@agentproto/runtime 4.0.0 → 5.1.0

package/dist/session-presence.mjs

@@ -1,11 +1,11 @@
 import { createHash } from 'crypto';
 import { join, resolve } from 'path';
+import '@agentproto/model-catalog/llm';
 import { createReadStream, promises } from 'fs';
 import { homedir } from 'os';
 import { createInterface } from 'readline';
 import 'fs/promises';
 import * as providers_store_star from '@agentproto/providers-store';
-import '@agentproto/model-catalog/llm';
 import '@agentproto/model-catalog/route-identity';
 import '@agentproto/provider-presets';
 import '@agentproto/secrets/provision/recipe';
@@ -169,6 +169,10 @@ var init_tool_call_record = __esm({
   "src/tool-call-record.ts"() {
   }
 });
+var init_usage = __esm({
+  "src/usage.ts"() {
+  }
+});
 function defaultTranscriptBaseDir() {
   return join(homedir(), ".agentproto", "sessions");
 }
@@ -182,6 +186,7 @@ var init_transcript_writer = __esm({
   "src/transcript-writer.ts"() {
     init_tool_call_record();
     init_pr_provenance();
+    init_usage();
   }
 });
 
@@ -578,11 +583,11 @@ async function discoverHermesSessions(cwd, since, expectedId) {
   }
 }
 async function defaultHermesRunner(adapterSessionId) {
-  const { spawn: spawn4 } = await import('child_process');
+  const { spawn: spawn5 } = await import('child_process');
   return new Promise((resolve16, reject) => {
     const chunks = [];
     const errChunks = [];
-    const proc = spawn4(
+    const proc = spawn5(
       "hermes",
       ["sessions", "export", "--session-id", adapterSessionId, "-"],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -1929,6 +1934,29 @@ var init_worktree_identity = __esm({
     z.object({ worktreeId: z.string() });
   }
 });
+var init_mcp_imports = __esm({
+  "src/mcp-imports.ts"() {
+  }
+});
+var bundleIdSchema, bundleSchema;
+var init_bundles = __esm({
+  "src/bundles.ts"() {
+    init_mcp_imports();
+    bundleIdSchema = z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "id must be lowercase kebab-case (letters, digits, hyphens)");
+    bundleSchema = z.object({
+      id: bundleIdSchema,
+      label: z.string().min(1),
+      description: z.string().min(1).optional(),
+      mcpImports: z.array(z.string().min(1)),
+      includeDaemon: z.boolean().optional(),
+      skills: z.array(z.string().min(1))
+    });
+    z.object({
+      version: z.literal(1),
+      bundles: z.array(bundleSchema)
+    });
+  }
+});
 var init_catalog_models = __esm({
   "src/catalog-models.ts"() {
     init_spawn_defaults();
@@ -2132,10 +2160,13 @@ var init_sandbox_adapters = __esm({
 var init_session_spawn = __esm({
   "src/session-spawn.ts"() {
     init_sessions();
+    init_transcript_writer();
     init_workspaces_config();
     init_config();
     init_worktree_identity();
     init_spawn_defaults();
+    init_bundles();
+    init_mcp_imports();
     init_launch_config();
     init_claude_code_oauth_source();
     init_providers_store();
@@ -2189,7 +2220,7 @@ var init_sandbox_spec_schema = __esm({
     }).strict();
   }
 });
-var commandSandboxSchema, attachFieldSchema, contextContinuityInputSchema;
+var commandSandboxSchema, attachFieldSchema, contentBlockSchema, promptInputSchema, contextContinuityInputSchema;
 var init_spawn_field_schemas = __esm({
   "src/spawn-field-schemas.ts"() {
     commandSandboxSchema = z.enum(["off", "workspace", "strict"]);
@@ -2197,6 +2228,12 @@ var init_spawn_field_schemas = __esm({
       z.boolean(),
       z.object({ parent: z.string().min(1).optional() })
     ]);
+    contentBlockSchema = z.record(z.string(), z.unknown());
+    promptInputSchema = z.union([
+      z.string().min(1),
+      contentBlockSchema,
+      z.array(contentBlockSchema).min(1)
+    ]);
     contextContinuityInputSchema = z.object({
       mode: z.enum(["manual", "ask", "auto"]).optional(),
       warnAtPct: z.number().int().min(0).max(100).optional(),
@@ -2217,7 +2254,7 @@ var init_spawn_field_schemas = __esm({
     });
   }
 });
-var mcpBool, mcpPositiveNumber, agentStartInputShape, agentStartInputSchema;
+var mcpBool, mcpPositiveNumber, help, agentStartInputShape, agentStartInputSchema;
 var init_agent_start_schema = __esm({
   "src/agent-start-schema.ts"() {
     init_json_tolerant();
@@ -2231,78 +2268,82 @@ var init_agent_start_schema = __esm({
       (v) => typeof v === "string" && v.trim() !== "" ? Number(v) : v,
       z.number().positive()
     );
+    help = (field) => `Details: tool_help {name:"agent_start", topic:"${field}"}`;
     agentStartInputShape = {
       adapter: z.string().min(1).optional().describe(
-        "Adapter slug \u2014 one of the installed `@agentproto/adapter-*` packages (e.g. 'claude-code', 'hermes', 'aider'). Omit only when `presetId` names a saved preset with an adapter."
-      ),
-      harness: z.string().min(1).optional().describe(
-        "Canonical harness slug \u2014 alias for `adapter`. Accepts the same values; use whichever field your caller produces."
+        `Adapter slug (e.g. 'claude-code', 'hermes', 'aider'). Omit only when \`presetId\` supplies one. ${help("adapter")}`
       ),
+      harness: z.string().min(1).optional().describe(`Alias for \`adapter\` \u2014 same values, whichever your caller produces.`),
       presetId: z.string().min(1).optional().describe(
-        "Saved user spawn preset id from `agentproto preset list`. Its adapter and decomposed axes are applied first; explicit fields on this call override it."
+        "Saved spawn preset id from `agentproto preset list`. Explicit fields on this call override its values."
       ),
       workspaceSlug: z.string().optional().describe(
-        "Workspace slug from `agentproto workspace list`. The daemon resolves it to an absolute path. Omit to use the `cwd` field or the active workspace."
+        "Workspace slug from `agentproto workspace list`, resolved to a path. Omit to use `cwd` or the active workspace."
       ),
-      cwd: z.string().optional().describe(
-        "Absolute path to spawn the agent in. Wins over `workspaceSlug` when both are set."
-      ),
-      prompt: z.string().optional().describe(
-        "Optional initial prompt. The session is spawned and the prompt dispatched in one shot \u2014 equivalent to `start` then `prompt` back-to-back. Skip to spawn idle."
-      ),
-      label: z.string().optional().describe(
-        "Free-text label that surfaces in `agent_sessions_list` and the UI \u2014 useful for tagging sessions with a conversation id or operator name."
+      cwd: z.string().optional().describe("Absolute path to spawn the agent in. Wins over `workspaceSlug` when both are set."),
+      prompt: promptInputSchema.optional().describe(
+        'Optional initial prompt \u2014 spawns and dispatches it in one call (spawn + `agent_prompt` combined). Omit to spawn idle. A plain string is composed with the role/AGENTS.md disposition preamble as usual; a content block or block array (e.g. a pasted image, `{type:"image", data, mimeType}`) SKIPS that composition and is sent to the adapter verbatim \u2014 the adapter negotiates its own multimodal support. ' + help("prompt")
       ),
+      label: z.string().optional().describe("Free-text label shown in `agent_sessions_list` and the UI."),
       mode: z.string().optional().describe(
-        "Manifest-declared mode id (AIP-45 `modes`) applied at spawn time, BEFORE the child process starts \u2014 e.g. claude-code's 'plan' (read-only: reasons and proposes but does not edit or run commands), 'accept-edits', 'bypass-permissions'; codex's 'read-only' / 'full-access'; mastracode/opencode's 'plan' / 'build'. Adapters that don't declare `modes` (e.g. hermes) reject ANY value here \u2014 only pass this for adapters known to support it. Omit for the adapter's normal interactive mode."
+        `Manifest-declared mode id (AIP-45 \`modes\`), applied before the child starts (e.g. claude-code's 'plan'/'accept-edits'/'bypass-permissions'). Adapters with no declared \`modes\` REJECT any value here. ${help("mode")}`
       ),
       origin: z.string().min(1).optional().describe(
-        "Source label for this spawn \u2014 the calling channel/harness (codex, cowork, vscode, cron, \u2026). Descriptor-only: groups the session under a source node in the tree. In-repo callers set it; the mcp-bridge can auto-stamp it from the host clientInfo."
+        "Source label for this spawn (codex, cowork, vscode, cron, \u2026) \u2014 descriptor-only, groups the session under a source node in the tree."
       ),
       parentSessionId: z.string().min(1).optional().describe(
-        "Parent-lineage hint: attribute this spawn to a logical parent session so it nests under that node in the sessions tree instead of appearing as a depth-0 root. Pass the `id` of the session doing the spawning (e.g. an agent-to-agent `agent_start`). The child's `depth` is derived from the parent (parent depth + 1); you don't set it. Ignored when this call arrives through the scoped orchestrator gateway \u2014 that path derives the parent from its own token, which always wins over this hint."
+        `Parent-lineage hint: nests this spawn under that session in the tree instead of a depth-0 root. Ignored through the scoped orchestrator gateway (its own token wins). ${help("parentSessionId")}`
       ),
       attach: jsonTolerant(attachFieldSchema).optional().describe(
-        'Parent-attach control, mirroring `worktree`. By DEFAULT (omitted) a spawn attaches under the session that made it \u2014 the daemon derives that parent from the trusted caller id, so a supervisor\'s executors nest instead of appearing as depth-0 roots, no `parentSessionId` needed. Pass `false` to launch an INDEPENDENT root (no parent) \u2014 the deliberate detached spawn. `true` forces attach even under an `on-request` daemon policy; `{ parent: "<id>" }` pins an explicit parent. Ignored when this call arrives through the scoped orchestrator gateway (the scope token wins). Descriptor-only lineage: never relaxes a depth-gated worktree/role guard.'
+        `Parent-attach override, mirrors \`worktree\`. Default attaches under the calling session; \`false\` = independent root; \`true\` forces attach; \`{ parent: "<id>" }\` pins an explicit parent. ${help("attach")}`
       ),
       boardId: z.string().min(1).optional().describe(
-        "Task-board pin for the spawned child, stamped onto its descriptor as `meta.boardId`. The Task ledger resolves the child's default board from this BEFORE walking `parentSessionId` lineage \u2014 so a client spawning several depth-0 root sessions (no shared lineage) can join them all onto ONE shared board. An explicit `boardId` passed on a task verb still wins over this pin. Omit for the lineage-derived `tree:<root>` default."
+        `Task-board pin for the child (\`meta.boardId\`), resolved before parent-lineage. An explicit board on a task verb still wins. ${help("boardId")}`
       ),
       idempotencyKey: z.string().min(1).optional().describe(
-        "Caller-declared 'this is the same logical spawn' token \u2014 a PROMISE, not a guess. A retried agent_start call (e.g. after a slow/lost response) that repeats the same `idempotencyKey` for the same `adapter`+`cwd` within ~10min of a successful spawn gets that SAME session's descriptor back instead of forking a second process \u2014 the response carries `deduped: true` and `dedupeSource: \"explicit\"` so you can tell. Always wins over the daemon's own derived key (see `dedupe` below) when both would apply. Omitting this does NOT mean 'spawn unconditionally' \u2014 see `dedupe`."
+        `Caller-declared dedup token: a retried call with the SAME key for the same \`adapter\`+\`cwd\` within ~10min of a successful spawn returns that SAME session (\`deduped: true\`) instead of forking a new one. Always wins over the implicit key \`dedupe\` derives. ${help("idempotencyKey")}`
       ),
       dedupe: mcpBool.optional().describe(
-        'Per-call override for the daemon\'s `spawn.dedupe` policy \u2014 what happens when NO `idempotencyKey` is supplied. By DEFAULT (`spawn.dedupe: "always"`) a spawn that carries a `label` gets an IMPLICIT key derived from that label plus a hash of `prompt`, and dedupes against it exactly like an explicit key \u2014 set `dedupeSource: "implicit"` on the response (alongside `deduped: true`) so you can tell it wasn\'t your own promise that matched. A spawn with no `label` is never touched by this \u2014 deliberate parallel fan-out into one cwd (a real, exercised pattern here) needs no label and stays exactly as many sessions as you asked for. Pass `dedupe: false` to opt this ONE spawn out of implicit derivation regardless of policy \u2014 the escape hatch, mirroring `attach: false` / `worktree: false`. `dedupe: true` forces derivation even under an `"on-request"` daemon policy, mirroring `attach: true`. Unrelated and NOT covered by this flag: a `worktree` spawn that lands in a worktree another LIVE session already occupies under the same `label` is always refused (`dedupeSource: "worktree-cwd"`) \u2014 a shared worktree, unlike a shared plain cwd, is never a legitimate fan-out.'
+        `Override the implicit dedup-by-\`label\` default (on when no \`idempotencyKey\` is given): \`false\` opts this spawn out, \`true\` forces it even under an "on-request" daemon policy. ${help("dedupe")}`
       ),
       permissionHold: mcpBool.optional().describe(
-        "Start the session in permission-hold mode: every ACP permission request the agent raises (Write, Bash, \u2026) is SURFACED and HELD in the cross-session inbox (`permissions_list` / `permissions_respond`) instead of auto-answered, and the agent blocks until a human/orchestrator approves or denies it. Default false = today's auto-answer behaviour. ACP adapters only; others ignore it."
+        "Hold every ACP permission request in the cross-session inbox (`permissions_list`/`permissions_respond`) instead of auto-answering. ACP adapters only; default false."
       ),
       notifyParentOnCrash: mcpBool.optional().describe(
-        "Opt this spawn into a direct in-band crash notice to its parent: if THIS session later crashes (adapter process gone between turns), the parent (`parentSessionId`, direct or inherited) is told via `[child-crashed] <label/id>: <reason> \u2014 <lastError>` \u2014 enqueued immediately if the parent is alive and idle, or queued for its next turn (never interrupting an in-flight one) if it's busy. Default false. The free external webhook (`notifyUrl`) already fires on any crash regardless of this flag \u2014 this only adds the direct signal into the parent's OWN session, for a delegating supervisor that wants to react to a child's death without polling."
+        `Notify this session's parent directly (in-band) if it later crashes. Independent of the global \`notifyUrl\` webhook, which fires either way. ${help("notifyParentOnCrash")}`
+      ),
+      sentinel: mcpBool.optional().describe(
+        `Set false to opt this spawn OUT of sentinel auto-link: a PR this session opens will never get an automatic AIP-60 sentinel watching it, regardless of the daemon's \`sentinel.autoWatchPrs\` config. ${help("sentinel")}`
       ),
       allowSharedCwd: mcpBool.optional().describe(
-        "Acknowledge that this nested spawn WILL run in place inside its parent's working tree even when that tree has uncommitted changes and isn't an isolated worktree \u2014 silencing the shared-dirty-cwd warning agent_start otherwise returns in `warnings`. Only relevant for a delegated (depth > 0) spawn with no `worktree` and no `sandbox`; ignored otherwise. Default false = warn."
+        "Acknowledge running a nested spawn in the parent's dirty working tree, silencing the shared-dirty-cwd warning. Only relevant with no `worktree`/`sandbox`; default false = warn."
       ),
       keepAlive: mcpBool.optional().describe(
-        "Exempt this session from the idle-reaper: it is never auto-retired for sitting idle, no matter how long. For a supervisor that legitimately parks \u2014 waiting on a child, waiting on a scheduled wake \u2014 idle looks identical to finished, and the reaper would otherwise pull it out from under you. Default false = today's behaviour. Toggle later with `session_set_keepalive`."
+        "Exempt this session from the idle-reaper \u2014 never auto-retired for sitting idle. Default false. Toggle later with `session_set_keepalive`."
       ),
       options: jsonTolerant(
         z.record(z.string(), z.union([z.boolean(), z.number(), z.string()]))
       ).optional().describe(
-        "Manifest-declared option id \u2192 value map (AIP-45 `options`), applied at spawn time alongside `mode` \u2014 e.g. hermes' `skills` (string, prepended before the subcommand) or a boolean flag appended when true. Each value is validated against the option's declared `type`/`enum`/`min`/`max`; unknown ids reject. Adapters that don't declare a given option id reject it."
+        "Manifest-declared option id \u2192 value map (AIP-45 `options`), validated against each option's declared type/enum/min/max. Unknown ids reject."
       ),
       skills: jsonTolerant(z.array(z.string())).optional().describe(
-        "Normalized, adapter-agnostic skill ids for this session (e.g. ['agentproto']). Merges with `~/.agentproto/config.json`'s `defaults.skills` / `defaults.adapters.<slug>.skills` (global < per-adapter < this field, which REPLACES rather than unions the config defaults when provided \u2014 a deliberate exact set). Folded into `options.skills` using the resolved adapter's declared shape (e.g. hermes' comma-joined `--skills a,b`); adapters with no declared `skills` option (e.g. claude-code, which auto-discovers from `~/.claude/skills`) ignore this \u2014 no-op."
+        `Normalized skill ids for this session (e.g. ['agentproto']). REPLACES (not unions) config defaults when set. Adapters with no \`skills\` option (e.g. claude-code) ignore it. ${help("skills")}`
+      ),
+      bundles: jsonTolerant(z.array(z.string())).optional().describe(
+        `Capability bundle ids (\`bundle_list\`) to attach \u2014 each expands to its imported MCPs (mounted as native MCP servers, never via the mcp_imported_* indirection) + skills, and optionally the daemon's own /mcp. REPLACES (not unions) config defaults when set. ${help("bundles")}`
+      ),
+      daemonMount: mcpBool.optional().describe(
+        `Explicitly mount the daemon's own scoped /mcp gateway for this spawn \u2014 the only way an adapter outside the default self-mount set (opencode, codex, gemini, \u2026) gets it. Default false. ${help("daemonMount")}`
       ),
       model: z.string().optional().describe(
-        "Model identifier to pass to the adapter (e.g. 'claude-opus-4-8'). For ACP adapters (claude-code) applied via session/set_config_option after newSession \u2014 NOT via a CLI flag. Others may ignore it."
+        "Model identifier to pass to the adapter. For claude-code, applied via session/set_config_option \u2014 NOT a CLI flag."
       ),
       effort: z.string().optional().describe(
-        "Reasoning effort level (e.g. 'low', 'medium', 'high', 'xhigh', 'max', 'ultracode'). IMPORTANT: effort is calibrated per model \u2014 the same label maps to different compute budgets across models, and defaults differ by model (Sonnet 4.6 / Opus 4.8 default 'high'; Opus 4.7 default 'xhigh'). 'max' and 'ultracode' are session-only. Omit to keep the model's own default."
+        "Reasoning effort label ('low'/'medium'/'high'/'xhigh'/'max'/'ultracode'). Calibrated PER MODEL \u2014 the same label means different compute budgets across models. Omit to keep the model's own default."
       ),
       route: jsonTolerant(
         z.object({ gateway: z.string().min(1), baseUrl: z.string().url().optional() })
-      ).optional().describe("Billing route/gateway. This is independent of model and named access profile."),
+      ).optional().describe("Billing route/gateway. Independent of `model` and `access`."),
       access: jsonTolerant(z.object({ profileRef: z.string().min(1).optional() })).optional().describe("Named auth profile to bill at initial spawn; resolved from the local keychain."),
       posture: z.string().optional().describe("Canonical agent posture (plan, bypass, accept-edits, read-only) or native harness mode."),
       contextProfile: z.string().optional().describe("Context intake profile (for example full or lean)."),
@@ -2314,7 +2355,7 @@ var init_agent_start_schema = __esm({
           apiKey: z.string().optional()
         })
       ).optional().describe(
-        "Deterministic billing-auth mode + EXPLICIT credential for adapters that declare it (today: claude-code). EXPLICIT credential selection, not scrub-by-absence: `mode` picks 'subscription' (default) or 'api-key'; `token`/`apiKey` (matching the resolved mode) is the secret VALUE, merged against `~/.agentproto/config.json`'s `defaults.adapters.claude-code.auth` (this field's `mode` wins; the credential for the resolved mode wins over the matching config field). For claude-code, 'subscription' SETS CLAUDE_CODE_OAUTH_TOKEN to `token` (a bearer token minted via `claude setup-token` \u2014 bills the Max/Pro subscription, not API credits) and DELETES ANTHROPIC_API_KEY + the cloud-provider redirect toggles + ANTHROPIC_BASE_URL. 'api-key' SETS ANTHROPIC_API_KEY to `apiKey` and DELETES ANTHROPIC_AUTH_TOKEN \u2014 the deliberate 'bill the API' choice. FAILS FAST (refuses the spawn, no fallback) when the resolved mode has no credential configured anywhere. The secret is never logged or echoed back \u2014 only a fingerprint appears on the session descriptor / `agent_sessions_list`. Adapters that don't declare this vocabulary ignore this field entirely. `source: \"claude-code-oauth\"` (subscription mode, opt-in) instead reads the bearer FRESH on every spawn from the local Claude Code login (Keychain / ~/.claude/.credentials.json) \u2014 effectively self-refreshing; an explicit `token` still wins over it."
+        `Explicit billing-auth mode + credential for adapters that declare it (today: claude-code) \u2014 'subscription' (default) bills the Max/Pro plan, 'api-key' bills API credits. FAILS FAST with no fallback if the resolved mode has no credential configured anywhere. ${help("auth")}`
       ),
       mcpServers: jsonTolerant(
         z.array(
@@ -2322,42 +2363,34 @@ var init_agent_start_schema = __esm({
             name: z.string(),
             transport: z.enum(["stdio", "http", "sse"]),
             ref: z.string().optional(),
-            headers: z.record(z.string(), z.string()).optional().describe(
-              "Static HTTP headers sent with every request to an `http` or `sse` MCP server (e.g. a fixed auth token). Ignored for `stdio` transports."
-            ),
+            headers: z.record(z.string(), z.string()).optional().describe("Static HTTP headers for `http`/`sse` transports. Ignored for `stdio`."),
             credentialRef: z.string().optional().describe(
-              "Brokered credential path resolved at spawn time into additional `headers` (typically `Authorization`). The actual secret never lives in env or config; brokered headers win on collision with `headers`."
+              "Brokered credential resolved into `headers` at spawn time (wins on collision with `headers`); the secret never lives in env/config."
             ),
-            args: z.array(z.string()).optional().describe("`stdio` only: argv passed to the `ref` command. Ignored for `http`/`sse`."),
-            env: z.record(z.string(), z.string()).optional().describe("`stdio` only: extra environment for the launched server. Ignored for `http`/`sse`.")
+            args: z.array(z.string()).optional().describe("`stdio` only: argv passed to the `ref` command."),
+            env: z.record(z.string(), z.string()).optional().describe("`stdio` only: extra environment for the launched server.")
           })
         )
       ).optional().describe(
-        "MCP servers to mount into the spawned agent's session at spawn time. Forwarded verbatim to `session/new.mcpServers` on the ACP arm \u2014 gives the child agent a host-chosen scoped toolset (e.g. the daemon's own orchestration gateway so it can spawn + supervise sub-agents). Adapters that don't model MCP mounting ignore it."
+        "MCP servers to mount into the spawned agent's session at spawn time. Adapters that don't model MCP mounting ignore it."
       ),
       orchestrator: jsonTolerant(
         z.union([
           z.boolean(),
           z.object({
-            tools: z.array(z.string()).optional().describe(
-              "Explicit allowlist \u2014 narrows the orchestration toolset to \u2286 the default subset. Names outside the default are dropped (a child can never widen its own scope). Omit for the full default subset."
-            ),
-            maxDepth: z.number().int().min(1).max(8).optional().describe(
-              "Max recursion depth reachable through this child (default 3, hard ceiling 8). A spawn that would exceed it is rejected. For a recursive spawn it can only LOWER the inherited cap, never raise it."
-            ),
-            maxChildren: z.number().int().min(1).optional().describe(
-              "Max concurrently-alive sub-agents this child may spawn (default 8). For a recursive spawn it can only lower the inherited quota."
-            )
+            tools: z.array(z.string()).optional().describe("Explicit allowlist \u2286 the default subset \u2014 a child can never widen its own scope."),
+            maxDepth: z.number().int().min(1).max(8).optional().describe("Max recursion depth reachable through this child (default 3, ceiling 8, lower-only on recursion)."),
+            maxChildren: z.number().int().min(1).optional().describe("Max concurrently-alive sub-agents this child may spawn (default 8, lower-only on recursion).")
           })
         ])
       ).optional().describe(
-        "Make this child a SCOPED orchestrator \u2014 auto-mount the daemon's own orchestration MCP tools (start/prompt/wait/poll/output + subtree list/kill) so it can spawn and supervise its OWN sub-agents. `true` = the default curated subset; `{ tools: [...] }` narrows it. The daemon mints a per-child scope-token, injects the scoped sub-gateway URL into the child's session (alongside any `mcpServers` you pass), and revokes the token when the session exits. Shell/fs/remote/import/terminal tools are NEVER exposed this way."
+        `Make this child a SCOPED orchestrator \u2014 auto-mounts the daemon's own spawn/supervise tools, scoped to its own sub-agents. \`true\` = default subset; \`{ tools }\` narrows it. Shell/fs/remote tools are NEVER exposed. ${help("orchestrator")}`
       ),
       notifyUrl: z.string().url().optional().describe(
         "Optional per-session webhook URL. POSTed (fire-and-forget) on this session's turn-end / awaiting-input / exited events, in addition to any global notify URL."
       ),
       wait: mcpBool.optional().describe(
-        "Block until the spawned session's first turn completes and include the cleaned output in the response. Default false = return the descriptor immediately. Note this blocks for the child's ENTIRE first turn (~40-90s+), not just the spawn. Batching several `wait: true` calls in one turn does NOT run them in parallel: harnesses that execute tool calls sequentially serialize them, each wait blocking its slot until its child's turn ends. For parallel fan-out spawn with `wait: false` (all spawns return in seconds), then wait on completion separately via `agentproto sessions wait <id> --until turn-end` (detached/background) or a completion policy via `policy_attach`."
+        `Block until the spawned session's first turn completes (~40-90s+) and include its output. Default false = return immediately. Batched \`wait:true\` calls do NOT run in parallel \u2014 see \`tool_help {name:"agent_start", topic:"wait"}\` for the fan-out pattern.`
       ),
       maxCostUsd: mcpPositiveNumber.optional().describe(
         "Hard ceiling on cumulative session cost (USD). The session is stopped at a turn-end once exceeded."
@@ -2369,45 +2402,39 @@ var init_agent_start_schema = __esm({
           scope: z.enum(["session", "profile"]).describe("Spend surface: this session, or every session on its auth profile.")
         })
       ).optional().describe(
-        "Windowed cost-budget cap (DISTINCT from `maxCostUsd`). Auto-attaches a governance policy that trips `policy:failed` when the rolling windowed spend for `scope` crosses `maxCostUsd`. Never kills the session \u2014 it trips a policy for a supervisor to act on."
+        "Windowed cost-budget cap (DISTINCT from `maxCostUsd`) \u2014 trips `policy:failed` on overage, never kills the session."
       ),
       restartPolicy: jsonTolerant(
         z.object({
-          on: z.array(z.enum(["crashed", "error"])).min(1).describe(
-            'Which automatic death reasons trigger a restart: "crashed" (the crash-detect sweep found the adapter process gone) and/or "error" (an unexpected turn error with no other intentional reason). Never restarts a clean exit, an operator kill, an idle-reap, a daemon-restart death, or a cost-budget kill, regardless of this list.'
-          ),
-          maxRetries: z.number().int().positive().describe(
-            "Rolling-window crash-loop cap: give up (leave the session dead, no further auto-restart) once this many restarts have fired within `windowMs`."
-          ),
+          on: z.array(z.enum(["crashed", "error"])).min(1).describe("Which automatic death reasons trigger a restart. Never a clean exit, kill, idle-reap, or cost-budget kill."),
+          maxRetries: z.number().int().positive().describe("Rolling-window crash-loop cap: give up after this many restarts within `windowMs`."),
           windowMs: z.number().int().positive().describe("Rolling window (ms) `maxRetries` counts restarts over."),
           baseDelayMs: z.number().int().positive().describe("First restart's backoff delay (ms), before `factor` compounds it."),
           factor: z.number().positive().describe("Exponential backoff multiplier applied per consecutive restart."),
           maxDelayMs: z.number().int().positive().describe("Backoff ceiling (ms) \u2014 the computed delay never grows past this."),
-          resume: z.boolean().optional().describe(
-            "Reserved for a future explicit resume-vs-fresh-spawn toggle; this PR always revives in place (same session id, same conversation)."
-          )
+          resume: z.boolean().optional().describe("Reserved for a future resume-vs-fresh-spawn toggle; this always revives in place today.")
         })
       ).optional().describe(
-        "Opt-in auto-restart policy (restart-scheduler PR-2). When set, an unexpected death (`crashed` and/or `error`, per `on`) is automatically revived IN PLACE (reusing the resume machinery \u2014 same session id, same conversation) after an exponential backoff, up to a rolling-window crash-loop cap. Omit for today's behaviour: a dead session stays dead until a human/orchestrator prompts or restarts it."
+        `Opt-in auto-restart policy: an unexpected death (\`crashed\`/\`error\`, per \`on\`) is revived IN PLACE after exponential backoff, up to a rolling-window crash-loop cap. Omit for today's stay-dead behaviour. ${help("restartPolicy")}`
       ),
       contextContinuity: jsonTolerant(contextContinuityInputSchema).optional().describe(
         "Context-continuity policy for this session \u2014 controls warning, opportunistic compaction, fresh-continuation, and hard-stop thresholds. Resolved from global \u2192 per-adapter \u2192 explicit override."
       ),
       role: z.string().optional().describe(
-        "Spawn-time role gating whether this child may itself delegate (spawn/drive further children) and, if it can, which roles IT may in turn spawn. Built-ins: 'executor' = leaf, cannot delegate \u2014 `orchestrator` is ignored and `agent_start`/`agent_prompt` are stripped from its default toolset, regardless of `promptAppend`. 'supervisor' = may delegate (today's default behaviour). Custom roles installed as role packs (see `role_list`) resolve the same way. A spawn made THROUGH an orchestrator is additionally gated by the privilege lattice: the calling role may only spawn a role allowlisted in its `spawnableRoles`, or \u2014 open mode, the default \u2014 at or below its own `level` (never something MORE privileged than itself). Omit `role` to derive from spawn depth (root spawns default to supervisor; spawns made through an orchestrator default to executor \u2014 see `defaultRoleDepthCutoff` in config.json's `defaults` block)."
+        `Spawn-time delegation gate. 'executor' = leaf, cannot delegate (\`agent_start\`/\`agent_prompt\` stripped). 'supervisor' = may delegate (default). Custom role packs resolve the same way. Omit to derive from spawn depth. ${help("role")}`
       ),
       promptAppend: z.string().optional().describe(
-        "One-off runtime text layered ON TOP of the resolved role's disposition and prepended to `prompt` \u2014 it specializes the disposition, it cannot replace it, and it cannot re-open the tool gate (an executor asked to 'delegate anyway' via this field still has no delegation tools)."
+        "One-off runtime text layered onto the resolved role's disposition and prepended to `prompt` \u2014 specializes it, cannot reopen a denied tool gate."
       ),
       deferredTools: z.boolean().optional().describe(
-        "Override deferred/lazy MCP tool loading for this spawn's daemon self-mount: `true` hides every tool outside a small always-on set from `tools/list` (still fully callable \u2014 use `tool_search` to look up a hidden tool's schema by keyword before calling it), `false` keeps the full eager surface. Omit to use the resolved role's own default ('executor' defaults ON, since it can't delegate anyway and rarely needs the full ~190-tool surface); omit AND spawn a role with no opinion to fall through to the daemon's own boot-time `defaults.mcp.deferredTools` config."
+        `Override lazy MCP tool loading for this spawn: \`true\` hides most tools from \`tools/list\` (still callable via \`tool_search\`), \`false\` keeps the full eager surface. Omit to use the role/daemon default. ${help("deferredTools")}`
       ),
       browser: z.preprocess(
         // `true` is sugar for the only mode; stringified booleans tolerated.
         (v) => v === true || v === "true" ? "headless" : v === "false" ? false : v,
         z.union([z.literal("headless"), z.literal(false)])
       ).optional().describe(
-        '`"headless"` gives the spawned agent its own isolated headless Chrome (1440x900, temporary profile) as a per-session `browser` MCP server (chrome-devtools-mcp: navigate_page, take_screenshot, evaluate_script, click, list_console_messages, \u2026), torn down with the session (`true` = `"headless"`). Works for any adapter that mounts stdio MCP servers; runs inside the session\'s `commandSandbox` (`strict` \u21D2 file:// only). `false` = none. Omit to use the role / preset / `defaults.spawn.browser` default (off). Not supported with `sandbox`.'
+        `\`"headless"\` gives the spawned agent its own isolated headless Chrome as a per-session \`browser\` MCP server, torn down with the session. \`false\` = none (default). Not supported with \`sandbox\`. ${help("browser")}`
       ),
       trace: z.boolean().optional().describe(
         "Emit Langfuse observability traces for this session (prompt/completion + tool spans + tokens/cost). Off by default; requires langfuse eval-reporter creds configured."
@@ -2416,22 +2443,22 @@ var init_agent_start_schema = __esm({
         z.union([
           z.string().min(1).describe("Sandbox provider slug from `list_sandbox_providers` (e.g. 'local', 'e2b')."),
           sandboxSpecWithReuseSchema.describe(
-            "Inline AIP-36 SandboxDefinition \u2014 boots this exact spec instead of a catalog slug. Set `reuse` (sandboxId, ledger label, or unique sandboxId prefix \u2014 see `agentproto sandbox list`) to reconnect to an existing sandbox instead of booting fresh."
+            "Inline AIP-36 SandboxDefinition \u2014 boots this exact spec instead of a catalog slug. Set `reuse` to reconnect to an existing sandbox instead of booting fresh."
           )
         ])
       ).optional().describe(
-        "Run this session inside a sandbox instead of on the host \u2014 pass a provider slug (see `list_sandbox_providers`) or an inline AIP-36 SandboxDefinition object. The daemon boots the sandbox, spawns `adapter` on the box's OWN agentproto daemon, and proxies the conversation back onto this session \u2014 `agent_prompt`/`agent_output`/`agent_kill` behave exactly as they do for a local spawn, and the transcript stays readable here even after the box is torn down. Omit to run locally (default). Pass an inline spec with `reuse: \"<sandboxId>\"` (from a prior session's `sandboxId`) to reconnect to an existing box instead \u2014 by default such a box is PAUSED (not killed) on session close so it stays reusable; set `lifecycle.destroy_on` to always kill it. DO NOT CONFUSE with `commandSandbox` below \u2014 this field boots a WHOLE SEPARATE machine/box; `commandSandbox` confines THIS host's own spawn argv in place. The two are independent and combine (or not) freely; `commandSandbox` is ignored for a `sandbox` spawn (the box's own daemon would need to apply it)."
+        `Run this session inside a sandbox instead of on the host (provider slug or inline AIP-36 spec) \u2014 the daemon boots the box, spawns \`adapter\` on its own agentproto daemon, and proxies the conversation back here. DISTINCT from \`commandSandbox\` (whole separate machine vs. confining this host's own process). Omit to run locally. ${help("sandbox")}`
       ),
       appServe: jsonTolerant(
         z.object({
           dir: z.string().min(1).describe("Absolute path to the app's directory INSIDE the sandbox box (e.g. '/home/user/apps/<slug>')."),
-          port: z.number().int().min(1).max(65535).optional().describe("Port the UI binds inside the box (default 3210). The port is exposed by the sandbox provider and its public URL returned.")
+          port: z.number().int().min(1).max(65535).optional().describe("Port the UI binds inside the box (default 3210). Exposed by the sandbox provider as a public URL.")
         }).strict()
       ).optional().describe(
-        "WP3 \u2014 serve an agentproto app's UI from INSIDE the sandbox box and return its public URL. Requires `sandbox` (rejected otherwise). The box daemon installs the app (`app_install` on the in-box `dir`), launches `agentproto app serve --host 0.0.0.0 --port <port>` detached through the box's `command_execute`, and the spawn result + descriptor carry `appServe: { appId, dir, port, url, ready }` \u2014 `url` is the provider-resolved public URL for the served UI (the port is also added to the spec's `extraPorts` and echoed in `sandboxPorts`)."
+        `Serve an agentproto app's UI from INSIDE the sandbox box and return its public URL. Requires \`sandbox\` (rejected otherwise). ${help("appServe")}`
       ),
       commandSandbox: commandSandboxSchema.optional().describe(
-        'OS-level process confinement (macOS Seatbelt / Linux bubblewrap) for the adapter\'s OWN spawned process on THIS host \u2014 NOT the `sandbox` field above, which boots an entirely separate remote box. This wraps the exact argv `adapter` spawns as (e.g. `claude`, `npx @agentclientprotocol/claude-agent-acp`) so its process tree is denied filesystem access outside the session\'s `cwd` \u2014 confinement an ACP permission seam can never provide, since it only sees tool calls the adapter chooses to report, not what an in-process Bash actually touches. `"off"` (default when omitted AND no `.agentproto/command-sandbox.json` sets an `adapterSpawn.mode`) = unconfined, unchanged behaviour. `"workspace"` = deny reads/writes to $HOME outside the workspace (protects ~/.ssh, ~/.aws, credentials, \u2026); network stays allowed. `"strict"` = `"workspace"` + deny all network. A workspace can set this same axis persistently via the `adapterSpawn` key of `.agentproto/command-sandbox.json` (a DISTINCT key from the top-level `mode` that key file also carries for `command_execute` \u2014 the two are never shared; misconfiguring the whole-session adapter jail is a bigger blast radius than misconfiguring one shell command) \u2014 this param, when set, overrides that file. Ignored for a `sandbox` spawn. `"workspace"`/`"strict"` with no backend installed for this platform (macOS needs `sandbox-exec`, Linux needs `bwrap`) FAILS the spawn rather than silently running unconfined.'
+        `OS-level confinement (macOS Seatbelt / Linux bubblewrap) of the adapter's OWN process on THIS host \u2014 NOT \`sandbox\` above, which boots a separate machine. \`"off"\` (default) = unconfined; \`"workspace"\` = deny reads/writes outside cwd; \`"strict"\` = + deny network. Fails the spawn if the OS backend isn't installed. ${help("commandSandbox")}`
       ),
       worktree: jsonTolerant(
         z.union([
@@ -2440,17 +2467,15 @@ var init_agent_start_schema = __esm({
             slug: z.string().regex(
               /^[a-z0-9][a-z0-9-]*$/,
               "slug must be lowercase kebab-case (letters, digits, hyphens)"
-            ).optional().describe(
-              "Pin the worktree's slug (names its branch `wt/<slug>` and its directory). Omit to auto-mint a collision-free one from the label."
-            ),
+            ).optional().describe("Pin the worktree's slug (branch `wt/<slug>`). Omit to auto-mint one from the label."),
             base: z.string().min(1).optional().describe("Git ref the worktree branch is cut from. Default 'origin/main'."),
             async: z.boolean().optional().describe(
-              'Return a real, registered session as soon as it\'s minted (status "starting") instead of blocking `agent_start`\'s response on `git worktree add` + the repo\'s setup hooks, which can run minutes. Provisioning + the driver spawn continue in the background; poll the session\'s `status` (flips to "running" on success, "error" with a readable `lastError` on failure \u2014 it never sits in "starting" forever). Any `prompt` is held and dispatched only once the tree and the driver session both exist. Incompatible with `wait` (there is no first-turn output to block on yet) \u2014 combining the two is rejected. Defaults to true for any spawn that provisions a worktree, UNLESS this call also sets `wait` (which falls back to the old synchronous path instead of conflicting). Pass `false` explicitly to force the old blocking ok/fail contract even without `wait`.'
+              `Return a registered session immediately (status "starting") instead of blocking on provisioning; incompatible with \`wait\`. Defaults true whenever a worktree is provisioned. ${help("worktree")}`
             )
           }).strict()
         ])
       ).optional().describe(
-        "Isolate this session in its OWN git worktree instead of spawning directly in `cwd` \u2014 so a parallel agent can't collide on the working tree. `true` provisions a worktree on a fresh branch `wt/<slug>` cut from origin/main (slug auto-minted from `label`); pass `{ slug, base, async }` to pin either, or opt into an early return (`async`, see that field's own description). The daemon boots the worktree (git worktree add + the repo's agentproto.json setup hooks) and spawns `adapter` THERE; the session's cwd, and every path it edits, live inside the worktree. Honoured only for a ROOT spawn (a spawn made THROUGH an orchestrator inherits its parent's tree \u2014 no second worktree; an EXPLICIT `worktree` on such a nested spawn is REJECTED, not silently ignored \u2014 use `sandbox` to isolate a child) and only when `cwd` is inside a git repo (nothing to isolate otherwise \u21D2 spawns plain, no error). The daemon's `worktrees.isolation` policy may force this ON for every root spawn (`always`) or OFF (`never`, which REJECTS an explicit `worktree`). Ignored for a `sandbox` spawn (the box already isolates). The worktree is NOT auto-removed on session close \u2014 it holds the agent's work; tear it down with `agentproto worktree rm|archive|gc`."
+        `Isolate this session in its OWN git worktree instead of \`cwd\`. \`true\` provisions one on a fresh \`wt/<slug>\` branch; \`{ slug, base, async }\` pins details. ROOT spawns only (rejected on a nested spawn \u2014 use \`sandbox\` there); ignored when \`cwd\` isn't a git repo. NOT auto-removed on session close \u2014 tear down with \`agentproto worktree rm\`. ${help("worktree")}`
       )
     };
     agentStartInputSchema = z.object(agentStartInputShape);
@@ -2482,6 +2507,7 @@ var init_user_presets = __esm({
       contextProfile: z.string().min(1).optional(),
       cwd: z.string().min(1).optional(),
       skills: z.array(z.string().min(1)).optional(),
+      bundles: z.array(z.string().min(1)).optional(),
       browser: z.union([z.literal("headless"), z.literal(false)]).optional()
     });
     z.object({
@@ -2494,8 +2520,20 @@ var init_catalog_provider_models = __esm({
   "src/catalog-provider-models.ts"() {
   }
 });
+var init_app_ui_build = __esm({
+  "src/app-ui-build.ts"() {
+  }
+});
+
+// src/app-ui-placeholder.ts
+var init_app_ui_placeholder = __esm({
+  "src/app-ui-placeholder.ts"() {
+  }
+});
 var init_app_ui_apps = __esm({
   "src/app-ui-apps.ts"() {
+    init_app_ui_build();
+    init_app_ui_placeholder();
   }
 });
 var MESSAGE_KINDS, MESSAGE_URGENCIES;
@@ -2517,6 +2555,7 @@ var init_agent_tools = __esm({
   "src/agent-tools.ts"() {
     init_transcript_export();
     init_agent_start_schema();
+    init_spawn_field_schemas();
     init_session_spawn();
     init_canonical_posture();
     init_user_presets();
@@ -2561,6 +2600,11 @@ var init_session_observer = __esm({
   "src/session-observer.ts"() {
   }
 });
+var init_session_artifacts = __esm({
+  "src/session-artifacts.ts"() {
+    init_transcript_writer();
+  }
+});
 var DEFAULT_TITLER_MODEL;
 var init_session_titler = __esm({
   "src/session-titler.ts"() {
@@ -2587,10 +2631,6 @@ var init_terminal_transcript_writer = __esm({
     init_transcript_writer();
   }
 });
-var init_usage = __esm({
-  "src/usage.ts"() {
-  }
-});
 var init_context_window = __esm({
   "src/context-window.ts"() {
   }
@@ -2640,6 +2680,7 @@ var init_sessions = __esm({
     init_session_observer();
     init_tool_presenter();
     init_transcript_writer();
+    init_session_artifacts();
     init_session_titler();
     init_resume_context_digest();
     init_conversation_index();
@@ -2723,7 +2764,9 @@ var init_config_schema = __esm({
       skills: z.array(z.string()).optional(),
       options: optionsMapSchema.optional(),
       auth: defaultsAdapterAuthConfigSchema.optional(),
-      contextContinuity: contextContinuityPolicySchema.optional()
+      contextContinuity: contextContinuityPolicySchema.optional(),
+      bundles: z.array(z.string()).optional(),
+      daemonMount: z.boolean().optional()
     }).passthrough();
     mcpDefaultsConfigSchema = z.object({
       deferredTools: deferredToolsConfigSchema.optional()
@@ -2732,6 +2775,7 @@ var init_config_schema = __esm({
       skills: z.array(z.string()).optional(),
       options: optionsMapSchema.optional(),
       adapters: z.record(z.string(), defaultsAdapterConfigSchema).optional(),
+      bundles: z.array(z.string()).optional(),
       contextContinuity: contextContinuityPolicySchema.optional(),
       defaultRoleDepthCutoff: z.number().optional(),
       maxGrantableDelegation: z.number().optional(),
@@ -2755,6 +2799,7 @@ var init_config_schema = __esm({
       label: z.string().optional(),
       authToken: z.string().optional(),
       resumeSessionsOnBoot: z.boolean().optional(),
+      continueInterruptedOnBoot: z.boolean().optional(),
       idleReapAfterMs: z.number().optional(),
       crashDetectIntervalMs: z.number().optional(),
       restartSweepIntervalMs: z.number().optional(),
@@ -2772,7 +2817,8 @@ var init_config_schema = __esm({
     }).passthrough();
     featuresConfigSchema = z.object({
       pty: z.boolean().optional(),
-      llmEndpoint: z.boolean().optional()
+      llmEndpoint: z.boolean().optional(),
+      deviceInferenceShare: z.boolean().optional()
     }).passthrough();
     worktreesConfigSchema = z.object({
       root: z.string().optional(),
@@ -2929,6 +2975,16 @@ var init_config_schema = __esm({
         help: "Eagerly re-spawn eligible agent-cli sessions that died from a daemon restart.",
         default: false
       },
+      {
+        path: "daemon.continueInterruptedOnBoot",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Continue interrupted sessions on boot",
+        help: 'After the eager resume pass, send a one-shot "continue" prompt to sessions the last restart cut off mid-turn.',
+        default: false
+      },
       {
         path: "daemon.idleReapAfterMs",
         schema: num,
@@ -3102,6 +3158,15 @@ var init_config_schema = __esm({
         label: "Default options",
         help: "AIP-45 options auto-applied to every agent_start spawn."
       },
+      {
+        path: "defaults.bundles",
+        schema: strArray,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default capability bundles",
+        help: "Bundle ids (bundle_list) auto-attached to every agent_start spawn (unioned with per-adapter bundles)."
+      },
       {
         path: "defaults.defaultRoleDepthCutoff",
         schema: num,
@@ -3328,6 +3393,25 @@ var init_config_schema = __esm({
         label: "Adapter default options",
         help: "AIP-45 options auto-applied to spawns of this adapter."
       },
+      {
+        path: "defaults.adapters.*.bundles",
+        schema: strArray,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter default capability bundles",
+        help: "Bundle ids (bundle_list) auto-attached to spawns of this adapter (unioned with the global default)."
+      },
+      {
+        path: "defaults.adapters.*.daemonMount",
+        schema: z.boolean(),
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter daemon self-mount opt-in",
+        help: "Explicitly mount the daemon's own scoped /mcp for spawns of this adapter, for harnesses outside the default self-mount allowlist (opencode, codex, gemini, \u2026).",
+        default: false
+      },
       {
         path: "defaults.adapters.*.contextContinuity",
         schema: contextContinuityPolicySchema,
@@ -3571,6 +3655,16 @@ var init_config_schema = __esm({
         label: "LLM Endpoint feature",
         help: "Enable the local LLM Endpoint proxy sidecar (route + MCP tools + child-process lifecycle).",
         default: false
+      },
+      {
+        path: "features.deviceInferenceShare",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Device inference sharing",
+        help: "Expose this daemon's local inference endpoint(s) to a paired HOST-scoped controller. Toggle via `agentproto devices share-inference on|off`.",
+        default: false
       }
     ];
   }