@agentproto/runtime 2.5.0 → 2.6.0

package/dist/index.d.ts

@@ -13,13 +13,15 @@ export { CostBudget, CostBudgetScope } from '@agentproto/auth';
 import { R as ResolvedContextContinuityPolicy } from './context-continuity-B9n0t0v-.js';
 import { SandboxMode } from '@agentproto/command-sandbox';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, HarnessCapabilities, AdapterEntry } from '@agentproto/provider-kit';
-import { R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-7uHRnYH1.js';
-export { a as AuthEcho, b as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, c as CredentialSource, d as DefaultsAdapterAuthConfig, e as DefaultsAdapterConfig, f as ResolveSubscriptionCredentialInput, g as ResolvedSpawnAuthMaterial, h as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, i as SubscriptionCredentialResolution, j as SubscriptionSourceError, k as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, l as resolveSpawnDefaults, m as resolveSubscriptionCredential } from './spawn-defaults-7uHRnYH1.js';
+import { R as ResolvedAuthSpec, D as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-CYJoeHeO.js';
+export { a as AuthEcho, b as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, c as CredentialSource, d as DefaultsAdapterAuthConfig, e as DefaultsAdapterConfig, f as ResolveSubscriptionCredentialInput, g as ResolvedSpawnAuthMaterial, h as ResolvedSpawnDefaults, S as SpawnDefaultsConfig, i as SubscriptionCredentialResolution, j as SubscriptionSourceError, k as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, l as resolveSpawnDefaults, m as resolveSubscriptionCredential } from './spawn-defaults-CYJoeHeO.js';
 import { CatalogModelsQuery, CatalogModelsResponse } from './catalog-models.js';
 export { CatalogAdapterInput, CatalogAdapterModelInput, CatalogPricing, CatalogProduct, CatalogRoute, CatalogRouteSummary, CatalogVendor, buildCatalogModels } from './catalog-models.js';
 import { FooterSession } from './pr-provenance.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SandboxProvider } from '@agentproto/sandbox';
+import { BrainManager, ExportedSessionLike } from '@agentproto/workspace-brain';
+export { BrainManager, BrainStats, IngestReport, IngestResult } from '@agentproto/workspace-brain';
 export { UserPreset, UserPresetsFile, deleteUserPreset, getUserPreset, listUserPresets, loadUserPresets, saveUserPreset, userPresetsPath } from './user-presets.js';
 import { ResolvedModel } from '@agentproto/model-catalog';
 import { FrameSink, E2eFrameSink } from '@agentproto/acp/tunnel';
@@ -1659,7 +1661,7 @@ declare function createTaskLedger(opts: {
  * and session_monitor MCP tool (long-poll multiplexed).
  */
 
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed";
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed";
 /**
  * Fixed severity vocabulary for a judge-gate finding (WP-D). Deliberately
  * small and fixed so `policy_status` output is comparable across different
@@ -1847,6 +1849,93 @@ interface SessionStallClearedEvent {
     label?: string;
     ts: string;
 }
+/**
+ * Emitted by the wait long-poll helper (`monitorSessionWait`) the moment a
+ * blocking wait actually SUBSCRIBES to this session — a `/sessions/:id/wait`
+ * long-poll or a `session_monitor` call that has to park. This is the bus
+ * twin of the ephemeral `watchers` descriptor counter (`incWatchers`,
+ * #session-visibility): where the counter lets `session_list` surface "N
+ * supervisors are blocked on this session", the event lets a LIVE consumer
+ * (the transcript panel inside the WATCHED session) react the instant a
+ * watcher appears rather than on its next descriptor poll. Detection +
+ * signal ONLY — nothing here changes the wait's own semantics. `watchers`
+ * is the counter AFTER the attach (read back from the registry, so a
+ * concurrent waiter is already reflected). `watcherSessionId` names the
+ * supervising session when the wait was initiated by one (the scoped
+ * orchestrator's `callerScope.ownerSessionId`); absent for an anonymous
+ * CLI/HTTP waiter. Same bus distribution as every other lifecycle event
+ * (`session_events_poll`, the webhook notifier, the routine engine,
+ * `session_monitor`). Paired with `session:watcher-detached` when the wait
+ * resolves or times out.
+ */
+interface SessionWatcherAttachedEvent {
+    type: "session:watcher-attached";
+    sessionId: string;
+    watchers: number;
+    watcherSessionId?: string;
+    label?: string;
+    ts: string;
+}
+/**
+ * Emitted when a blocking wait on this session releases its watcher — the
+ * wait resolved (a matching lifecycle event landed) or timed out; see
+ * {@link SessionWatcherAttachedEvent}. `watchers` is the counter AFTER the
+ * detach, so a consumer can tell "the last watcher left" (`0`) from "one of
+ * several left". Detection + signal only — a zero count does NOT imply the
+ * session is unsupervised in every sense (a completion policy watches via
+ * its own mechanism, not this counter); it only means no `monitorSessionWait`
+ * long-poll is currently parked on it. Same bus distribution as every other
+ * lifecycle event.
+ */
+interface SessionWatcherDetachedEvent {
+    type: "session:watcher-detached";
+    sessionId: string;
+    watchers: number;
+    watcherSessionId?: string;
+    label?: string;
+    ts: string;
+}
+/**
+ * Emitted at turn-end when the turn that just finished started one or more
+ * BACKGROUND tool calls (a tool-call whose `arguments` object carries
+ * `run_in_background: true` — how Claude Code's Bash announces a
+ * `run_in_background` task; matched generically on the property, not the
+ * tool name) AND the session is NOT `awaitingInput`. The target failure
+ * mode is the turn-END twin of `session:stalled`: the harness's own
+ * task-completion notification does NOT trigger a new turn, so the session
+ * sits `busy:false`, `awaitingInput:false`, background tasks pending — a
+ * silent dead end that looks exactly like a session idle and waiting to be
+ * re-prompted. Detection + signal ONLY: nothing here re-prompts or wakes
+ * the session (no auto-wake — a wake-up path would have to decide what to
+ * say, and that policy belongs to the supervisor, not the daemon). `count`
+ * is how many background tool starts the turn observed. Same bus
+ * distribution as every other lifecycle event (`session_events_poll`, the
+ * webhook notifier, the routine engine, `session_monitor`). Paired with
+ * `session:bg-tasks-cleared` when the flag is later cleared.
+ */
+interface SessionBgTasksParkedEvent {
+    type: "session:bg-tasks-parked";
+    sessionId: string;
+    count: number;
+    label?: string;
+    ts: string;
+}
+/**
+ * Emitted when a session's `pendingBgTasks` flag (see {@link
+ * SessionBgTasksParkedEvent}) is cleared — by the next turn starting (the
+ * session was re-prompted, so it is no longer parked: its new turn will see
+ * whatever the background tasks produced) or by the session exiting (a dead
+ * row carries no live flag). Does NOT imply the background tasks finished
+ * or their output was consumed — only that the "ended its turn with
+ * background work pending and no wake-up path" condition no longer holds.
+ * Same bus distribution as every other lifecycle event.
+ */
+interface SessionBgTasksClearedEvent {
+    type: "session:bg-tasks-cleared";
+    sessionId: string;
+    label?: string;
+    ts: string;
+}
 /**
  * Emitted when a dead agent-cli row is brought back IN PLACE — same session
  * id, same descriptor — by the lazy resume-on-prompt path (`maybeResumeAgent`)
@@ -2097,7 +2186,7 @@ interface TaskChangedEvent {
     sessionId?: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent;
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -3748,7 +3837,7 @@ type AdapterCapabilitiesLister = (opts?: {
 interface AdapterInstallResult {
     slug: string;
     ok: boolean;
-    method: "npm-global" | "agentproto-install" | "already-installed" | "unsupported";
+    method: "npm-global" | "shell-hint" | "agentproto-install" | "already-installed" | "unsupported";
     /** Human-readable one-liner: what ran, and how it ended. */
     message: string;
     /** The shell command that was run, for surfacing in logs / errors.
@@ -4022,6 +4111,8 @@ interface AgentStreamEvent {
      *  @agentproto/acp's `StreamEvent`'s `agent-prompt` kind. Harness-shaped
      *  and untyped; don't assume a stable schema across adapters. */
     rawInput?: unknown;
+    /** "plan" event title — see @agentproto/acp's `StreamEvent`'s `plan` kind. */
+    title?: string;
     /** "plan" event entries — see @agentproto/acp's `StreamEvent`'s `plan` kind. */
     entries?: Array<{
         content: string;
@@ -4089,6 +4180,7 @@ declare const SESSION_ID_ENV = "AGENTPROTO_SESSION_ID";
 declare const WORKSPACE_SLUG_ENV = "AGENTPROTO_WORKSPACE_SLUG";
 type SessionKind = "terminal" | "agent-cli" | "command" | "browser";
 type SessionStatus = "starting" | "running" | "exited" | "killed" | "error";
+type SessionCurrentPhase = "thinking" | `tool-call:${string}` | "awaiting-input" | "awaiting-permission" | "idle" | "completed" | "killed";
 /**
  * The billing-auth resolver's OBSERVABLE echo, recorded on a session
  * descriptor. `mode` + `fingerprint` are always present when recorded (a
@@ -4184,6 +4276,18 @@ interface SessionDescriptor {
      *  `lastOutputAt` goes stale. Updated on incoming session/update
      *  notifications AND on outbound RPC calls. ISO 8601. */
     lastActivityAt?: string;
+    /** Read-time projection of what the session is doing now. Tool-call phases
+     *  carry the adapter-reported tool name (for example
+     *  `tool-call:file_read`). Ephemeral: recomputed by list()/get() and never
+     *  persisted. */
+    currentPhase?: SessionCurrentPhase;
+    /** Whole seconds since `lastActivityAt`, computed at read time. Absent until
+     *  the adapter has reported activity; never persisted. */
+    secondsSinceLastActivity?: number;
+    /** Number of distinct tool calls observed in the current (or most recently
+     *  completed) turn. Reset when the next turn starts. Tool-call enrichment
+     *  events sharing an id count only once. Ephemeral and never persisted. */
+    toolCallsThisTurn?: number;
     /** Whether the underlying OS process is still alive. Computed via
      *  `process.kill(pid, 0)` at read time (list()/get()) — cheap,
      *  zero-overhead, standard POSIX check. Absent when `pid` is null
@@ -4234,6 +4338,20 @@ interface SessionDescriptor {
      *  stalled. Detection + signal only — nothing here kills or restarts the
      *  session. */
     stalledSinceMs?: number;
+    /** Counted background tool starts in the last turn; the session ended its
+     *  turn without a wake-up path — likely parked. Stamped at turn-end when
+     *  the turn observed one or more tool-calls whose `arguments` object
+     *  carries `run_in_background: true` (how Claude Code's Bash announces a
+     *  background task — matched generically on the property, not the tool
+     *  name) AND the session is not `awaitingInput`. The harness's own
+     *  task-completion notification does NOT trigger a new turn, so the
+     *  session sits `busy:false`, `awaitingInput:false`, background tasks
+     *  pending — a silent dead end. Detection + signal ONLY (same doctrine
+     *  as `stalledSinceMs`): nothing here re-prompts or wakes the session.
+     *  Cleared (deleted, never a stale value) on the next turn start and on
+     *  session exit. Emits `session:bg-tasks-parked` /
+     *  `session:bg-tasks-cleared`. */
+    pendingBgTasks?: number;
     /** DERIVED, read-time only (never persisted — stripped by `snapshotRows`,
      *  stamped by `stampInterrupted` in list()/get()/findByIdOrName). True when
      *  this session died with a turn in flight under a daemon restart —
@@ -4431,6 +4549,23 @@ interface SessionDescriptor {
      *  `adapterSlug`, recorded under the canonical axis name. Falls back to
      *  `adapterSlug` when not explicitly set. Undefined for pty/command kinds. */
     harness?: string;
+    /**
+     * How this adapter's spawn ROUTE relates to the chosen model (AIP-45
+     * launch-menu drill-down). `"derived-from-model"` means the endpoint falls
+     * out of the model id's own vendor prefix; `"free"`/omitted means the route
+     * is an independent choice. Recorded at spawn time so a live `setModel` can
+     * apply the same wire normalization the spawn path used.
+     */
+    routeSelection?: "free" | "derived-from-model";
+    /**
+     * The adapter manifest's provider (`authDescriptor.provider`) — e.g.
+     * `"anthropic"` for claude-code, `"openai"` for codex. Recorded at spawn
+     * time so a live `setModel` knows when it can safely bare a
+     * `vendor/product` direct ref; ignored for derived-from-model adapters.
+     * Distinct from `auth.provider`, which is the resolved billing wallet and
+     * may name a gateway route.
+     */
+    adapterProvider?: string;
     /**
      * AIP-45 mode the session was spawned with (`AgentCliStartOptions.config.
      * mode` — e.g. claude-code's `plan`/`accept-edits`, a gateway preset mode
@@ -4742,6 +4877,9 @@ interface SessionSummary {
     killedMidTurn?: boolean;
     lastOutputAt?: string;
     lastActivityAt?: string;
+    currentPhase?: SessionCurrentPhase;
+    secondsSinceLastActivity?: number;
+    toolCallsThisTurn?: number;
     processAlive?: boolean;
     /** Live supervisor waiter count (#session-visibility) — see
      *  `SessionDescriptor.watchers`. Ephemeral, stamped at read time. */
@@ -4777,6 +4915,10 @@ interface SessionSummary {
     busy?: boolean;
     blockedOn?: "subagent" | "command";
     stalledSinceMs?: number;
+    /** Parked-with-background-tasks marker — see
+     *  `SessionDescriptor.pendingBgTasks`. Stamped at turn-end, cleared on the
+     *  next turn start / exit. */
+    pendingBgTasks?: number;
     origin?: string;
     parentSessionId?: string;
     depth?: number;
@@ -5524,6 +5666,14 @@ interface SpawnAgentInput {
     nativeTerminalResume?: boolean;
     /** Canonical harness slug — recorded on the descriptor; defaults to adapterSlug. */
     harness?: string;
+    /** Manifest-declared `routeSelection` (AIP-45) — recorded verbatim onto
+     *  {@link SessionDescriptor.routeSelection} so live `setModel` can apply
+     *  the same wire normalization as spawn. */
+    routeSelection?: "free" | "derived-from-model";
+    /** Manifest-declared provider (`authDescriptor.provider`) — recorded onto
+     *  {@link SessionDescriptor.adapterProvider} so live `setModel` knows when
+     *  to bare a direct `vendor/product` ref; ignored for derived adapters. */
+    adapterProvider?: string;
     /** Optional initial prompt to dispatch immediately. The promise
      *  the registry returns resolves AFTER the spawn — the prompt
      *  runs in the background, projecting events into the ring
@@ -6120,6 +6270,212 @@ interface InboundWatcher {
     shutdown(): void;
 }
 
+/**
+ * Runtime-side glue for the per-workspace brain: a shared registry of
+ * {@link BrainManager}s (one per workspace bucket) plus the two bridges that
+ * connect the pure `@agentproto/workspace-brain` engine to this daemon's real
+ * conversation stores:
+ *
+ *   - `readSessionForBrain` — a session id → exported transcript, via the same
+ *     ladder as `conversation-read.ts`: the provider-native store first
+ *     (`CONVERSATION_STORES`), then the universal `events.jsonl` capture
+ *     (`exportDaemonEventsSession`). `null` when neither has anything.
+ *   - `resolveWorkspace` — a session id → the workspace bucket it was recorded
+ *     under (via the persisted `conversations.jsonl` index).
+ *
+ * The registry itself is keyed by bucket slug and creates each `BrainManager`
+ * lazily, so a workspace that never produces a session pays nothing until its
+ * first exit does.
+ *
+ * A workspace's knowledge backends are configured per-workspace by a
+ * `knowledge.json` file at `<bucket>/knowledge.json` (see
+ * {@link loadKnowledgeConfigForWorkspace}). No file → the brain's default
+ * single `files` provider (identical to pre-config behavior); an invalid
+ * file → warn + fall back to that default; never throws either way.
+ */
+
+/** The shared registry handed to both the subscriber and the MCP tools. */
+interface WorkspaceBrains {
+    /** Get (creating lazily) the brain manager for a workspace bucket slug. */
+    getBrain(workspace: string): BrainManager;
+    /** Map a session id to the workspace bucket it was recorded under. */
+    resolveWorkspace(sessionId: string): Promise<string | undefined>;
+    /** Resolve an explicit workspace slug (or caller slug) to a safe bucket
+     *  slug — "default" when unregistered/absent (membership rule). */
+    resolveWorkspaceSlug(workspace?: string, callerSlug?: string): string;
+}
+/** Resolve a session id to its exported transcript, native first then daemon
+ *  events — `null` (never throws) when neither store has anything readable. */
+declare function readSessionForBrain(sessionId: string): Promise<ExportedSessionLike | null>;
+declare function createWorkspaceBrains(): WorkspaceBrains;
+
+/**
+ * MCP tools that expose the per-workspace brain to agents.
+ *
+ * Three tools over the shared {@link WorkspaceBrains} registry:
+ *
+ *   - `workspace_brain_query`  — BM25 recall over a workspace's ingested
+ *                                conversations (dispatch to the provider).
+ *   - `workspace_brain_status` — how many sessions a workspace has ingested.
+ *   - `workspace_brain_ingest` — manually trigger ingestion (a session, or
+ *                                every known-but-uningested session).
+ *
+ * Every tool resolves its target workspace the same way: an explicit
+ * `workspace` argument wins; otherwise the calling session's own workspace is
+ * used (from its descriptor's `workspaceSlug`). Resolution applies the bucket
+ * membership rule, so an unregistered slug degrades to `default` rather than
+ * pointing a brain at an arbitrary path.
+ */
+
+interface RegisterBrainToolsOptions {
+    /** The shared per-workspace brain registry. */
+    brains: WorkspaceBrains;
+    /** Registry used to resolve the calling session's own workspace. */
+    registry: SessionsRegistry;
+    /** The calling agent session id (from `?callerSessionId=` on `/mcp`). */
+    callerSessionId?: string;
+}
+declare function registerBrainTools(server: McpServer, opts: RegisterBrainToolsOptions): void;
+
+/**
+ * Workshop-brain subscriber — auto-ingest a workspace's conversations when its
+ * sessions exit.
+ *
+ * Subscribes to `session:exited` on the {@link SessionEventBus} and, after a
+ * short debounce, fire-and-forgets an ingestion of each freshly-exited session
+ * into its workspace's brain. The debounce batches a flurry of exits (e.g. an
+ * orchestrator tearing down N children at once) into one pass instead of N
+ * index rebuilds.
+ *
+ * Mirrors `webhook-notifier.ts`'s containment discipline: the handler never
+ * throws into the bus's hot path — every error is swallowed and logged, so a
+ * brain hiccup can never take down an exit event.
+ */
+
+interface WorkspaceBrainSubscriberOptions {
+    readonly bus: SessionEventBus;
+    /** The shared brain registry. */
+    readonly brains: WorkspaceBrains;
+    /** Debounce window for batching consecutive exits. Default 5000ms. */
+    debounceMs?: number;
+}
+interface WorkspaceBrainSubscriber {
+    /** Wire the handler onto the bus (idempotent). */
+    start(): void;
+    /** Unsubscribe (idempotent). */
+    stop(): void;
+    /** Flush any pending (not-yet-debounced) exits now. */
+    flush(): void;
+}
+declare function createWorkspaceBrainSubscriber(opts: WorkspaceBrainSubscriberOptions): WorkspaceBrainSubscriber;
+
+/**
+ * `~/.agentproto/harness-presets.json` — the persisted harness→profile binding
+ * (mode 0600). A {@link HarnessPreset} names, per adapter harness, WHICH auth
+ * profile and default model a fresh spawn should bill through, so the operator
+ * no longer re-picks the profile every time (today that link lives only
+ * ephemerally per-session `setSessionAccessProfile` or per-spawn in the
+ * Configuration Lab picker).
+ *
+ * This is a POINTER store, like `auth-profiles.json` and
+ * `llm-endpoint-links.json`, not a secret store: an entry holds a `profileRef`
+ * (an {@link AuthProfile} id) and a `defaultModel` string, never a credential —
+ * so it needs no encryption. It reuses the exact persistence primitives the
+ * sibling stores established (a versioned JSON file under `~/.agentproto/`,
+ * `node:fs/promises`, mode 0600, whole-file write) — see
+ * `user-presets.ts` / `profile-store.ts` / `llm-endpoint-links-store.ts`.
+ *
+ * Invariants enforced on write (validated once, at this boundary, for every
+ * CLI/MCP/editor caller):
+ *   • at most one `isDefault: true` per `harnessSlug` — the spawn path reads
+ *     exactly one default per harness (see `getDefaultHarnessPreset`);
+ *   • `profileRef` must reference an EXISTING, ENABLED auth profile — a dangling
+ *     or disabled profile can never become the silent default a spawn bills;
+ *   • `defaultModel` must be serviceable by that profile's curation allowlist
+ *     (a `mode: "allow"` profile only bills the models it lists).
+ * The profile lookup is injected ({@link HarnessPresetValidationDeps}) so the
+ * store is testable without touching the real auth-profile store; it defaults
+ * to `@agentproto/auth`'s `getAuthProfile`.
+ */
+
+/**
+ * A persisted harness→profile binding: for one adapter harness, which auth
+ * profile + default model a fresh spawn bills through when the caller pins
+ * neither explicitly.
+ */
+interface HarnessPreset {
+    /** Stable, machine-local id — unique across all presets (e.g. `hm-cheap`). */
+    id: string;
+    /** Adapter harness slug this preset binds (e.g. `hermes`). Matched against a
+     *  spawn's `harness ?? adapter`. */
+    harnessSlug: string;
+    /** Human-readable display name (e.g. `Cheap`). */
+    name: string;
+    /** The {@link AuthProfile} id this preset bills through — must exist and be
+     *  enabled at write time. */
+    profileRef: string;
+    /** Model id applied at spawn when the caller named none (e.g. `z-ai/glm-5.2`). */
+    defaultModel: string;
+    /** Whether this is THE default preset for its `harnessSlug`. At most one per
+     *  harness — enforced on write. */
+    isDefault: boolean;
+}
+declare const harnessPresetsFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    presets: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        harnessSlug: z.ZodString;
+        name: z.ZodString;
+        profileRef: z.ZodString;
+        defaultModel: z.ZodString;
+        isDefault: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type HarnessPresetsFile = z.infer<typeof harnessPresetsFileSchema>;
+/** Thrown when a create/update violates a store invariant (unknown/disabled
+ *  profile, a model the profile can't service, …). A validation failure, not
+ *  an I/O failure — callers surface it as a rejected request, not a crash. */
+declare class HarnessPresetValidationError extends Error {
+    constructor(message: string);
+}
+/** Injected profile lookup — lets the store validate `profileRef` without a
+ *  hard dependency on the real auth-profile file (tests stub it). */
+interface HarnessPresetValidationDeps {
+    getProfile: (id: string) => Promise<AuthProfile | undefined>;
+}
+declare function harnessPresetsPath(): string;
+/** Missing or malformed config is treated as empty — a bad preset file must
+ *  never prevent the daemon from spawning. Writes always restore valid JSON. */
+declare function loadHarnessPresets(): Promise<HarnessPresetsFile>;
+/** List all presets, optionally filtered to one harness slug. */
+declare function listHarnessPresets(harnessSlug?: string): Promise<HarnessPreset[]>;
+/** Look up a single preset by id, or undefined if none exists. */
+declare function getHarnessPreset(id: string): Promise<HarnessPreset | undefined>;
+/** The default preset for `harnessSlug`, or undefined when none is marked. The
+ *  spawn path reads this to fill an unpinned `access.profileRef` + model. */
+declare function getDefaultHarnessPreset(harnessSlug: string): Promise<HarnessPreset | undefined>;
+/**
+ * Add or replace a preset by id. Validates the profile binding, then upserts.
+ * When the incoming preset is `isDefault`, every OTHER preset for the same
+ * `harnessSlug` is demoted first, preserving the one-default-per-harness
+ * invariant even across a replace that flips an id's harness or default flag.
+ */
+declare function addHarnessPreset(preset: HarnessPreset, deps?: HarnessPresetValidationDeps): Promise<HarnessPreset>;
+/** Partial update of an existing preset. Re-validates the resulting profile
+ *  binding and re-applies the one-default invariant. Returns the updated
+ *  preset, or undefined when `id` doesn't exist. */
+declare function updateHarnessPreset(id: string, patch: Partial<Omit<HarnessPreset, "id">>, deps?: HarnessPresetValidationDeps): Promise<HarnessPreset | undefined>;
+/** Remove a preset by id. Returns true if it existed. */
+declare function removeHarnessPreset(id: string): Promise<boolean>;
+/**
+ * Mark `presetId` as THE default for its harness, demoting every other preset
+ * that shares its `harnessSlug`. Idempotent. Throws
+ * {@link HarnessPresetValidationError} when `presetId` doesn't exist or when the
+ * caller-supplied `harnessSlug` disagrees with the preset's own — the latter
+ * guards against defaulting a preset under the wrong harness by a stale id.
+ */
+declare function setDefaultPreset(harnessSlug: string, presetId: string): Promise<HarnessPreset>;
+
 /**
  * Built-in custom-route registration (PR-5).
  *
@@ -6153,7 +6509,9 @@ interface InboundWatcher {
  * external, must `await` the returned promise or operator-route overrides
  * will silently not apply.
  */
-declare function registerBuiltinRoutes(): Promise<void>;
+declare function registerBuiltinRoutes(opts?: {
+    llmEndpoint?: boolean;
+}): Promise<void>;
 
 /**
  * Read-only per-provider model enumeration (AIP-45 launch-menu "+" picker,
@@ -7603,6 +7961,16 @@ declare function monitorSessionWait(opts: {
     event?: SessionWaitEvent;
     timeoutMs?: number;
     since?: number;
+    /**
+     * The calling orchestrator's scope, when this wait was initiated by an
+     * agent session (the scoped orchestrator sub-gateway stamps
+     * `ownerSessionId`). Used ONLY to attribute the watcher attach/detach bus
+     * events this wait emits while blocked — an anonymous CLI/HTTP waiter
+     * leaves it absent. Never changes the wait's own semantics.
+     */
+    callerScope?: {
+        ownerSessionId?: string;
+    };
 }): Promise<SessionWaitResult>;
 /**
  * Block until the named policy's status transitions out of the active
@@ -7927,6 +8295,11 @@ interface CreateGatewayOptions {
      * returns) so the injected `serve` can capture the finished gateway.
      */
     pairingRegistry?: PairingRegistry;
+    /** Enable the local LLM Endpoint proxy sidecar (route registration,
+     *  MCP tools, child-process lifecycle). Default false — the endpoint is
+     *  an opt-in feature; when off, the `llm-endpoint` custom route is not
+     *  registered and the `llm_endpoint_*` MCP tools are not exposed. */
+    llmEndpoint?: boolean;
 }
 interface GatewayHandle {
     url: string;
@@ -7985,4 +8358,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type GateSpec, type GatewayHandle, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LocatedConversation, type LocatedConversationByPath, type McpCredentialDeps, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, type PrResolvedState, type PrStateResolver, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, type RemainingQuota, type RemainingQuotaReader, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, SessionConfig, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, WorkspaceFs, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getMcpCredentialDeps, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readUsageSnapshots, reapOrphanedDescendants, recordProfileQuota, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, resolveBucketSlug, resolveNativeLink, resolvePosture, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runStallWatchdogPass, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, verifyInboundSignature, workflowToActivities, writeDaemonRegistryEntry };
+export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreatedOffer, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DeclaredAdapterOption, type DeclaredAdapterPreset, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type GateSpec, type GatewayHandle, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LocatedConversation, type LocatedConversationByPath, type McpCredentialDeps, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, type PrResolvedState, type PrStateResolver, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterSessionInput, type RemainingQuota, type RemainingQuotaReader, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type ScopeTokenRegistry, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionKind, type SessionObserver, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, harnessPresetsPath, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSessionForBrain, readUsageSnapshots, reapOrphanedDescendants, recordProfileQuota, registerBrainTools, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, removeHarnessPreset, resolveBucketSlug, resolveNativeLink, resolvePosture, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runStallWatchdogPass, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, verifyInboundSignature, workflowToActivities, writeDaemonRegistryEntry };