` exposes only `capabilities` — never a cred
- * value (Appendix B). The setup tool's fields are marked SENSITIVE and the
- * result NEVER echoes any field value back.
- */
-
-/**
- * Family descriptor (`TInfo`). Pure metadata surfaced in
- * `list_sandbox_providers`. The kit's `AdapterEntry` already carries
- * slug/name/description/status/version, so the only sandbox-specific field
- * is the declared capability set. NEVER carries a cred value.
- */
-interface SandboxAdapterInfo {
-    capabilities: SandboxProviderCapabilities;
-}
-/** Resolve a sandbox provider slug to a handle, or null when unavailable. */
-type SandboxProviderResolver = AdapterResolver<SandboxProviderHandle>;
-/** List every sandbox provider with its live status + capabilities. */
-type SandboxProviderLister = AdapterLister<SandboxAdapterInfo>;
-
 /**
  * Policy layer for `agent_start.worktree` — the config-driven decision of
  * WHETHER to isolate a spawn into its own git worktree, kept deliberately
@@ -2343,6 +2886,108 @@ declare function loadWorktreeIsolation(loadCfg?: () => Promise<{
     };
 }>): Promise<WorktreeIsolationMode>;
 
+/**
+ * Read-only catalog/vendor endpoint (`agentproto-session-config-axes`
+ * SPEC §5) — `GET /catalog/models` + `catalog_models` MCP tool wire into
+ * {@link buildCatalogModels}, the pure join this module owns.
+ *
+ * Reuses three already-shipped pieces instead of rebuilding them:
+ *   - the vendor/product/route model + router widening (OpenRouter/
+ *     Requesty/HuggingFace) from `@agentproto/model-catalog/route-identity`
+ *     (`resolveLlmModelRoute`, `route-identity/index.ts:396-511`) — this is
+ *     what keeps the catalog from being capped at any one adapter's
+ *     `models.allowed` list (SPEC §5.1);
+ *   - the profile eligibility predicate shipped in #470
+ *     (`@agentproto/auth`'s `eligibleProfiles`, `packages/auth/src/
+ *     eligibility.ts:81-89`) for the profile-aware `runnable` flag (SPEC
+ *     §5.3) — the old bare `hasKey` check (`packages/cli/src/commands/
+ *     models.ts:113-117`) is the degenerate one-profile-per-provider case
+ *     this predicate subsumes;
+ *   - `AdapterAuthDescriptor` (`spawn-defaults.ts:226`), the SAME
+ *     provider/authSubscription projection `resolveAuthSpec` reads, as the
+ *     source for which auth methods an adapter can present on its direct
+ *     route (SPEC §3.4's derivable replacement for a hand-maintained
+ *     `authSubscription` boolean).
+ *
+ * A gateway/router route (anything where the resolved route differs from
+ * the model's vendor — `openrouter`, `requesty`, `huggingface`, or an
+ * adapter's own gateway mode id like `moonshot`) always bills against the
+ * route's own id and is always reached with an api-key credential — never
+ * oauth-bearer, since no third-party gateway has an Anthropic-style
+ * subscription bearer path (SPEC §1c: "a moonshot profile, not the Claude
+ * sub"). That structural rule is what lets this module compute
+ * `runnable`/`eligibleProfiles` for the widened, non-curated rows without
+ * per-adapter gateway-vendor tables.
+ */
+
+/** One model entry as declared in an adapter's `models.allowed`
+ *  (`AdapterModelInfo`, `packages/cli/src/registry/resolve.ts:134-142`) —
+ *  the subset this module needs. */
+interface CatalogAdapterModelInput {
+    /** Model id exactly as declared — bare (`"claude-opus-4-8"`) or
+     *  `vendor/product` form. */
+    id: string;
+    /** The adapter mode id that must be applied to reach this model on a
+     *  non-direct route (`AdapterModelInfo.mode`) — e.g. `"moonshot"`.
+     *  Undefined ⇒ direct route (the model's own vendor). */
+    mode?: string;
+}
+/** One installed adapter's contribution to the catalog. */
+interface CatalogAdapterInput {
+    slug: string;
+    models: readonly CatalogAdapterModelInput[];
+    /** This adapter's billing-auth capability on its DIRECT route — the same
+     *  projection `resolveAuthSpec` reads (`spawn-defaults.ts:226`). Omitted
+     *  ⇒ the adapter presents no auth method, so rows it curates are
+     *  discoverable but never runnable through it alone. */
+    authDescriptor?: AdapterAuthDescriptor;
+}
+interface CatalogModelsQuery {
+    /** Keep only routes reachable via this adapter slug. */
+    adapter?: string;
+    /** Keep only this vendor's entry. */
+    vendor?: string;
+    /** Keep only routes with this route id. */
+    route?: string;
+    /** Drop every route with `runnable: false`. */
+    runnableOnly?: boolean;
+}
+interface CatalogPricing {
+    inPer1M: number;
+    outPer1M: number;
+}
+interface CatalogRoute {
+    route: string;
+    ref: string;
+    baseUrl: string | null;
+    pricing: CatalogPricing | null;
+    runnable: boolean;
+    eligibleProfiles: string[];
+    adapterModes: string[];
+    adapters: string[];
+    curated: boolean;
+}
+interface CatalogProduct {
+    product: string;
+    routes: CatalogRoute[];
+}
+interface CatalogVendor {
+    vendor: string;
+    products: CatalogProduct[];
+}
+interface CatalogModelsResponse {
+    vendors: CatalogVendor[];
+}
+interface BuildCatalogModelsInput {
+    adapters: readonly CatalogAdapterInput[];
+    profiles: readonly AuthProfile[];
+    query?: CatalogModelsQuery;
+}
+/** The pure join (SPEC §5): adapter-declared models + router widening +
+ *  the #470 eligibility predicate → the vendor/product/route tree. No I/O —
+ *  callers (the HTTP route / MCP tool) own loading adapters + profiles. */
+declare function buildCatalogModels(input: BuildCatalogModelsInput): CatalogModelsResponse;
+
 /**
  * Pluggable adapter resolver — keeps the runtime package free of any
  * @agentproto/cli dep. The host (cli `serve`, playground, embedding
@@ -2482,6 +3127,13 @@ interface AdapterListEntry {
     modes: AdapterListMode[];
 }
 type AgentAdapterLister = () => Promise<AdapterListEntry[]>;
+/** Loads the read-only vendor/product/route catalog (SPEC §5) for
+ *  `GET /catalog/models` + the `catalog_models` MCP tool. A host wires this
+ *  from `buildCatalogModels` (`catalog-models.ts`) fed by its installed
+ *  adapters + `@agentproto/auth`'s `listAuthProfiles()` — the query params
+ *  are forwarded verbatim from the request. Omitted ⇒ the route/tool
+ *  report "not enabled" (same convention as `listAgentAdapters`). */
+type CatalogModelsLister = (query: CatalogModelsQuery) => Promise<CatalogModelsResponse>;
 interface AuthOptions {
     mode: "none" | "bearer";
     token?: string;
@@ -2756,6 +3408,131 @@ declare function declaredPresetToProviderPreset(decl: DeclaredAdapterPreset): Pr
  */
 declare function listPresets(env?: Record<string, string | undefined>, adapterPresets?: readonly DeclaredAdapterPreset[]): AdapterEntry<PresetInfo>[];
 
+/**
+ * Canonical-posture layer (SPEC §3.4a, build step 2c, out-of-repo design doc
+ * `agentproto-session-config-axes/SPEC.md`). Pure: a map + preambles + a
+ * resolution helper, no I/O, no daemon wiring. It is the piece that makes the
+ * agentproto-canonical posture vocabulary (`CanonicalPosture` from
+ * `./session-config.js`) portable across harnesses:
+ *
+ *   1. **Native enforcement.** A canonical posture is resolved to a *harness*
+ *      `SessionModeId` when the session's advertised `availableModes`
+ *      (`SessionModeState.availableModes`, surfaced read-only by the ACP
+ *      capability layer landed in #482, `packages/acp/src/client/index.ts`) has
+ *      an equivalent. That mode is switched live via `setSessionMode` (step 5)
+ *      or applied on restart (step 6) — a real permission boundary.
+ *   2. **Prompt-injection fallback.** When no advertised mode matches, the
+ *      posture is honoured as an injected system-prompt PREAMBLE — advisory,
+ *      NOT a permission boundary (SPEC risk Rw). This module returns the
+ *      preamble text; steps 5/6 ride it onto the system prompt at spawn.
+ *
+ * This module deliberately does NOT implement the live-posture verb (step 5) or
+ * the posture restart-override (step 6) — it only tells them WHICH of the two
+ * apply-paths a given (posture × session) resolves to, and supplies the
+ * preamble for the fallback path.
+ *
+ * Read-surface dependency: `availableModes` comes from the #482 ACP capability
+ * read surface (`AcpClientSession.availableModes` →
+ * `AgentCliRuntimeSession.availableModes`) — this module consumes it, never
+ * reimplements it.
+ */
+
+/**
+ * Per-posture system-prompt preamble — the prompt-injection fallback applied
+ * when a canonical posture has NO native advertised mode on the current harness
+ * (SPEC §3.4a). This is ADVISORY text the model can ignore, never a permission
+ * boundary (SPEC risk Rw) — a consumer must present a prompt-enforced posture
+ * as "advisory", never imply it sandboxes tools.
+ *
+ * `"default"` has no preamble: it is the neutral posture (no constraint to
+ * announce), so it resolves to a no-op rather than an injected string when the
+ * harness advertises no native `default` mode.
+ */
+declare const POSTURE_PREAMBLES: Readonly<Record<Exclude<CanonicalPosture, "default">, string>>;
+/**
+ * agentproto-canonical posture → the harness `SessionModeId`s that mean the
+ * same thing. This is the "canonical posture ↔ advertised ACP mode id" map
+ * (SPEC §3.4a): the daemon resolves a portable posture onto whichever native
+ * mode a given harness happens to advertise, since harnesses spell the same
+ * concept differently — claude-code's ACP wrapper uses `acceptEdits` /
+ * `bypassPermissions` (`adapters/claude-code/src/index.ts:216,223`), the
+ * manifest posture ids use `accept-edits` / `bypass-permissions`, codex uses
+ * `full-access`, opencode uses `build`, etc.
+ *
+ * Matching is case- and separator-insensitive (see {@link normalizeModeId}), so
+ * ONE readable spelling here covers every casing/hyphenation a harness might
+ * advertise — `"accept-edits"` already matches claude-code's `acceptEdits`, so
+ * both spellings need not be listed. Aliases are disjoint across postures — no
+ * advertised id maps to two canonical postures — so {@link canonicalForModeId}
+ * is unambiguous. Kept consistent with the legacy `mode`-id normalization in
+ * `session-config.ts` (`POSTURE_MODE_VALUES`).
+ */
+declare const POSTURE_NATIVE_ALIASES: Readonly<Record<CanonicalPosture, readonly string[]>>;
+/**
+ * Normalize a mode id for matching: lowercase and strip every non-alphanumeric
+ * character, so `"acceptEdits"`, `"accept-edits"`, and `"Accept_Edits"` all
+ * collapse to `"acceptedits"`. Lets one readable alias in
+ * {@link POSTURE_NATIVE_ALIASES} cover any casing/separator a harness advertises.
+ */
+declare function normalizeModeId(id: string): string;
+/**
+ * Inverse of the alias map: which canonical posture (if any) a harness mode id
+ * normalizes to. `undefined` for a harness-specific mode the canonical
+ * vocabulary doesn't name (e.g. opencode's `architect`) — such a mode is still
+ * offerable as a raw `{ harnessModeId }` posture, it just has no portable name.
+ */
+declare function canonicalForModeId(modeId: string): CanonicalPosture | undefined;
+/**
+ * Find the advertised harness mode that natively enforces `posture`, or
+ * `undefined` if none does.
+ *
+ * - A `CanonicalPosture` matches an advertised mode whose id normalizes to one
+ *   of that posture's aliases.
+ * - A raw `{ harnessModeId }` matches an advertised mode with the (normalized)
+ *   same id — it's already a native id, we only confirm the session still
+ *   advertises it.
+ */
+declare function findNativeMode(posture: Posture, availableModes: readonly SessionMode[]): SessionMode | undefined;
+/**
+ * How a requested posture resolves against a session's advertised modes.
+ *
+ * - `native` — an advertised mode enforces it; switch via `setSessionMode`
+ *   (live, step 5) or apply on restart (step 6). A real permission boundary.
+ * - `prompt` — no native mode; honour it as an injected system-prompt preamble
+ *   (advisory only, SPEC risk Rw). Rides the system prompt, so it applies at
+ *   spawn/restart, never live.
+ * - `noop` — the `default` (neutral) posture with no advertised `default` mode:
+ *   nothing to enforce and nothing to announce.
+ * - `unavailable` — a raw `{ harnessModeId }` the session no longer advertises;
+ *   it has no canonical name, so there is no preamble to fall back to. The
+ *   caller surfaces this rather than silently doing nothing.
+ */
+type PostureResolution = {
+    readonly kind: "native";
+    readonly mode: SessionMode;
+} | {
+    readonly kind: "prompt";
+    readonly posture: Exclude<CanonicalPosture, "default">;
+    readonly preamble: string;
+} | {
+    readonly kind: "noop";
+    readonly posture: "default";
+} | {
+    readonly kind: "unavailable";
+    readonly requestedModeId: string;
+};
+/**
+ * Resolve a requested posture against the session's advertised `availableModes`
+ * (from the #482 read surface) into one of the {@link PostureResolution} arms.
+ * Pure and total — the single decision function steps 5 (live) and 6 (restart
+ * override) call to learn whether a posture pick is native-enforced or
+ * prompt-injected, without either of them re-deriving the map.
+ *
+ * Native enforcement is always preferred: a canonical posture resolves to
+ * `prompt` ONLY when the harness advertises no equivalent mode.
+ */
+declare function resolvePosture(posture: Posture, availableModes: readonly SessionMode[]): PostureResolution;
+
 /**
  * Per-workspace state buckets — AIP-46 §State partitioning.
  *
@@ -2867,7 +3644,18 @@ declare function resolveBucketSlug(workspaceSlug: string | undefined | null, reg
  *  silently pooling into `default` until restart. Never throws: a
  *  missing/corrupt registry degrades to "nothing is registered", i.e.
  *  everything lands in `default` — today's pooled behaviour, which is
- *  the right failure direction. */
+ *  the right failure direction.
+ *
+ *  A registry read that fails transiently (a race with a concurrent
+ *  `saveWorkspacesConfig` tmp+rename) is indistinguishable here from one
+ *  that's genuinely empty — but the persist path never actually needs to
+ *  tell them apart: `sessions.ts`'s `sourceBucketOf` already keeps a
+ *  loaded row homed to the bucket it came from regardless of what this
+ *  returns, so a bad read here degrades a NEW session's placement (still
+ *  `default`, same as always) and nothing else. See the 2026-07-18
+ *  bucket-clobber incident for why that distinction matters for loaded
+ *  rows, and `sourceBucketOf`'s docblock in `sessions.ts` for where it's
+ *  actually enforced. */
 declare function readRegisteredSlugs(configPath?: string): ReadonlySet<string>;
 /** Bucket directories that exist on disk. Order is not meaningful. */
 declare function listBuckets(root: string): string[];
@@ -2908,6 +3696,118 @@ declare function migrateLegacySessionsFile(opts: {
     registered: ReadonlySet<string>;
 }): MigrationMarker | null;
 
+/**
+ * Persisted conversation index — the session ↔ native-transcript link,
+ * stored instead of re-derived (DESIGN.md `agentproto-state-multitenancy`
+ * §6).
+ *
+ * Today the link between an agentproto session and the original
+ * claude/hermes conversation file is DERIVED on every read, through
+ * `claudeCodeProjectDir`/`claudeProjectSlug` (conversation-store.ts) — and
+ * until that function was fixed, derived *wrong* for any cwd containing a
+ * dot. Re-deriving is also blind to cwd drift (a worktree that moved) and
+ * carries no record of subagent transcripts at all.
+ *
+ * This module is the fix: an **append-only** `conversations.jsonl`, one
+ * per workspace bucket (co-located with that bucket's `sessions.json`,
+ * `workspace-buckets.ts`), upserted by `sessionId` — readers take the LAST
+ * record per id. Append-only is deliberate, not incidental: it is immune
+ * to the wholesale-rewrite clobber `sessions.ts`'s `persistSnapshot`
+ * already has (see DESIGN.md §1) — a writer can only ever ADD a line, so a
+ * second process racing a first can't shrink what's on disk.
+ *
+ * Write points (best-effort, mirroring how `transcriptWriter`/
+ * `persistSnapshot` never throw into the turn path): session spawn, an
+ * ACP-level resume, and a native graceful-exit resume-hint — see
+ * `sessions.ts`'s calls into `recordConversationLink`.
+ *
+ * No tenant layer yet — the index lives directly under the workspace
+ * bucket dir today (`bucketDir(bucketsRoot, slug)/conversations.jsonl`);
+ * DESIGN.md §9 notes it migrates under `tenants/<t>/…` at a later PR.
+ */
+/** The claude-code native store: one jsonl per conversation, plus any
+ *  subagent transcripts nested under `<sessionId>/subagents/agent-*.jsonl`. */
+interface ClaudeNativeRef {
+    kind: "claude-jsonl";
+    path: string;
+    subagents: string[];
+}
+/** The hermes native store: a row in a shared sqlite db, keyed by the same
+ *  id agentproto already records as `adapterSessionId` — no path to derive. */
+interface HermesNativeRef {
+    kind: "hermes-sqlite";
+    dbPath: string;
+    rowId: string;
+}
+type ConversationNativeRef = ClaudeNativeRef | HermesNativeRef;
+interface ConversationIndexRecord {
+    sessionId: string;
+    workspace: string;
+    cwd: string;
+    adapterSlug: string;
+    adapterSessionId: string;
+    /** Absent when `adapterSlug` has no known native store (an adapter
+     *  outside claude-code/hermes) — the record still links session ↔
+     *  cwd ↔ adapterSessionId, it just can't point at a native file. */
+    native?: ConversationNativeRef;
+    agentprotoTranscript: string;
+    title?: string;
+    startedAt: string;
+    endedAt?: string;
+}
+/** Absolute path to a workspace bucket's conversation index. Sibling of
+ *  `bucketSessionsFile` in `workspace-buckets.ts`, same root/slug rule. */
+declare function conversationIndexPath(bucketsRoot: string, slug: string): string;
+interface ResolveNativeLinkInput {
+    cwd: string;
+    adapterSlug: string;
+    adapterSessionId: string;
+}
+/**
+ * Resolve where THIS provider keeps this conversation, computed once (at
+ * a write point) rather than re-derived on every read. Claude-code's path
+ * uses the corrected `claudeProjectSlug` via `claudeCodeProjectDir` — the
+ * whole point of pairing this module with the encoder fix in the same PR.
+ * Returns `undefined` for an adapter with no known native store (e.g.
+ * mastracode, claude-sdk) — a record without `native` is still useful
+ * (session ↔ cwd ↔ adapterSessionId), it just has nothing further to add.
+ */
+declare function resolveNativeLink(input: ResolveNativeLinkInput): Promise<ConversationNativeRef | undefined>;
+/** Append one record. Never rewrites — the caller decides when a fresher
+ *  snapshot of the same session is worth a new line; readers always take
+ *  the last one. Creates the bucket dir if this is its first conversation
+ *  record (a bucket that has only ever held terminal/command sessions
+ *  won't have one yet). */
+declare function appendConversationRecord(bucketsRoot: string, slug: string, record: ConversationIndexRecord): Promise<void>;
+/** Read one bucket's index, upserted by `sessionId` — a line later in the
+ *  file always wins over an earlier one for the same id, append-only's
+ *  upsert semantics. A malformed line (partial write, hand-edited garbage)
+ *  is skipped, not fatal — the rest of the file still reads. `[]` (not a
+ *  throw) when the bucket has no index yet. */
+declare function readConversationIndex(bucketsRoot: string, slug: string): Promise<ConversationIndexRecord[]>;
+/** Forward lookup within one already-known bucket. */
+declare function findConversationRecord(bucketsRoot: string, slug: string, sessionId: string): Promise<ConversationIndexRecord | undefined>;
+interface LocatedConversation {
+    workspace: string;
+    record: ConversationIndexRecord;
+}
+/** Forward lookup: sessionId → its record, scanning every bucket (the
+ *  caller doesn't have to know which workspace a session landed in).
+ *  `undefined` when no bucket's index has ever recorded this session. */
+declare function locateConversationBySessionId(bucketsRoot: string, listBuckets: () => string[], sessionId: string): Promise<LocatedConversation | undefined>;
+interface LocatedConversationByPath extends LocatedConversation {
+    /** Set when the match was a subagent transcript rather than the root
+     *  conversation file — the path that actually matched. */
+    matchedSubagentPath?: string;
+}
+/** Reverse lookup: a native jsonl path (root conversation OR a subagent
+ *  transcript) → the agentproto session/workspace that owns it. Scans
+ *  every bucket's index; paths are compared after `path.resolve` so a
+ *  relative or `..`-bearing argument still matches an absolute recorded
+ *  one. Only meaningful for claude-code's `native.path`/`native.subagents`
+ *  — hermes has no per-conversation file to reverse-lookup from. */
+declare function locateConversationByNativePath(bucketsRoot: string, listBuckets: () => string[], nativePath: string): Promise<LocatedConversationByPath | undefined>;
+
 /** A journal-file StepCache scoped to one cacheKey. Best-effort: read/parse
  *  failures degrade to "no cache" (a miss), never throw into the run. */
 declare function createFileStepCache(cacheKey: string, opts?: {
@@ -3032,6 +3932,44 @@ declare function readRuntimeMeta(workspace: string): Promise<{
  */
 declare function sweepStaleRuntimeMetas(workspaces: readonly string[], currentWorkspace: string): Promise<string[]>;
 
+/**
+ * Conversation as pivot: one store abstraction per provider, read on any
+ * session. A "conversation" is the provider's own persisted session — the
+ * durable object. An agentproto session (ACP or PTY) is just an attachment
+ * to it. `CONVERSATION_STORES` is the single source of truth for "where does
+ * this provider keep its conversations, and how do I read/attach to one" —
+ * `RESUME_STRATEGIES` (resume-strategies.ts) and `EXPORT_STRATEGIES`
+ * (transcript-export.ts) are thin adapters over it so the two historically
+ * drifted tables can never diverge again.
+ */
+
+/**
+ * Claude Code's own `cwd` → project-dir-name encoder.
+ *
+ * The real rule (verified empirically against `~/.claude/projects/`
+ * directory names for dozens of known cwds, including dotted worktree
+ * paths and macOS temp dirs): every character that is NOT `[a-zA-Z0-9]`
+ * is replaced 1:1 with `-`. Crucially, runs of consecutive non-alnum
+ * characters are NOT collapsed — each input character produces exactly
+ * one output character.
+ *
+ * This used to be `cwd.replace(/\//g, "-")` — slashes only. That's wrong
+ * for any cwd containing a dot (every `.agentproto` worktree, any
+ * dotdir), an underscore-prefixed segment, a space, etc., because those
+ * characters are left untouched instead of becoming `-`, so the computed
+ * directory never matches the one claude actually created.
+ *
+ * Reconstruction proof (both real, both `ls ~/.claude/projects/`-verified):
+ *   cwd  /Users/jeremy/.agentproto/worktrees/ts/gc-fresh-hold
+ *   →    -Users-jeremy--agentproto-worktrees-ts-gc-fresh-hold
+ *   (note the "--" from "/." — one dash for "/", one for ".", not collapsed)
+ *
+ *   cwd  /Volumes/SSDExternalMacStudio/Code/_agentproto-worktrees/adapter-claude-sdk
+ *   →    -Volumes-SSDExternalMacStudio-Code--agentproto-worktrees-adapter-claude-sdk
+ *   (same double-dash shape, this time from "/_")
+ */
+declare function claudeProjectSlug(cwd: string): string;
+
 /**
  * Read-only probe: does a credential actually RESOLVE for an adapter slug's
  * billing auth? Used by `adapter_list` to report an HONEST status instead of
@@ -3194,6 +4132,11 @@ interface CreateGatewayOptions {
      *  `GET /adapters` HTTP route + `adapter_list` MCP tool so UIs
      *  can discover what's installed on the host. */
     listAgentAdapters?: AgentAdapterLister;
+    /** Optional catalog lister — when provided, enables
+     *  `GET /catalog/models` HTTP route + `catalog_models` MCP tool
+     *  (SPEC §5) so UIs can discover every runnable model + route without
+     *  trial-and-error against a spawn. */
+    listCatalogModels?: CatalogModelsLister;
     /** Optional browser adapter resolver — when provided, enables the
      *  `start_browser` MCP tool (launches Camofox / Bureau / Chromium). */
     resolveBrowserAdapter?: BrowserAdapterResolver;
@@ -3334,4 +4277,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { AdapterAuthDescriptor, type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CommitSpec, type CompletionPolicySupervisor, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type GateSpec, type GatewayHandle, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type McpCredentialDeps, type MigrationMarker, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, PAIRINGS_VERSION, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, ResolvedAuthSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listPresets, loadWorktreeIsolation, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeWorktreeField, parseWorktreeIsolationMode, policyWatchesSession, projectSessionUsage, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, resolveBucketSlug, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };
+export { AdapterAuthDescriptor, type AdapterListEntry, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AttachPolicyInput, type AuthMethod, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, type CanonicalPosture, type CatalogAdapterInput, type CatalogAdapterModelInput, type CatalogModelsLister, type CatalogModelsQuery, type CatalogModelsResponse, type CatalogPricing, type CatalogProduct, type CatalogRoute, type CatalogVendor, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, type ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DeclaredAdapterMode, DeclaredAdapterOption, type DeclaredAdapterPreset, type EffortLevel, type GateSpec, type GatewayHandle, type HermesNativeRef, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LocatedConversation, type LocatedConversationByPath, type McpCredentialDeps, type MigrationMarker, type OnFailSpec, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, type Posture, type PostureResolution, type PresetInfo, type PricingResolver, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, type ResolveNativeLinkInput, ResolvedAuthSpec, type RouteSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, type SessionConfig, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type TokenPricing, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageComputeInput, type UsageSource, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, appendConversationRecord, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, canonicalForModeId, claudeProjectSlug, composeMode, composeSessionObservers, conversationIndexPath, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, deriveSessionUsage, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeModeId, normalizeWorktreeField, parseWorktreeIsolationMode, policyWatchesSession, projectSessionUsage, readConversationIndex, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, resolveBucketSlug, resolveNativeLink, resolvePosture, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };