@agentproto/runtime 4.0.0 → 5.1.0

package/dist/index.d.ts

@@ -13,8 +13,8 @@ export { CostBudget, CostBudgetScope } from '@agentproto/auth';
 import { S as SpawnBrowserMode, R as ResolveHeadlessBrowser, C as ContextContinuityPolicy, a as ResolvedContextContinuityPolicy } from './context-continuity-Bn99UtVC.js';
 import { SandboxMode } from '@agentproto/command-sandbox';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, CredsStore, HarnessCapabilities, AdapterEntry } from '@agentproto/provider-kit';
-import { S as SpawnDefaultsConfig, D as DefaultsAdapterAuthConfig, R as ResolvedAuthSpec, a as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-CZj39Znq.js';
-export { b as AuthEcho, c as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, d as CredentialSource, e as DefaultsAdapterConfig, f as DeferredToolsConfig, g as ResolveSubscriptionCredentialInput, h as ResolvedSpawnAuthMaterial, i as ResolvedSpawnDefaults, j as SubscriptionCredentialResolution, k as SubscriptionSourceError, l as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, m as resolveDeferredToolsGatewayOption, o as resolveSpawnDefaults, p as resolveSubscriptionCredential } from './spawn-defaults-CZj39Znq.js';
+import { S as SpawnDefaultsConfig, D as DefaultsAdapterAuthConfig, R as ResolvedAuthSpec, a as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-wQV9AeiG.js';
+export { b as AuthEcho, c as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, d as CredentialSource, e as DefaultsAdapterConfig, f as DeferredToolsConfig, g as ResolveSubscriptionCredentialInput, h as ResolvedSpawnAuthMaterial, i as ResolvedSpawnDefaults, j as SubscriptionCredentialResolution, k as SubscriptionSourceError, l as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, m as resolveDeferredToolsGatewayOption, o as resolveSpawnDefaults, p as resolveSubscriptionCredential } from './spawn-defaults-wQV9AeiG.js';
 import { CatalogModelsQuery, CatalogModelsResponse } from './catalog-models.js';
 export { CatalogAdapterInput, CatalogAdapterModelInput, CatalogPricing, CatalogProduct, CatalogRoute, CatalogRouteSummary, CatalogVendor, buildCatalogModels } from './catalog-models.js';
 import { FooterSession } from './pr-provenance.js';
@@ -26,6 +26,7 @@ import * as _agentproto_tool from '@agentproto/tool';
 import { ToolContext } from '@agentproto/tool';
 import { DriverHandle } from '@agentproto/driver';
 import { Attestation, LedgerKey, RubricDigest, ReviewPrRef, LaneResult, ReviewLaneExecutor, LaneOutcome } from '@agentproto/review';
+import { ImportedMcpsConfig } from './mcp-imports.js';
 import { UserPreset } from './user-presets.js';
 export { UserPresetsFile, deleteUserPreset, getUserPreset, listUserPresets, loadUserPresets, saveUserPreset, userPresetsPath } from './user-presets.js';
 import { WorktreeIsolationMode, SpawnAttachMode, SpawnDedupeMode } from './config.js';
@@ -451,13 +452,64 @@ type UsageSource = "adapter" | "computed" | "no-pricing" | "none";
 interface TokenPricing {
     inputPer1M: number;
     outputPer1M: number;
+    /** Multiplier on `inputPer1M` for cache-read tokens (Anthropic: ~0.1).
+     *  Absent = 1 (no discount), same default as the catalog. */
+    cacheReadMultiplier?: number;
+    /** Multiplier on `inputPer1M` for cache-creation tokens (Anthropic:
+     *  ~1.25). Absent = 1. */
+    cacheWriteMultiplier?: number;
+}
+/**
+ * Token-detail and activity fields shared by every usage shape below. All
+ * optional and never zero-filled: absent means "this source doesn't report
+ * it", a present 0 is a measured zero.
+ *
+ *   - `cacheReadTokens` / `cacheWriteTokens`: prompt-cache reads / cache
+ *     creation, cumulative. Kept OUT of `tokensIn` (which is uncached input
+ *     only when a cache split is known).
+ *   - `reasoningTokens`: thinking/reasoning tokens, cumulative. A subset of
+ *     `tokensOut` for providers that bill them as output (Anthropic).
+ *   - `turns`: completed turns (the descriptor's `turnsCompleted`).
+ *   - `toolCalls`: tool calls the daemon observed, cumulative.
+ *   - `durationMs`: wall time spent inside turns, cumulative.
+ */
+interface UsageDetail {
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+    turns?: number;
+    toolCalls?: number;
+    durationMs?: number;
 }
+/** Copy only the present (`number`) `UsageDetail` fields of `src`. */
+declare function pickUsageDetail(src: UsageDetail): UsageDetail;
 /** Pluggable pricing accessor — defaults to the in-repo catalog's
  *  `resolvePricing`, overridable in tests. Returns undefined for an
  *  unknown model (the caller then tags `no-pricing`). */
 type PricingResolver = (model: string) => TokenPricing | undefined;
+/**
+ * What an adapter's usage reader (`readUsage`: hermes state.db, opencode.db,
+ * the claude-code transcript JSONL) returns. Every field is cumulative for
+ * the session and optional; `null` from the reader means "nothing found".
+ */
+interface UsageReadResult {
+    model?: string;
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+}
+/** Where a reader should look for the session's native store — the spawn's
+ *  cwd and isolated provider config dir (`CLAUDE_CONFIG_DIR` for
+ *  claude-code). Readers that key only on the session id ignore it. */
+interface UsageReadContext {
+    cwd?: string;
+    configDir?: string;
+}
 /** Raw signals gathered over a turn, handed to `deriveSessionUsage`. */
-interface UsageComputeInput {
+interface UsageComputeInput extends UsageDetail {
     /** Requested model id — needed to look up per-token prices. */
     model?: string;
     /** Cost the adapter reported directly (readUsage or usage_update.cost).
@@ -471,7 +523,7 @@ interface UsageComputeInput {
 /** The resolved usage snapshot — the shape `session_usage` returns and the
  *  durable `usage_snapshot` transcript record carries. Cost/token fields are
  *  omitted when absent so a missing value never reads as a measured zero. */
-interface SessionUsage {
+interface SessionUsage extends UsageDetail {
     model?: string;
     costUsd?: number;
     tokensIn?: number;
@@ -488,7 +540,7 @@ interface SessionUsage {
  */
 declare function deriveSessionUsage(input: UsageComputeInput, resolve?: PricingResolver): SessionUsage;
 /** Descriptor-shaped fields `projectSessionUsage` reads. */
-interface UsageDescriptorFields {
+interface UsageDescriptorFields extends Omit<UsageDetail, "turns"> {
     model?: string;
     costUsd?: number;
     tokensIn?: number;
@@ -496,6 +548,8 @@ interface UsageDescriptorFields {
     contextSize?: number;
     contextUsed?: number;
     usageSource?: UsageSource;
+    /** Surfaced as `turns`. */
+    turnsCompleted?: number;
 }
 /**
  * Project a session descriptor's persisted usage fields into the
@@ -830,7 +884,7 @@ declare function turnToActivities(session: ActivityTurnSession, opts?: {
 interface ActivityRunStepSlice {
     index: number;
     label: string;
-    status: "pending" | "running" | "done" | "failed" | "skipped";
+    status: "pending" | "running" | "done" | "failed" | "skipped" | "cancelled";
     sessionId?: string;
     startedAt?: string;
     endedAt?: string;
@@ -855,8 +909,8 @@ interface ActivityWorkflowRunSlice {
  * Project one workflow run's steps (stage-barrier semantics): running →
  * active; a `pending` step waits on the stage barrier — the unfinished
  * steps of EARLIER stages are the sessions whose turn-ends open it;
- * done/failed → terminal; skipped → cancelled; a step still pending inside
- * a terminal run settles as cancelled.
+ * done/failed → terminal; skipped/cancelled → cancelled; a step still
+ * pending inside a terminal run settles as cancelled.
  */
 declare function workflowToActivities(run: ActivityWorkflowRunSlice): ActivityRecord[];
 /**
@@ -1736,7 +1790,7 @@ declare function createTaskLedger(opts: {
  * list — {@link isKnownSessionEndReason} says so, and callers should fall
  * back to a generic label rather than throw.
  */
-declare const SESSION_END_REASONS: readonly ["daemon-restart", "idle-reaped", "crashed", "operator-completed", "operator-stopped", "cost-cap-exceeded", "policy-cleanup", "parent-exited", "provider-limit", "forgotten"];
+declare const SESSION_END_REASONS: readonly ["daemon-restart", "idle-reaped", "crashed", "operator-completed", "operator-stopped", "cost-cap-exceeded", "policy-cleanup", "parent-exited", "provider-limit", "forgotten", "steward-completed", "steward-abandoned"];
 type SessionEndReason = (typeof SESSION_END_REASONS)[number];
 /** True when `reason` is one of {@link SESSION_END_REASONS}. A label
  *  lookup, not a wire-format gate — an unrecognized string is still a
@@ -1763,7 +1817,7 @@ declare function isProviderLimitError(message: string | undefined): boolean;
  * and session_monitor MCP tool (long-poll multiplexed).
  */
 
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning";
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:artifact-added" | "session:artifact-pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning";
 /**
  * Fixed severity vocabulary for a judge-gate finding (WP-D). Deliberately
  * small and fixed so `policy_status` output is comparable across different
@@ -1837,6 +1891,18 @@ interface SessionTurnEndEvent {
      * a normal, productive turn.
      */
     empty?: boolean;
+    /**
+     * The in-band `error` stream event's message text observed during this
+     * turn, when one occurred (see `SessionDescriptor.lastTurnErrorMessage`'s
+     * doc). Present whenever `reason` is `"error"` AND the adapter emitted an
+     * `error`-kind event before ending the stream — including the case where
+     * the generator simply returned with no explicit turn-end and no thrown
+     * exception, which is exactly what left an errored turn indistinguishable
+     * from a clean one before this field existed. Absent when the adapter
+     * reported `reason:"error"` on its own turn-end without a preceding
+     * `error` event, and absent (not empty string) on every non-error turn.
+     */
+    error?: string;
     /**
      * True when the turn was not started by a prompt: the agent woke on its
      * own (Claude Code's task-notification cycle after a background task
@@ -2299,6 +2365,32 @@ interface SessionPinnedEvent {
     pinned: boolean;
     ts: string;
 }
+/**
+ * Emitted when a new artifact (or a new version of an existing one) is
+ * materialized into the session's artifact store (`session_artifact_add`,
+ * `POST /sessions/:id/artifacts` — see `session-artifacts.ts`). Carries just
+ * enough for a live UI to append/update its inline card and "Artifacts"
+ * section without a round trip — the full record (all versions) is a
+ * `session_artifact_list` / `GET /sessions/:id/artifacts` call away.
+ */
+interface SessionArtifactAddedEvent {
+    type: "session:artifact-added";
+    sessionId: string;
+    key: string;
+    kind: string;
+    version: number;
+    label?: string;
+    ts: string;
+}
+/** Emitted when an artifact's `pinned` flag changes
+ *  (`session_artifact_pin`, `POST /sessions/:id/artifacts/:key/pin`). */
+interface SessionArtifactPinnedEvent {
+    type: "session:artifact-pinned-changed";
+    sessionId: string;
+    key: string;
+    pinned: boolean;
+    ts: string;
+}
 /**
  * Emitted when a session is first registered in the registry (WP-R3) — both
  * the agent-cli spawn path (`spawnAgent`) and the terminal path (`spawnPty`).
@@ -2517,7 +2609,7 @@ interface SessionHarnessWarningEvent {
     label?: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent;
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionArtifactAddedEvent | SessionArtifactPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -2763,6 +2855,318 @@ declare class TunnelRegistry {
     private loadFromDisk;
 }
 
+/**
+ * Typed inter-session message envelope (AIP-46 §Session messages).
+ *
+ * A PROMPT is an instruction from whoever drives a session; a MESSAGE is a
+ * report between sessions in the same tree whose sender the DAEMON attests.
+ * Everything in `from` is computed here from the caller's verified identity
+ * and the session forest — a send request can never set it.
+ *
+ * Pure module: no registry, no I/O. The registry (sessions.ts) carries a
+ * `SessionMessage` on a queued prompt (`QueuedPrompt.envelope`), renders it
+ * into the model's context with `renderSessionMessages`, and records it as
+ * its own `session-message` transcript record — never a `user-prompt`.
+ */
+/** Sender's position in the tree, relative to the recipient. */
+type MessageRelation = "child" | "parent" | "sibling" | "human" | "system";
+type MessageKind = "report" | "question" | "blocker" | "done" | "notice";
+type MessageUrgency = "fyi" | "next-turn" | "steer" | "interrupt";
+type MessageDeliveryVia = "wait" | "steer" | "turn" | "interrupt" | "inbox";
+declare const MESSAGE_KINDS: readonly MessageKind[];
+declare const MESSAGE_URGENCIES: readonly MessageUrgency[];
+interface SessionMessageFrom {
+    /** Absent only for relation `human` | `system`. */
+    sessionId?: string;
+    /** Registry label at send time — display only, never identity. */
+    label?: string;
+    role?: string;
+    adapter?: string;
+    relation: MessageRelation;
+}
+interface SessionMessage {
+    /** `msg_<uuid8>`, daemon-minted. */
+    id: string;
+    ts: string;
+    /** Recipient sessionId. */
+    to: string;
+    from: SessionMessageFrom;
+    kind: MessageKind;
+    /** Requested urgency. */
+    urgency: MessageUrgency;
+    /** Stamped on delivery. */
+    delivered?: {
+        via: MessageDeliveryVia;
+        at: string;
+        turnSeq?: number;
+    };
+    /** Thread id; defaults to the first message's id. */
+    correlationId?: string;
+    /** A `SessionMessage.id` this answers. */
+    replyTo?: string;
+    text: string;
+    /** Optional structured payload (≤ `MAX_MESSAGE_DATA_BYTES`). */
+    data?: Record<string, unknown>;
+    ackedAt?: string;
+}
+declare const MAX_MESSAGE_DATA_BYTES: number;
+/** The slice of a session descriptor relation/ACL resolution needs. */
+interface MessageTreeNode {
+    id: string;
+    parentSessionId?: string;
+    label?: string;
+    role?: string;
+    adapterSlug?: string;
+}
+/**
+ * Relation of `sender` to `recipient` in the session forest, or `undefined`
+ * when they're not tree neighbours (cousins, strangers, self). `sender`
+ * absent ⇒ `human` (an HTTP/CLI operator); daemon-originated notices pass
+ * `"system"` explicitly instead of calling this.
+ */
+declare function resolveRelation(sender: MessageTreeNode | undefined, recipient: MessageTreeNode): Exclude<MessageRelation, "system"> | undefined;
+/**
+ * ACL: child→parent, parent→direct child, human/system→any. Sibling↔sibling
+ * only when `allowSiblings` (config-gated, default off). Anything else — a
+ * cousin, a stranger, yourself — is refused.
+ */
+declare function isMessageAllowed(relation: MessageRelation | undefined, opts?: {
+    allowSiblings?: boolean;
+}): relation is MessageRelation;
+/** Build a `from` block from the verified sender + the resolved relation. */
+declare function messageFrom(sender: MessageTreeNode | undefined, relation: MessageRelation): SessionMessageFrom;
+declare function mintMessageId(): string;
+declare function createSessionMessage(input: {
+    to: string;
+    from: SessionMessageFrom;
+    text: string;
+    kind?: MessageKind;
+    urgency?: MessageUrgency;
+    replyTo?: string;
+    correlationId?: string;
+    data?: Record<string, unknown>;
+}): SessionMessage;
+interface MessageFilter {
+    /** Sender session ids, or `"children"` for any message whose relation is
+     *  `child` (i.e. from one of the recipient's own children). */
+    from?: readonly string[] | "children";
+    kind?: readonly MessageKind[];
+    correlationId?: string;
+}
+declare function matchesMessageFilter(msg: SessionMessage, filter: MessageFilter): boolean;
+declare const MESSAGE_TAG = "agentproto-message";
+/** Child-settable label → attribute-safe: `[A-Za-z0-9._-]`, ≤ 48 chars. */
+declare function sanitizeLabel(label: string | undefined): string | undefined;
+/** Escape every envelope/body sentinel inside a message body, so a sender
+ *  can't close the tag early and forge a second header. */
+declare function escapeMessageBody(text: string): string;
+/** A human prompt is NOT wrapped (humans keep today's UX), but a line that
+ *  starts with the envelope sentinel is escaped, so the invariant "text
+ *  outside an `<agentproto-message>` tag is the human" holds. Nothing else
+ *  in human text changes. */
+declare function escapeHumanPrompt(text: string): string;
+declare function renderSessionMessage(msg: SessionMessage): string;
+/** A coalesced batch → sibling tags, one per message, in order. */
+declare function renderSessionMessages(msgs: readonly SessionMessage[]): string;
+/** One-line typed digest of `fyi` messages that never woke the session —
+ *  prepended (as a `system-prompt` slice) to the next turn it runs anyway. */
+declare function renderInboxDigest(msgs: readonly SessionMessage[]): string;
+/** Taught once, the first time a session RECEIVES a message (recorded as a
+ *  `system-prompt`). Children also get the same invariant in their lineage
+ *  line at spawn. */
+declare const MESSAGE_PREAMBLE: string;
+
+/**
+ * Shared types for pluggable sentinel providers (AIP-60 §3, §4).
+ *
+ * The sentinel family is a `@agentproto/provider-kit` consumer, same shape as
+ * the tunnel family (`remote-providers/types.ts`) and the sandbox family
+ * (`sandbox-providers/types.ts`): {@link SentinelProviderHandle} extends the
+ * kit's generic `AdapterHandle` (slug/name/version/description/requiresSetup/
+ * check) with the sentinel-specific `capabilities` plus the create/attach/
+ * cancel/status/poll/ack/parseInbound lifecycle a provider implements.
+ *
+ * This file is deliberately self-contained (no import from `sentinel-store.js`)
+ * so the contract never depends on the store's internals — `SentinelSpec` is
+ * the vocabulary a provider is handed, `sentinel-store.ts` imports it from
+ * here rather than the other way around.
+ */
+
+/** When a sentinel stops watching. */
+type SentinelUntil = {
+    kind: "subject_terminal";
+} | {
+    kind: "at";
+    ms: number;
+} | {
+    kind: "count";
+    n: number;
+} | {
+    kind: "never";
+};
+/** Where a matching event is delivered.
+ *
+ *  `routine` is reserved for AIP-41 `schedule.kind: event` binding; `webhook`
+ *  is reserved for forwarding a matched event to an external HTTP callback.
+ *  Both are FROZEN SHAPES ONLY — `SentinelStore.create` rejects them with
+ *  {@link SentinelTargetNotImplementedError} until a later step wires actual
+ *  delivery (design §6/§12 step 4 for `routine`; `webhook` has no design
+ *  section yet). Declaring the shape now lets callers/tools reference the
+ *  full union before delivery exists. */
+type SentinelTarget = {
+    kind: "session";
+    sessionId: string;
+    urgency: MessageUrgency;
+} | {
+    kind: "routine";
+    routineId: string;
+} | {
+    kind: "webhook";
+    url: string;
+    secret: string;
+};
+/** One clause of a sentinel's watch: a subject (exact, or a `*`-suffixed
+ *  prefix match against an event's `subjects`) plus an optional per-clause
+ *  type glob list. */
+interface SentinelMatchClause {
+    /** Hierarchical routing key, e.g. "github:agentproto/ts#1428". A trailing
+     *  `*` is a prefix match against an event's `subjects`. */
+    subject: string;
+    /** Type globs; undefined = the provider's `defaultTypes(subject)`. */
+    types?: string[];
+}
+/**
+ * "Watch any of `match` until `condition`, deliver to `target`."
+ *
+ * `match` is OR semantics: an event matches the sentinel if it matches ANY
+ * clause (subject + that clause's own type glob / provider default). At
+ * least one clause is required — use {@link singleMatch} for a one-clause
+ * spec. The event's own `subject` (not the matching clause's, which may be a
+ * `*` prefix template) is what lands as `correlationId: sentinel:<subject>`
+ * and the `[<scheme>]` inbox-text prefix — see `sentinel-runtime.ts`.
+ *
+ * Dedup key is `(sentinelId, event.id)`, same for every clause — see
+ * {@link SentinelEvent.id}.
+ */
+interface SentinelSpec {
+    match: SentinelMatchClause[];
+    until: SentinelUntil;
+    target: SentinelTarget;
+    /** Provider slug; undefined = auto-select (not implemented by the runtime
+     *  yet — step 2 requires an explicit slug). */
+    provider?: string;
+    /** Fan-out grouping — sentinels created together (e.g. several
+     *  PR-related watches for one review) share a `group` id so they can be
+     *  listed/removed together later. Purely descriptive: the runtime never
+     *  reads it, no MCP tool consumes it yet. */
+    group?: string;
+    /** Human-readable label surfaced by `sentinel_list` / the CLI. Purely
+     *  descriptive, same as `group`. */
+    label?: string;
+}
+
+/**
+ * SentinelStore — persists `~/.agentproto/sentinels.json` (AIP-60 §2).
+ *
+ * State is in-memory; sentinels persist to disk (debounced async write +
+ * sync flush at shutdown), mirroring `inbound-endpoints.ts`'s
+ * `InboundEndpointStore`. Unlike that store's `markSeen` (deliberately
+ * in-memory only), dedup here is PERSISTED per sentinel, bounded to the last
+ * 1000 event ids (design §2/§9) — a sentinel's dedup window must survive a
+ * daemon restart, since the whole point of a sentinel is to keep watching
+ * across restarts.
+ *
+ * Writes are atomic (write to a per-process tmp file, then rename), same
+ * idiom as `sandbox-ledger.ts` — a crash mid-write must never leave a
+ * corrupt `sentinels.json` behind.
+ */
+
+type SentinelStatus = "active" | "paused" | "expired" | "orphaned" | "error";
+
+/**
+ * LlmEndpointRegistry — supervised-sidecar manager for the
+ * `@agentproto/llm-endpoint` proxy gateway.
+ *
+ * The daemon spawns the llm-endpoint bin as a CHILD PROCESS (never an
+ * in-process import — the runtime package has zero dependency on
+ * @agentproto/llm-endpoint, exactly like it never imports cloudflared).
+ * This is the single-sidecar analog of {@link TunnelRegistry}: one endpoint,
+ * one port, an in-memory descriptor that tracks pid / port / status /
+ * startedAt, and a start / stop / status lifecycle exposed over MCP.
+ *
+ * Lifecycle (mirrors RemoteController's singleton style — created fresh each
+ * boot, state in memory; the child dies with the daemon so there is nothing
+ * to reconcile on restart):
+ *   start(input) → assemble env, spawn `node <bin> serve`, health-probe to
+ *                  readiness, store descriptor. Idempotent: a call while the
+ *                  endpoint is already running+healthy returns the existing
+ *                  descriptor without spawning (like `start_browser`).
+ *   status()     → descriptor + live `GET /v1/models` health probe.
+ *   stop()       → SIGTERM the child, mark stopped (mirrors tunnel stop).
+ *   shutdown()   → stop the child on daemon exit.
+ *
+ * Env on spawn (see {@link assembleLlmEndpointEnv}): the provider API keys
+ * via `injectProviderKeysIntoEnv` (the same store llm-endpoint's own cli.ts
+ * reads), `LLM_ENDPOINT_PORT` (default 18090), and `LLM_ENDPOINT_ACCESS_TOKENS`
+ * when configured. Explicit env passed to `start` always wins.
+ */
+type LlmEndpointStatus = "starting" | "running" | "stopped" | "error";
+/** The `llm_endpoint_status` MCP contract — see {@link LlmEndpointRegistry.status}. */
+interface LlmEndpointStatusReport {
+    running: boolean;
+    pid: number | null;
+    port: number | null;
+    baseUrl: string | null;
+    healthy: boolean;
+    startedAt: string | null;
+    status: LlmEndpointStatus | "never-started";
+    /** Who is actually serving this endpoint. `"daemon"` — this registry's own
+     *  spawn (or nothing at all). `"external"` — a healthy process on the same
+     *  port that this registry did NOT spawn (e.g. a launchd KeepAlive
+     *  sidecar); `pid` is unknown (always `null`) and `injectedProviders`, if
+     *  present, was DERIVED by probing `/v1/models` rather than read off our
+     *  own key-injection bookkeeping. */
+    owner: "daemon" | "external";
+    /** Whether upstream links persisted via `llm_endpoint_set_upstream_link`
+     *  are actually applied to the process answering this port. Always
+     *  `false` for `owner:"external"` — this registry never spawned it, so it
+     *  never injected `LLM_ENDPOINT_PROFILE_<UPSTREAM>`; the operator must
+     *  configure the external service's own env directly. */
+    linksApplied: boolean;
+    lastError?: string;
+    injectedProviders?: string[];
+    linkedProviders?: string[];
+    /** `@agentproto/llm-endpoint`'s own package version, read from the
+     *  resolved bin's `package.json` — best-effort, present only for
+     *  `owner:"daemon"` (the version of the code this registry would spawn /
+     *  did spawn). Undefined when unresolvable, or for `owner:"external"`
+     *  (an adopted process exposes no version of its own to probe). */
+    version?: string;
+}
+interface LlmEndpointDescriptor {
+    pid: number | null;
+    port: number;
+    baseUrl: string;
+    status: LlmEndpointStatus;
+    startedAt: string;
+    stoppedAt?: string;
+    lastError?: string;
+    /** Provider names whose keys were injected into the child's env (never values). */
+    injectedProviders?: string[];
+    /** Upstream names mapped to an auth-profile link (`LLM_ENDPOINT_PROFILE_<P>`)
+     *  in the child's env. Profile IDS, not secrets — but only the provider names
+     *  are surfaced here, mirroring `injectedProviders`. */
+    linkedProviders?: string[];
+    /**
+     * Only populated on the value returned by {@link LlmEndpointRegistry.start}
+     * (never stored on the in-memory descriptor): `true` when the call reused an
+     * already-running/starting child instead of spawning — so the caller can
+     * tell a fresh `start` (new port/tokens applied) from a no-op idempotent hit
+     * (old descriptor returned, nothing new applied). Mirrors `start_browser`.
+     */
+    wasAlreadyRunning?: boolean;
+}
+
 /**
  * RemoteController — owns the gateway's "publish to the internet" state.
  *
@@ -2970,6 +3374,14 @@ interface PairingRecord {
     /** Set on a pairing made under the retired pair/v1 protocol: listed and
      *  revocable, never served — its client is told to re-pair. */
     legacy?: true;
+    /** Set when this pairing was made under an offer minted with
+     *  `agentproto pair offer --host` (PR-C) — i.e. the offering daemon's own
+     *  intent, recorded server-side at handshake time from the OfferEntry it
+     *  itself created, never from the (unauthenticated) `scope` param a client
+     *  presented in the offer URL. Absent for an ordinary remote-control
+     *  pairing. Purely informational here — it does not change how this
+     *  pairing is served. */
+    scope?: "host";
 }
 /** Mode of a served channel — first-contact offer vs. an established reconnect. */
 type PairingChannelMode = "offer" | "reconnect";
@@ -2981,6 +3393,13 @@ interface PairingChannelContext {
     fingerprint: string;
     /** Client label. */
     name: string;
+    /** This pairing's OWN recorded scope (mirrors `PairingRecord.scope`) —
+     *  `"host"` when the offer that produced it was minted with
+     *  `agentproto pair offer --host`, absent for an ordinary remote-control
+     *  pairing. Present on BOTH the offer and every reconnect context, so
+     *  `serve` can gate scope-restricted routes (e.g. device-inference
+     *  proxying) the same way on first contact and on every later reconnect. */
+    scope?: "host";
 }
 /** Handle to a live served channel — the registry closes it on teardown. */
 interface PairingChannelHandle {
@@ -3003,12 +3422,21 @@ interface CreatedOffer {
      *  falls back to `HOSTED_RENDEZVOUS_URL`. Surfaced so `pair offer` can flag,
      *  never silently, that the daemon is relaying through our infrastructure. */
     rendezvousIsHostedDefault: boolean;
+    /** Echoes `CreateOfferInput.scope`. `"host"` when minted with `--host`;
+     *  absent for a plain offer. */
+    scope?: "host";
 }
 interface CreateOfferInput {
     /** Time-to-live in ms. Default 10 minutes. */
     ttlMs?: number;
     /** Rendezvous URL override; falls back to the configured default. */
     rendezvousUrl?: string;
+    /** Mint a HOST-scoped offer (PR-C): the accepting side may register this
+     *  daemon as a driveable host (`devices add`), not just remote-control it.
+     *  Recorded on the resulting `OfferEntry`/`PairingRecord` server-side — this
+     *  is the authoritative record of what was granted, independent of the
+     *  `scope` param an accepting client's offer URL happens to carry. */
+    scope?: "host";
 }
 interface PairingRegistryDeps {
     /** Lazily load (create on first use) the daemon identity. Kept lazy so a
@@ -3052,17 +3480,362 @@ interface PairingRegistry {
     createOffer(input?: CreateOfferInput): Promise<CreatedOffer>;
     /** All persisted pairings (copies). Loads `pairings.json` on first call. */
     list(): Promise<PairingRecord[]>;
+    /** Rename a pairing by fingerprint or name (cosmetic only — no effect on
+     *  auth or routing). Returns false when nothing matched; throws on an
+     *  empty `newName`. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
     /** Drop a pairing by fingerprint or name; stops its rendezvous connections.
      *  Returns false when nothing matched. */
     revoke(idOrName: string): Promise<boolean>;
+    /** Is a channel (offer or reconnect) currently served for this fingerprint? */
+    isOnline(fingerprint: string): boolean;
     /** Start standing reconnect connections for every persisted pairing. Call
      *  after the gateway is up (so the injected `serve` can reach it). */
     startAutoconnect(): Promise<void>;
     /** Tear down every offer + reconnect connection and served channel. */
     shutdown(): Promise<void>;
 }
+/**
+ * Read-only snapshot of `pairings.json` for callers that just want the
+ * persisted records — no `dial`/`serve`/`loadIdentity` deps, no rendezvous
+ * connections started (e.g. `agentproto doctor`'s devices check). Mirrors
+ * `ensureLoaded`'s parse + v1-legacy flagging; never throws — a missing or
+ * malformed file just yields `[]`.
+ */
+declare function readPairingsSnapshot(path?: string): Promise<PairingRecord[]>;
 declare function createPairingRegistry(deps: PairingRegistryDeps): PairingRegistry;
 
+/**
+ * Daemon-side HOST registry (DEVICES-PLAN PR-C) — the "client" half of
+ * pair/v2, living on the daemon so it's reachable over both an HTTP route
+ * and an MCP tool, not just CLI-local bookkeeping (`client-pairings.ts` /
+ * `pair-transport.ts` are that CLI-local equivalent today).
+ *
+ * Where `pairing-registry.ts` is what a daemon uses to let OTHER machines
+ * pair with and remote-control IT, `host-registry.ts` is what a daemon uses
+ * to register and drive OTHER daemons — reverse pairing. `add()` accepts a
+ * HOST-scoped offer (`agentproto pair offer --host`, offer-url.ts's
+ * `scope`), runs the pair/v2 client handshake, and persists the resulting
+ * pair root; `forwardHttp()` dials on demand, reconnecting over the current
+ * (then previous) epoch token exactly like `pair-transport.ts`'s
+ * `openPairChannel`, forwards one HTTP request over the resulting tunnel
+ * client, and closes. There is no standing connection here — unlike
+ * `PairingRegistry`, a `HostRegistry` never autoconnects or keeps a
+ * reconnect loop parked at the broker; every reach-out is a fresh dial.
+ * That also means shutdown needs no teardown: there is nothing standing to
+ * tear down.
+ *
+ * ## The scope gate
+ *
+ * `add()` REFUSES (throws) any offer whose parsed `scope !== "host"` before
+ * ever dialing anything. This is the default-deny gate PR-C exists to add:
+ * an ordinary "remote-control me" offer (today's `pair offer`, no `--host`)
+ * must not silently become a host registration, even though the underlying
+ * wire capability is identical either way (see offer-url.ts's "Offer scope"
+ * and pairing-registry.ts's `OfferEntry.scope` doc comment for why the
+ * offering daemon's OWN server-side record — not the URL's plaintext
+ * `scope` param — is what's authoritative about what it granted). There is
+ * deliberately no override flag.
+ *
+ * Persisted to `hosts.json` (`~/.agentproto/hosts.json` by default) with the
+ * same atomic-write discipline as `pairings.json` (mkdir, write to a
+ * pid-keyed tmp file at 0600, chmod, rename) and the same lazy-load-on-
+ * first-use pattern.
+ *
+ * ## Online tracking
+ *
+ * `isOnline(fingerprint)` mirrors `PairingRegistry.isOnline`: it's true only
+ * while a `forwardHttp()` call for that fingerprint is in flight (a
+ * reference count, incremented on dial and decremented in a `finally`).
+ * There is no live probe backing `list()` — that would make `devices list`
+ * slow/flaky over N hosts — so `list()`'s `online` is only ever true
+ * immediately after (or during) an actual `forwardHttp`/`devices status`
+ * call, never a background heartbeat. That's enough to make `devices list`
+ * show the right thing right after `devices status`/`exec`, which is what
+ * matters for this PR; a standing/autoconnect host connection with a real
+ * liveness signal is PR-D's to build.
+ */
+
+/** `hosts.json` format. */
+declare const HOSTS_VERSION: 1;
+/** One persisted host — a daemon this daemon can drive. */
+interface HostRecord {
+    /** The target daemon's identity fingerprint (32 hex). */
+    fingerprint: string;
+    /** Human-facing label; defaults to the fingerprint. */
+    name: string;
+    /** Target daemon's static X25519 public key, standard base64 SPKI DER —
+     *  pinned at `add()` time. */
+    daemonX25519Pub: string;
+    /** Target daemon's static Ed25519 public key, standard base64 SPKI DER —
+     *  pinned at `add()` time. */
+    daemonEd25519Pub: string;
+    /** Rendezvous endpoint to reach the host through. */
+    rendezvousUrl: string;
+    /** Long-term shared secret (base64), from which epoch routing tokens
+     *  derive — same derivation as `PairingRecord.pairRoot`. */
+    pairRoot: string;
+    /** ISO-8601 first-add timestamp. */
+    createdAt: string;
+    /** ISO-8601 of the most recent successful `forwardHttp`. */
+    lastSeen: string;
+    /** Set on a host added under the retired pair/v1 protocol. Present for
+     *  parity with `PairingRecord`/`ClientPairing`; pair/v1 offers are refused
+     *  by `parseOfferUrl` before `add()` ever sees them, so this is currently
+     *  unreachable — kept so a future downgrade path has somewhere to flag it. */
+    legacy?: true;
+    /** Self-reported by the host at add-time (SANDBOX-VISIBILITY-JOIN) — e.g. a
+     *  sandbox provider slug, a provider-side sandbox id, and free-form labels
+     *  (PR number, run URL, …). Never verified beyond "the host said so"; purely
+     *  descriptive for `device_list`/`devices sessions`. */
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
+}
+/** Optional self-reported metadata `add()` attaches to the resulting
+ *  `HostRecord` (see `HostRecord.provider`/`sandboxId`/`labels`). */
+interface HostJoinMeta {
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
+}
+interface HostRegistryDeps {
+    /** Dial a rendezvous WS and adapt it to a `FrameSink`. Same shape as
+     *  `PairingRegistryDeps.dial` — the CLI's `daemonDialRendezvous` satisfies
+     *  it directly. Rejects if the dial fails or `signal` aborts. */
+    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
+    /** Path to `hosts.json`. Defaults to `~/.agentproto/hosts.json`. */
+    hostsPath?: string;
+    /** Injectable clock (ms). Defaults to Date.now. */
+    now?: () => number;
+    /** Diagnostic log sink. */
+    log?: (line: string) => void;
+    /** Rendezvous dial ceiling per attempt. Default 15s. */
+    dialTimeoutMs?: number;
+    /** Handshake ceiling per attempt. Default 15s. */
+    handshakeTimeoutMs?: number;
+}
+interface ForwardHttpRequest {
+    method: string;
+    path: string;
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+}
+interface ForwardHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: Uint8Array;
+}
+/** Streaming counterpart of {@link ForwardHttpResponse} — `body` is a Web
+ *  `ReadableStream` the caller drains directly (SSE chat/completions, most
+ *  notably) instead of a fully-buffered `Uint8Array`. See
+ *  {@link HostRegistry.forwardHttpStream}. */
+interface ForwardHttpStreamResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: ReadableStream<Uint8Array>;
+}
+interface HostRegistry {
+    /**
+     * Accept an offer URL and register the target daemon as a driveable host.
+     * REFUSES (throws a plain `Error`) unless the parsed offer has
+     * `scope === "host"` — no dial is attempted in that case. Otherwise: dials
+     * the offer's rendezvous, runs the pair/v2 client handshake, verifies the
+     * derived peer fingerprint matches the offer's `id` (defence in depth,
+     * mirrors `pair-transport.ts`'s `acceptOffer`), derives the pair root, and
+     * persists a `HostRecord` (upserted by fingerprint — re-adding replaces).
+     */
+    add(offerUrl: string, name?: string, meta?: HostJoinMeta): Promise<{
+        fingerprint: string;
+        name: string;
+        rendezvousUrl: string;
+    }>;
+    /** All persisted hosts (copies). Loads `hosts.json` on first call. */
+    list(): Promise<HostRecord[]>;
+    /** Rename a host (fingerprint or current name). Returns false when nothing
+     *  matched; throws on an empty `newName`. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
+    /** Drop a host by fingerprint or name. Returns false when nothing matched. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Is a `forwardHttp` call for this fingerprint in flight right now? */
+    isOnline(fingerprint: string): boolean;
+    /**
+     * On-demand: dial the host, run the client handshake against the current
+     * epoch's tokens (falling back to the previous epoch, bridging clock
+     * skew — same two-attempt shape as `pair-transport.ts`'s
+     * `openPairChannel`), forward one HTTP request over the resulting tunnel
+     * client, then close. Throws with a re-pair hint if every attempt hangs up
+     * on the hello (likely a pair/v1 peer).
+     */
+    forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
+    /**
+     * Same dial/handshake/retry shape as {@link forwardHttp}, but for a
+     * streamed response (SSE, NDJSON, long-poll) — the daemon-inference proxy's
+     * `/v1/chat/completions` most notably, which must relay tokens as they
+     * arrive rather than buffering the whole completion first. Unlike
+     * `forwardHttp`, the tunnel client is kept open (and `isOnline` stays true)
+     * until the returned `body` stream is fully drained, errors, or is
+     * cancelled — only then does it close and the online count drop.
+     */
+    forwardHttpStream(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpStreamResponse>;
+}
+declare function createHostRegistry(deps: HostRegistryDeps): HostRegistry;
+
+/**
+ * Daemon-side JOIN TOKEN registry (SANDBOX-VISIBILITY-JOIN, stacked on
+ * DEVICES-PLAN PR-C's `host-registry.ts`).
+ *
+ * `host-registry.ts`'s `add()` requires a HUMAN to relay a host-scoped offer
+ * URL from the box to this daemon (`agentproto pair offer --host` on the box,
+ * `agentproto devices add <url>` here) — fine for a laptop, impossible for an
+ * unattended CI sandbox with no one watching its logs to copy a one-time,
+ * 10-minute-TTL secret. A join token flips who initiates: this daemon mints a
+ * long-lived, revocable, reusable credential ahead of time (stored as a
+ * GitHub secret, say); a box started with `AGENTPROTO_JOIN=<token>` dials
+ * in — over the SAME rendezvous/pair-v2 primitives, no protocol change — and
+ * this daemon adds it as a host automatically.
+ *
+ * ## Why this isn't just a long-lived `host-registry.ts` offer
+ *
+ * pair/v2 deliberately gives a CLIENT no persistent identity key (see
+ * `pairing-registry.ts`'s "Reconnect authentication" doc) — only the
+ * DAEMON/offerer side has stable keys a peer can pin and re-dial later.
+ * `HostRegistry.forwardHttp` needs exactly those stable keys to reach a host
+ * on demand, so the box MUST end up as the offerer of its own host-scoped
+ * offer (a normal, single-use `pair offer --host`) with THIS daemon
+ * `add()`-ing it — `host-registry.ts` is not touched by this module at all.
+ *
+ * What the join token replaces is only the relay step: this daemon parks a
+ * STANDING accept loop (`side=daemon`, exactly like a `pair offer`'s park,
+ * except never single-use) on a route deterministically derived from the
+ * token's own secret. A box holding the token dials that route as the
+ * CLIENT — the role a browser/CLI plays consuming a normal offer — and its
+ * sealed hello's `clientName` carries a small JSON envelope: the box's own
+ * self-minted host-scoped offer URL (freshly created, in-process, via its
+ * own `PairingRegistry.createOffer({scope:"host"})` — see
+ * `packages/cli/src/commands/serve.ts`'s `AGENTPROTO_JOIN` boot wiring) plus
+ * a self-reported name/provider/sandboxId/labels. On receipt, this daemon
+ * just calls `HostRegistry.add(offerUrl, name, meta)` — the exact call a
+ * human would type — closes the bootstrap channel, and re-parks for the next
+ * box. No new wire messages, no new crypto: two ordinary pair/v2 handshakes
+ * back to back, the first only ever used to carry one string.
+ *
+ * ## Reuse and revocation
+ *
+ * Unlike an `OfferEntry` (`pairing-registry.ts`), a join token's
+ * `{route, auth}` never rotates and is never "spent" — `useCount`/`maxUses`/
+ * `expiresAt`/`revokedAt` (all checked inside `verifyAuthToken`, which may be
+ * async) gate reuse instead. This is the same trust shape as an existing
+ * epoch reconnect token (valid, unrotated, for its whole day) stretched over
+ * a longer, explicit, revocable window — not a new security primitive.
+ *
+ * ## A known limitation
+ *
+ * One token parks on exactly one fixed route, so exactly one box can be
+ * mid-handshake on it at a time; a second box dialing in the same instant
+ * either waits for the loop to re-park (typical: the ceremony is a single
+ * short-TTL round trip) or, in the worst case, times out and retries with
+ * backoff. Fine for the sequential-CI-review case this exists for; a fleet
+ * of concurrently-joining boxes would want multiple parked slots per token,
+ * deferred (see PR body).
+ *
+ * Persisted to `~/.agentproto/join-tokens.json`, same atomic-write + lazy-
+ * load discipline as `hosts.json`/`pairings.json`. The raw `secret` — not a
+ * hash — is stored, exactly like `pairings.json` stores `pairRoot` in the
+ * clear: it is crypto material this daemon must re-derive `{route, auth}`
+ * from on every boot, not a password to be hashed.
+ */
+
+/** `join-tokens.json` format. */
+declare const JOIN_TOKENS_VERSION: 1;
+/** One persisted join token. `secret` is the crypto material a box's
+ *  `AGENTPROTO_JOIN` value carries too — never log or echo it once minted. */
+interface JoinTokenRecord {
+    /** Short random id (CLI/MCP target), distinct from `secret`. */
+    id: string;
+    /** Human-facing label (e.g. "ci-reviewer"). */
+    name: string;
+    /** One-time-offer-shaped secret (base64url) — re-derives `{route, auth}`
+     *  via `deriveOfferTokens`. Never rotates for this token's lifetime. */
+    secret: string;
+    /** Rendezvous endpoint boxes dial through. */
+    rendezvousUrl: string;
+    /** ISO-8601 mint time. */
+    createdAt: string;
+    /** ISO-8601 expiry — always set (`create()` defaults `ttlMs`). */
+    expiresAt: string;
+    /** Reuse ceiling. Absent = unlimited (until `expiresAt`/revoke). */
+    maxUses?: number;
+    /** Successful joins so far. */
+    useCount: number;
+    /** ISO-8601 of the most recent successful join. */
+    lastUsedAt?: string;
+    /** ISO-8601 revoke time. Present ⇒ inactive; kept for `list()` history. */
+    revokedAt?: string;
+}
+interface CreateJoinTokenInput {
+    name: string;
+    /** Time-to-live in ms. Default 90 days. */
+    ttlMs?: number;
+    /** Reuse ceiling. Absent = unlimited. */
+    maxUses?: number;
+    /** Rendezvous URL override; falls back to the configured default. */
+    rendezvousUrl?: string;
+}
+interface CreatedJoinToken {
+    id: string;
+    name: string;
+    /** The `AGENTPROTO_JOIN` value — an `agentproto://pair?…&scope=host` URL.
+     *  Shown ONCE; `list()` never returns it. */
+    token: string;
+    rendezvousUrl: string;
+    expiresAt: string;
+}
+interface JoinTokenRegistryDeps {
+    /** Lazily load (create on first use) the daemon identity — same contract
+     *  as `PairingRegistryDeps.loadIdentity`. */
+    loadIdentity: () => Promise<DaemonIdentity>;
+    /** Path to `join-tokens.json`. Defaults to `~/.agentproto/join-tokens.json`. */
+    joinTokensPath?: string;
+    /** Configured rendezvous URL default — same three-state contract as
+     *  `PairingRegistryDeps.defaultRendezvousUrl` (absent → hosted default;
+     *  `""` → explicit opt-out, fails closed without `--rendezvous`). */
+    defaultRendezvousUrl?: string;
+    /** Dial a rendezvous WS and adapt it to a `FrameSink`. Same shape as
+     *  `PairingRegistryDeps.dial`/`HostRegistryDeps.dial`. */
+    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
+    /** Called once per successful join, with the box's self-minted host offer
+     *  URL and self-reported name/meta — normally `hostRegistry.add`. Errors
+     *  are logged and swallowed: a bad/unreachable offer from one join must not
+     *  crash the standing accept loop. */
+    addHost: (offerUrl: string, name?: string, meta?: HostJoinMeta) => Promise<unknown>;
+    /** Injectable clock (ms). Defaults to Date.now. */
+    now?: () => number;
+    /** Diagnostic log sink. */
+    log?: (line: string) => void;
+    /** Handshake ceiling per attempt. Default 110s (mirrors PairingRegistry's
+     *  park timeout, kept just under the broker's own). */
+    handshakeTimeoutMs?: number;
+    /** Reconnect backoff floor / ceiling (ms) after a failed dial. Defaults 1s/30s. */
+    reconnectMinMs?: number;
+    reconnectMaxMs?: number;
+}
+interface JoinTokenRegistry {
+    /** Mint a token and start its standing accept loop. */
+    create(input: CreateJoinTokenInput): Promise<CreatedJoinToken>;
+    /** All persisted tokens (copies), `secret` stripped. Loads on first call. */
+    list(): Promise<Omit<JoinTokenRecord, "secret">[]>;
+    /** Revoke by id or name — stops its accept loop. Returns false if nothing
+     *  matched or it was already revoked. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Start standing accept loops for every active persisted token. Call once
+     *  at boot, after the gateway/hostRegistry are wired. */
+    startAutoconnect(): Promise<void>;
+    /** Tear down every accept loop. */
+    shutdown(): Promise<void>;
+}
+declare function createJoinTokenRegistry(deps: JoinTokenRegistryDeps): JoinTokenRegistry;
+
 /**
  * Shared types for pluggable sandbox providers.
  *
@@ -3873,6 +4646,29 @@ declare function createActivityProjector(opts: {
     resolvePrState?: PrStateResolver;
 }): ActivityProjector;
 
+/**
+ * `~/.agentproto/bundles.json` — named sets of imported MCPs + skills (+
+ * optionally the daemon's own `/mcp`), attachable to any harness in one
+ * `agent_start({bundles:["research"]})` call.
+ *
+ * Same load/save/atomic-write pattern as `user-presets.ts`; validation
+ * against the live imported-MCP set is the single boundary every writer
+ * (MCP tools, HTTP routes) goes through (`saveBundle`).
+ */
+
+declare const bundlesFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    bundles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        mcpImports: z.ZodArray<z.ZodString>;
+        includeDaemon: z.ZodOptional<z.ZodBoolean>;
+        skills: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type BundlesFile = z.infer<typeof bundlesFileSchema>;
+
 /**
  * Spawn-time role profiles — the primitive that decides whether a
  * spawned agent may itself delegate (spawn further children).
@@ -4113,6 +4909,21 @@ interface WorktreeProvisionRequest {
     /** Free-text label (the session's `label`) the provisioner may fold into a
      *  minted slug for human readability. Never load-bearing for correctness. */
     labelHint?: string;
+    /** Absolute path the provisioner should append the setup hooks' FULL
+     *  stdout+stderr to (see `worktree.provision`'s `setupLogPath` input and
+     *  `@agentproto/worktree`'s `runSetup`). `session-spawn.ts` passes the
+     *  spawning session's own transcript dir here, so a failing setup hook's
+     *  full output survives even after a subsequently-reclaimed worktree is
+     *  gone — the short `HookError` message alone only carries a filtered
+     *  tail. Omitted callers (e.g. `agentproto worktree new`, no session to
+     *  log into) simply get no persisted log. */
+    setupLogPath?: string;
+    /** Re-run a failing `worktree.setup` command exactly once before giving
+     *  up — see `worktree.provision`'s `retrySetupOnFailure` input and
+     *  `runSetup`'s doc for why this is a bounded complement, not a
+     *  substitute, and why the daemon opts in while `agentproto worktree new`
+     *  doesn't. */
+    retrySetupOnFailure?: boolean;
 }
 /** The provisioner's outcome. `isolated: false` is NOT a failure — it means
  *  there was nothing to isolate (`cwd` sits in no git repo), and the caller
@@ -4329,6 +5140,15 @@ interface SpawnAgentSessionDeps {
      *  `loadConfig` when omitted; tests inject a stub to avoid touching
      *  the real file. */
     loadDefaultsConfig?: () => Promise<SpawnDefaultsConfig | undefined>;
+    /** Loads `~/.agentproto/bundles.json` for capability-bundle expansion
+     *  (`agent_start.bundles` / config `defaults.bundles`, PLAN D phase 1).
+     *  Defaults to the real loader when omitted; tests inject a stub to avoid
+     *  touching the real file. */
+    loadBundlesConfig?: () => Promise<BundlesFile>;
+    /** Loads `~/.agentproto/imported-mcps.json` — resolves a bundle's
+     *  `mcpImports` ids to their alias/snapshot and detects dangling ones.
+     *  Defaults to the real loader when omitted; tests inject a stub. */
+    loadImportedMcpsConfig?: () => Promise<ImportedMcpsConfig>;
     /** Builds the per-session headless-browser mount for `browser:
      *  "headless"` (see `browser-mount.ts`). Defaults to the real resolver
      *  (installs chrome-devtools-mcp on first use); tests inject a stub. */
@@ -4394,6 +5214,18 @@ interface SpawnAgentSessionDeps {
      *  manifest not covering the requested model still reaches the driver,
      *  same as before this guard existed. */
     listCatalogModels?: CatalogModelsLister;
+    /** Ensure the local `llm-endpoint` proxy sidecar (`LlmEndpointRegistry`)
+     *  is up before a spawn that bills through it. Without this hook, a spawn
+     *  whose resolved gateway is `"llm-endpoint"` assumed the sidecar was
+     *  already running (started externally, or via the `llm_endpoint_start`
+     *  MCP tool) — a fresh install with `features.llmEndpoint` on but nothing
+     *  having called that tool yet would spawn fine and only fail once the
+     *  adapter made its first request. Wired to the registry's own
+     *  (idempotent) `start()` at the composition root; omitted ⇒ unchanged
+     *  pre-existing behavior. Best-effort: a rejection here is swallowed by
+     *  the caller, not surfaced as a spawn failure — the adapter's own first
+     *  request is left to report the real connection error. */
+    ensureLlmEndpointRunning?: () => Promise<void>;
 }
 interface SpawnAgentSessionInput {
     adapter: string;
@@ -4455,7 +5287,19 @@ interface SpawnAgentSessionInput {
      *  blank. Not exposed on the MCP `agent_start` tool today — only the
      *  HTTP route (`sessions restart`) passes this. */
     resumeSessionId?: string;
-    prompt?: string;
+    /** The caller's initial ask — a plain string (the common case, composed
+     *  with the role/AGENTS.md/RULES.md preamble below into one string turn),
+     *  or a content block / block array (an attachment-bearing first message,
+     *  same loose shape `POST /sessions/:id/prompt` accepts). The block form
+     *  is a narrow path: composing daemon-synthesized preamble TEXT onto a
+     *  turn that opens with an image isn't meaningful string concatenation,
+     *  so it SKIPS the whole preamble composition below (role disposition,
+     *  AGENTS.md, RULES.md, parent-lineage line, posture-as-prompt fallback)
+     *  and is sent to the adapter verbatim — see `effectivePrompt`'s doc.
+     *  Acceptable because this path is human/UI-initiated (an attachment
+     *  typed into a chat composer), not the orchestrator-driven role spawns
+     *  that actually depend on the composed disposition text. */
+    prompt?: string | Record<string, unknown> | unknown[];
     label?: string;
     /** Explicit session title (SPEC-3 FIX C, `agentproto sessions start
      *  --title`). When set, it wins over the first-sentence derivation from
@@ -4477,6 +5321,22 @@ interface SpawnAgentSessionInput {
      *  such option (e.g. claude-code, which auto-discovers skills) ignore
      *  it. See `resolveSpawnDefaults` / `normalizeSkillsOption`. */
     skills?: string[];
+    /** Capability bundle ids (`bundle_list`) to attach (PLAN D phase 1). Merged
+     *  with config.json's `defaults.bundles` / `defaults.adapters.<slug>.bundles`
+     *  with the same precedence/replace semantics as `skills` — see
+     *  `resolveBundleDefaults`. Each bundle expands to its `mcpImports` (mounted
+     *  as native MCP servers via the daemon's `/mcp/imported/<id>` passthrough,
+     *  never the two-step `mcp_imported_*` indirection), optionally the
+     *  daemon's own `/mcp` (`includeDaemon`), and its `skills` (unioned into
+     *  the resolved skill list). Ignored (with a warning) for a sandbox spawn —
+     *  the box cannot reach this daemon's loopback `/mcp`. */
+    bundles?: string[];
+    /** Explicitly mount the daemon's own scoped `/mcp` for this spawn — the
+     *  only way an adapter outside `shouldInjectDaemonSelfMount`'s allowlist
+     *  (opencode, codex, gemini, …) gets it. Merged with config's
+     *  `defaults.adapters.<slug>.daemonMount` (per-spawn wins). Ignored (with a
+     *  warning) for a sandbox spawn. */
+    daemonMount?: boolean;
     model?: string;
     effort?: string;
     /** Decomposed route identity.  This is canonical transport; `mode` remains
@@ -4615,6 +5475,12 @@ interface SpawnAgentSessionInput {
      *  external webhook path (`notifyUrl`) already fires regardless of this
      *  flag. */
     notifyParentOnCrash?: boolean;
+    /** Per-spawn opt-out of sentinel auto-link (AIP-60 §6/step 4): `false`
+     *  means a PR this session opens is never auto-watched, regardless of
+     *  `config.sentinel.autoWatchPrs`. Recorded verbatim onto
+     *  {@link SessionDescriptor.sentinelAutoWatch}; `undefined`/`true` = allowed
+     *  (still gated by the config default). */
+    sentinel?: boolean;
     /** Exempt this session from the idle-reaper (`isReapable` in
      *  idle-reaper.ts) regardless of how long it sits idle. Stamped straight
      *  onto the descriptor — see `SessionDescriptor.keepAlive`. Default false
@@ -4955,6 +5821,8 @@ interface BranchGcPlanView {
     includeReviewed: boolean;
     generatedAt: string;
     otherRemoteRefs: number;
+    /** true = base-remote `fetch --prune` succeeded; false = failed; null = skipped / no remote. */
+    fetched: boolean | null;
     entries: BranchGcPlanEntryView[];
 }
 /** kind → class → count, and kind → (status | "protected") → count. */
@@ -5033,6 +5901,22 @@ interface BranchGcVerdictLookupInput {
  *  lookup, so a caller can check one tip without re-running a whole `branch_gc` plan. */
 type BranchGcVerdictReader = (input: BranchGcVerdictLookupInput) => Promise<BranchGcVerdictRecordView | null>;
 
+/**
+ * Set by the tunnel server (never a caller) on every `http_request` it
+ * forwards from a HOST-scoped pairing (DEVICES-PLAN item 1) —
+ * `buildDaemonTunnelServerOptions`'s `pairingScope` in
+ * `packages/cli/src/util/tunnel-serve.ts`. `httpInjectHeaders` overrides any
+ * same-named header the ORIGINAL caller's frame carried, so this can never be
+ * spoofed by whoever dials in over a pairing — only the daemon's own
+ * server-side scope decision at serve time ever sets it.
+ *
+ * Deliberately NOT paired with an `isLoopback` bypass the way most other
+ * routes are: every `http_request` a tunnel forwards to THIS server lands as
+ * a loopback socket (the daemon dialing its own gateway via `fetch`), so
+ * `isLoopback` is true for ALL forwarded traffic — host-scoped or not — and
+ * cannot distinguish them. `handleDeviceInference` checks this header alone.
+ */
+declare const HOST_SCOPE_HEADER = "x-agentproto-host-scope";
 /**
  * Pluggable adapter resolver — keeps the runtime package free of any
  * @agentproto/cli dep. The host (cli `serve`, playground, embedding
@@ -5158,12 +6042,10 @@ type AgentAdapterResolver = (slug: string) => Promise<{
     }): Promise<AgentSessionLike>;
     /** Display label for the descriptor's `command` field. */
     commandPreview?: string;
-    /** Best-effort per-session usage reader (adapter-specific, e.g. hermes state.db). */
-    readUsage?: (adapterSessionId: string) => Promise<{
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    /** Best-effort per-session usage reader (adapter-specific, e.g. hermes
+     *  state.db, the claude-code transcript JSONL). `ctx` carries the spawn's
+     *  cwd + isolated config dir for readers that locate their store by them. */
+    readUsage?: (adapterSessionId: string, ctx?: UsageReadContext) => Promise<UsageReadResult | null>;
     /** AIP-45 `options[]` this adapter's manifest declares (id + type only —
      *  no spawn internals). Lets `session-spawn.ts` fold a config-level
      *  `defaults.skills` list into `options.skills` using the shape the
@@ -5313,169 +6195,48 @@ interface AdapterInstallResult {
      *  post-install re-list failed (the install itself may still have
      *  succeeded — read `ok`). */
     status?: "supported" | "available" | "ready" | "unresolvable";
-    /** True when the install failed ONLY because a manifest setup step
-     *  declares `interactive: true` and this process has no TTY to run it
-     *  in (e.g. openclaw's `onboard --install-daemon` TUI). The remedy is a
-     *  real terminal — `agentproto setup <slug>` — which a UI can offer
-     *  directly as a PTY terminal session. */
-    needsInteractiveSetup?: boolean;
-}
-/**
- * Installs an agent CLI adapter by slug and reports the outcome. Wired by
- * the daemon from `@agentproto/cli`'s `installAdapter` (which knows the
- * catalog + the two install classes); the runtime stays cli-free and only
- * exposes the verb. Must never throw for an ordinary install failure —
- * report it via `ok:false` + `message` — so the MCP tool / HTTP route can
- * return a clean result instead of a 500.
- */
-type AgentAdapterInstaller = (slug: string) => Promise<AdapterInstallResult>;
-/** Loads the read-only vendor/product/route catalog (SPEC §5) for
- *  `GET /catalog/models` + the `catalog_models` MCP tool. A host wires this
- *  from `buildCatalogModels` (`catalog-models.ts`) fed by its installed
- *  adapters + `@agentproto/auth`'s `listAuthProfiles()` — the query params
- *  are forwarded verbatim from the request. Omitted ⇒ the route/tool
- *  report "not enabled" (same convention as `listAgentAdapters`). */
-type CatalogModelsLister = (query: CatalogModelsQuery) => Promise<CatalogModelsResponse>;
-interface AuthOptions {
-    mode: "none" | "bearer";
-    token?: string;
-}
-
-/** One background task as mirrored onto `SessionDescriptor.backgroundTasks`. */
-interface SessionBackgroundTask {
-    taskId: string;
-    /** Friendly task type (`"shell"`, `"monitor"`, ...), when the agent says. */
-    taskKind?: string;
-    description?: string;
-    /** Where the task writes its output, when the agent says. */
-    outputFile?: string;
-    status: "running" | "paused" | "completed" | "failed" | "stopped";
-    summary?: string;
-    toolCallId?: string;
-    /** ISO 8601 — when the daemon first heard of the task. */
-    startedAt: string;
-}
-
-/**
- * Typed inter-session message envelope (AIP-46 §Session messages).
- *
- * A PROMPT is an instruction from whoever drives a session; a MESSAGE is a
- * report between sessions in the same tree whose sender the DAEMON attests.
- * Everything in `from` is computed here from the caller's verified identity
- * and the session forest — a send request can never set it.
- *
- * Pure module: no registry, no I/O. The registry (sessions.ts) carries a
- * `SessionMessage` on a queued prompt (`QueuedPrompt.envelope`), renders it
- * into the model's context with `renderSessionMessages`, and records it as
- * its own `session-message` transcript record — never a `user-prompt`.
- */
-/** Sender's position in the tree, relative to the recipient. */
-type MessageRelation = "child" | "parent" | "sibling" | "human" | "system";
-type MessageKind = "report" | "question" | "blocker" | "done" | "notice";
-type MessageUrgency = "fyi" | "next-turn" | "steer" | "interrupt";
-type MessageDeliveryVia = "wait" | "steer" | "turn" | "interrupt" | "inbox";
-declare const MESSAGE_KINDS: readonly MessageKind[];
-declare const MESSAGE_URGENCIES: readonly MessageUrgency[];
-interface SessionMessageFrom {
-    /** Absent only for relation `human` | `system`. */
-    sessionId?: string;
-    /** Registry label at send time — display only, never identity. */
-    label?: string;
-    role?: string;
-    adapter?: string;
-    relation: MessageRelation;
-}
-interface SessionMessage {
-    /** `msg_<uuid8>`, daemon-minted. */
-    id: string;
-    ts: string;
-    /** Recipient sessionId. */
-    to: string;
-    from: SessionMessageFrom;
-    kind: MessageKind;
-    /** Requested urgency. */
-    urgency: MessageUrgency;
-    /** Stamped on delivery. */
-    delivered?: {
-        via: MessageDeliveryVia;
-        at: string;
-        turnSeq?: number;
-    };
-    /** Thread id; defaults to the first message's id. */
-    correlationId?: string;
-    /** A `SessionMessage.id` this answers. */
-    replyTo?: string;
-    text: string;
-    /** Optional structured payload (≤ `MAX_MESSAGE_DATA_BYTES`). */
-    data?: Record<string, unknown>;
-    ackedAt?: string;
-}
-declare const MAX_MESSAGE_DATA_BYTES: number;
-/** The slice of a session descriptor relation/ACL resolution needs. */
-interface MessageTreeNode {
-    id: string;
-    parentSessionId?: string;
-    label?: string;
-    role?: string;
-    adapterSlug?: string;
+    /** True when the install failed ONLY because a manifest setup step
+     *  declares `interactive: true` and this process has no TTY to run it
+     *  in (e.g. openclaw's `onboard --install-daemon` TUI). The remedy is a
+     *  real terminal — `agentproto setup <slug>` — which a UI can offer
+     *  directly as a PTY terminal session. */
+    needsInteractiveSetup?: boolean;
 }
 /**
- * Relation of `sender` to `recipient` in the session forest, or `undefined`
- * when they're not tree neighbours (cousins, strangers, self). `sender`
- * absent ⇒ `human` (an HTTP/CLI operator); daemon-originated notices pass
- * `"system"` explicitly instead of calling this.
- */
-declare function resolveRelation(sender: MessageTreeNode | undefined, recipient: MessageTreeNode): Exclude<MessageRelation, "system"> | undefined;
-/**
- * ACL: child→parent, parent→direct child, human/system→any. Sibling↔sibling
- * only when `allowSiblings` (config-gated, default off). Anything else — a
- * cousin, a stranger, yourself — is refused.
+ * Installs an agent CLI adapter by slug and reports the outcome. Wired by
+ * the daemon from `@agentproto/cli`'s `installAdapter` (which knows the
+ * catalog + the two install classes); the runtime stays cli-free and only
+ * exposes the verb. Must never throw for an ordinary install failure —
+ * report it via `ok:false` + `message` — so the MCP tool / HTTP route can
+ * return a clean result instead of a 500.
  */
-declare function isMessageAllowed(relation: MessageRelation | undefined, opts?: {
-    allowSiblings?: boolean;
-}): relation is MessageRelation;
-/** Build a `from` block from the verified sender + the resolved relation. */
-declare function messageFrom(sender: MessageTreeNode | undefined, relation: MessageRelation): SessionMessageFrom;
-declare function mintMessageId(): string;
-declare function createSessionMessage(input: {
-    to: string;
-    from: SessionMessageFrom;
-    text: string;
-    kind?: MessageKind;
-    urgency?: MessageUrgency;
-    replyTo?: string;
-    correlationId?: string;
-    data?: Record<string, unknown>;
-}): SessionMessage;
-interface MessageFilter {
-    /** Sender session ids, or `"children"` for any message whose relation is
-     *  `child` (i.e. from one of the recipient's own children). */
-    from?: readonly string[] | "children";
-    kind?: readonly MessageKind[];
-    correlationId?: string;
+type AgentAdapterInstaller = (slug: string) => Promise<AdapterInstallResult>;
+/** Loads the read-only vendor/product/route catalog (SPEC §5) for
+ *  `GET /catalog/models` + the `catalog_models` MCP tool. A host wires this
+ *  from `buildCatalogModels` (`catalog-models.ts`) fed by its installed
+ *  adapters + `@agentproto/auth`'s `listAuthProfiles()` — the query params
+ *  are forwarded verbatim from the request. Omitted ⇒ the route/tool
+ *  report "not enabled" (same convention as `listAgentAdapters`). */
+type CatalogModelsLister = (query: CatalogModelsQuery) => Promise<CatalogModelsResponse>;
+interface AuthOptions {
+    mode: "none" | "bearer";
+    token?: string;
+}
+
+/** One background task as mirrored onto `SessionDescriptor.backgroundTasks`. */
+interface SessionBackgroundTask {
+    taskId: string;
+    /** Friendly task type (`"shell"`, `"monitor"`, ...), when the agent says. */
+    taskKind?: string;
+    description?: string;
+    /** Where the task writes its output, when the agent says. */
+    outputFile?: string;
+    status: "running" | "paused" | "completed" | "failed" | "stopped";
+    summary?: string;
+    toolCallId?: string;
+    /** ISO 8601 — when the daemon first heard of the task. */
+    startedAt: string;
 }
-declare function matchesMessageFilter(msg: SessionMessage, filter: MessageFilter): boolean;
-declare const MESSAGE_TAG = "agentproto-message";
-/** Child-settable label → attribute-safe: `[A-Za-z0-9._-]`, ≤ 48 chars. */
-declare function sanitizeLabel(label: string | undefined): string | undefined;
-/** Escape every envelope/body sentinel inside a message body, so a sender
- *  can't close the tag early and forge a second header. */
-declare function escapeMessageBody(text: string): string;
-/** A human prompt is NOT wrapped (humans keep today's UX), but a line that
- *  starts with the envelope sentinel is escaped, so the invariant "text
- *  outside an `<agentproto-message>` tag is the human" holds. Nothing else
- *  in human text changes. */
-declare function escapeHumanPrompt(text: string): string;
-declare function renderSessionMessage(msg: SessionMessage): string;
-/** A coalesced batch → sibling tags, one per message, in order. */
-declare function renderSessionMessages(msgs: readonly SessionMessage[]): string;
-/** One-line typed digest of `fyi` messages that never woke the session —
- *  prepended (as a `system-prompt` slice) to the next turn it runs anyway. */
-declare function renderInboxDigest(msgs: readonly SessionMessage[]): string;
-/** Taught once, the first time a session RECEIVES a message (recorded as a
- *  `system-prompt`). Children also get the same invariant in their lineage
- *  line at spawn. */
-declare const MESSAGE_PREAMBLE: string;
 
 /**
  * A per-session observer — the pluggable seam behind the runtime's transcript
@@ -5537,6 +6298,94 @@ interface SessionObserver {
  */
 declare function composeSessionObservers(observers: readonly SessionObserver[]): SessionObserver;
 
+/**
+ * Session-scoped artifact store — durable, content-addressed documents
+ * (image, pdf, html, presentation, site, generic file) attached to an
+ * agent-cli session, kept across restarts and browsable in the session's
+ * "Artifacts" section, distinct from the ephemeral inline card a chat
+ * message renders.
+ *
+ * Deliberately mirrors `transcript-writer.ts`'s `AttachmentEntry`, which
+ * itself mirrors AIP-58's `ArtifactEntry` (`packages/workflow-runtime/src/
+ * types.ts`) field-for-field — `key`/`path`/`sha256`/`size`/`contentType` —
+ * so promoting an attachment to an artifact is a metadata copy, never a
+ * data migration. What this module adds on top of a bare `ArtifactEntry`
+ * is the session-artifact-specific envelope AIP-58 has no notion of:
+ * `kind`, `label`, `pinned`, `createdBy`, `sourceRef`, and version history
+ * under one stable `key`.
+ *
+ * Storage layout, under `sessionTranscriptDir(sessionId)`:
+ *
+ *   artifacts/<sha256>.<ext>      — one file per single-file version
+ *   artifacts/<sha256>/           — one directory per "site" version
+ *   artifacts.jsonl               — append-only ledger, one JSON line per
+ *                                    mutation (`artifact.added` |
+ *                                    `artifact.pinned`)
+ *
+ * The ledger is the single source of truth, same posture AIP-58 §5 takes
+ * for its run event log: `listSessionArtifacts`/`getSessionArtifact` are
+ * folds over it, never a second store that could disagree with it. A
+ * `key`'s version history is append-only; nothing here ever rewrites a
+ * prior version's file or ledger line.
+ */
+type ArtifactKind = "image" | "document" | "pdf" | "html" | "presentation" | "site" | "file";
+type ArtifactCreator = "agent" | "user";
+interface ArtifactVersionEntry {
+    version: number;
+    /** Content hash — sha256 of the file's bytes for a single-file version,
+     *  or a manifest hash (sorted relative paths + sizes) for a "site"
+     *  directory version. Not a cryptographic content-integrity guarantee
+     *  for the directory case, only a stable change-detection key. */
+    sha256: string;
+    /** Relative to `sessionTranscriptDir(sessionId)` — `"artifacts/<sha>.<ext>"`
+     *  for a single file, `"artifacts/<sha>"` (a directory) for a site. */
+    path: string;
+    /** True when `path` names a directory (a "site"). */
+    isDirectory: boolean;
+    size: number;
+    contentType?: string;
+    createdAt: string;
+    createdBy: ArtifactCreator;
+    sourceRef?: string;
+}
+interface ArtifactRecord {
+    key: string;
+    kind: ArtifactKind;
+    label?: string;
+    pinned: boolean;
+    updatedAt: string;
+    versions: ArtifactVersionEntry[];
+}
+interface AddSessionArtifactInput {
+    /** Stable id this version is filed under. Versions accrue when the same
+     *  key is added again with different content. Defaults to a slug of
+     *  `name`, else the content hash. */
+    key?: string;
+    kind?: ArtifactKind;
+    label?: string;
+    createdBy: ArtifactCreator;
+    /** e.g. `"attachment:attachments/<sha>.<ext>"`, `"workflow-run:<runId>/
+     *  <artifactKey>"`, `"canvakit:<exportPath>"` — free-form provenance. */
+    sourceRef?: string;
+    /** Inline content, base64-encoded. Mutually exclusive with `sourcePath`. */
+    bytes?: string;
+    /** Display name — also the default `key`/extension source. */
+    name?: string;
+    mimeType?: string;
+    /** Absolute path to an existing file or directory (e.g. a canvakit
+     *  export) to copy into the store. A directory implies `kind: "site"`
+     *  unless overridden. Mutually exclusive with `bytes`. */
+    sourcePath?: string;
+}
+interface GetSessionArtifactResult {
+    record: ArtifactRecord;
+    version: ArtifactVersionEntry;
+    /** Absent for a "site" (directory) version — browse it via the raw-serve
+     *  route instead; nothing here bounds a whole directory's bytes. */
+    content?: Buffer;
+    truncated: boolean;
+}
+
 /** Where a session's `contextSize` came from — see the module doc. */
 type ContextSizeSource = "adapter" | "catalog" | "reported";
 
@@ -5560,8 +6409,11 @@ type ContextSizeSource = "adapter" | "catalog" | "reported";
  */
 
 interface SessionOutcomeArtifact {
-    type: "pr" | "commit" | "url";
-    /** The artifact's canonical reference — a PR url, a commit sha, a url. */
+    type: "pr" | "commit" | "url" | "file";
+    /** The artifact's canonical reference — a PR url, a commit sha, a url,
+     *  or (for `type: "file"`) the session artifact's `key`
+     *  (`session-artifacts.ts`) — resolve it via `session_artifact_get` /
+     *  `GET /sessions/:id/artifacts/:key`. */
     ref: string;
     title?: string;
 }
@@ -5574,12 +6426,26 @@ interface SessionOutcomeLink {
     title?: string;
 }
 interface SessionOutcome {
-    /** Level 1 only ever writes `"derived"`; a declared outcome (Level 2) is a
-     *  later addition. */
-    source: "derived";
+    /** Level 1 (`deriveSessionOutcome`) only ever writes `"derived"` — what an
+     *  ended session produced, with zero agent/human cooperation. Level 2 adds
+     *  `"judged"` (a judge agent decided the verdict, `judgedBy` names the
+     *  judge session) and `"declared"` (a deterministic rule or an operator
+     *  declared it, `judgedBy` is `"steward-rules"` or absent). See
+     *  `registry.closeWithOutcome`. */
+    source: "derived" | "judged" | "declared";
     /** `produced` — the session said something or left an artifact;
      *  `empty` — no assistant text and no artifacts. */
     status: "produced" | "empty";
+    /** Level 2 only: what a judge/declaration decided the session's work
+     *  amounted to. Absent on a plain Level 1 `"derived"` outcome. */
+    verdict?: "done" | "abandoned" | "blocked" | "needs-input";
+    /** Level 2 only: who reached `verdict` — a session id (a judge agent) or
+     *  the literal `"steward-rules"` for a deterministic close with no judge
+     *  in the loop. Absent on a plain Level 1 `"derived"` outcome. */
+    judgedBy?: string;
+    /** Level 2 only: free-text note from the judge/declaration explaining
+     *  `verdict` — never populated by `deriveSessionOutcome` itself. */
+    note?: string;
     /** Last assistant message of the session, trimmed to
      *  {@link OUTCOME_SUMMARY_MAX} chars (the TAIL is kept — the conclusion,
      *  not the preamble). Absent when the session never said anything. */
@@ -5625,6 +6491,12 @@ interface SessionOutcomeCompact {
 interface DeriveSessionOutcomeInput {
     /** The last assistant message the registry observed (raw, untrimmed). */
     lastAssistantText?: string;
+    /** Extra `type: "file"` artifacts to merge alongside the PR-derived ones
+     *  — the registry passes the session's PINNED `session-artifacts.ts`
+     *  records here so the ended block can show them (an unpinned artifact
+     *  still lists in the session's "Artifacts" section, just not surfaced
+     *  in the terse outcome). */
+    artifacts?: SessionOutcomeArtifact[];
     now?: Date;
 }
 /**
@@ -6155,7 +7027,10 @@ interface SessionDescriptor {
      *     `"parent-exited"` (an orchestrator's dying subtree reap),
      *     `"provider-limit"` (a driver-reported subscription/usage-cap error,
      *     e.g. Claude Code's "hit your session limit"), `"forgotten"` (a live
-     *     session killed as part of an operator `DELETE`).
+     *     session killed as part of an operator `DELETE`), `"steward-completed"` /
+     *     `"steward-abandoned"` (the session steward's `closeWithOutcome` —
+     *     verdict `"done"` vs. `"abandoned"`; a `"blocked"`/`"needs-input"`
+     *     verdict doesn't close at all, see `SessionDescriptor.wrapupFlag`).
      *  Absent for every terminal path this file doesn't tag (a plain natural
      *  exit, an ordinary turn error) — the session's own fault, or at least
      *  not something worth a special label. A string outside this list is
@@ -6188,6 +7063,20 @@ interface SessionDescriptor {
      *  revives the row. Persisted, so it survives restarts and archiving. See
      *  `session-outcome.ts`. */
     outcome?: SessionOutcome;
+    /** A steward verdict of `"blocked"` or `"needs-input"` from
+     *  `registry.closeWithOutcome` (`session-wrapup.ts` / FIX-9A) — recorded
+     *  INSTEAD of closing, since neither verdict means the session is done.
+     *  The session stays exactly as alive as it was; this is a signal for a
+     *  human/orchestrator to look, not a termination. Persisted; overwritten
+     *  (not accumulated) by the next flag, and left stale on the descriptor
+     *  until something clears it (nothing here does — a later successful
+     *  turn/close is a separate, more informative signal than deleting this). */
+    wrapupFlag?: {
+        verdict: "blocked" | "needs-input";
+        note?: string;
+        judgedBy?: string;
+        at: string;
+    };
     /** Last time anything was written to stdout/stderr. Lets the UI
      *  spot stuck sessions ("running for 2h, last output 12min ago"). */
     lastOutputAt?: string;
@@ -6225,6 +7114,12 @@ interface SessionDescriptor {
      *  every read since it's a live OS query, stale the instant it's
      *  written to disk. */
     processAlive?: boolean;
+    /** Summed RSS in bytes of this session's process and all its OS-level
+     *  descendants (`processTreeRss`, `process-memory.ts`). Ephemeral,
+     *  never persisted — stamped only when a caller opts in (`session_list`'s
+     *  `withMemory: true`) since it costs a `ps` spawn; absent otherwise, and
+     *  absent for a row with no `pid` or that `ps` didn't report. */
+    rssBytes?: number;
     /** Count of live supervisors currently blocked waiting on this session —
      *  HTTP `GET /sessions/:id/wait` long-polls and `session_monitor`
      *  subscriptions, both via `monitorSessionWait` (#session-visibility).
@@ -6320,16 +7215,32 @@ interface SessionDescriptor {
      *  `status` to `"error"` directly (a genuinely terminal row the existing
      *  crash/error handling already catches). This is the twin gap for a
      *  turn that fails IN-BAND while the process stays alive: `status` stays
-     *  `"running"`, `lastError` stays unset (reserved for `markCrashed`), and
-     *  nothing else distinguishes the session from one that simply finished
-     *  a clean turn and is idle. Folded into the same "stalled" activity/UI
-     *  treatment a mid-turn stall gets (see sessionsTree.logic.ts's
-     *  `activityFor`) rather than a new state, on the theory that both mean
-     *  "the last thing this session did needs a look, not a re-prompt on
-     *  faith". Stamped at turn-end when `turnEndReason === "error"`; cleared
-     *  the moment a LATER turn completes without one (same reset shape as
+     *  `"running"`, `lastError` stays unset (still reserved for `markCrashed`
+     *  — see `lastTurnErrorMessage` below for the message text this field's
+     *  own turn carries), and nothing else distinguishes the session from
+     *  one that simply finished a clean turn and is idle. Folded into the
+     *  same "stalled" activity/UI treatment a mid-turn stall gets (see
+     *  sessionsTree.logic.ts's `activityFor`) rather than a new state, on
+     *  the theory that both mean "the last thing this session did needs a
+     *  look, not a re-prompt on faith". Stamped at turn-end when
+     *  `turnEndReason === "error"` — including the case where the adapter's
+     *  stream generator simply returned after emitting an in-band `error`
+     *  event with no explicit turn-end and no thrown exception, which
+     *  `runAgentTurn`'s P5 synthetic-reason fallback now classifies as
+     *  `"error"` rather than defaulting to `"exited"`. Cleared the moment a
+     *  LATER turn completes without one (same reset shape as
      *  `resumeAttempts`/`restartAttempts`). Detection + signal only. */
     lastTurnErroredAt?: string;
+    /** The captured error text for the turn `lastTurnErroredAt` timestamps —
+     *  `evt.error.message` off the in-band stream `error` event observed
+     *  during that turn (see `runAgentTurn`'s `turnErrorMessage`). Distinct
+     *  from `lastError` (reserved for `markCrashed`) and from
+     *  `rt.lastErrorMessage` (an internal, cross-turn, never-cleared runtime
+     *  field — this one is the public, turn-scoped descriptor projection of
+     *  it). Absent when the adapter reported `reason:"error"` on its own
+     *  turn-end without a preceding `error`-kind stream event. Stamped and
+     *  cleared together with `lastTurnErroredAt`. */
+    lastTurnErrorMessage?: string;
     /** True when the LAST completed turn produced zero assistant output and
      *  zero tool calls (mirrors `SessionTurnEndEvent.empty` — see that
      *  field's doc). Persisted so `monitorSessionWait`'s synchronous
@@ -6359,6 +7270,32 @@ interface SessionDescriptor {
      *  the underlying `killedMidTurn`/`endedReason`). The in-place resume path
      *  never auto-retries the interrupted prompt. */
     interrupted?: boolean;
+    /** The `SessionsRegistry.bootId` of the daemon boot that followed the
+     *  restart which cut this row's turn off. The graceful shutdown that
+     *  interrupts a turn parks `INTERRUPTED_PENDING_BOOT` here; the next boot
+     *  reload (`loadHistorySnapshot`) swaps that — or, after an unclean exit, a
+     *  row still alive on disk — for its own `bootId`. Nothing else is ever
+     *  stamped: an interrupted row carrying no marker was persisted by a daemon
+     *  predating it, i.e. by an older restart, and stays stale. Cleared on the
+     *  next successful turn-end (with the markers it
+     *  qualifies). `interruptedAtBoot === registry.bootId` is how the
+     *  continue-interrupted verb and boot pass pick "interrupted by the LAST
+     *  restart" apart from a stale interruption nobody picked back up. PERSISTED
+     *  (unlike the derived `interrupted`) — the boot that stamped it may not be
+     *  the one reading it. */
+    interruptedAtBoot?: string;
+    /** How many automatic continue prompts the daemon has sent this row
+     *  (`daemon.continueInterruptedOnBoot`) since its last successful turn-end.
+     *  Incremented BEFORE the prompt is sent, so a continue turn that itself
+     *  gets cut off by another restart still counts; reset on the next
+     *  successful turn-end. The boot pass stops at
+     *  `MAX_AUTO_CONTINUE_ATTEMPTS` — the no-loop bound for a turn that keeps
+     *  taking the daemon down with it. PERSISTED; absent until the first one. */
+    autoContinueAttempts?: number;
+    /** `bootId` of the boot whose pass last auto-continued this row — the
+     *  at-most-one-auto-continue-per-restart guard. Reset with
+     *  `autoContinueAttempts`. */
+    lastAutoContinueBoot?: string;
     /** How many in-place resume attempts have FAILED in a row for this session
      *  (§5 cap/backoff). Incremented on every failed `maybeResumeAgent` attempt —
      *  the resume throws, the adapter rejects the id, or the spawn returns null —
@@ -6717,6 +7654,19 @@ interface SessionDescriptor {
     /** Cumulative input / output token counts (same source + cadence as costUsd). */
     tokensIn?: number;
     tokensOut?: number;
+    /** Cumulative prompt-cache read / cache-creation / reasoning tokens, from
+     *  the adapter's usage reader (claude-code transcript, hermes state.db,
+     *  opencode.db). Absent when the adapter doesn't expose them — never
+     *  zero-filled. See `UsageDetail` in usage.ts. */
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+    reasoningTokens?: number;
+    /** Tool calls the daemon observed across completed turns (cumulative).
+     *  Stamped at the first turn end, so absent = no turn has finished yet. */
+    toolCalls?: number;
+    /** Wall time spent inside turns, cumulative ms. Same cadence as
+     *  `toolCalls`. */
+    durationMs?: number;
     /** Context-window size + tokens-in-context from the latest `usage_update`
      *  event (ACP adapters that report a context window). Refreshed live as
      *  usage_update events arrive, not just at turn-end. */
@@ -6776,6 +7726,20 @@ interface SessionDescriptor {
      *  — so this carries no secrets today. Should the shape ever grow
      *  headers/tokens, NEVER log this field's contents. */
     mcpServers?: AcpMcpServer[];
+    /** Resolved skills list at spawn time — explicit ∪ preset ∪ config
+     *  defaults (`resolveSpawnDefaults`'s own merge), recorded regardless of
+     *  whether the adapter actually CONSUMES a `skills` spawn option (today
+     *  only hermes does — see `normalizeSkillsOption`). Persisted so it
+     *  survives restart/resume like `mcpServers`, and so a read surface
+     *  (`session_capabilities`) can show what was resolved even for an
+     *  adapter (claude-code) that auto-discovers skills on its own and never
+     *  reads this list back. */
+    skills?: string[];
+    /** Capability bundle ids (`bundle_list`) resolved for this spawn (PLAN D
+     *  phase 1) — ids only, never the expanded imported-MCP snapshots (those
+     *  live only in `mcpServers` above, as reference-only proxy URLs). Absent
+     *  ⇒ no bundle was attached. */
+    bundles?: string[];
     /** Provider-specific resume hints sniffed from the session's
      *  output. claude-code prints `claude --resume <uuid>` on exit;
      *  we capture that uuid as `claudeResumeId`. On `restart`, when a
@@ -6878,6 +7842,12 @@ interface SessionDescriptor {
      *  want. Threaded like `permissionHold` — set at spawn time, immutable
      *  thereafter. */
     notifyParentOnCrash?: boolean;
+    /** Per-spawn opt-out of sentinel auto-link (AIP-60 §6/step 4,
+     *  `agent_start.sentinel: false`). `undefined`/`true` = allowed (subject to
+     *  `config.sentinel.autoWatchPrs`); `false` = this session's opened PRs are
+     *  never auto-watched, no matter the config. Set once at spawn, immutable
+     *  thereafter — same threading as `notifyParentOnCrash`. */
+    sentinelAutoWatch?: boolean;
     /** True when the session was spawned in permission-hold mode. */
     permissionHold?: boolean;
     /** Effective OS-level confinement of the adapter's own process
@@ -6912,9 +7882,17 @@ interface SessionDescriptor {
      *  time (spawn / resume) — shown in `session_list` so a sender can predict
      *  a message's delivery tier. `steering`: the agent accepts ACP steering
      *  (`_session/steering`) — a `steer` message can be injected into its
-     *  running turn instead of waiting for it to end. */
+     *  running turn instead of waiting for it to end. `commandsSupported`:
+     *  the live agent session is the ACP protocol arm (has a working `steer`
+     *  method — only the ACP arm implements it, per `AgentSessionLike`'s own
+     *  doc), which is what actually emits `available_commands_update`
+     *  notifications; false for the print/proprietary arms regardless of
+     *  `steeringSupported`, since a harness can be ACP without advertising
+     *  the steering extension. Read by `session_capabilities` to derive its
+     *  `arm`/`commandsSupported` fields without re-deriving the signal. */
     capabilities?: {
         steering: boolean;
+        commandsSupported: boolean;
     };
     /** FIFO of prompts that arrived while this session was mid-turn and
      *  asked to be QUEUED rather than rejected (`enqueuePrompt`'s
@@ -7368,6 +8346,28 @@ type PermissionRespondResult = {
     error: "not_found" | "session_gone" | "no_matching_option" | "unsupported";
     message: string;
 };
+/** Input to `SessionsRegistry.closeWithOutcome`. `verdict: "done" |
+ *  "abandoned"` records the Level 2 fields onto the session's
+ *  `SessionOutcome` and actually closes it; `"blocked" | "needs-input"`
+ *  records the SAME `note`/`judgedBy` onto `SessionDescriptor.wrapupFlag`
+ *  instead and never touches the session's liveness. See {@link
+ *  SessionOutcome} / {@link SessionDescriptor.wrapupFlag} for the field
+ *  meanings. */
+interface CloseWithOutcomeInput {
+    verdict: "done" | "abandoned" | "blocked" | "needs-input";
+    /** Overrides the outcome's derived summary when given (e.g. a judge's own
+     *  written summary) — trimmed the same way `deriveSessionOutcome` trims
+     *  `lastAssistantText`. Omitted keeps whatever `deriveSessionOutcome`
+     *  computed from the session's own last assistant message. Ignored for a
+     *  `"blocked"`/`"needs-input"` verdict (there's no outcome to summarize —
+     *  nothing closed). */
+    summary?: string;
+    note?: string;
+    /** A judge session id, or `"steward-rules"` for a deterministic close with
+     *  no judge in the loop. */
+    judgedBy?: string;
+    source: "judged" | "declared";
+}
 interface SessionsRegistry {
     spawn(input: SpawnSessionInput): SessionDescriptor;
     /** Adopt a ChildProcess that was spawned outside the registry —
@@ -7636,6 +8636,21 @@ interface SessionsRegistry {
         reason?: string;
         interrupted?: boolean;
     }>;
+    /** A currently-RUNNING background task's info plus a tail of its output
+     *  file, for the UI's "click a live background-task row to peek at its
+     *  output" affordance. Scoped to `SessionDescriptor.backgroundTasks` on
+     *  purpose — a settled task is dropped from that list moments after it
+     *  reports terminal status (see `noteBackgroundTask`), so this never
+     *  becomes an arbitrary-file-read: the caller supplies a `taskId`, never a
+     *  path, and only a path the agent itself already reported for a task
+     *  still tracked as running is ever read. Returns `null` when the session
+     *  or the task is unknown (the caller surfaces 404); `tail` is `null` when
+     *  the task has no `outputFile` or the file can't be read (not yet
+     *  created, already rotated away, ...). */
+    readBackgroundTaskTail(id: string, taskId: string): {
+        task: SessionBackgroundTask;
+        tail: string | null;
+    } | null;
     /** Eagerly resume ONE dead-but-resumable agent-cli session IN PLACE,
      *  WITHOUT a prompt — the boot-time counterpart to the lazy resume that
      *  `sendPrompt`/`enqueuePrompt` trigger on the first prompt after a restart
@@ -7658,6 +8673,17 @@ interface SessionsRegistry {
      *  touching the adapter, so the bounded boot pass can call it per row and
      *  tally the results. */
     resumeOnBoot(id: string): Promise<EagerResumeOutcome>;
+    /** Opaque id unique to this registry instance — one per daemon boot.
+     *  Stamped as `interruptedAtBoot` on rows the boot reload finds interrupted,
+     *  so `interruptedAtBoot === bootId` means "interrupted by the restart that
+     *  preceded THIS boot" (continue-interrupted). */
+    readonly bootId: string;
+    /** Book one automatic continue prompt against `id` (increment
+     *  `autoContinueAttempts`, stamp `lastAutoContinueBoot = bootId`) and
+     *  persist. Called by the continue-on-boot pass BEFORE it sends, so the
+     *  no-loop bound holds even when the continue turn is itself cut off by the
+     *  next restart. No-op for an unknown id. */
+    recordAutoContinue(id: string): void;
     /** Cancel the in-flight turn on a live agent-cli session and leave the
      *  session itself alive and idle — the bare "interrupt, no next prompt"
      *  primitive `sendPrompt`/`enqueuePrompt`'s `opts.interrupt` arm lacks
@@ -7850,6 +8876,29 @@ interface SessionsRegistry {
      *  touches `keepAlive`, reaper eligibility, or any notification path —
      *  pin is quiet, structural state only. Throws when the id is unknown. */
     setPinned(id: string, pinned: boolean): SessionDescriptor;
+    /** Materialize a new artifact (or version of one) into the session's
+     *  durable artifact store (`session_artifact_add` MCP verb / `POST
+     *  /sessions/:id/artifacts`) — see `session-artifacts.ts`. Emits
+     *  `session:artifact-added` on a real (non-deduped) write. Throws when
+     *  the id is unknown. */
+    addSessionArtifact(id: string, input: AddSessionArtifactInput): ArtifactRecord;
+    /** Current-state fold of the session's artifact store — every key's
+     *  version history, most-recently-updated first. Empty array for a
+     *  known session with no artifacts yet. Throws when the id is unknown. */
+    listSessionArtifacts(id: string): ArtifactRecord[];
+    /** One artifact version's metadata plus its bounded file content (single-
+     *  file kinds only — a "site" version's content is browsed via the raw-
+     *  serve HTTP route instead). Undefined when the key/version doesn't
+     *  exist. Throws when the session id is unknown. */
+    getSessionArtifact(id: string, key: string, opts?: {
+        version?: number;
+        maxBytes?: number;
+    }): GetSessionArtifactResult | undefined;
+    /** Set or clear an artifact's pin (`session_artifact_pin` MCP verb /
+     *  `POST /sessions/:id/artifacts/:key/pin`). Emits
+     *  `session:artifact-pinned-changed`. Undefined when the key doesn't
+     *  exist. Throws when the session id is unknown. */
+    setArtifactPinned(id: string, key: string, pinned: boolean): ArtifactRecord | undefined;
     /**
      * Manually override `awaitingInput`/`awaitingQuestion` (the
      * `session_flag_status` MCP verb) — the ONE write path for this pair
@@ -7955,6 +9004,34 @@ interface SessionsRegistry {
      *  reason (including `"operator-stopped"` or none) on a terminal row
      *  stays the plain no-op. */
     kill(id: string, signal?: NodeJS.Signals, reason?: SessionEndReason): boolean;
+    /** Close a LIVE agent-cli session with a Level 2 (judged/declared) outcome
+     *  — the primitive the session steward (FIX-9A/9B) drives once a wrap-up
+     *  plan (`planSessionWrapup`, `session-wrapup.ts`) puts a session in the
+     *  `close`/`stuck` class, or a judge agent reaches a verdict on a `judge`
+     *  one. Verdict `"done"` or `"abandoned"` actually closes: terminates the
+     *  same graceful way `kill()` does, tags `endedReason: "steward-completed"`
+     *  (`"done"`) or `"steward-abandoned"` (`"abandoned"`), and — like
+     *  `reapIdle`, unlike a plain `kill()` — CLEARS the in-memory
+     *  `agentSession` binding so the row stays lazy-resumable in place. The
+     *  recorded outcome's `source`/`verdict`/`judgedBy`/`note` are stamped onto
+     *  the row's `SessionOutcome` (see `session-outcome.ts`) on top of what
+     *  `deriveSessionOutcome` would otherwise compute (last assistant message,
+     *  PRs, cost) — a declared close still shows what the session actually
+     *  produced. Verdict `"blocked"` or `"needs-input"` is NOT a completion —
+     *  nothing is terminated; the verdict is recorded as
+     *  `SessionDescriptor.wrapupFlag` instead, and the session is left exactly
+     *  as alive as it was.
+     *
+     *  Refuses (returns false, no-op) a session that is not a live
+     *  (`running`/`starting`) agent-cli row, or that AT THE MOMENT OF THE CALL
+     *  is `busy`/`awaitingInput`/`awaitingPermission` or has a background task
+     *  outstanding (`pendingBgTasks`/`backgroundTasks`) — a plan computed
+     *  moments earlier can be stale; this is the re-check that keeps an
+     *  autonomous close from ever landing on a session that just picked up a
+     *  turn, asked a question, or still has something in flight. Applies to
+     *  BOTH branches (close and flag-only) — a stale plan is refused either
+     *  way, never silently acted on. */
+    closeWithOutcome(id: string, input: CloseWithOutcomeInput): boolean;
     /** Retire a long-idle agent-cli session to free its adapter process — the
      *  primitive the idle-session reaper (`runIdleReapPass`, PR-6) drives on a
      *  periodic sweep. Terminates the underlying adapter/child the SAME graceful
@@ -8062,6 +9139,18 @@ interface SessionsRegistry {
      *  window keeps aging out naturally rather than being wiped by the
      *  give-up itself. Returns false (no-op) for an unknown id. */
     giveUpRestart(id: string, message: string): boolean;
+    /** Record a daemon-authored DISPLAY-ONLY notice into an agent-cli
+     *  session's transcript — the same `kind: "notice"` event `markCrashed`/
+     *  `giveUpRestart`/`interruptInFlightTurn` already stamp on their own
+     *  teardown/interrupt paths (see transcript-writer.ts's "notice" case),
+     *  exposed generically for a caller with just a session id, no `rt`
+     *  in hand. Appends to `events.jsonl` (so `session_story`/`live_session`
+     *  render it as a system message) and the ring buffer — nothing else:
+     *  it does NOT touch `promptQueue`, the inbox, or `busy`, so it can never
+     *  enqueue a prompt, wake an idle session into a turn, or interrupt a busy
+     *  one. Returns false (no-op) for an unknown id or a non-`agent-cli`
+     *  session. */
+    recordNotice(id: string, text: string): boolean;
     /** List permission requests currently parked in the pending-permissions
      *  inbox across all permission-hold sessions, newest last. Optionally
      *  filtered to one session. */
@@ -8167,8 +9256,10 @@ interface SpawnAgentInput {
     /** Optional initial prompt to dispatch immediately. The promise
      *  the registry returns resolves AFTER the spawn — the prompt
      *  runs in the background, projecting events into the ring
-     *  buffer. Skip to spawn idle. */
-    initialPrompt?: string;
+     *  buffer. Skip to spawn idle. A plain string, or a content-block
+     *  prompt (attachment-bearing first message) — see
+     *  `SpawnAgentSessionInput.prompt`'s doc. */
+    initialPrompt?: string | Record<string, unknown> | unknown[];
     /** The daemon-composed SYSTEM slice of {@link initialPrompt} — the part
      *  it synthesized ahead of the CALLER's ask (role disposition, lineage
      *  line, AGENTS.md, posture preamble). The adapter still receives the
@@ -8190,6 +9281,13 @@ interface SpawnAgentInput {
      *  the resume/re-spawn path can re-mount the same toolset (orchestrator
      *  WP1). */
     mcpServers?: AcpMcpServer[];
+    /** Resolved skills list at spawn time (`resolveSpawnDefaults`'s merged
+     *  explicit ∪ preset ∪ config-defaults result) — recorded verbatim onto
+     *  {@link SessionDescriptor.skills}. See that field's doc. */
+    skills?: string[];
+    /** Capability bundle ids resolved for this spawn — recorded verbatim onto
+     *  {@link SessionDescriptor.bundles}; see that field's doc. */
+    bundles?: string[];
     /** Persistent isolated-config dir this spawn passed to
      *  `startSession({ configDir })` — recorded verbatim onto
      *  {@link SessionDescriptor.adapterConfigDir} so restart/lazy-resume can
@@ -8260,12 +9358,7 @@ interface SpawnAgentInput {
      *  cost/token fields on the descriptor. Adapter-specific (e.g. hermes
      *  reads its state.db keyed by the adapter session id). Omit for adapters
      *  with no usage source. */
-    readUsage?: () => Promise<{
-        model?: string;
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    readUsage?: () => Promise<UsageReadResult | null>;
     /** Opt this session into Langfuse tracing (prompt/completion + tool spans +
      *  tokens/cost). Effective opt-in is `trace ?? opts.langfuseTracingDefault ?? false`. */
     trace?: boolean;
@@ -8298,6 +9391,9 @@ interface SpawnAgentInput {
     /** Recorded verbatim onto {@link SessionDescriptor.notifyParentOnCrash} —
      *  see that field's doc. Default false. */
     notifyParentOnCrash?: boolean;
+    /** Recorded verbatim onto {@link SessionDescriptor.sentinelAutoWatch} — see
+     *  that field's doc. `undefined` = allowed. */
+    sentinelAutoWatch?: boolean;
     /** Exempt this session from the idle-reaper (`isReapable` in
      *  idle-reaper.ts) regardless of how long it sits idle — stamped straight
      *  onto `SessionDescriptor.keepAlive`. Default false. */
@@ -8322,15 +9418,12 @@ type PendingAgentOutcome = {
     commandPreview?: string;
     resumable?: boolean;
     nativeTerminalResume?: boolean;
-    readUsage?: () => Promise<{
-        model?: string;
-        costUsd?: number;
-        tokensIn?: number;
-        tokensOut?: number;
-    } | null>;
+    readUsage?: () => Promise<UsageReadResult | null>;
     /** Dispatched now that the tree + driver session both exist — never
-     *  passed to `spawnAgentPending`, which would race the tree. */
-    initialPrompt?: string;
+     *  passed to `spawnAgentPending`, which would race the tree. A plain
+     *  string, or a content-block prompt (attachment-bearing first
+     *  message) — see `SpawnAgentSessionInput.prompt`'s doc. */
+    initialPrompt?: string | Record<string, unknown> | unknown[];
     /** The daemon-composed SYSTEM slice of `initialPrompt` (see
      *  `SpawnAgentInput.initialPromptSystem`) — threaded through the
      *  placeholder so the deferred dispatch records it as a system turn. */
@@ -8606,6 +9699,170 @@ declare function runEagerResumePass(opts: {
     isServed?: (desc: SessionDescriptor) => boolean;
 }): Promise<EagerResumeSummary>;
 
+/**
+ * Continue-interrupted: pick back up the sessions a daemon restart cut off
+ * mid-turn, by sending each an explicit "continue" prompt.
+ *
+ * Everything below the prompt already exists — the persisted registry is the
+ * snapshot, `maybeResumeAgent` resumes a dead row in place (lazily on its first
+ * prompt, or eagerly at boot via `eager-resume.ts`), and the row keeps the
+ * derived `interrupted` marker until its next successful turn-end. What a
+ * restart does NOT do, by design, is re-run the interrupted prompt (prompts
+ * aren't idempotent). This module is the explicit, opt-in replacement for that:
+ * a NEW prompt that tells the agent its last turn was cut off and to check the
+ * state on disk before carrying on.
+ *
+ * Two callers share one eligibility rule + one sender:
+ *   - the manual verb (`session_continue_interrupted` MCP tool,
+ *     `POST /sessions/continue-interrupted`, `agentproto sessions
+ *     continue-interrupted`) — `mode: "manual"`, dry-run by default;
+ *   - the opt-in boot pass (`daemon.continueInterruptedOnBoot`) —
+ *     `mode: "boot"`, run by serve.ts right after the eager resume pass.
+ *
+ * Eligibility (both modes): an agent-cli row that is `interrupted` BY THE LAST
+ * RESTART (`interruptedAtBoot === registry.bootId` — a stale interruption from
+ * an older restart that nobody picked up is left alone), resumable under the
+ * attempt cap (`canResume`), not already busy, and whose `cwd` still exists
+ * (a removed worktree fails the adapter respawn every time — knowable up front,
+ * so the dry run must not call such a row eligible). The prompt goes through
+ * `enqueuePrompt`, the same entry MCP `agent_prompt` uses, so a
+ * dead-but-resumable row lazy-resumes with its billing auth re-resolved exactly
+ * as a human prompt would. When that resume fails, the outcome says so instead
+ * of passing on the bare post-resume "not alive" admission error.
+ *
+ * No-loop rules (boot mode only — a human pressing the button is intent):
+ *   - never auto-continue a row whose resume has failed (`resumeAttempts > 0`:
+ *     the eager pass, or an earlier attempt, could not bring it back);
+ *   - at most one auto-continue per restart (`lastAutoContinueBoot`);
+ *   - at most `MAX_AUTO_CONTINUE_ATTEMPTS` auto-continues without a successful
+ *     turn-end in between (`autoContinueAttempts`, booked BEFORE sending), so a
+ *     continue turn that keeps getting cut off — or keeps taking the daemon
+ *     down with it — stops being retried.
+ *
+ * Ordering (boot mode): MUST run after the supervisor is re-armed, same
+ * constraint as `eager-resume.ts` — the continue turn's `turn-end` is exactly
+ * what a re-armed completion policy is waiting for — and after the eager pass,
+ * so a row whose eager resume failed is recognisable (`resumeAttempts`) and
+ * skipped rather than lazily retried.
+ */
+
+/** The prompt sent when the caller doesn't supply one. */
+declare const DEFAULT_CONTINUE_PROMPT: string;
+/** Transcript provenance for the continue prompt (`opts.source`). */
+declare const CONTINUE_PROMPT_SOURCE = "daemon:continue-interrupted";
+/** Cap on automatic continue prompts sent to one row without a successful
+ *  turn-end in between (boot mode). 2 = the original interruption gets one
+ *  auto-continue, and if a second restart cuts THAT turn off it gets one more;
+ *  after that only a human (manual verb) re-sends. */
+declare const MAX_AUTO_CONTINUE_ATTEMPTS = 2;
+type ContinueInterruptedSkipReason = 
+/** Unknown id (explicit `ids` filter only). */
+"unknown"
+/** Not interrupted at all — no turn was cut off. */
+ | "not-interrupted"
+/** Interrupted by an EARLIER restart, not the last one. */
+ | "stale-interrupt"
+/** Not in-place resumable (not agent-cli / missing adapter session / archived). */
+ | "not-resumable"
+/** Already burned through `MAX_RESUME_ATTEMPTS` failed resumes. */
+ | "resume-cap-exhausted"
+/** Mid-turn already — someone got there first. */
+ | "busy"
+/** The row's `cwd` is gone (removed worktree) — the resume would fail. */
+ | "cwd-missing"
+/** Boot mode: a resume attempt has failed on this row. */
+ | "resume-failed"
+/** Boot mode: already auto-continued by this boot. */
+ | "already-auto-continued"
+/** Boot mode: `MAX_AUTO_CONTINUE_ATTEMPTS` reached without recovering. */
+ | "auto-continue-cap"
+/** Excluded by the cross-process `isServed` gate (another daemon's row). */
+ | "not-served";
+type ContinueInterruptedOutcome = {
+    id: string;
+    name?: string;
+    status: "eligible";
+} | {
+    id: string;
+    name?: string;
+    status: "sent";
+} | {
+    id: string;
+    name?: string;
+    status: "skipped";
+    reason: ContinueInterruptedSkipReason;
+} | {
+    id: string;
+    name?: string;
+    status: "failed";
+    error: string;
+};
+interface ContinueInterruptedResult {
+    dryRun: boolean;
+    /** The prompt that was (or, on a dry run, would be) sent. */
+    prompt: string;
+    /** The boot the candidates were interrupted before (`registry.bootId`). */
+    bootId: string;
+    /** One entry per considered row — every interrupted row when `ids` is
+     *  omitted, every requested id otherwise. Eligible-first ordering matches
+     *  the send order (newest activity first). */
+    sessions: ContinueInterruptedOutcome[];
+    /** Counts by outcome status. */
+    eligible: number;
+    sent: number;
+    skipped: number;
+    failed: number;
+}
+type ContinueInterruptedMode = "manual" | "boot";
+/** Decide one row. `undefined` ⇒ eligible. Pure — reads the descriptor only. */
+declare function continueSkipReason(desc: SessionDescriptor, bootId: string, mode: ContinueInterruptedMode): ContinueInterruptedSkipReason | undefined;
+/**
+ * List — and unless `dryRun` — continue the sessions interrupted by the last
+ * restart. See the module docblock for eligibility, the no-loop rules, and the
+ * ordering contract. No-throw per row: a send that fails admission (row went
+ * busy, resume refused) is reported as `failed` and the pass carries on.
+ */
+declare function continueInterruptedSessions(opts: {
+    registry: Pick<SessionsRegistry, "list" | "get" | "enqueuePrompt" | "bootId" | "recordAutoContinue">;
+    mode: ContinueInterruptedMode;
+    /** Default true: report what would be sent, send nothing. */
+    dryRun?: boolean;
+    /** Restrict to these session ids. Omitted ⇒ every interrupted row. */
+    ids?: readonly string[];
+    /** Custom prompt. Omitted/blank ⇒ `DEFAULT_CONTINUE_PROMPT`. */
+    prompt?: string;
+    /** Max sends in flight at once (each may lazily resume an adapter). Clamped
+     *  to ≥1. Default 4, same as the eager pass. */
+    concurrency?: number;
+    /** Cross-process gate — see `runEagerResumePass`. Omitted ⇒ all served. */
+    isServed?: (desc: SessionDescriptor) => boolean;
+    /** Extra visibility filter (a scoped orchestrator's subtree). Rows it
+     *  rejects are dropped silently — never reported, never sent. */
+    visible?: (desc: SessionDescriptor) => boolean;
+    /** Filesystem probe for the `cwd-missing` check. Default `existsSync`. */
+    cwdExists?: (cwd: string) => boolean;
+}): Promise<ContinueInterruptedResult>;
+/** Tally of the boot-time continue pass, for the boot-banner line. */
+interface ContinueOnBootSummary {
+    /** False when `daemon.continueInterruptedOnBoot` is off (nothing ran). */
+    enabled: boolean;
+    /** Rows passing eligibility at selection time — the banner's denominator. */
+    eligible: number;
+    sent: number;
+    skipped: number;
+    failed: number;
+}
+/**
+ * The boot pass: `continueInterruptedSessions` in `mode: "boot"`, not a dry
+ * run, reduced to the banner tally. Caller (the gateway handle, invoked from
+ * serve.ts) is responsible for the ordering contract in the module docblock.
+ */
+declare function runContinueOnBootPass(opts: {
+    registry: Parameters<typeof continueInterruptedSessions>[0]["registry"];
+    concurrency: number;
+    isServed?: (desc: SessionDescriptor) => boolean;
+}): Promise<ContinueOnBootSummary>;
+
 /**
  * Daemon-lane PR provenance STAMPER.
  *
@@ -8811,6 +10068,89 @@ interface InboundWatcher {
     shutdown(): void;
 }
 
+/**
+ * `capabilities_inventory` — one read that answers "what MCP servers and
+ * skills does this daemon actually know about, and which harnesses can
+ * reach them?" Backs both the `capabilities_inventory` MCP tool
+ * (session-tools.ts) and its HTTP twin (`GET /capabilities/inventory`,
+ * http-server.ts) so the two surfaces can never drift.
+ *
+ * Read-only, never throws: a failure in one source (MCP discovery, the
+ * proxy registry, an adapter package that fails to import) becomes an
+ * `error` string on that block alone — the rest of the inventory still
+ * returns. Redaction: nothing here ever carries command/args/env/headers/
+ * url — only the identity/status fields a UI needs (same discipline as
+ * `compactDiscoveredMcp` / `compactImportedMcpEntry`).
+ *
+ * The `skills` block's per-adapter `metadata.skills` / `options` read uses
+ * the same dynamic-`import()` + duck-typed-export technique as
+ * `role-registry.ts`'s adapter-carried role discovery — reused rather than
+ * reinvented, and importantly NOT a `packages/cli` dependency: it walks the
+ * exact adapter list `listAgentAdapters` already returned (so `byHarness`
+ * is guaranteed the same installed set as `adapter_list`), importing each
+ * adapter's own already-installed package by its `packageName`.
+ */
+
+interface CapabilitiesInventoryImportedMcp {
+    id: string;
+    alias?: string;
+    name: string;
+    type: string;
+    source: string;
+    status: "connected" | "idle" | "error" | "unknown";
+    error?: string;
+    /** Only present when `status === "connected"` — never connects just to count. */
+    toolCount?: number;
+    usedBySessions: string[];
+}
+interface CapabilitiesInventoryDiscoveredMcp {
+    id: string;
+    source: string;
+    scope: string;
+    name: string;
+    type: string;
+    imported: boolean;
+}
+interface CapabilitiesInventoryMcp {
+    imported: CapabilitiesInventoryImportedMcp[];
+    discovered: CapabilitiesInventoryDiscoveredMcp[];
+    /** Which harnesses get the daemon's own `/mcp` (and so the imported pool)
+     *  mounted by default — derived from `shouldInjectDaemonSelfMount` +
+     *  each installed adapter's declared protocol, never a hardcoded list. */
+    daemonMountByHarness: Record<string, "default" | "on-request" | "none">;
+    error?: string;
+}
+interface SkillPackInventoryEntry {
+    name: string;
+    version?: string;
+    path: string;
+    skills: string[];
+}
+interface SkillsByHarnessEntry {
+    adapter: string;
+    target?: {
+        format: string;
+        dir: string;
+        unit?: string;
+    };
+    installed: string[];
+    native: string[];
+    spawnOption: boolean;
+}
+interface CapabilitiesInventorySkills {
+    packs: SkillPackInventoryEntry[];
+    byHarness: SkillsByHarnessEntry[];
+    defaults: {
+        global: string[];
+        byAdapter: Record<string, string[]>;
+    };
+    error?: string;
+}
+interface CapabilitiesInventory {
+    mcp: CapabilitiesInventoryMcp;
+    skills: CapabilitiesInventorySkills;
+}
+
 /**
  * Dynamic MCP-app panels for installed `@agentproto/app-kit` apps that ship
  * a `ui` block (`defineApp({ ui: { html, title?, tools?, csp? } })`,
@@ -8820,8 +10160,16 @@ interface InboundWatcher {
  *
  * `mcpServerFactory` (index.ts) rebuilds a fresh McpServer per `/mcp`
  * request, so this module never throws — a bad app record must not take
- * down every other request. Failures (a collided tool id, an unreadable
- * `ui.path`) are skipped with a `console.warn`, not surfaced to the caller.
+ * down every other request. A collided tool id is still skipped with a
+ * `console.warn` (there's nowhere else for a second panel to live). Every
+ * OTHER failure — a removed app dir, a missing/unreadable `ui.path`, a
+ * failed or in-flight `ui.build` — still mounts the panel, serving a
+ * readable HTML placeholder/error page in place of the real bundle
+ * (app-ui-placeholder.ts) instead of skipping it outright: a `ui://`
+ * resource that silently doesn't exist just shows as a JSON-RPC "resource
+ * not found" in a host, which is what motivated this file's placeholder
+ * page in the first place — a HOST-VISIBLE page, even a stand-in one, beats
+ * a resource the host has to explain away as missing.
  */
 
 /**
@@ -9064,6 +10412,9 @@ interface PrStatusSnapshot {
         name: string;
         conclusion: string | null;
     }>;
+    /** The PR's head commit at fetch time — absent from snapshots taken
+     *  before this field existed. */
+    headSha?: string;
 }
 /** The mutable annotations sidecar of a ledger entry. */
 interface LedgerAnnotations {
@@ -9076,6 +10427,13 @@ interface ReviewLedgerFilter {
     rangeSha?: string;
     binding?: string;
     manifestSha?: string;
+    /** Keep only entries whose `attestation.requester.sessionId` is one of
+     *  these — backs `review_ledger({requesterSessionId, subtree})`: a single
+     *  id, or (with `subtree: true`) that session's whole subtree, resolved by
+     *  the caller before reaching the ledger. Answered from an in-memory
+     *  `requesterSessionId -> ledger keys` index (built lazily on first use,
+     *  kept current on every `put()`), never a full re-scan. */
+    requesterSessionIds?: readonly string[];
 }
 interface ReviewLedger {
     /** Absolute root directory of the ledger. */
@@ -9258,12 +10616,27 @@ interface ReviewRun {
     /** Where the attestation was written in the ledger. */
     ledgerPath?: string;
     error?: string;
+    /** The session that requested this run (`input.requesterSessionId ??
+     *  input.parentSessionId`), when known — mirrors
+     *  `Attestation.requester.sessionId` for a run that hasn't (or never will)
+     *  reach the ledger, so `review_ledger({includeRunning: true})` and the
+     *  `session_tree` badge (WP-review-panel) can attribute an in-flight/
+     *  cancelled/failed run to its requester without waiting for an
+     *  attestation. */
+    requesterSessionId?: string;
 }
 interface ReviewRunner {
     start(input: ReviewRunInput): ReviewRun;
     status(runId: string): Promise<ReviewRun | undefined>;
     wait(runId: string): Promise<ReviewRun | undefined>;
     cancel(runId: string): boolean;
+    /** Every run this daemon process has started, newest first — running runs
+     *  plus ones that settled (done/failed/cancelled) without a daemon
+     *  restart in between. Runs live in memory only for the process lifetime
+     *  (a restart loses this list, same as the rest of `runs` — the ATTESTATION
+     *  is what persists, in the ledger). Backs `review_ledger({includeRunning:
+     *  true})` and the `session_tree` review badge. */
+    list(): ReviewRun[];
     readonly ledger: ReviewLedger;
 }
 interface CreateReviewRunnerOptions {
@@ -9273,6 +10646,14 @@ interface CreateReviewRunnerOptions {
     reviewers?: ReviewerSessionHost;
     /** Attestor identity. Default: `agentproto-runtime@<hostname>`. */
     daemonId?: string;
+    /** Called once a run with a `requesterSessionId` reaches `done` — never
+     *  for `failed`/`cancelled` (no verdict to report). Display-only: the
+     *  daemon writes `text` into the requester's transcript as a `notice`
+     *  (see `sessions.ts`'s `recordNotice`) so `session_story`/`live_session`
+     *  show it — this never enqueues a prompt, touches the inbox, or starts a
+     *  turn. Fire-and-forget from the runner's perspective; a throw here is
+     *  swallowed. */
+    notifyRequester?: (sessionId: string, text: string) => void;
 }
 /** Placeholder values the daemon binds for every review. `{changed}` is a
  *  shell-quoted turbo filter for the packages changed since the range base
@@ -9502,6 +10883,12 @@ interface RegisterReviewToolsOptions {
     /** `gh` runner for `review_pr` — injectable for tests. Default: the real
      *  `gh` on the daemon's PATH. */
     gh?: GhRunner;
+    /** Resolve a session id to its subtree (itself + every session it
+     *  transitively spawned) — backs `review_ledger({requesterSessionId,
+     *  subtree: true})`. Omitted ⇒ `subtree` is ignored (scoped to the exact
+     *  id only), so a caller without sessions-registry access still works,
+     *  just without the subtree expansion. */
+    resolveSubtree?: (sessionId: string) => readonly string[];
 }
 declare function registerReviewTools(server: McpServer, opts: RegisterReviewToolsOptions): void;
 
@@ -10295,6 +11682,108 @@ declare function formatToolCall(toolName: string, args: unknown): string;
  */
 declare function formatToolResult(toolName: string | undefined, result: unknown, isError: boolean): string | null;
 
+/**
+ * Pure sizing helper for a `tools/list` response — shared by
+ * `scripts/measure-mcp-tools.mjs` (human-readable before/after report) and
+ * the budget-guard test (`__tests__/tool-schema-budget.test.ts`) so both
+ * measure the exact same thing: the JSON bytes an MCP client actually pays
+ * for per tool (`description` + `inputSchema`), sorted biggest first.
+ */
+interface MeasuredToolEntry {
+    name: string;
+    bytes: number;
+}
+interface ToolListMeasurement {
+    entries: MeasuredToolEntry[];
+    totalBytes: number;
+}
+interface MeasurableTool {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}
+/** UTF-8 byte size of the `{description, inputSchema}` JSON a client
+ *  receives for one tool — the same two fields `tools/list` sends over the
+ *  wire, so this tracks prompt-token cost rather than just character count. */
+declare function measureTool(tool: MeasurableTool): number;
+declare function measureToolList(tools: readonly MeasurableTool[]): ToolListMeasurement;
+
+/**
+ * Long-form MCP tool documentation, read from `docs/mcp-tools/<name>.md`.
+ *
+ * The schema `description` on a tool/field is a contract: what it does, and
+ * the one rule that prevents a wrong call — kept short so `tools/list` stays
+ * cheap. Everything else (edge cases, interactions with other fields,
+ * examples, history) lives here instead, fetched on demand by the `tool_help`
+ * MCP tool (`tool-help-mcp.ts`) and the `agentproto help <tool>` CLI verb
+ * (`packages/cli/src/commands/help.ts`) — both call the two functions below,
+ * so the markdown file is the single source both surfaces read.
+ *
+ * `docs/mcp-tools/` sits at the PACKAGE root (a sibling of `src`/`dist`, not
+ * the repo-level `docs/`) so it ships inside the published npm tarball —
+ * see the `files` array in `package.json`. Resolved relative to this
+ * module's own directory rather than by package name: whether this code is
+ * running from `src` (vitest, no build) or `dist` (built/published), the
+ * module's directory is always a direct child of the package root, so one
+ * `..` reaches it either way — no `require.resolve` needed.
+ */
+/** Full markdown help text for `name`, or `undefined` when no doc exists. */
+declare function getToolHelp(name: string): string | undefined;
+/** Every tool name with a help doc available — for a "did you mean" list. */
+declare function listToolHelpTopics(): string[];
+/** Extract a `## <topic>` section (case-insensitive) up to the next `##`
+ *  heading — shared by the `tool_help` MCP tool and the `agentproto help`
+ *  CLI verb so both slice a doc identically. `undefined` when no section
+ *  with that heading exists. */
+declare function extractHelpSection(doc: string, topic: string): string | undefined;
+
+/**
+ * Subtree usage rollup: one session's own usage plus the summed usage of
+ * every session it (transitively) spawned — the shape `session_usage
+ * { includeSubtree: true }` and `GET /sessions/:id/usage?includeSubtree=1`
+ * return.
+ *
+ * Pure over a descriptor list (walked by `parentSessionId`, the same graph
+ * `collectSubtree` uses for orchestrator scoping), so it's unit-testable
+ * without a registry.
+ *
+ * Absent stays absent: a total is the sum of the sessions that REPORT the
+ * field, and is omitted entirely when none of them do — a subtree of
+ * cost-less sessions never reads as a measured $0.
+ */
+
+/** Summed usage across the root and all its descendants. */
+interface SubtreeUsageTotals {
+    /** Sessions counted, root included. */
+    sessions: number;
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+}
+/** One direct child of the root, with that child's OWN usage (its own
+ *  descendants roll up into `subtree`, not here). */
+interface SubtreeChildUsage {
+    id: string;
+    label?: string;
+    status: SessionDescriptor["status"];
+    costUsd?: number;
+    tokensIn?: number;
+    tokensOut?: number;
+}
+interface SessionUsageWithSubtree {
+    self: SessionUsage;
+    subtree: SubtreeUsageTotals;
+    children: SubtreeChildUsage[];
+}
+/**
+ * Roll `root`'s usage up over its subtree. `all` should be the FULL
+ * descriptor list (archived included) so an archived intermediate session
+ * doesn't sever the parent→child chain.
+ */
+declare function rollupSessionSubtree(root: SessionDescriptor, all: readonly SessionDescriptor[]): SessionUsageWithSubtree;
+
 /**
  * Dependency-injection surface for MCP credential resolution.
  *
@@ -10399,6 +11888,63 @@ declare function enrichRollupWithProviderQuota(rollup: UsageRollup, window: stri
  *  such lines; skips any malformed or non-`usage_snapshot` line. Never throws. */
 declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promise<UsageSnapshotRecord[]>;
 
+/**
+ * MCP surface for the sentinel primitive (AIP-60 §6): `sentinel_watch`,
+ * `sentinel_list`, `sentinel_unwatch`, `sentinel_poll_now`.
+ *
+ * `sentinel_watch`'s `sessionId` defaults to the calling session — same
+ * "trusted `?callerSessionId=`" pattern `message-tools.ts` uses — so a
+ * session watching its own PR doesn't need to know its own id.
+ *
+ * Provider auto-select isn't implemented yet (design §6): `provider`
+ * defaults to `local-gh`, the only built-in that ships as of this step.
+ *
+ * `createSentinelWatch`/`cancelSentinelWatch`/`sentinelView` are exported so
+ * `http-server.ts`'s `POST/GET/DELETE /sentinels` routes (the daemon-HTTP
+ * surface `agentproto sentinel` talks to) share the exact same
+ * validation/sugar-resolution logic as this MCP surface — same pattern as
+ * `TunnelRegistry` backing both `tunnel_create` and `POST /tunnels`, except
+ * here the shared logic is a plain function rather than a stateful registry
+ * method, since sentinel creation also needs the provider handle.
+ */
+
+/** Compact wire view of a sentinel for tool/HTTP results — the internal-only
+ *  fields (`handle`, `seen`, `terminalSubjects`) never leave the daemon. */
+interface SentinelView {
+    id: string;
+    provider: string;
+    status: SentinelStatus;
+    match: SentinelMatchClause[];
+    until: SentinelUntil;
+    target: SentinelTarget;
+    group?: string;
+    label?: string;
+    createdTs: number;
+    eventCount: number;
+    lastEventTs?: number;
+    lastError?: string;
+}
+
+/**
+ * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
+ * operator who already configured a named endpoint, an upstream credential
+ * link, or an explicit `llm-endpoint` custom route is clearly USING the
+ * proxy already — booting with the sidecar off (today's default) would
+ * silently break their next `route:{gateway:"llm-endpoint"}` spawn on a
+ * fresh install. An operator who never touched any of that gets the
+ * unchanged, conservative default (off).
+ *
+ * An explicit `configured` value (`config.json`'s `features.llmEndpoint`,
+ * profile-overlaid) always wins, in either direction — this resolver only
+ * fills in the gap when the operator left the flag unset.
+ */
+/**
+ * Resolve the EFFECTIVE `features.llmEndpoint` flag. `configured` is the
+ * operator's merged config value (`undefined` when never set in either
+ * `config.json` or the active profile).
+ */
+declare function resolveEffectiveLlmEndpointFlag(configured: boolean | undefined): Promise<boolean>;
+
 /**
  * MCP tools that drive the pairing registry — the daemon's "let a client pair
  * with me over an untrusted rendezvous" surface (design: DESIGN §6).
@@ -10420,6 +11966,102 @@ interface RegisterPairingToolsOptions {
 }
 declare function registerPairingTools(server: McpServer, opts: RegisterPairingToolsOptions): void;
 
+/**
+ * Device registry — a read view over `PairingRegistry` (+, when wired,
+ * `HostRegistry`) that presents each pairing/host as a "device" (DEVICES-PLAN
+ * PR-A, hosts added PR-C). A paired CLIENT (today's `pair_offer`/`pair
+ * accept`) gets `role: "client"`; a registered HOST (`pair offer --host` +
+ * `devices add`, host-registry.ts) gets `role: "host"`.
+ *
+ * This is deliberately a thin computed view, not a second store: renaming
+ * and revoking a client device mutate the same `pairings.json`
+ * `PairingRegistry` already owns; a host device mutates the same
+ * `hosts.json` `HostRegistry` — so `pair_*`/`/pairings` and
+ * `device_*`/`/devices` are two surfaces over the same two sources of truth.
+ */
+
+type DeviceRole = "client" | "host";
+type DeviceKind = "browser" | "cli" | "daemon";
+interface Device {
+    fingerprint: string;
+    name: string;
+    role: DeviceRole;
+    kind: DeviceKind;
+    rendezvous: string;
+    createdAt: string;
+    lastSeen: string;
+    /** A channel (offer or reconnect) is served for this device right now
+     *  (client) or a `forwardHttp` call is in flight for it right now (host).
+     *  For a host this is NOT a live heartbeat — see host-registry.ts's
+     *  "Online tracking" — it only reflects actual recent/current traffic. */
+    online: boolean;
+    /** A pair/v1 pairing: listed and revocable, but can't connect until
+     *  re-paired — see `PairingRecord.legacy`. */
+    legacy?: true;
+    /** Set when this device's pairing/host record was granted under a
+     *  HOST-scoped offer (`agentproto pair offer --host`) — see
+     *  offer-url.ts's "Offer scope". Surfaced from either side of a pairing so
+     *  a user can see, from EITHER daemon, which of their pairings/hosts grant
+     *  host control. */
+    scope?: "host";
+    /** Self-reported by a host at join time (SANDBOX-VISIBILITY-JOIN) — see
+     *  `HostRecord.provider`/`sandboxId`/`labels`. Absent for a client device. */
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
+}
+interface DeviceRegistry {
+    /** Every known device. Read-only. */
+    list(): Promise<Device[]>;
+    /** Rename a device (fingerprint or current name) to a new label. Tries the
+     *  pairing registry first, then the host registry. Returns false when
+     *  nothing matched. */
+    rename(idOrName: string, newName: string): Promise<boolean>;
+    /** Drop a device by fingerprint or name — same effect as `pair revoke` for
+     *  a client device, `devices revoke`-of-a-host for a host device. Tries
+     *  the pairing registry first, then the host registry. Returns false when
+     *  nothing matched. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Register a host from an offer URL (delegates to `HostRegistry.add`).
+     *  Rejects if no `HostRegistry` was wired into this device registry. */
+    add(offerUrl: string, name?: string): Promise<{
+        fingerprint: string;
+        name: string;
+        rendezvousUrl: string;
+    }>;
+    /** Forward one HTTP request to a HOST device on demand (delegates to
+     *  `HostRegistry.forwardHttp`) — the basis for `device_sessions`. Rejects
+     *  if no `HostRegistry` was wired, or if `idOrName` doesn't match a host. */
+    forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
+}
+declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegistry): DeviceRegistry;
+
+/**
+ * MCP tools over the device registry (DEVICES-PLAN PR-A/PR-C) — `device_list`
+ * / `device_rename` / `device_revoke` / `device_add`. A view on top of the
+ * same registries `pair_offer`/`pair_list`/`pair_revoke` (pairing-tools.ts)
+ * and host-registry.ts drive; those keep working unchanged. `device_revoke`
+ * has the exact effect of `pair_revoke` for a client device.
+ *
+ * `device_add` (PR-C) registers a HOST from a `--host`-scoped offer URL —
+ * see `HostRegistry.add`'s scope gate (host-registry.ts). It requires the
+ * gateway to have wired a `HostRegistry` into the `DeviceRegistry`; without
+ * one the call rejects with a clear message rather than a missing-tool error
+ * (this repo always wires one when `pairingRegistry` is wired, so that's
+ * only reachable via a deliberate host misconfiguration).
+ *
+ * Registered beside `pair_*` — same closure-rebind pattern; the registry
+ * singleton lives on the gateway.
+ */
+
+interface RegisterDeviceToolsOptions {
+    registry: DeviceRegistry;
+    /** Optional (SANDBOX-VISIBILITY-JOIN) — when wired, registers
+     *  `join_token_create`/`join_token_list`/`join_token_revoke`. */
+    joinTokens?: JoinTokenRegistry;
+}
+declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
+
 /**
  * Rate-limited failure logging for reconnect loops.
  *
@@ -11257,6 +12899,15 @@ interface SessionWaitResult {
      *  reported one. `"error"` means the adapter reported a failed turn.
      *  Same three-branch coverage as `empty`. */
     reason?: string;
+    /** The matched turn-end's captured error text — `SessionTurnEndEvent.error`
+     *  on the ring-replay/bus branches, `SessionDescriptor.lastTurnErrorMessage`
+     *  on the sync fast-path (no event object to read there). Present only
+     *  when `reason` is `"error"` AND the adapter emitted an in-band `error`
+     *  stream event during the turn. Same three-branch coverage as `empty`/
+     *  `reason` — this is the field a waiter (a supervisor session, `sessions
+     *  wait`, a webhook) needed to actually learn WHY a turn errored instead
+     *  of just that it did. */
+    error?: string;
 }
 /**
  * Block until one of the listed sessions fires a matching lifecycle event
@@ -11406,6 +13057,12 @@ interface CreateGatewayOptions {
      *  to an `enabled: false` summary. Also surfaced in `daemon_health` /
      *  `GET /health` so an operator can see the effective value. */
     resumeSessionsOnBoot?: boolean;
+    /** Opt-in continue-on-boot. Mirrors the `daemon.continueInterruptedOnBoot`
+     *  config knob; when true, the `continueInterruptedOnBoot()` handle method
+     *  runs the boot continue pass (see `continue-interrupted.ts`); when
+     *  false/omitted it short-circuits to an `enabled: false` summary. Surfaced
+     *  in `daemon_health` / `GET /health`. */
+    continueInterruptedOnBoot?: boolean;
     /** Idle agent-session reaper threshold in ms (PR-6). Mirrors the
      *  `daemon.idleReapAfterMs` config knob; the CLI resolves it (env >
      *  config > off) and passes it here. When positive, the gateway starts a
@@ -11659,11 +13316,38 @@ interface CreateGatewayOptions {
      * returns) so the injected `serve` can capture the finished gateway.
      */
     pairingRegistry?: PairingRegistry;
+    /**
+     * Optional HOST registry (see `createHostRegistry`, DEVICES-PLAN PR-C) —
+     * the reverse-pairing "client" half of pair/v2, living daemon-side. When
+     * wired alongside `pairingRegistry`, the gateway layers registered hosts
+     * into `device_list`/`GET /devices`, and enables the `device_add` MCP tool
+     * plus `POST /devices/add` + `POST /devices/:id/exec`. Unlike
+     * `pairingRegistry`, this registry keeps no standing connections — every
+     * `add`/`forwardHttp` dials fresh — so there is nothing for the gateway to
+     * autoconnect or tear down on shutdown.
+     */
+    hostRegistry?: HostRegistry;
+    /**
+     * Optional JOIN TOKEN registry (see `createJoinTokenRegistry`,
+     * SANDBOX-VISIBILITY-JOIN). When wired alongside `pairingRegistry` +
+     * `hostRegistry`, the gateway mounts `POST/GET /devices/join-tokens` +
+     * `DELETE /devices/join-tokens/:id`, the `join_token_create/list/revoke`
+     * MCP tools, and `device_sessions`/`GET /devices/:id/sessions[/…/output]`.
+     * Autoconnect is the caller's to start (after this returns), same as
+     * `pairingRegistry`.
+     */
+    joinTokens?: JoinTokenRegistry;
     /** Enable the local LLM Endpoint proxy sidecar (route registration,
      *  MCP tools, child-process lifecycle). Default false — the endpoint is
      *  an opt-in feature; when off, the `llm-endpoint` custom route is not
      *  registered and the `llm_endpoint_*` MCP tools are not exposed. */
     llmEndpoint?: boolean;
+    /** Mirrors `config.features.deviceInferenceShare` (DEVICES-PLAN item 1).
+     *  Default false. Only meaningful alongside `llmEndpoint: true` — passed
+     *  straight through to `startHttpServer`'s `deviceInferenceShare`, which
+     *  gates `/device-inference/*` (see http-server.ts's `HOST_SCOPE_HEADER`
+     *  doc comment for the full scope-gate story). */
+    deviceInferenceShare?: boolean;
 }
 /**
  * Default always-on set when `deferredTools` is enabled without an
@@ -11674,10 +13358,10 @@ interface CreateGatewayOptions {
  * `toolPolicy.delegation: "deny"`, so those two names are simply absent
  * from a deny-role's registry and cost nothing) but still needs to report
  * back to its parent (`message_parent`), coordinate over the task ledger
- * (`task_*`), and observe its own session/turn state
- * (`session_context_status` alongside the pre-existing `session_list` /
- * `session_monitor` / `session_events_poll`). Everything else (fs_*,
- * directory_*, command_*, remote_*, browser_*, terminal_*, mcp_*,
+ * (`task_*`), and observe its own session/turn state and capabilities
+ * (`session_context_status` / `session_capabilities` alongside the
+ * pre-existing `session_list` / `session_monitor` / `session_events_poll`).
+ * Everything else (fs_*, directory_*, command_*, remote_*, browser_*, terminal_*, mcp_*,
  * routine_*, workflow_*, policy_*, inbound_watcher_*, session_tree,
  * agent_export, adapter_list, every `app_ui_*` panel tool, ...) starts
  * deferred — reachable via `tool_search`, never removed from `tools/call`.
@@ -11700,6 +13384,15 @@ interface GatewayHandle {
      *  `CreateGatewayOptions.pairingRegistry`. Undefined otherwise. Exposed so
      *  the CLI can `startAutoconnect()` after boot and `shutdown()` it. */
     pairing?: PairingRegistry;
+    /** HOST registry, when one was wired via `CreateGatewayOptions.hostRegistry`
+     *  (DEVICES-PLAN PR-C). Undefined otherwise. No autoconnect/shutdown to
+     *  call on it — see that option's doc comment. */
+    hosts?: HostRegistry;
+    /** JOIN TOKEN registry, when one was wired via
+     *  `CreateGatewayOptions.joinTokens` (SANDBOX-VISIBILITY-JOIN). Undefined
+     *  otherwise. Exposed so the CLI can `startAutoconnect()` after boot and
+     *  `shutdown()` it, same as `pairing`. */
+    joinTokens?: JoinTokenRegistry;
     /** Per-boot bearer token required on mutating /sessions/* routes
      *  + WS PTY upgrades. Exposed so an embedding host (e.g. the CLI
      *  shell that hosts the gateway in-process) can pass it to child
@@ -11724,6 +13417,16 @@ interface GatewayHandle {
     resumeSessionsOnBoot(opts?: {
         isServed?: (desc: SessionDescriptor) => boolean;
     }): Promise<EagerResumeSummary>;
+    /** Run the opt-in continue-on-boot pass and return its tally — a no-op
+     *  returning `{ enabled: false, ... }` when the `continueInterruptedOnBoot`
+     *  knob is off. serve.ts invokes this right AFTER `resumeSessionsOnBoot()`
+     *  (so a row whose eager resume failed is recognisable and skipped) — and
+     *  therefore, like it, after the supervisor was re-armed, so a re-armed
+     *  completion policy sees the continue turn's turn-end. Same `isServed`
+     *  cross-process gate. */
+    continueInterruptedOnBoot(opts?: {
+        isServed?: (desc: SessionDescriptor) => boolean;
+    }): Promise<ContinueOnBootSummary>;
     stop(): Promise<void>;
 }
 /**
@@ -11740,4 +13443,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LocatedConversation, type LocatedConversationByPath, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
+export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedJoinToken, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostRecord, type HostRegistry, type HostRegistryDeps, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SkillPackInventoryEntry, type SkillsByHarnessEntry, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, type SubtreeChildUsage, type SubtreeUsageTotals, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageDetail, type UsageReadContext, type UsageReadResult, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };