@agentproto/runtime 2.0.0 → 2.1.0

package/dist/index.d.ts

@@ -6,7 +6,7 @@ import { AcpMcpServer, AcpPermissionResolution } from '@agentproto/acp';
 import { SessionMode } from '@agentproto/acp/client';
 export { SessionMode } from '@agentproto/acp/client';
 import { ChildProcess } from 'node:child_process';
-import { S as SessionConfig, P as Posture, C as ContextProfile, R as RouteSpec, E as EffortLevel, A as AuthMethod, a as CanonicalPosture } from './session-config-DIf6wYYP.js';
+import { R as RouteSpec, S as SessionConfig, P as Posture, C as ContextProfile, E as EffortLevel, A as AuthMethod, a as CanonicalPosture } from './session-config-DIf6wYYP.js';
 export { D as DeclaredAdapterMode, c as composeMode, d as decomposeMode } from './session-config-DIf6wYYP.js';
 import { CostBudget, AuthProfile, CostBudgetScope } from '@agentproto/auth';
 export { CostBudget, CostBudgetScope } from '@agentproto/auth';
@@ -950,10 +950,15 @@ interface RunCommandInput {
     cwd: string;
     stdin?: string;
     timeoutMs: number;
+    /** Extra env for the spawned command — today only the daemon's own
+     *  session-identity vars (see {@link SESSION_ID_ENV}), merged on top of
+     *  `process.env`/`withSanePath`. Not caller-exposed by `command_execute`'s
+     *  tool schema, so there's no forgery surface here yet — merged plainly. */
+    env?: Record<string, string>;
 }
 
 /**
- * Completion-policy supervisor — WP1 + WP2 + WP3 + WP4 + WP5 + WP6 + WP7.
+ * Completion-policy supervisor — WP1 + WP2 + WP3 + WP4 + WP5 + WP6 + WP7 + WP-D.
  *
  * WP7 (judge-gate): a gate may be a judge AGENT instead of a shell command —
  * `gate: { judge: { adapter, model?, prompt, timeoutMs? } }`. When the trigger
@@ -969,6 +974,25 @@ interface RunCommandInput {
  * gate left in `gating` at crash is re-armed to `watching` like any active
  * policy and simply re-runs the judge — no in-flight judge is persisted.
  *
+ * WP-D (structured verdict): a judge may OPTIONALLY answer with a fenced JSON
+ * block (`{decision, summary?, findings?}`, `findings: [{severity, file?,
+ * note}]`) instead of (immediately before) the plain `VERDICT:` line —
+ * `parseJsonVerdict` is tried first, falling back to the WP7 text-line parser
+ * `parseVerdict` when no JSON block validates. Either way `decision` alone
+ * drives pass/fail; `findings`' severities are never thresholded by the
+ * engine (see `JudgeVerdict`'s doc in `session-event-bus.ts` for the
+ * argument). The result is persisted as `PolicyRunState.verdict`, overwritten
+ * — not merged — on every gate run, and echoed on `policy:passed` /
+ * `policy:failed`. Fail-safe is unchanged: an unparseable-by-either-path
+ * reply still FAILs and leaves `verdict` unset.
+ *
+ * WP-D also lets a judge gate pick its own billing identity —
+ * `JudgeGateSpec.judge.access`/`route`/`mode` passthrough to the judge spawn
+ * (see `runJudge`) — so a rate-limited/revoked default wallet doesn't have to
+ * fail every judge gate in the daemon. A ranked, automatic-fail-over WALLET
+ * LADDER across multiple profiles is explicitly OUT of scope here (see
+ * `runJudge`'s doc) — this is a single explicit pin, not fail-over.
+ *
  *
  * State machine per attached policy:
  *   watching → gating → acting → done
@@ -1079,6 +1103,32 @@ interface JudgeGateSpec {
         /** Max wall-clock for the judge turn before it is killed + FAIL.
          *  Default 120_000ms. */
         timeoutMs?: number;
+        /**
+         * Named billing credential to pin the judge spawn to (WP-D) — resolved
+         * via `resolveAccessProfileAuth` (the same profile → credential chain
+         * `agent_start`'s `access.profileRef` uses) and forwarded to the judge's
+         * `startSession({auth})`. Omitted ⇒ today's behaviour: the judge spawns
+         * on whatever the daemon's default/ambient wallet resolves to for
+         * `adapter`. This is a single EXPLICIT pin, not a ranked list with
+         * automatic fail-over across profiles — see `runJudge`'s doc for why a
+         * wallet LADDER is out of scope here. An unresolvable profile fails the
+         * gate (fail-safe FAIL), same as any other judge-spawn failure.
+         */
+        access?: {
+            profileRef?: string;
+        };
+        /** Decomposed route identity for the judge spawn (custom gateway /
+         *  preset id) — same shape and forwarding as `agent_start`'s `route`.
+         *  Only consulted together with `access.profileRef` (eligibility +
+         *  `resolveAuthSpec`'s `routeGateway`); a bare `route` with no profile is
+         *  NOT resolved (see `runJudge`'s doc) — the judge spawns on the
+         *  adapter's ambient default in that case, same as omitting `route`. */
+        route?: RouteSpec;
+        /** AIP-45 mode id forwarded to the judge's `startSession({mode})` (e.g.
+         *  claude-code's `plan`/`bypass-permissions`). Forwarded as-is — the
+         *  driver validates it against the adapter's manifest, same as any other
+         *  spawn. */
+        mode?: string;
     };
 }
 /**
@@ -1193,6 +1243,16 @@ interface PolicyRunState {
         exitCode: number;
         at: string;
     };
+    /**
+     * Structured judge-gate verdict (WP-D). Set when the gate is a judge gate
+     * (`JudgeGateSpec`) and the judge's reply parsed — either a structured JSON
+     * block or, lacking one, the plain `VERDICT: PASS|FAIL` text line (in which
+     * case only `decision` is populated). Absent for shell/cost gates, and for
+     * a judge gate whose reply was wholly unparseable (fail-safe FAIL — see
+     * `state.error` for why). Overwritten (not merged) on every gate run, so a
+     * nudge-and-retry round never carries a stale verdict forward.
+     */
+    verdict?: JudgeVerdict;
     /**
      * The exact commit prepared at the green gate (WP5). Set when entering
      * `awaiting-ack` (or just before a direct commit) so that an ack arriving
@@ -1600,6 +1660,37 @@ declare function createTaskLedger(opts: {
  */
 
 type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed";
+/**
+ * Fixed severity vocabulary for a judge-gate finding (WP-D). Deliberately
+ * small and fixed so `policy_status` output is comparable across different
+ * judge gates — but the engine never interprets it as a pass/fail threshold;
+ * see `JudgeVerdict`'s doc for why.
+ */
+type VerdictSeverity = "info" | "low" | "medium" | "high" | "critical";
+/** One finding inside a structured judge verdict — mirrors the shape a real
+ *  consumer (the agentik-studio push gate reviewer) already produces. */
+interface VerdictFinding {
+    severity: VerdictSeverity;
+    file?: string;
+    note: string;
+}
+/**
+ * Structured judge-gate verdict (WP-D), an optional richer alternative to the
+ * plain `VERDICT: PASS|FAIL` text line WP7 already parses. `decision` is the
+ * SAME single bit the text line always carried: the engine's pass/fail comes
+ * directly from `decision`, never computed from `findings`' severities.
+ * Severity thresholds are deliberately the CALLER's business — encoded in the
+ * judge's own prompt ("FAIL if any finding is high or above"), not baked into
+ * this engine, because "what severity blocks" is domain vocabulary that
+ * differs per gate (a security review and a style lint don't share a bar).
+ * `summary`/`findings` are informational only, persisted so an operator
+ * reading a FAILED gate learns WHY it failed, not just THAT it failed.
+ */
+interface JudgeVerdict {
+    decision: "PASS" | "FAIL";
+    summary?: string;
+    findings?: VerdictFinding[];
+}
 /**
  * Structured detail on why a session is awaiting input, when derivable.
  * `source: "structured"` — a driver-reported ACP-style prompt (e.g. a tool
@@ -1866,6 +1957,9 @@ interface PolicyPassedEvent {
     type: "policy:passed";
     policyId: string;
     sessionId: string;
+    /** The judge's structured verdict (WP-D), when the gate was a judge gate
+     *  and the judge emitted a parseable one. Absent for shell/cost gates. */
+    verdict?: JudgeVerdict;
     ts: string;
 }
 /** Emitted by the supervisor when a completion policy's gate fails. */
@@ -1874,6 +1968,10 @@ interface PolicyFailedEvent {
     policyId: string;
     sessionId: string;
     exitCode?: number;
+    /** The judge's structured verdict (WP-D), when the gate was a judge gate
+     *  and the judge emitted a parseable one. Absent for shell/cost gates, and
+     *  for a judge gate whose reply was unparseable (fail-safe FAIL). */
+    verdict?: JudgeVerdict;
     ts: string;
 }
 /**
@@ -3089,18 +3187,30 @@ declare const WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
 declare const DEFAULT_WORKTREE_ISOLATION: WorktreeIsolationMode;
 /**
  * The `agent_start.worktree` field. `true` isolates with an auto-minted slug;
- * an object additionally pins the slug and/or base ref; `false` (or omitted)
- * is "no explicit request" — the policy mode decides.
+ * an object additionally pins the slug and/or base ref, and can opt into
+ * async provisioning (`async: true` — see `WorktreeRequest.async`); `false`
+ * (or omitted) is "no explicit request" — the policy mode decides.
  */
 type WorktreeField = boolean | {
     slug?: string;
     base?: string;
+    async?: boolean;
 };
 /** The caller's explicit request, normalized — `undefined` when the field is
  *  absent or `false`, otherwise the (possibly empty) slug/base overrides. */
 interface WorktreeRequest {
     slug?: string;
     base?: string;
+    /** Opt-in: return a real, registered session as soon as it's minted,
+     *  provisioning the worktree in the BACKGROUND instead of blocking
+     *  `agent_start`'s response on `git worktree add` + the repo's setup
+     *  hooks (which can run minutes — see `session-spawn.ts`'s async-provision
+     *  branch). Deliberately opt-in, not the default: existing callers that
+     *  built on a synchronous ok/fail result (this package's own
+     *  `worktree_provision_failed` test coverage among them) keep exactly
+     *  today's behaviour unless they ask for the early return. Default
+     *  false. */
+    async?: boolean;
 }
 /** What the runtime hands the provisioner. `cwd` is where the session would
  *  otherwise spawn; the provisioner resolves the owning repo from it. */
@@ -3271,6 +3381,15 @@ declare function toWorktreeStatusView(entry: unknown): WorktreeStatusView;
  */
 /** `gc`'s three classes, mirrored runtime-local (matches `GcClass`). */
 type WorktreeGcClass = "reclaim" | "salvage" | "hold";
+/**
+ * `gc`'s one reclaim reason, mirrored runtime-local (matches `GcReclaimReason`).
+ * Set only on a `reclaim`-class entry/outcome that was promoted out of `hold`
+ * by the dep-bump exemption (`resolveGcClass` in `@agentproto/worktree`) —
+ * absent for an ordinary merged/fresh reclaim, so its presence alone is the
+ * "why does this line have unpushed commits and still leave" signal a human
+ * reading the plan/outcome table needs.
+ */
+type WorktreeGcReclaimReason = "dep-bump";
 /**
  * One entry of the dry-run plan — a runtime-local projection of a
  * `GcPlanEntry`. `tree` / `integration` / `liveness` are flattened to their
@@ -3282,6 +3401,8 @@ interface WorktreeGcPlanEntryView {
     branch: string | null;
     head: string;
     class: WorktreeGcClass;
+    /** Set only when `class === "reclaim"` via the dep-bump exemption. */
+    reclaimReason?: WorktreeGcReclaimReason;
     tree: string;
     integration: {
         state: string;
@@ -3303,6 +3424,8 @@ interface WorktreeGcOutcomeView {
     path: string;
     branch: string | null;
     result: "reclaimed" | "salvaged" | "held" | "skipped-dirty" | "aborted-reclassified" | "aborted-vanished" | "failed";
+    /** Set only for a `reclaimed` outcome via the dep-bump exemption. */
+    reclaimReason?: WorktreeGcReclaimReason;
     /** Set only for `salvaged`. */
     salvageDir?: string;
     /** Set only for `aborted-reclassified`. */
@@ -3434,6 +3557,15 @@ type AgentAdapterResolver = (slug: string) => Promise<{
          *  command-sandbox`'s `loadAdapterSpawnSandboxConfig`), or stays
          *  unconfined if that's unset too. */
         commandSandbox?: SandboxMode;
+        /** Extra env for the spawned adapter process — forwarded verbatim to the
+         *  driver's `runtime.start({ env })`, which the AIP-45 driver already
+         *  applies LAST (after manifest/mode/option env and billing-auth), so
+         *  these keys always win. `spawnAgentSession` (session-spawn.ts) uses
+         *  this to inject the daemon's own session-identity vars
+         *  (`SESSION_ID_ENV`/`WORKSPACE_SLUG_ENV`, see sessions.ts) — there is
+         *  no caller-facing `env` passthrough on `agent_start` today, so this is
+         *  daemon-authored only, not a general escape hatch. */
+        env?: Record<string, string>;
     }): Promise<AgentSessionLike>;
     /** Display label for the descriptor's `command` field. */
     commandPreview?: string;
@@ -3864,6 +3996,32 @@ interface AgentStreamEvent {
     tokensIn?: number;
     tokensOut?: number;
 }
+/**
+ * Env vars the registry injects into every process it spawns on a session's
+ * behalf (agent-cli adapters, PTY/terminal, and generic `spawn()` — see
+ * `spawn()`/`spawnPty()` below; `spawnAgent()` doesn't own the child process,
+ * so `session-spawn.ts` injects these itself before calling the adapter
+ * resolver's `startSession()`). Two vars, deliberately: `SESSION_ID_ENV` is
+ * the opaque identity a hook/script needs to report back or nest a child
+ * session under (`parentSessionId`); `WORKSPACE_SLUG_ENV` costs nothing to
+ * add (always resolved before spawn) and turns "which session" into "which
+ * session in which workspace" without a round-trip. `label`/`name` are
+ * deliberately NOT carried — they're optional, mutable (renameable) and
+ * absent on most sessions, so a hook could not depend on them; a caller that
+ * needs one can look it up via `SESSION_ID_ENV` + `session_list`.
+ *
+ * THE RULE (identity forgery + inheritance, see spawn()/spawnPty()): these
+ * are assigned into the child's env LAST — after both `process.env` and any
+ * caller-supplied `input.env` have been merged — so a caller can never
+ * override or forge them, and a freshly minted id always wins over whatever
+ * (if anything) happened to be ambient. The daemon process itself is never a
+ * session, so `process.env` never carries a stale value to begin with; the
+ * assign-last rule is what makes that true by construction rather than by
+ * accident, and is what guarantees a child spawned from inside a session
+ * gets its OWN id rather than inheriting its parent's.
+ */
+declare const SESSION_ID_ENV = "AGENTPROTO_SESSION_ID";
+declare const WORKSPACE_SLUG_ENV = "AGENTPROTO_WORKSPACE_SLUG";
 type SessionKind = "terminal" | "agent-cli" | "command" | "browser";
 type SessionStatus = "starting" | "running" | "exited" | "killed" | "error";
 /**
@@ -4685,6 +4843,42 @@ interface SessionsRegistry {
      *  descriptor. The agent stays alive — call `sendPrompt(id, ...)`
      *  for follow-up turns until `kill(id)` closes it. */
     spawnAgent(input: SpawnAgentInput): SessionDescriptor;
+    /** Register a STARTING placeholder for an agent-cli spawn whose worktree
+     *  provisioning (or other pre-flight work) hasn't finished yet — the
+     *  async-worktree-provisioning half of WP-F. Every field `spawnAgent`
+     *  would otherwise consume up front is known already (model/label/
+     *  parentage/etc. never depend on the tree existing); only the
+     *  agentSession-derived fields (pid, adapterSessionId, commandPreview,
+     *  resumable) are missing, because the driver hasn't started yet. `cwd`
+     *  is the caller's BEST KNOWN cwd at this point — the pre-worktree repo
+     *  path when the final worktree path isn't minted yet — and gets
+     *  overwritten by `settlePendingAgent`'s real `cwd` once known. Returns a
+     *  stable id + `status: "starting"` immediately; no initial prompt is
+     *  dispatched here (see `settlePendingAgent`'s `initialPrompt` — a
+     *  prompt must never be sent into a tree that isn't built yet). */
+    spawnAgentPending(input: SpawnAgentPendingInput): SessionDescriptor;
+    /** Resolve a placeholder created by `spawnAgentPending`, once the deferred
+     *  work (worktree provisioning + the driver's `startSession`) finishes.
+     *
+     *  `ok: true` binds the now-live `agentSession`, refreshes `cwd`/
+     *  `worktreePath`/`worktreeId` from the FINAL cwd, flips `status` to
+     *  `"running"`, and — only now, with the tree and the driver session both
+     *  real — fires the deferred `initialPrompt` (fire-and-forget, same as
+     *  `spawnAgent`'s own initial-prompt dispatch).
+     *
+     *  `ok: false` flips `status` to `"error"` and stamps `lastError` with the
+     *  (readable) failure reason, so a spawn that can never run ends VISIBLY
+     *  instead of sitting in `"starting"` forever — mirrors `markCrashed`'s
+     *  terminal-failure shape. Emits `session:exited` either way nothing sits
+     *  silently; a webhook/policy gate watching this id learns the outcome
+     *  without polling.
+     *
+     *  Race guard: a no-op (and, on `ok: true`, a best-effort teardown of the
+     *  just-started `agentSession` — never leak a live, unsupervised process)
+     *  when the placeholder is no longer `"starting"` — e.g. an operator
+     *  killed it mid-provision. A terminal descriptor is never resurrected.
+     *  Also a no-op for an unknown id (the row was removed entirely). */
+    settlePendingAgent(id: string, outcome: PendingAgentOutcome): void;
     /** Spawn a process under a real PTY (node-pty). Bytes flow through
      *  the registry's byte ring buffer + emitter; attach with
      *  `attachPty(id, ...)`. Throws when the registry was constructed
@@ -5293,6 +5487,34 @@ interface SpawnAgentInput {
      *  onto `SessionDescriptor.keepAlive`. Default false. */
     keepAlive?: boolean;
 }
+/** `SpawnAgentInput` minus the fields that only exist once the driver's
+ *  `startSession` has actually run — see `spawnAgentPending`'s doc for why
+ *  everything else is safe to record up front. */
+type SpawnAgentPendingInput = Omit<SpawnAgentInput, "agentSession" | "commandPreview" | "resumable" | "nativeTerminalResume" | "initialPrompt">;
+/** The deferred outcome `settlePendingAgent` resolves a placeholder with —
+ *  see that method's doc. */
+type PendingAgentOutcome = {
+    ok: true;
+    agentSession: AgentSessionLike;
+    /** The real cwd (the provisioned worktree, or unchanged when nothing
+     *  needed isolating) — replaces the placeholder's best-known cwd. */
+    cwd: string;
+    commandPreview?: string;
+    resumable?: boolean;
+    nativeTerminalResume?: boolean;
+    readUsage?: () => Promise<{
+        costUsd?: number;
+        tokensIn?: number;
+        tokensOut?: number;
+    } | null>;
+    /** Dispatched now that the tree + driver session both exist — never
+     *  passed to `spawnAgentPending`, which would race the tree. */
+    initialPrompt?: string;
+} | {
+    ok: false;
+    /** Short, readable — stamped verbatim onto `SessionDescriptor.lastError`. */
+    message: string;
+};
 interface SpawnSessionInput {
     kind: SessionKind;
     workspaceSlug: string;
@@ -5349,6 +5571,13 @@ interface SpawnPtyInput {
     resumeVia?: string;
 }
 interface RecordCommandInput {
+    /** Pre-minted id (`mintSessionId()`), when the caller minted one BEFORE
+     *  running the command so it could inject {@link SESSION_ID_ENV} into the
+     *  child's own env — see `command-tools.ts`'s `command_execute` and
+     *  `cron-scheduler.ts`'s command-action executor. Omitted ⇒ minted here,
+     *  same as before this field existed (a command run some other way, with
+     *  no env to inject into, e.g. tests). */
+    id?: string;
     workspaceSlug: string;
     /** Working directory the command actually ran in (post cwd-anchoring).
      *  Matched against a fresh session's cwd by `findPriorCommandSessionId`. */
@@ -5793,11 +6022,17 @@ declare function registerBuiltinRoutes(): Promise<void>;
  *
  * Backed straight by the static catalog's `getModelsByProvider`
  * (`@agentproto/model-catalog`, `registry/index.ts`) — a pure query over the
- * kind-organized catalogs, so NO adapters, NO profiles, NO host wiring. The
- * generated OpenRouter route table is folded into the LLM result upstream
- * (`OPENROUTER_ROUTES` is spread into `LLM_PRICING_CATALOG`, `llm/catalog.ts`),
- * so an `openrouter` query returns the full, large list — the picker
- * paginates client-side. NEVER log the rows: OpenRouter alone is thousands.
+ * kind-organized catalogs, so NO adapters, NO profiles, NO host wiring.
+ * `getModelsByProvider` is itself router-aware: OpenRouter's route table is
+ * spread into `LLM_PRICING_CATALOG` upstream (`llm/catalog.ts`), so an
+ * `openrouter` query returns that full, large list with bare ids; Requesty
+ * and HuggingFace are NOT spread into that catalog — spreading a second
+ * router's bare-id pricing there would repoint direct-vendor ids at router
+ * pricing (`route-identity/index.ts`) — so `getModelsByProvider` instead
+ * folds their generated route tables in directly, emitting `vendor/
+ * product@route` ids. All three routers enumerate through the same path;
+ * the picker paginates client-side. NEVER log the rows: OpenRouter alone is
+ * thousands.
  */
 
 interface CatalogProviderModelsQuery {
@@ -7494,4 +7729,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type GateSpec, type GatewayHandle, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LocatedConversation, type LocatedConversationByPath, type McpCredentialDeps, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, type PrResolvedState, type PrStateResolver, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, type RemainingQuota, type RemainingQuotaReader, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, SessionConfig, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readUsageSnapshots, reapOrphanedDescendants, recordProfileQuota, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, resolveBucketSlug, resolveNativeLink, resolvePosture, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, verifyInboundSignature, workflowToActivities, writeDaemonRegistryEntry };
+export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type GateSpec, type GatewayHandle, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LocatedConversation, type LocatedConversationByPath, type McpCredentialDeps, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, type PrResolvedState, type PrStateResolver, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, type RemainingQuota, type RemainingQuotaReader, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, SessionConfig, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readUsageSnapshots, reapOrphanedDescendants, recordProfileQuota, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, resolveBucketSlug, resolveNativeLink, resolvePosture, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, verifyInboundSignature, workflowToActivities, writeDaemonRegistryEntry };