@agentproto/runtime 4.0.0 → 4.1.0

package/dist/index.d.ts

@@ -451,13 +451,64 @@ type UsageSource = "adapter" | "computed" | "no-pricing" | "none";
 interface TokenPricing {
     inputPer1M: number;
     outputPer1M: number;
+    /** Multiplier on `inputPer1M` for cache-read tokens (Anthropic: ~0.1).
+     *  Absent = 1 (no discount), same default as the catalog. */
+    cacheReadMultiplier?: number;
+    /** Multiplier on `inputPer1M` for cache-creation tokens (Anthropic:
+     *  ~1.25). Absent = 1. */
+    cacheWriteMultiplier?: number;
+}
+/**
+ * Token-detail and activity fields shared by every usage shape below. All
+ * optional and never zero-filled: absent means "this source doesn't report
+ * it", a present 0 is a measured zero.
+ *
+ *   - `cacheReadTokens` / `cacheWriteTokens`: prompt-cache reads / cache
+ *     creation, cumulative. Kept OUT of `tokensIn` (which is uncached input
+ *     only when a cache split is known).
+ *   - `reasoningTokens`: thinking/reasoning tokens, cumulative. A subset of
+ *     `tokensOut` for providers that bill them as output (Anthropic).
+ *   - `turns`: completed turns (the descriptor's `turnsCompleted`).
+ *   - `toolCalls`: tool calls the daemon observed, cumulative.
+ *   - `durationMs`: wall time spent inside turns, cumulative.
+ */
+interface UsageDetail {
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+    turns?: number;
+    toolCalls?: number;
+    durationMs?: number;
 }
+/** Copy only the present (`number`) `UsageDetail` fields of `src`. */
+declare function pickUsageDetail(src: UsageDetail): UsageDetail;
 /** Pluggable pricing accessor — defaults to the in-repo catalog's
  *  `resolvePricing`, overridable in tests. Returns undefined for an
  *  unknown model (the caller then tags `no-pricing`). */
 type PricingResolver = (model: string) => TokenPricing | undefined;
+/**
+ * What an adapter's usage reader (`readUsage`: hermes state.db, opencode.db,
+ * the claude-code transcript JSONL) returns. Every field is cumulative for
+ * the session and optional; `null` from the reader means "nothing found".
+ */
+interface UsageReadResult {
+    model?: string;
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+}
+/** Where a reader should look for the session's native store — the spawn's
+ *  cwd and isolated provider config dir (`CLAUDE_CONFIG_DIR` for
+ *  claude-code). Readers that key only on the session id ignore it. */
+interface UsageReadContext {
+    cwd?: string;
+    configDir?: string;
+}
 /** Raw signals gathered over a turn, handed to `deriveSessionUsage`. */
-interface UsageComputeInput {
+interface UsageComputeInput extends UsageDetail {
     /** Requested model id — needed to look up per-token prices. */
     model?: string;
     /** Cost the adapter reported directly (readUsage or usage_update.cost).
@@ -471,7 +522,7 @@ interface UsageComputeInput {
 /** The resolved usage snapshot — the shape `session_usage` returns and the
  *  durable `usage_snapshot` transcript record carries. Cost/token fields are
  *  omitted when absent so a missing value never reads as a measured zero. */
-interface SessionUsage {
+interface SessionUsage extends UsageDetail {
     model?: string;
     costUsd?: number;
     tokensIn?: number;
@@ -488,7 +539,7 @@ interface SessionUsage {
  */
 declare function deriveSessionUsage(input: UsageComputeInput, resolve?: PricingResolver): SessionUsage;
 /** Descriptor-shaped fields `projectSessionUsage` reads. */
-interface UsageDescriptorFields {
+interface UsageDescriptorFields extends Omit<UsageDetail, "turns"> {
     model?: string;
     costUsd?: number;
     tokensIn?: number;
@@ -496,6 +547,8 @@ interface UsageDescriptorFields {
     contextSize?: number;
     contextUsed?: number;
     usageSource?: UsageSource;
+    /** Surfaced as `turns`. */
+    turnsCompleted?: number;
 }
 /**
  * Project a session descriptor's persisted usage fields into the
@@ -1837,6 +1890,18 @@ interface SessionTurnEndEvent {
      * a normal, productive turn.
      */
     empty?: boolean;
+    /**
+     * The in-band `error` stream event's message text observed during this
+     * turn, when one occurred (see `SessionDescriptor.lastTurnErrorMessage`'s
+     * doc). Present whenever `reason` is `"error"` AND the adapter emitted an
+     * `error`-kind event before ending the stream — including the case where
+     * the generator simply returned with no explicit turn-end and no thrown
+     * exception, which is exactly what left an errored turn indistinguishable
+     * from a clean one before this field existed. Absent when the adapter
+     * reported `reason:"error"` on its own turn-end without a preceding
+     * `error` event, and absent (not empty string) on every non-error turn.
+     */
+    error?: string;
     /**
      * True when the turn was not started by a prompt: the agent woke on its
      * own (Claude Code's task-notification cycle after a background task
@@ -2763,6 +2828,90 @@ declare class TunnelRegistry {
     private loadFromDisk;
 }
 
+/**
+ * LlmEndpointRegistry — supervised-sidecar manager for the
+ * `@agentproto/llm-endpoint` proxy gateway.
+ *
+ * The daemon spawns the llm-endpoint bin as a CHILD PROCESS (never an
+ * in-process import — the runtime package has zero dependency on
+ * @agentproto/llm-endpoint, exactly like it never imports cloudflared).
+ * This is the single-sidecar analog of {@link TunnelRegistry}: one endpoint,
+ * one port, an in-memory descriptor that tracks pid / port / status /
+ * startedAt, and a start / stop / status lifecycle exposed over MCP.
+ *
+ * Lifecycle (mirrors RemoteController's singleton style — created fresh each
+ * boot, state in memory; the child dies with the daemon so there is nothing
+ * to reconcile on restart):
+ *   start(input) → assemble env, spawn `node <bin> serve`, health-probe to
+ *                  readiness, store descriptor. Idempotent: a call while the
+ *                  endpoint is already running+healthy returns the existing
+ *                  descriptor without spawning (like `start_browser`).
+ *   status()     → descriptor + live `GET /v1/models` health probe.
+ *   stop()       → SIGTERM the child, mark stopped (mirrors tunnel stop).
+ *   shutdown()   → stop the child on daemon exit.
+ *
+ * Env on spawn (see {@link assembleLlmEndpointEnv}): the provider API keys
+ * via `injectProviderKeysIntoEnv` (the same store llm-endpoint's own cli.ts
+ * reads), `LLM_ENDPOINT_PORT` (default 18090), and `LLM_ENDPOINT_ACCESS_TOKENS`
+ * when configured. Explicit env passed to `start` always wins.
+ */
+type LlmEndpointStatus = "starting" | "running" | "stopped" | "error";
+/** The `llm_endpoint_status` MCP contract — see {@link LlmEndpointRegistry.status}. */
+interface LlmEndpointStatusReport {
+    running: boolean;
+    pid: number | null;
+    port: number | null;
+    baseUrl: string | null;
+    healthy: boolean;
+    startedAt: string | null;
+    status: LlmEndpointStatus | "never-started";
+    /** Who is actually serving this endpoint. `"daemon"` — this registry's own
+     *  spawn (or nothing at all). `"external"` — a healthy process on the same
+     *  port that this registry did NOT spawn (e.g. a launchd KeepAlive
+     *  sidecar); `pid` is unknown (always `null`) and `injectedProviders`, if
+     *  present, was DERIVED by probing `/v1/models` rather than read off our
+     *  own key-injection bookkeeping. */
+    owner: "daemon" | "external";
+    /** Whether upstream links persisted via `llm_endpoint_set_upstream_link`
+     *  are actually applied to the process answering this port. Always
+     *  `false` for `owner:"external"` — this registry never spawned it, so it
+     *  never injected `LLM_ENDPOINT_PROFILE_<UPSTREAM>`; the operator must
+     *  configure the external service's own env directly. */
+    linksApplied: boolean;
+    lastError?: string;
+    injectedProviders?: string[];
+    linkedProviders?: string[];
+    /** `@agentproto/llm-endpoint`'s own package version, read from the
+     *  resolved bin's `package.json` — best-effort, present only for
+     *  `owner:"daemon"` (the version of the code this registry would spawn /
+     *  did spawn). Undefined when unresolvable, or for `owner:"external"`
+     *  (an adopted process exposes no version of its own to probe). */
+    version?: string;
+}
+interface LlmEndpointDescriptor {
+    pid: number | null;
+    port: number;
+    baseUrl: string;
+    status: LlmEndpointStatus;
+    startedAt: string;
+    stoppedAt?: string;
+    lastError?: string;
+    /** Provider names whose keys were injected into the child's env (never values). */
+    injectedProviders?: string[];
+    /** Upstream names mapped to an auth-profile link (`LLM_ENDPOINT_PROFILE_<P>`)
+     *  in the child's env. Profile IDS, not secrets — but only the provider names
+     *  are surfaced here, mirroring `injectedProviders`. */
+    linkedProviders?: string[];
+    /**
+     * Only populated on the value returned by {@link LlmEndpointRegistry.start}
+     * (never stored on the in-memory descriptor): `true` when the call reused an
+     * already-running/starting child instead of spawning — so the caller can
+     * tell a fresh `start` (new port/tokens applied) from a no-op idempotent hit
+     * (old descriptor returned, nothing new applied). Mirrors `start_browser`.
+     */
+    wasAlreadyRunning?: boolean;
+}
+
 /**
  * RemoteController — owns the gateway's "publish to the internet" state.
  *
@@ -2970,6 +3119,14 @@ interface PairingRecord {
     /** Set on a pairing made under the retired pair/v1 protocol: listed and
      *  revocable, never served — its client is told to re-pair. */
     legacy?: true;
+    /** Set when this pairing was made under an offer minted with
+     *  `agentproto pair offer --host` (PR-C) — i.e. the offering daemon's own
+     *  intent, recorded server-side at handshake time from the OfferEntry it
+     *  itself created, never from the (unauthenticated) `scope` param a client
+     *  presented in the offer URL. Absent for an ordinary remote-control
+     *  pairing. Purely informational here — it does not change how this
+     *  pairing is served. */
+    scope?: "host";
 }
 /** Mode of a served channel — first-contact offer vs. an established reconnect. */
 type PairingChannelMode = "offer" | "reconnect";
@@ -3003,12 +3160,21 @@ interface CreatedOffer {
      *  falls back to `HOSTED_RENDEZVOUS_URL`. Surfaced so `pair offer` can flag,
      *  never silently, that the daemon is relaying through our infrastructure. */
     rendezvousIsHostedDefault: boolean;
+    /** Echoes `CreateOfferInput.scope`. `"host"` when minted with `--host`;
+     *  absent for a plain offer. */
+    scope?: "host";
 }
 interface CreateOfferInput {
     /** Time-to-live in ms. Default 10 minutes. */
     ttlMs?: number;
     /** Rendezvous URL override; falls back to the configured default. */
     rendezvousUrl?: string;
+    /** Mint a HOST-scoped offer (PR-C): the accepting side may register this
+     *  daemon as a driveable host (`devices add`), not just remote-control it.
+     *  Recorded on the resulting `OfferEntry`/`PairingRecord` server-side — this
+     *  is the authoritative record of what was granted, independent of the
+     *  `scope` param an accepting client's offer URL happens to carry. */
+    scope?: "host";
 }
 interface PairingRegistryDeps {
     /** Lazily load (create on first use) the daemon identity. Kept lazy so a
@@ -3052,17 +3218,174 @@ interface PairingRegistry {
     createOffer(input?: CreateOfferInput): Promise<CreatedOffer>;
     /** All persisted pairings (copies). Loads `pairings.json` on first call. */
     list(): Promise<PairingRecord[]>;
+    /** Rename a pairing by fingerprint or name (cosmetic only — no effect on
+     *  auth or routing). Returns false when nothing matched; throws on an
+     *  empty `newName`. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
     /** Drop a pairing by fingerprint or name; stops its rendezvous connections.
      *  Returns false when nothing matched. */
     revoke(idOrName: string): Promise<boolean>;
+    /** Is a channel (offer or reconnect) currently served for this fingerprint? */
+    isOnline(fingerprint: string): boolean;
     /** Start standing reconnect connections for every persisted pairing. Call
      *  after the gateway is up (so the injected `serve` can reach it). */
     startAutoconnect(): Promise<void>;
     /** Tear down every offer + reconnect connection and served channel. */
     shutdown(): Promise<void>;
 }
+/**
+ * Read-only snapshot of `pairings.json` for callers that just want the
+ * persisted records — no `dial`/`serve`/`loadIdentity` deps, no rendezvous
+ * connections started (e.g. `agentproto doctor`'s devices check). Mirrors
+ * `ensureLoaded`'s parse + v1-legacy flagging; never throws — a missing or
+ * malformed file just yields `[]`.
+ */
+declare function readPairingsSnapshot(path?: string): Promise<PairingRecord[]>;
 declare function createPairingRegistry(deps: PairingRegistryDeps): PairingRegistry;
 
+/**
+ * Daemon-side HOST registry (DEVICES-PLAN PR-C) — the "client" half of
+ * pair/v2, living on the daemon so it's reachable over both an HTTP route
+ * and an MCP tool, not just CLI-local bookkeeping (`client-pairings.ts` /
+ * `pair-transport.ts` are that CLI-local equivalent today).
+ *
+ * Where `pairing-registry.ts` is what a daemon uses to let OTHER machines
+ * pair with and remote-control IT, `host-registry.ts` is what a daemon uses
+ * to register and drive OTHER daemons — reverse pairing. `add()` accepts a
+ * HOST-scoped offer (`agentproto pair offer --host`, offer-url.ts's
+ * `scope`), runs the pair/v2 client handshake, and persists the resulting
+ * pair root; `forwardHttp()` dials on demand, reconnecting over the current
+ * (then previous) epoch token exactly like `pair-transport.ts`'s
+ * `openPairChannel`, forwards one HTTP request over the resulting tunnel
+ * client, and closes. There is no standing connection here — unlike
+ * `PairingRegistry`, a `HostRegistry` never autoconnects or keeps a
+ * reconnect loop parked at the broker; every reach-out is a fresh dial.
+ * That also means shutdown needs no teardown: there is nothing standing to
+ * tear down.
+ *
+ * ## The scope gate
+ *
+ * `add()` REFUSES (throws) any offer whose parsed `scope !== "host"` before
+ * ever dialing anything. This is the default-deny gate PR-C exists to add:
+ * an ordinary "remote-control me" offer (today's `pair offer`, no `--host`)
+ * must not silently become a host registration, even though the underlying
+ * wire capability is identical either way (see offer-url.ts's "Offer scope"
+ * and pairing-registry.ts's `OfferEntry.scope` doc comment for why the
+ * offering daemon's OWN server-side record — not the URL's plaintext
+ * `scope` param — is what's authoritative about what it granted). There is
+ * deliberately no override flag.
+ *
+ * Persisted to `hosts.json` (`~/.agentproto/hosts.json` by default) with the
+ * same atomic-write discipline as `pairings.json` (mkdir, write to a
+ * pid-keyed tmp file at 0600, chmod, rename) and the same lazy-load-on-
+ * first-use pattern.
+ *
+ * ## Online tracking
+ *
+ * `isOnline(fingerprint)` mirrors `PairingRegistry.isOnline`: it's true only
+ * while a `forwardHttp()` call for that fingerprint is in flight (a
+ * reference count, incremented on dial and decremented in a `finally`).
+ * There is no live probe backing `list()` — that would make `devices list`
+ * slow/flaky over N hosts — so `list()`'s `online` is only ever true
+ * immediately after (or during) an actual `forwardHttp`/`devices status`
+ * call, never a background heartbeat. That's enough to make `devices list`
+ * show the right thing right after `devices status`/`exec`, which is what
+ * matters for this PR; a standing/autoconnect host connection with a real
+ * liveness signal is PR-D's to build.
+ */
+
+/** `hosts.json` format. */
+declare const HOSTS_VERSION: 1;
+/** One persisted host — a daemon this daemon can drive. */
+interface HostRecord {
+    /** The target daemon's identity fingerprint (32 hex). */
+    fingerprint: string;
+    /** Human-facing label; defaults to the fingerprint. */
+    name: string;
+    /** Target daemon's static X25519 public key, standard base64 SPKI DER —
+     *  pinned at `add()` time. */
+    daemonX25519Pub: string;
+    /** Target daemon's static Ed25519 public key, standard base64 SPKI DER —
+     *  pinned at `add()` time. */
+    daemonEd25519Pub: string;
+    /** Rendezvous endpoint to reach the host through. */
+    rendezvousUrl: string;
+    /** Long-term shared secret (base64), from which epoch routing tokens
+     *  derive — same derivation as `PairingRecord.pairRoot`. */
+    pairRoot: string;
+    /** ISO-8601 first-add timestamp. */
+    createdAt: string;
+    /** ISO-8601 of the most recent successful `forwardHttp`. */
+    lastSeen: string;
+    /** Set on a host added under the retired pair/v1 protocol. Present for
+     *  parity with `PairingRecord`/`ClientPairing`; pair/v1 offers are refused
+     *  by `parseOfferUrl` before `add()` ever sees them, so this is currently
+     *  unreachable — kept so a future downgrade path has somewhere to flag it. */
+    legacy?: true;
+}
+interface HostRegistryDeps {
+    /** Dial a rendezvous WS and adapt it to a `FrameSink`. Same shape as
+     *  `PairingRegistryDeps.dial` — the CLI's `daemonDialRendezvous` satisfies
+     *  it directly. Rejects if the dial fails or `signal` aborts. */
+    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
+    /** Path to `hosts.json`. Defaults to `~/.agentproto/hosts.json`. */
+    hostsPath?: string;
+    /** Injectable clock (ms). Defaults to Date.now. */
+    now?: () => number;
+    /** Diagnostic log sink. */
+    log?: (line: string) => void;
+    /** Rendezvous dial ceiling per attempt. Default 15s. */
+    dialTimeoutMs?: number;
+    /** Handshake ceiling per attempt. Default 15s. */
+    handshakeTimeoutMs?: number;
+}
+interface ForwardHttpRequest {
+    method: string;
+    path: string;
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+}
+interface ForwardHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: Uint8Array;
+}
+interface HostRegistry {
+    /**
+     * Accept an offer URL and register the target daemon as a driveable host.
+     * REFUSES (throws a plain `Error`) unless the parsed offer has
+     * `scope === "host"` — no dial is attempted in that case. Otherwise: dials
+     * the offer's rendezvous, runs the pair/v2 client handshake, verifies the
+     * derived peer fingerprint matches the offer's `id` (defence in depth,
+     * mirrors `pair-transport.ts`'s `acceptOffer`), derives the pair root, and
+     * persists a `HostRecord` (upserted by fingerprint — re-adding replaces).
+     */
+    add(offerUrl: string, name?: string): Promise<{
+        fingerprint: string;
+        name: string;
+        rendezvousUrl: string;
+    }>;
+    /** All persisted hosts (copies). Loads `hosts.json` on first call. */
+    list(): Promise<HostRecord[]>;
+    /** Rename a host (fingerprint or current name). Returns false when nothing
+     *  matched; throws on an empty `newName`. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
+    /** Drop a host by fingerprint or name. Returns false when nothing matched. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Is a `forwardHttp` call for this fingerprint in flight right now? */
+    isOnline(fingerprint: string): boolean;
+    /**
+     * On-demand: dial the host, run the client handshake against the current
+     * epoch's tokens (falling back to the previous epoch, bridging clock
+     * skew — same two-attempt shape as `pair-transport.ts`'s
+     * `openPairChannel`), forward one HTTP request over the resulting tunnel
+     * client, then close. Throws with a re-pair hint if every attempt hangs up
+     * on the hello (likely a pair/v1 peer).
+     */
+    forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
+}
+declare function createHostRegistry(deps: HostRegistryDeps): HostRegistry;
+
 /**
  * Shared types for pluggable sandbox providers.
  *
@@ -4394,6 +4717,18 @@ interface SpawnAgentSessionDeps {
      *  manifest not covering the requested model still reaches the driver,
      *  same as before this guard existed. */
     listCatalogModels?: CatalogModelsLister;
+    /** Ensure the local `llm-endpoint` proxy sidecar (`LlmEndpointRegistry`)
+     *  is up before a spawn that bills through it. Without this hook, a spawn
+     *  whose resolved gateway is `"llm-endpoint"` assumed the sidecar was
+     *  already running (started externally, or via the `llm_endpoint_start`
+     *  MCP tool) — a fresh install with `features.llmEndpoint` on but nothing
+     *  having called that tool yet would spawn fine and only fail once the
+     *  adapter made its first request. Wired to the registry's own
+     *  (idempotent) `start()` at the composition root; omitted ⇒ unchanged
+     *  pre-existing behavior. Best-effort: a rejection here is swallowed by
+     *  the caller, not surfaced as a spawn failure — the adapter's own first
+     *  request is left to report the real connection error. */
+    ensureLlmEndpointRunning?: () => Promise<void>;
 }
 interface SpawnAgentSessionInput {
     adapter: string;
@@ -4455,7 +4790,19 @@ interface SpawnAgentSessionInput {
      *  blank. Not exposed on the MCP `agent_start` tool today — only the
      *  HTTP route (`sessions restart`) passes this. */
     resumeSessionId?: string;
-    prompt?: string;
+    /** The caller's initial ask — a plain string (the common case, composed
+     *  with the role/AGENTS.md/RULES.md preamble below into one string turn),
+     *  or a content block / block array (an attachment-bearing first message,
+     *  same loose shape `POST /sessions/:id/prompt` accepts). The block form
+     *  is a narrow path: composing daemon-synthesized preamble TEXT onto a
+     *  turn that opens with an image isn't meaningful string concatenation,
+     *  so it SKIPS the whole preamble composition below (role disposition,
+     *  AGENTS.md, RULES.md, parent-lineage line, posture-as-prompt fallback)
+     *  and is sent to the adapter verbatim — see `effectivePrompt`'s doc.
+     *  Acceptable because this path is human/UI-initiated (an attachment
+     *  typed into a chat composer), not the orchestrator-driven role spawns
+     *  that actually depend on the composed disposition text. */
+    prompt?: string | Record<string, unknown> | unknown[];
     label?: string;
     /** Explicit session title (SPEC-3 FIX C, `agentproto sessions start
      *  --title`). When set, it wins over the first-sentence derivation from
@@ -4955,6 +5302,8 @@ interface BranchGcPlanView {
     includeReviewed: boolean;
     generatedAt: string;
     otherRemoteRefs: number;
+    /** true = base-remote `fetch --prune` succeeded; false = failed; null = skipped / no remote. */
+    fetched: boolean | null;
     entries: BranchGcPlanEntryView[];
 }
 /** kind → class → count, and kind → (status | "protected") → count. */
@@ -5158,12 +5507,10 @@ type AgentAdapterResolver = (slug: string) => Promise<{
     }): Promise<AgentSessionLike>;
     /** Display label for the descriptor's `command` field. */
     commandPreview?: string;
-    /** Best-effort per-session usage reader (adapter-specific, e.g. hermes state.db). */
-    readUsage?: (adapterSessionId: string) => Promise<{
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    /** Best-effort per-session usage reader (adapter-specific, e.g. hermes
+     *  state.db, the claude-code transcript JSONL). `ctx` carries the spawn's
+     *  cwd + isolated config dir for readers that locate their store by them. */
+    readUsage?: (adapterSessionId: string, ctx?: UsageReadContext) => Promise<UsageReadResult | null>;
     /** AIP-45 `options[]` this adapter's manifest declares (id + type only —
      *  no spawn internals). Lets `session-spawn.ts` fold a config-level
      *  `defaults.skills` list into `options.skills` using the shape the
@@ -6320,16 +6667,32 @@ interface SessionDescriptor {
      *  `status` to `"error"` directly (a genuinely terminal row the existing
      *  crash/error handling already catches). This is the twin gap for a
      *  turn that fails IN-BAND while the process stays alive: `status` stays
-     *  `"running"`, `lastError` stays unset (reserved for `markCrashed`), and
-     *  nothing else distinguishes the session from one that simply finished
-     *  a clean turn and is idle. Folded into the same "stalled" activity/UI
-     *  treatment a mid-turn stall gets (see sessionsTree.logic.ts's
-     *  `activityFor`) rather than a new state, on the theory that both mean
-     *  "the last thing this session did needs a look, not a re-prompt on
-     *  faith". Stamped at turn-end when `turnEndReason === "error"`; cleared
-     *  the moment a LATER turn completes without one (same reset shape as
+     *  `"running"`, `lastError` stays unset (still reserved for `markCrashed`
+     *  — see `lastTurnErrorMessage` below for the message text this field's
+     *  own turn carries), and nothing else distinguishes the session from
+     *  one that simply finished a clean turn and is idle. Folded into the
+     *  same "stalled" activity/UI treatment a mid-turn stall gets (see
+     *  sessionsTree.logic.ts's `activityFor`) rather than a new state, on
+     *  the theory that both mean "the last thing this session did needs a
+     *  look, not a re-prompt on faith". Stamped at turn-end when
+     *  `turnEndReason === "error"` — including the case where the adapter's
+     *  stream generator simply returned after emitting an in-band `error`
+     *  event with no explicit turn-end and no thrown exception, which
+     *  `runAgentTurn`'s P5 synthetic-reason fallback now classifies as
+     *  `"error"` rather than defaulting to `"exited"`. Cleared the moment a
+     *  LATER turn completes without one (same reset shape as
      *  `resumeAttempts`/`restartAttempts`). Detection + signal only. */
     lastTurnErroredAt?: string;
+    /** The captured error text for the turn `lastTurnErroredAt` timestamps —
+     *  `evt.error.message` off the in-band stream `error` event observed
+     *  during that turn (see `runAgentTurn`'s `turnErrorMessage`). Distinct
+     *  from `lastError` (reserved for `markCrashed`) and from
+     *  `rt.lastErrorMessage` (an internal, cross-turn, never-cleared runtime
+     *  field — this one is the public, turn-scoped descriptor projection of
+     *  it). Absent when the adapter reported `reason:"error"` on its own
+     *  turn-end without a preceding `error`-kind stream event. Stamped and
+     *  cleared together with `lastTurnErroredAt`. */
+    lastTurnErrorMessage?: string;
     /** True when the LAST completed turn produced zero assistant output and
      *  zero tool calls (mirrors `SessionTurnEndEvent.empty` — see that
      *  field's doc). Persisted so `monitorSessionWait`'s synchronous
@@ -6359,6 +6722,29 @@ interface SessionDescriptor {
      *  the underlying `killedMidTurn`/`endedReason`). The in-place resume path
      *  never auto-retries the interrupted prompt. */
     interrupted?: boolean;
+    /** The `SessionsRegistry.bootId` of the FIRST daemon boot that found this
+     *  row interrupted — i.e. which restart cut its turn off. Stamped by the
+     *  boot reload (`loadHistorySnapshot`) on an interrupted row that doesn't
+     *  carry one yet; dropped whenever the row is interrupted AGAIN (so the next
+     *  boot restamps it) and on the next successful turn-end (with the markers it
+     *  qualifies). `interruptedAtBoot === registry.bootId` is how the
+     *  continue-interrupted verb and boot pass pick "interrupted by the LAST
+     *  restart" apart from a stale interruption nobody picked back up. PERSISTED
+     *  (unlike the derived `interrupted`) — the boot that stamped it may not be
+     *  the one reading it. */
+    interruptedAtBoot?: string;
+    /** How many automatic continue prompts the daemon has sent this row
+     *  (`daemon.continueInterruptedOnBoot`) since its last successful turn-end.
+     *  Incremented BEFORE the prompt is sent, so a continue turn that itself
+     *  gets cut off by another restart still counts; reset on the next
+     *  successful turn-end. The boot pass stops at
+     *  `MAX_AUTO_CONTINUE_ATTEMPTS` — the no-loop bound for a turn that keeps
+     *  taking the daemon down with it. PERSISTED; absent until the first one. */
+    autoContinueAttempts?: number;
+    /** `bootId` of the boot whose pass last auto-continued this row — the
+     *  at-most-one-auto-continue-per-restart guard. Reset with
+     *  `autoContinueAttempts`. */
+    lastAutoContinueBoot?: string;
     /** How many in-place resume attempts have FAILED in a row for this session
      *  (§5 cap/backoff). Incremented on every failed `maybeResumeAgent` attempt —
      *  the resume throws, the adapter rejects the id, or the spawn returns null —
@@ -6717,6 +7103,19 @@ interface SessionDescriptor {
     /** Cumulative input / output token counts (same source + cadence as costUsd). */
     tokensIn?: number;
     tokensOut?: number;
+    /** Cumulative prompt-cache read / cache-creation / reasoning tokens, from
+     *  the adapter's usage reader (claude-code transcript, hermes state.db,
+     *  opencode.db). Absent when the adapter doesn't expose them — never
+     *  zero-filled. See `UsageDetail` in usage.ts. */
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+    /** Tool calls the daemon observed across completed turns (cumulative).
+     *  Stamped at the first turn end, so absent = no turn has finished yet. */
+    toolCalls?: number;
+    /** Wall time spent inside turns, cumulative ms. Same cadence as
+     *  `toolCalls`. */
+    durationMs?: number;
     /** Context-window size + tokens-in-context from the latest `usage_update`
      *  event (ACP adapters that report a context window). Refreshed live as
      *  usage_update events arrive, not just at turn-end. */
@@ -7636,6 +8035,21 @@ interface SessionsRegistry {
         reason?: string;
         interrupted?: boolean;
     }>;
+    /** A currently-RUNNING background task's info plus a tail of its output
+     *  file, for the UI's "click a live background-task row to peek at its
+     *  output" affordance. Scoped to `SessionDescriptor.backgroundTasks` on
+     *  purpose — a settled task is dropped from that list moments after it
+     *  reports terminal status (see `noteBackgroundTask`), so this never
+     *  becomes an arbitrary-file-read: the caller supplies a `taskId`, never a
+     *  path, and only a path the agent itself already reported for a task
+     *  still tracked as running is ever read. Returns `null` when the session
+     *  or the task is unknown (the caller surfaces 404); `tail` is `null` when
+     *  the task has no `outputFile` or the file can't be read (not yet
+     *  created, already rotated away, ...). */
+    readBackgroundTaskTail(id: string, taskId: string): {
+        task: SessionBackgroundTask;
+        tail: string | null;
+    } | null;
     /** Eagerly resume ONE dead-but-resumable agent-cli session IN PLACE,
      *  WITHOUT a prompt — the boot-time counterpart to the lazy resume that
      *  `sendPrompt`/`enqueuePrompt` trigger on the first prompt after a restart
@@ -7658,6 +8072,17 @@ interface SessionsRegistry {
      *  touching the adapter, so the bounded boot pass can call it per row and
      *  tally the results. */
     resumeOnBoot(id: string): Promise<EagerResumeOutcome>;
+    /** Opaque id unique to this registry instance — one per daemon boot.
+     *  Stamped as `interruptedAtBoot` on rows the boot reload finds interrupted,
+     *  so `interruptedAtBoot === bootId` means "interrupted by the restart that
+     *  preceded THIS boot" (continue-interrupted). */
+    readonly bootId: string;
+    /** Book one automatic continue prompt against `id` (increment
+     *  `autoContinueAttempts`, stamp `lastAutoContinueBoot = bootId`) and
+     *  persist. Called by the continue-on-boot pass BEFORE it sends, so the
+     *  no-loop bound holds even when the continue turn is itself cut off by the
+     *  next restart. No-op for an unknown id. */
+    recordAutoContinue(id: string): void;
     /** Cancel the in-flight turn on a live agent-cli session and leave the
      *  session itself alive and idle — the bare "interrupt, no next prompt"
      *  primitive `sendPrompt`/`enqueuePrompt`'s `opts.interrupt` arm lacks
@@ -8167,8 +8592,10 @@ interface SpawnAgentInput {
     /** Optional initial prompt to dispatch immediately. The promise
      *  the registry returns resolves AFTER the spawn — the prompt
      *  runs in the background, projecting events into the ring
-     *  buffer. Skip to spawn idle. */
-    initialPrompt?: string;
+     *  buffer. Skip to spawn idle. A plain string, or a content-block
+     *  prompt (attachment-bearing first message) — see
+     *  `SpawnAgentSessionInput.prompt`'s doc. */
+    initialPrompt?: string | Record<string, unknown> | unknown[];
     /** The daemon-composed SYSTEM slice of {@link initialPrompt} — the part
      *  it synthesized ahead of the CALLER's ask (role disposition, lineage
      *  line, AGENTS.md, posture preamble). The adapter still receives the
@@ -8260,12 +8687,7 @@ interface SpawnAgentInput {
      *  cost/token fields on the descriptor. Adapter-specific (e.g. hermes
      *  reads its state.db keyed by the adapter session id). Omit for adapters
      *  with no usage source. */
-    readUsage?: () => Promise<{
-        model?: string;
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    readUsage?: () => Promise<UsageReadResult | null>;
     /** Opt this session into Langfuse tracing (prompt/completion + tool spans +
      *  tokens/cost). Effective opt-in is `trace ?? opts.langfuseTracingDefault ?? false`. */
     trace?: boolean;
@@ -8322,15 +8744,12 @@ type PendingAgentOutcome = {
     commandPreview?: string;
     resumable?: boolean;
     nativeTerminalResume?: boolean;
-    readUsage?: () => Promise<{
-        model?: string;
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    readUsage?: () => Promise<UsageReadResult | null>;
     /** Dispatched now that the tree + driver session both exist — never
-     *  passed to `spawnAgentPending`, which would race the tree. */
-    initialPrompt?: string;
+     *  passed to `spawnAgentPending`, which would race the tree. A plain
+     *  string, or a content-block prompt (attachment-bearing first
+     *  message) — see `SpawnAgentSessionInput.prompt`'s doc. */
+    initialPrompt?: string | Record<string, unknown> | unknown[];
     /** The daemon-composed SYSTEM slice of `initialPrompt` (see
      *  `SpawnAgentInput.initialPromptSystem`) — threaded through the
      *  placeholder so the deferred dispatch records it as a system turn. */
@@ -8606,6 +9025,163 @@ declare function runEagerResumePass(opts: {
     isServed?: (desc: SessionDescriptor) => boolean;
 }): Promise<EagerResumeSummary>;
 
+/**
+ * Continue-interrupted: pick back up the sessions a daemon restart cut off
+ * mid-turn, by sending each an explicit "continue" prompt.
+ *
+ * Everything below the prompt already exists — the persisted registry is the
+ * snapshot, `maybeResumeAgent` resumes a dead row in place (lazily on its first
+ * prompt, or eagerly at boot via `eager-resume.ts`), and the row keeps the
+ * derived `interrupted` marker until its next successful turn-end. What a
+ * restart does NOT do, by design, is re-run the interrupted prompt (prompts
+ * aren't idempotent). This module is the explicit, opt-in replacement for that:
+ * a NEW prompt that tells the agent its last turn was cut off and to check the
+ * state on disk before carrying on.
+ *
+ * Two callers share one eligibility rule + one sender:
+ *   - the manual verb (`session_continue_interrupted` MCP tool,
+ *     `POST /sessions/continue-interrupted`, `agentproto sessions
+ *     continue-interrupted`) — `mode: "manual"`, dry-run by default;
+ *   - the opt-in boot pass (`daemon.continueInterruptedOnBoot`) —
+ *     `mode: "boot"`, run by serve.ts right after the eager resume pass.
+ *
+ * Eligibility (both modes): an agent-cli row that is `interrupted` BY THE LAST
+ * RESTART (`interruptedAtBoot === registry.bootId` — a stale interruption from
+ * an older restart that nobody picked up is left alone), resumable under the
+ * attempt cap (`canResume`), and not already busy. The prompt goes through
+ * `enqueuePrompt`, the normal prompt path, so a dead-but-resumable row
+ * lazy-resumes with its billing auth re-resolved exactly as a human prompt
+ * would.
+ *
+ * No-loop rules (boot mode only — a human pressing the button is intent):
+ *   - never auto-continue a row whose resume has failed (`resumeAttempts > 0`:
+ *     the eager pass, or an earlier attempt, could not bring it back);
+ *   - at most one auto-continue per restart (`lastAutoContinueBoot`);
+ *   - at most `MAX_AUTO_CONTINUE_ATTEMPTS` auto-continues without a successful
+ *     turn-end in between (`autoContinueAttempts`, booked BEFORE sending), so a
+ *     continue turn that keeps getting cut off — or keeps taking the daemon
+ *     down with it — stops being retried.
+ *
+ * Ordering (boot mode): MUST run after the supervisor is re-armed, same
+ * constraint as `eager-resume.ts` — the continue turn's `turn-end` is exactly
+ * what a re-armed completion policy is waiting for — and after the eager pass,
+ * so a row whose eager resume failed is recognisable (`resumeAttempts`) and
+ * skipped rather than lazily retried.
+ */
+
+/** The prompt sent when the caller doesn't supply one. */
+declare const DEFAULT_CONTINUE_PROMPT: string;
+/** Transcript provenance for the continue prompt (`opts.source`). */
+declare const CONTINUE_PROMPT_SOURCE = "daemon:continue-interrupted";
+/** Cap on automatic continue prompts sent to one row without a successful
+ *  turn-end in between (boot mode). 2 = the original interruption gets one
+ *  auto-continue, and if a second restart cuts THAT turn off it gets one more;
+ *  after that only a human (manual verb) re-sends. */
+declare const MAX_AUTO_CONTINUE_ATTEMPTS = 2;
+type ContinueInterruptedSkipReason = 
+/** Unknown id (explicit `ids` filter only). */
+"unknown"
+/** Not interrupted at all — no turn was cut off. */
+ | "not-interrupted"
+/** Interrupted by an EARLIER restart, not the last one. */
+ | "stale-interrupt"
+/** Not in-place resumable (not agent-cli / missing adapter session / archived). */
+ | "not-resumable"
+/** Already burned through `MAX_RESUME_ATTEMPTS` failed resumes. */
+ | "resume-cap-exhausted"
+/** Mid-turn already — someone got there first. */
+ | "busy"
+/** Boot mode: a resume attempt has failed on this row. */
+ | "resume-failed"
+/** Boot mode: already auto-continued by this boot. */
+ | "already-auto-continued"
+/** Boot mode: `MAX_AUTO_CONTINUE_ATTEMPTS` reached without recovering. */
+ | "auto-continue-cap"
+/** Excluded by the cross-process `isServed` gate (another daemon's row). */
+ | "not-served";
+type ContinueInterruptedOutcome = {
+    id: string;
+    name?: string;
+    status: "eligible";
+} | {
+    id: string;
+    name?: string;
+    status: "sent";
+} | {
+    id: string;
+    name?: string;
+    status: "skipped";
+    reason: ContinueInterruptedSkipReason;
+} | {
+    id: string;
+    name?: string;
+    status: "failed";
+    error: string;
+};
+interface ContinueInterruptedResult {
+    dryRun: boolean;
+    /** The prompt that was (or, on a dry run, would be) sent. */
+    prompt: string;
+    /** The boot the candidates were interrupted before (`registry.bootId`). */
+    bootId: string;
+    /** One entry per considered row — every interrupted row when `ids` is
+     *  omitted, every requested id otherwise. Eligible-first ordering matches
+     *  the send order (newest activity first). */
+    sessions: ContinueInterruptedOutcome[];
+    /** Counts by outcome status. */
+    eligible: number;
+    sent: number;
+    skipped: number;
+    failed: number;
+}
+type ContinueInterruptedMode = "manual" | "boot";
+/** Decide one row. `undefined` ⇒ eligible. Pure — reads the descriptor only. */
+declare function continueSkipReason(desc: SessionDescriptor, bootId: string, mode: ContinueInterruptedMode): ContinueInterruptedSkipReason | undefined;
+/**
+ * List — and unless `dryRun` — continue the sessions interrupted by the last
+ * restart. See the module docblock for eligibility, the no-loop rules, and the
+ * ordering contract. No-throw per row: a send that fails admission (row went
+ * busy, resume refused) is reported as `failed` and the pass carries on.
+ */
+declare function continueInterruptedSessions(opts: {
+    registry: Pick<SessionsRegistry, "list" | "get" | "enqueuePrompt" | "bootId" | "recordAutoContinue">;
+    mode: ContinueInterruptedMode;
+    /** Default true: report what would be sent, send nothing. */
+    dryRun?: boolean;
+    /** Restrict to these session ids. Omitted ⇒ every interrupted row. */
+    ids?: readonly string[];
+    /** Custom prompt. Omitted/blank ⇒ `DEFAULT_CONTINUE_PROMPT`. */
+    prompt?: string;
+    /** Max sends in flight at once (each may lazily resume an adapter). Clamped
+     *  to ≥1. Default 4, same as the eager pass. */
+    concurrency?: number;
+    /** Cross-process gate — see `runEagerResumePass`. Omitted ⇒ all served. */
+    isServed?: (desc: SessionDescriptor) => boolean;
+    /** Extra visibility filter (a scoped orchestrator's subtree). Rows it
+     *  rejects are dropped silently — never reported, never sent. */
+    visible?: (desc: SessionDescriptor) => boolean;
+}): Promise<ContinueInterruptedResult>;
+/** Tally of the boot-time continue pass, for the boot-banner line. */
+interface ContinueOnBootSummary {
+    /** False when `daemon.continueInterruptedOnBoot` is off (nothing ran). */
+    enabled: boolean;
+    /** Rows passing eligibility at selection time — the banner's denominator. */
+    eligible: number;
+    sent: number;
+    skipped: number;
+    failed: number;
+}
+/**
+ * The boot pass: `continueInterruptedSessions` in `mode: "boot"`, not a dry
+ * run, reduced to the banner tally. Caller (the gateway handle, invoked from
+ * serve.ts) is responsible for the ordering contract in the module docblock.
+ */
+declare function runContinueOnBootPass(opts: {
+    registry: Parameters<typeof continueInterruptedSessions>[0]["registry"];
+    concurrency: number;
+    isServed?: (desc: SessionDescriptor) => boolean;
+}): Promise<ContinueOnBootSummary>;
+
 /**
  * Daemon-lane PR provenance STAMPER.
  *
@@ -8820,8 +9396,16 @@ interface InboundWatcher {
  *
  * `mcpServerFactory` (index.ts) rebuilds a fresh McpServer per `/mcp`
  * request, so this module never throws — a bad app record must not take
- * down every other request. Failures (a collided tool id, an unreadable
- * `ui.path`) are skipped with a `console.warn`, not surfaced to the caller.
+ * down every other request. A collided tool id is still skipped with a
+ * `console.warn` (there's nowhere else for a second panel to live). Every
+ * OTHER failure — a removed app dir, a missing/unreadable `ui.path`, a
+ * failed or in-flight `ui.build` — still mounts the panel, serving a
+ * readable HTML placeholder/error page in place of the real bundle
+ * (app-ui-placeholder.ts) instead of skipping it outright: a `ui://`
+ * resource that silently doesn't exist just shows as a JSON-RPC "resource
+ * not found" in a host, which is what motivated this file's placeholder
+ * page in the first place — a HOST-VISIBLE page, even a stand-in one, beats
+ * a resource the host has to explain away as missing.
  */
 
 /**
@@ -10295,6 +10879,108 @@ declare function formatToolCall(toolName: string, args: unknown): string;
  */
 declare function formatToolResult(toolName: string | undefined, result: unknown, isError: boolean): string | null;
 
+/**
+ * Pure sizing helper for a `tools/list` response — shared by
+ * `scripts/measure-mcp-tools.mjs` (human-readable before/after report) and
+ * the budget-guard test (`__tests__/tool-schema-budget.test.ts`) so both
+ * measure the exact same thing: the JSON bytes an MCP client actually pays
+ * for per tool (`description` + `inputSchema`), sorted biggest first.
+ */
+interface MeasuredToolEntry {
+    name: string;
+    bytes: number;
+}
+interface ToolListMeasurement {
+    entries: MeasuredToolEntry[];
+    totalBytes: number;
+}
+interface MeasurableTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}
+/** UTF-8 byte size of the `{description, inputSchema}` JSON a client
+ *  receives for one tool — the same two fields `tools/list` sends over the
+ *  wire, so this tracks prompt-token cost rather than just character count. */
+declare function measureTool(tool: MeasurableTool): number;
+declare function measureToolList(tools: readonly MeasurableTool[]): ToolListMeasurement;
+
+/**
+ * Long-form MCP tool documentation, read from `docs/mcp-tools/<name>.md`.
+ *
+ * The schema `description` on a tool/field is a contract: what it does, and
+ * the one rule that prevents a wrong call — kept short so `tools/list` stays
+ * cheap. Everything else (edge cases, interactions with other fields,
+ * examples, history) lives here instead, fetched on demand by the `tool_help`
+ * MCP tool (`tool-help-mcp.ts`) and the `agentproto help <tool>` CLI verb
+ * (`packages/cli/src/commands/help.ts`) — both call the two functions below,
+ * so the markdown file is the single source both surfaces read.
+ *
+ * `docs/mcp-tools/` sits at the PACKAGE root (a sibling of `src`/`dist`, not
+ * the repo-level `docs/`) so it ships inside the published npm tarball —
+ * see the `files` array in `package.json`. Resolved relative to this
+ * module's own directory rather than by package name: whether this code is
+ * running from `src` (vitest, no build) or `dist` (built/published), the
+ * module's directory is always a direct child of the package root, so one
+ * `..` reaches it either way — no `require.resolve` needed.
+ */
+/** Full markdown help text for `name`, or `undefined` when no doc exists. */
+declare function getToolHelp(name: string): string | undefined;
+/** Every tool name with a help doc available — for a "did you mean" list. */
+declare function listToolHelpTopics(): string[];
+/** Extract a `## <topic>` section (case-insensitive) up to the next `##`
+ *  heading — shared by the `tool_help` MCP tool and the `agentproto help`
+ *  CLI verb so both slice a doc identically. `undefined` when no section
+ *  with that heading exists. */
+declare function extractHelpSection(doc: string, topic: string): string | undefined;
+
+/**
+ * Subtree usage rollup: one session's own usage plus the summed usage of
+ * every session it (transitively) spawned — the shape `session_usage
+ * { includeSubtree: true }` and `GET /sessions/:id/usage?includeSubtree=1`
+ * return.
+ *
+ * Pure over a descriptor list (walked by `parentSessionId`, the same graph
+ * `collectSubtree` uses for orchestrator scoping), so it's unit-testable
+ * without a registry.
+ *
+ * Absent stays absent: a total is the sum of the sessions that REPORT the
+ * field, and is omitted entirely when none of them do — a subtree of
+ * cost-less sessions never reads as a measured $0.
+ */
+
+/** Summed usage across the root and all its descendants. */
+interface SubtreeUsageTotals {
+    /** Sessions counted, root included. */
+    sessions: number;
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+}
+/** One direct child of the root, with that child's OWN usage (its own
+ *  descendants roll up into `subtree`, not here). */
+interface SubtreeChildUsage {
+    id: string;
+    label?: string;
+    status: SessionDescriptor["status"];
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+}
+interface SessionUsageWithSubtree {
+    self: SessionUsage;
+    subtree: SubtreeUsageTotals;
+    children: SubtreeChildUsage[];
+}
+/**
+ * Roll `root`'s usage up over its subtree. `all` should be the FULL
+ * descriptor list (archived included) so an archived intermediate session
+ * doesn't sever the parent→child chain.
+ */
+declare function rollupSessionSubtree(root: SessionDescriptor, all: readonly SessionDescriptor[]): SessionUsageWithSubtree;
+
 /**
  * Dependency-injection surface for MCP credential resolution.
  *
@@ -10399,6 +11085,26 @@ declare function enrichRollupWithProviderQuota(rollup: UsageRollup, window: stri
  *  such lines; skips any malformed or non-`usage_snapshot` line. Never throws. */
 declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promise<UsageSnapshotRecord[]>;
 
+/**
+ * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
+ * operator who already configured a named endpoint, an upstream credential
+ * link, or an explicit `llm-endpoint` custom route is clearly USING the
+ * proxy already — booting with the sidecar off (today's default) would
+ * silently break their next `route:{gateway:"llm-endpoint"}` spawn on a
+ * fresh install. An operator who never touched any of that gets the
+ * unchanged, conservative default (off).
+ *
+ * An explicit `configured` value (`config.json`'s `features.llmEndpoint`,
+ * profile-overlaid) always wins, in either direction — this resolver only
+ * fills in the gap when the operator left the flag unset.
+ */
+/**
+ * Resolve the EFFECTIVE `features.llmEndpoint` flag. `configured` is the
+ * operator's merged config value (`undefined` when never set in either
+ * `config.json` or the active profile).
+ */
+declare function resolveEffectiveLlmEndpointFlag(configured: boolean | undefined): Promise<boolean>;
+
 /**
  * MCP tools that drive the pairing registry — the daemon's "let a client pair
  * with me over an untrusted rendezvous" surface (design: DESIGN §6).
@@ -10420,6 +11126,90 @@ interface RegisterPairingToolsOptions {
 }
 declare function registerPairingTools(server: McpServer, opts: RegisterPairingToolsOptions): void;
 
+/**
+ * Device registry — a read view over `PairingRegistry` (+, when wired,
+ * `HostRegistry`) that presents each pairing/host as a "device" (DEVICES-PLAN
+ * PR-A, hosts added PR-C). A paired CLIENT (today's `pair_offer`/`pair
+ * accept`) gets `role: "client"`; a registered HOST (`pair offer --host` +
+ * `devices add`, host-registry.ts) gets `role: "host"`.
+ *
+ * This is deliberately a thin computed view, not a second store: renaming
+ * and revoking a client device mutate the same `pairings.json`
+ * `PairingRegistry` already owns; a host device mutates the same
+ * `hosts.json` `HostRegistry` — so `pair_*`/`/pairings` and
+ * `device_*`/`/devices` are two surfaces over the same two sources of truth.
+ */
+
+type DeviceRole = "client" | "host";
+type DeviceKind = "browser" | "cli" | "daemon";
+interface Device {
+    fingerprint: string;
+    name: string;
+    role: DeviceRole;
+    kind: DeviceKind;
+    rendezvous: string;
+    createdAt: string;
+    lastSeen: string;
+    /** A channel (offer or reconnect) is served for this device right now
+     *  (client) or a `forwardHttp` call is in flight for it right now (host).
+     *  For a host this is NOT a live heartbeat — see host-registry.ts's
+     *  "Online tracking" — it only reflects actual recent/current traffic. */
+    online: boolean;
+    /** A pair/v1 pairing: listed and revocable, but can't connect until
+     *  re-paired — see `PairingRecord.legacy`. */
+    legacy?: true;
+    /** Set when this device's pairing/host record was granted under a
+     *  HOST-scoped offer (`agentproto pair offer --host`) — see
+     *  offer-url.ts's "Offer scope". Surfaced from either side of a pairing so
+     *  a user can see, from EITHER daemon, which of their pairings/hosts grant
+     *  host control. */
+    scope?: "host";
+}
+interface DeviceRegistry {
+    /** Every known device. Read-only. */
+    list(): Promise<Device[]>;
+    /** Rename a device (fingerprint or current name) to a new label. Tries the
+     *  pairing registry first, then the host registry. Returns false when
+     *  nothing matched. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
+    /** Drop a device by fingerprint or name — same effect as `pair revoke` for
+     *  a client device, `devices revoke`-of-a-host for a host device. Tries
+     *  the pairing registry first, then the host registry. Returns false when
+     *  nothing matched. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Register a host from an offer URL (delegates to `HostRegistry.add`).
+     *  Rejects if no `HostRegistry` was wired into this device registry. */
+    add(offerUrl: string, name?: string): Promise<{
+        fingerprint: string;
+        name: string;
+        rendezvousUrl: string;
+    }>;
+}
+declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegistry): DeviceRegistry;
+
+/**
+ * MCP tools over the device registry (DEVICES-PLAN PR-A/PR-C) — `device_list`
+ * / `device_rename` / `device_revoke` / `device_add`. A view on top of the
+ * same registries `pair_offer`/`pair_list`/`pair_revoke` (pairing-tools.ts)
+ * and host-registry.ts drive; those keep working unchanged. `device_revoke`
+ * has the exact effect of `pair_revoke` for a client device.
+ *
+ * `device_add` (PR-C) registers a HOST from a `--host`-scoped offer URL —
+ * see `HostRegistry.add`'s scope gate (host-registry.ts). It requires the
+ * gateway to have wired a `HostRegistry` into the `DeviceRegistry`; without
+ * one the call rejects with a clear message rather than a missing-tool error
+ * (this repo always wires one when `pairingRegistry` is wired, so that's
+ * only reachable via a deliberate host misconfiguration).
+ *
+ * Registered beside `pair_*` — same closure-rebind pattern; the registry
+ * singleton lives on the gateway.
+ */
+
+interface RegisterDeviceToolsOptions {
+    registry: DeviceRegistry;
+}
+declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
+
 /**
  * Rate-limited failure logging for reconnect loops.
  *
@@ -11257,6 +12047,15 @@ interface SessionWaitResult {
      *  reported one. `"error"` means the adapter reported a failed turn.
      *  Same three-branch coverage as `empty`. */
     reason?: string;
+    /** The matched turn-end's captured error text — `SessionTurnEndEvent.error`
+     *  on the ring-replay/bus branches, `SessionDescriptor.lastTurnErrorMessage`
+     *  on the sync fast-path (no event object to read there). Present only
+     *  when `reason` is `"error"` AND the adapter emitted an in-band `error`
+     *  stream event during the turn. Same three-branch coverage as `empty`/
+     *  `reason` — this is the field a waiter (a supervisor session, `sessions
+     *  wait`, a webhook) needed to actually learn WHY a turn errored instead
+     *  of just that it did. */
+    error?: string;
 }
 /**
  * Block until one of the listed sessions fires a matching lifecycle event
@@ -11406,6 +12205,12 @@ interface CreateGatewayOptions {
      *  to an `enabled: false` summary. Also surfaced in `daemon_health` /
      *  `GET /health` so an operator can see the effective value. */
     resumeSessionsOnBoot?: boolean;
+    /** Opt-in continue-on-boot. Mirrors the `daemon.continueInterruptedOnBoot`
+     *  config knob; when true, the `continueInterruptedOnBoot()` handle method
+     *  runs the boot continue pass (see `continue-interrupted.ts`); when
+     *  false/omitted it short-circuits to an `enabled: false` summary. Surfaced
+     *  in `daemon_health` / `GET /health`. */
+    continueInterruptedOnBoot?: boolean;
     /** Idle agent-session reaper threshold in ms (PR-6). Mirrors the
      *  `daemon.idleReapAfterMs` config knob; the CLI resolves it (env >
      *  config > off) and passes it here. When positive, the gateway starts a
@@ -11659,6 +12464,17 @@ interface CreateGatewayOptions {
      * returns) so the injected `serve` can capture the finished gateway.
      */
     pairingRegistry?: PairingRegistry;
+    /**
+     * Optional HOST registry (see `createHostRegistry`, DEVICES-PLAN PR-C) —
+     * the reverse-pairing "client" half of pair/v2, living daemon-side. When
+     * wired alongside `pairingRegistry`, the gateway layers registered hosts
+     * into `device_list`/`GET /devices`, and enables the `device_add` MCP tool
+     * plus `POST /devices/add` + `POST /devices/:id/exec`. Unlike
+     * `pairingRegistry`, this registry keeps no standing connections — every
+     * `add`/`forwardHttp` dials fresh — so there is nothing for the gateway to
+     * autoconnect or tear down on shutdown.
+     */
+    hostRegistry?: HostRegistry;
     /** Enable the local LLM Endpoint proxy sidecar (route registration,
      *  MCP tools, child-process lifecycle). Default false — the endpoint is
      *  an opt-in feature; when off, the `llm-endpoint` custom route is not
@@ -11700,6 +12516,10 @@ interface GatewayHandle {
      *  `CreateGatewayOptions.pairingRegistry`. Undefined otherwise. Exposed so
      *  the CLI can `startAutoconnect()` after boot and `shutdown()` it. */
     pairing?: PairingRegistry;
+    /** HOST registry, when one was wired via `CreateGatewayOptions.hostRegistry`
+     *  (DEVICES-PLAN PR-C). Undefined otherwise. No autoconnect/shutdown to
+     *  call on it — see that option's doc comment. */
+    hosts?: HostRegistry;
     /** Per-boot bearer token required on mutating /sessions/* routes
      *  + WS PTY upgrades. Exposed so an embedding host (e.g. the CLI
      *  shell that hosts the gateway in-process) can pass it to child
@@ -11724,6 +12544,16 @@ interface GatewayHandle {
     resumeSessionsOnBoot(opts?: {
         isServed?: (desc: SessionDescriptor) => boolean;
     }): Promise<EagerResumeSummary>;
+    /** Run the opt-in continue-on-boot pass and return its tally — a no-op
+     *  returning `{ enabled: false, ... }` when the `continueInterruptedOnBoot`
+     *  knob is off. serve.ts invokes this right AFTER `resumeSessionsOnBoot()`
+     *  (so a row whose eager resume failed is recognisable and skipped) — and
+     *  therefore, like it, after the supervisor was re-armed, so a re-armed
+     *  completion policy sees the continue turn's turn-end. Same `isServed`
+     *  cross-process gate. */
+    continueInterruptedOnBoot(opts?: {
+        isServed?: (desc: SessionDescriptor) => boolean;
+    }): Promise<ContinueOnBootSummary>;
     stop(): Promise<void>;
 }
 /**
@@ -11740,4 +12570,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LocatedConversation, type LocatedConversationByPath, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
+export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, HOSTS_VERSION, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostRecord, type HostRegistry, type HostRegistryDeps, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, type SubtreeChildUsage, type SubtreeUsageTotals, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageDetail, type UsageReadContext, type UsageReadResult, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };