@agentproto/runtime 4.1.0 → 5.1.0

package/dist/index.d.ts

@@ -13,8 +13,8 @@ export { CostBudget, CostBudgetScope } from '@agentproto/auth';
 import { S as SpawnBrowserMode, R as ResolveHeadlessBrowser, C as ContextContinuityPolicy, a as ResolvedContextContinuityPolicy } from './context-continuity-Bn99UtVC.js';
 import { SandboxMode } from '@agentproto/command-sandbox';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, CredsStore, HarnessCapabilities, AdapterEntry } from '@agentproto/provider-kit';
-import { S as SpawnDefaultsConfig, D as DefaultsAdapterAuthConfig, R as ResolvedAuthSpec, a as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-CZj39Znq.js';
-export { b as AuthEcho, c as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, d as CredentialSource, e as DefaultsAdapterConfig, f as DeferredToolsConfig, g as ResolveSubscriptionCredentialInput, h as ResolvedSpawnAuthMaterial, i as ResolvedSpawnDefaults, j as SubscriptionCredentialResolution, k as SubscriptionSourceError, l as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, m as resolveDeferredToolsGatewayOption, o as resolveSpawnDefaults, p as resolveSubscriptionCredential } from './spawn-defaults-CZj39Znq.js';
+import { S as SpawnDefaultsConfig, D as DefaultsAdapterAuthConfig, R as ResolvedAuthSpec, a as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-wQV9AeiG.js';
+export { b as AuthEcho, c as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, d as CredentialSource, e as DefaultsAdapterConfig, f as DeferredToolsConfig, g as ResolveSubscriptionCredentialInput, h as ResolvedSpawnAuthMaterial, i as ResolvedSpawnDefaults, j as SubscriptionCredentialResolution, k as SubscriptionSourceError, l as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, m as resolveDeferredToolsGatewayOption, o as resolveSpawnDefaults, p as resolveSubscriptionCredential } from './spawn-defaults-wQV9AeiG.js';
 import { CatalogModelsQuery, CatalogModelsResponse } from './catalog-models.js';
 export { CatalogAdapterInput, CatalogAdapterModelInput, CatalogPricing, CatalogProduct, CatalogRoute, CatalogRouteSummary, CatalogVendor, buildCatalogModels } from './catalog-models.js';
 import { FooterSession } from './pr-provenance.js';
@@ -26,6 +26,7 @@ import * as _agentproto_tool from '@agentproto/tool';
 import { ToolContext } from '@agentproto/tool';
 import { DriverHandle } from '@agentproto/driver';
 import { Attestation, LedgerKey, RubricDigest, ReviewPrRef, LaneResult, ReviewLaneExecutor, LaneOutcome } from '@agentproto/review';
+import { ImportedMcpsConfig } from './mcp-imports.js';
 import { UserPreset } from './user-presets.js';
 export { UserPresetsFile, deleteUserPreset, getUserPreset, listUserPresets, loadUserPresets, saveUserPreset, userPresetsPath } from './user-presets.js';
 import { WorktreeIsolationMode, SpawnAttachMode, SpawnDedupeMode } from './config.js';
@@ -883,7 +884,7 @@ declare function turnToActivities(session: ActivityTurnSession, opts?: {
 interface ActivityRunStepSlice {
     index: number;
     label: string;
-    status: "pending" | "running" | "done" | "failed" | "skipped";
+    status: "pending" | "running" | "done" | "failed" | "skipped" | "cancelled";
     sessionId?: string;
     startedAt?: string;
     endedAt?: string;
@@ -908,8 +909,8 @@ interface ActivityWorkflowRunSlice {
  * Project one workflow run's steps (stage-barrier semantics): running →
  * active; a `pending` step waits on the stage barrier — the unfinished
  * steps of EARLIER stages are the sessions whose turn-ends open it;
- * done/failed → terminal; skipped → cancelled; a step still pending inside
- * a terminal run settles as cancelled.
+ * done/failed → terminal; skipped/cancelled → cancelled; a step still
+ * pending inside a terminal run settles as cancelled.
  */
 declare function workflowToActivities(run: ActivityWorkflowRunSlice): ActivityRecord[];
 /**
@@ -1789,7 +1790,7 @@ declare function createTaskLedger(opts: {
  * list — {@link isKnownSessionEndReason} says so, and callers should fall
  * back to a generic label rather than throw.
  */
-declare const SESSION_END_REASONS: readonly ["daemon-restart", "idle-reaped", "crashed", "operator-completed", "operator-stopped", "cost-cap-exceeded", "policy-cleanup", "parent-exited", "provider-limit", "forgotten"];
+declare const SESSION_END_REASONS: readonly ["daemon-restart", "idle-reaped", "crashed", "operator-completed", "operator-stopped", "cost-cap-exceeded", "policy-cleanup", "parent-exited", "provider-limit", "forgotten", "steward-completed", "steward-abandoned"];
 type SessionEndReason = (typeof SESSION_END_REASONS)[number];
 /** True when `reason` is one of {@link SESSION_END_REASONS}. A label
  *  lookup, not a wire-format gate — an unrecognized string is still a
@@ -1816,7 +1817,7 @@ declare function isProviderLimitError(message: string | undefined): boolean;
  * and session_monitor MCP tool (long-poll multiplexed).
  */
 
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning";
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:artifact-added" | "session:artifact-pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning";
 /**
  * Fixed severity vocabulary for a judge-gate finding (WP-D). Deliberately
  * small and fixed so `policy_status` output is comparable across different
@@ -2364,6 +2365,32 @@ interface SessionPinnedEvent {
     pinned: boolean;
     ts: string;
 }
+/**
+ * Emitted when a new artifact (or a new version of an existing one) is
+ * materialized into the session's artifact store (`session_artifact_add`,
+ * `POST /sessions/:id/artifacts` — see `session-artifacts.ts`). Carries just
+ * enough for a live UI to append/update its inline card and "Artifacts"
+ * section without a round trip — the full record (all versions) is a
+ * `session_artifact_list` / `GET /sessions/:id/artifacts` call away.
+ */
+interface SessionArtifactAddedEvent {
+    type: "session:artifact-added";
+    sessionId: string;
+    key: string;
+    kind: string;
+    version: number;
+    label?: string;
+    ts: string;
+}
+/** Emitted when an artifact's `pinned` flag changes
+ *  (`session_artifact_pin`, `POST /sessions/:id/artifacts/:key/pin`). */
+interface SessionArtifactPinnedEvent {
+    type: "session:artifact-pinned-changed";
+    sessionId: string;
+    key: string;
+    pinned: boolean;
+    ts: string;
+}
 /**
  * Emitted when a session is first registered in the registry (WP-R3) — both
  * the agent-cli spawn path (`spawnAgent`) and the terminal path (`spawnPty`).
@@ -2582,7 +2609,7 @@ interface SessionHarnessWarningEvent {
     label?: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent;
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionArtifactAddedEvent | SessionArtifactPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -2828,6 +2855,234 @@ declare class TunnelRegistry {
     private loadFromDisk;
 }
 
+/**
+ * Typed inter-session message envelope (AIP-46 §Session messages).
+ *
+ * A PROMPT is an instruction from whoever drives a session; a MESSAGE is a
+ * report between sessions in the same tree whose sender the DAEMON attests.
+ * Everything in `from` is computed here from the caller's verified identity
+ * and the session forest — a send request can never set it.
+ *
+ * Pure module: no registry, no I/O. The registry (sessions.ts) carries a
+ * `SessionMessage` on a queued prompt (`QueuedPrompt.envelope`), renders it
+ * into the model's context with `renderSessionMessages`, and records it as
+ * its own `session-message` transcript record — never a `user-prompt`.
+ */
+/** Sender's position in the tree, relative to the recipient. */
+type MessageRelation = "child" | "parent" | "sibling" | "human" | "system";
+type MessageKind = "report" | "question" | "blocker" | "done" | "notice";
+type MessageUrgency = "fyi" | "next-turn" | "steer" | "interrupt";
+type MessageDeliveryVia = "wait" | "steer" | "turn" | "interrupt" | "inbox";
+declare const MESSAGE_KINDS: readonly MessageKind[];
+declare const MESSAGE_URGENCIES: readonly MessageUrgency[];
+interface SessionMessageFrom {
+    /** Absent only for relation `human` | `system`. */
+    sessionId?: string;
+    /** Registry label at send time — display only, never identity. */
+    label?: string;
+    role?: string;
+    adapter?: string;
+    relation: MessageRelation;
+}
+interface SessionMessage {
+    /** `msg_<uuid8>`, daemon-minted. */
+    id: string;
+    ts: string;
+    /** Recipient sessionId. */
+    to: string;
+    from: SessionMessageFrom;
+    kind: MessageKind;
+    /** Requested urgency. */
+    urgency: MessageUrgency;
+    /** Stamped on delivery. */
+    delivered?: {
+        via: MessageDeliveryVia;
+        at: string;
+        turnSeq?: number;
+    };
+    /** Thread id; defaults to the first message's id. */
+    correlationId?: string;
+    /** A `SessionMessage.id` this answers. */
+    replyTo?: string;
+    text: string;
+    /** Optional structured payload (≤ `MAX_MESSAGE_DATA_BYTES`). */
+    data?: Record<string, unknown>;
+    ackedAt?: string;
+}
+declare const MAX_MESSAGE_DATA_BYTES: number;
+/** The slice of a session descriptor relation/ACL resolution needs. */
+interface MessageTreeNode {
+    id: string;
+    parentSessionId?: string;
+    label?: string;
+    role?: string;
+    adapterSlug?: string;
+}
+/**
+ * Relation of `sender` to `recipient` in the session forest, or `undefined`
+ * when they're not tree neighbours (cousins, strangers, self). `sender`
+ * absent ⇒ `human` (an HTTP/CLI operator); daemon-originated notices pass
+ * `"system"` explicitly instead of calling this.
+ */
+declare function resolveRelation(sender: MessageTreeNode | undefined, recipient: MessageTreeNode): Exclude<MessageRelation, "system"> | undefined;
+/**
+ * ACL: child→parent, parent→direct child, human/system→any. Sibling↔sibling
+ * only when `allowSiblings` (config-gated, default off). Anything else — a
+ * cousin, a stranger, yourself — is refused.
+ */
+declare function isMessageAllowed(relation: MessageRelation | undefined, opts?: {
+    allowSiblings?: boolean;
+}): relation is MessageRelation;
+/** Build a `from` block from the verified sender + the resolved relation. */
+declare function messageFrom(sender: MessageTreeNode | undefined, relation: MessageRelation): SessionMessageFrom;
+declare function mintMessageId(): string;
+declare function createSessionMessage(input: {
+    to: string;
+    from: SessionMessageFrom;
+    text: string;
+    kind?: MessageKind;
+    urgency?: MessageUrgency;
+    replyTo?: string;
+    correlationId?: string;
+    data?: Record<string, unknown>;
+}): SessionMessage;
+interface MessageFilter {
+    /** Sender session ids, or `"children"` for any message whose relation is
+     *  `child` (i.e. from one of the recipient's own children). */
+    from?: readonly string[] | "children";
+    kind?: readonly MessageKind[];
+    correlationId?: string;
+}
+declare function matchesMessageFilter(msg: SessionMessage, filter: MessageFilter): boolean;
+declare const MESSAGE_TAG = "agentproto-message";
+/** Child-settable label → attribute-safe: `[A-Za-z0-9._-]`, ≤ 48 chars. */
+declare function sanitizeLabel(label: string | undefined): string | undefined;
+/** Escape every envelope/body sentinel inside a message body, so a sender
+ *  can't close the tag early and forge a second header. */
+declare function escapeMessageBody(text: string): string;
+/** A human prompt is NOT wrapped (humans keep today's UX), but a line that
+ *  starts with the envelope sentinel is escaped, so the invariant "text
+ *  outside an `<agentproto-message>` tag is the human" holds. Nothing else
+ *  in human text changes. */
+declare function escapeHumanPrompt(text: string): string;
+declare function renderSessionMessage(msg: SessionMessage): string;
+/** A coalesced batch → sibling tags, one per message, in order. */
+declare function renderSessionMessages(msgs: readonly SessionMessage[]): string;
+/** One-line typed digest of `fyi` messages that never woke the session —
+ *  prepended (as a `system-prompt` slice) to the next turn it runs anyway. */
+declare function renderInboxDigest(msgs: readonly SessionMessage[]): string;
+/** Taught once, the first time a session RECEIVES a message (recorded as a
+ *  `system-prompt`). Children also get the same invariant in their lineage
+ *  line at spawn. */
+declare const MESSAGE_PREAMBLE: string;
+
+/**
+ * Shared types for pluggable sentinel providers (AIP-60 §3, §4).
+ *
+ * The sentinel family is a `@agentproto/provider-kit` consumer, same shape as
+ * the tunnel family (`remote-providers/types.ts`) and the sandbox family
+ * (`sandbox-providers/types.ts`): {@link SentinelProviderHandle} extends the
+ * kit's generic `AdapterHandle` (slug/name/version/description/requiresSetup/
+ * check) with the sentinel-specific `capabilities` plus the create/attach/
+ * cancel/status/poll/ack/parseInbound lifecycle a provider implements.
+ *
+ * This file is deliberately self-contained (no import from `sentinel-store.js`)
+ * so the contract never depends on the store's internals — `SentinelSpec` is
+ * the vocabulary a provider is handed, `sentinel-store.ts` imports it from
+ * here rather than the other way around.
+ */
+
+/** When a sentinel stops watching. */
+type SentinelUntil = {
+    kind: "subject_terminal";
+} | {
+    kind: "at";
+    ms: number;
+} | {
+    kind: "count";
+    n: number;
+} | {
+    kind: "never";
+};
+/** Where a matching event is delivered.
+ *
+ *  `routine` is reserved for AIP-41 `schedule.kind: event` binding; `webhook`
+ *  is reserved for forwarding a matched event to an external HTTP callback.
+ *  Both are FROZEN SHAPES ONLY — `SentinelStore.create` rejects them with
+ *  {@link SentinelTargetNotImplementedError} until a later step wires actual
+ *  delivery (design §6/§12 step 4 for `routine`; `webhook` has no design
+ *  section yet). Declaring the shape now lets callers/tools reference the
+ *  full union before delivery exists. */
+type SentinelTarget = {
+    kind: "session";
+    sessionId: string;
+    urgency: MessageUrgency;
+} | {
+    kind: "routine";
+    routineId: string;
+} | {
+    kind: "webhook";
+    url: string;
+    secret: string;
+};
+/** One clause of a sentinel's watch: a subject (exact, or a `*`-suffixed
+ *  prefix match against an event's `subjects`) plus an optional per-clause
+ *  type glob list. */
+interface SentinelMatchClause {
+    /** Hierarchical routing key, e.g. "github:agentproto/ts#1428". A trailing
+     *  `*` is a prefix match against an event's `subjects`. */
+    subject: string;
+    /** Type globs; undefined = the provider's `defaultTypes(subject)`. */
+    types?: string[];
+}
+/**
+ * "Watch any of `match` until `condition`, deliver to `target`."
+ *
+ * `match` is OR semantics: an event matches the sentinel if it matches ANY
+ * clause (subject + that clause's own type glob / provider default). At
+ * least one clause is required — use {@link singleMatch} for a one-clause
+ * spec. The event's own `subject` (not the matching clause's, which may be a
+ * `*` prefix template) is what lands as `correlationId: sentinel:<subject>`
+ * and the `[<scheme>]` inbox-text prefix — see `sentinel-runtime.ts`.
+ *
+ * Dedup key is `(sentinelId, event.id)`, same for every clause — see
+ * {@link SentinelEvent.id}.
+ */
+interface SentinelSpec {
+    match: SentinelMatchClause[];
+    until: SentinelUntil;
+    target: SentinelTarget;
+    /** Provider slug; undefined = auto-select (not implemented by the runtime
+     *  yet — step 2 requires an explicit slug). */
+    provider?: string;
+    /** Fan-out grouping — sentinels created together (e.g. several
+     *  PR-related watches for one review) share a `group` id so they can be
+     *  listed/removed together later. Purely descriptive: the runtime never
+     *  reads it, no MCP tool consumes it yet. */
+    group?: string;
+    /** Human-readable label surfaced by `sentinel_list` / the CLI. Purely
+     *  descriptive, same as `group`. */
+    label?: string;
+}
+
+/**
+ * SentinelStore — persists `~/.agentproto/sentinels.json` (AIP-60 §2).
+ *
+ * State is in-memory; sentinels persist to disk (debounced async write +
+ * sync flush at shutdown), mirroring `inbound-endpoints.ts`'s
+ * `InboundEndpointStore`. Unlike that store's `markSeen` (deliberately
+ * in-memory only), dedup here is PERSISTED per sentinel, bounded to the last
+ * 1000 event ids (design §2/§9) — a sentinel's dedup window must survive a
+ * daemon restart, since the whole point of a sentinel is to keep watching
+ * across restarts.
+ *
+ * Writes are atomic (write to a per-process tmp file, then rename), same
+ * idiom as `sandbox-ledger.ts` — a crash mid-write must never leave a
+ * corrupt `sentinels.json` behind.
+ */
+
+type SentinelStatus = "active" | "paused" | "expired" | "orphaned" | "error";
+
 /**
  * LlmEndpointRegistry — supervised-sidecar manager for the
  * `@agentproto/llm-endpoint` proxy gateway.
@@ -3138,6 +3393,13 @@ interface PairingChannelContext {
     fingerprint: string;
     /** Client label. */
     name: string;
+    /** This pairing's OWN recorded scope (mirrors `PairingRecord.scope`) —
+     *  `"host"` when the offer that produced it was minted with
+     *  `agentproto pair offer --host`, absent for an ordinary remote-control
+     *  pairing. Present on BOTH the offer and every reconnect context, so
+     *  `serve` can gate scope-restricted routes (e.g. device-inference
+     *  proxying) the same way on first contact and on every later reconnect. */
+    scope?: "host";
 }
 /** Handle to a live served channel — the registry closes it on teardown. */
 interface PairingChannelHandle {
@@ -3322,6 +3584,20 @@ interface HostRecord {
      *  by `parseOfferUrl` before `add()` ever sees them, so this is currently
      *  unreachable — kept so a future downgrade path has somewhere to flag it. */
     legacy?: true;
+    /** Self-reported by the host at add-time (SANDBOX-VISIBILITY-JOIN) — e.g. a
+     *  sandbox provider slug, a provider-side sandbox id, and free-form labels
+     *  (PR number, run URL, …). Never verified beyond "the host said so"; purely
+     *  descriptive for `device_list`/`devices sessions`. */
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
+}
+/** Optional self-reported metadata `add()` attaches to the resulting
+ *  `HostRecord` (see `HostRecord.provider`/`sandboxId`/`labels`). */
+interface HostJoinMeta {
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
 }
 interface HostRegistryDeps {
     /** Dial a rendezvous WS and adapt it to a `FrameSink`. Same shape as
@@ -3350,6 +3626,15 @@ interface ForwardHttpResponse {
     headers: Record<string, string>;
     body: Uint8Array;
 }
+/** Streaming counterpart of {@link ForwardHttpResponse} — `body` is a Web
+ *  `ReadableStream` the caller drains directly (SSE chat/completions, most
+ *  notably) instead of a fully-buffered `Uint8Array`. See
+ *  {@link HostRegistry.forwardHttpStream}. */
+interface ForwardHttpStreamResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: ReadableStream<Uint8Array>;
+}
 interface HostRegistry {
     /**
      * Accept an offer URL and register the target daemon as a driveable host.
@@ -3360,7 +3645,7 @@ interface HostRegistry {
      * mirrors `pair-transport.ts`'s `acceptOffer`), derives the pair root, and
      * persists a `HostRecord` (upserted by fingerprint — re-adding replaces).
      */
-    add(offerUrl: string, name?: string): Promise<{
+    add(offerUrl: string, name?: string, meta?: HostJoinMeta): Promise<{
         fingerprint: string;
         name: string;
         rendezvousUrl: string;
@@ -3383,9 +3668,174 @@ interface HostRegistry {
      * on the hello (likely a pair/v1 peer).
      */
     forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
+    /**
+     * Same dial/handshake/retry shape as {@link forwardHttp}, but for a
+     * streamed response (SSE, NDJSON, long-poll) — the daemon-inference proxy's
+     * `/v1/chat/completions` most notably, which must relay tokens as they
+     * arrive rather than buffering the whole completion first. Unlike
+     * `forwardHttp`, the tunnel client is kept open (and `isOnline` stays true)
+     * until the returned `body` stream is fully drained, errors, or is
+     * cancelled — only then does it close and the online count drop.
+     */
+    forwardHttpStream(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpStreamResponse>;
 }
 declare function createHostRegistry(deps: HostRegistryDeps): HostRegistry;
 
+/**
+ * Daemon-side JOIN TOKEN registry (SANDBOX-VISIBILITY-JOIN, stacked on
+ * DEVICES-PLAN PR-C's `host-registry.ts`).
+ *
+ * `host-registry.ts`'s `add()` requires a HUMAN to relay a host-scoped offer
+ * URL from the box to this daemon (`agentproto pair offer --host` on the box,
+ * `agentproto devices add <url>` here) — fine for a laptop, impossible for an
+ * unattended CI sandbox with no one watching its logs to copy a one-time,
+ * 10-minute-TTL secret. A join token flips who initiates: this daemon mints a
+ * long-lived, revocable, reusable credential ahead of time (stored as a
+ * GitHub secret, say); a box started with `AGENTPROTO_JOIN=<token>` dials
+ * in — over the SAME rendezvous/pair-v2 primitives, no protocol change — and
+ * this daemon adds it as a host automatically.
+ *
+ * ## Why this isn't just a long-lived `host-registry.ts` offer
+ *
+ * pair/v2 deliberately gives a CLIENT no persistent identity key (see
+ * `pairing-registry.ts`'s "Reconnect authentication" doc) — only the
+ * DAEMON/offerer side has stable keys a peer can pin and re-dial later.
+ * `HostRegistry.forwardHttp` needs exactly those stable keys to reach a host
+ * on demand, so the box MUST end up as the offerer of its own host-scoped
+ * offer (a normal, single-use `pair offer --host`) with THIS daemon
+ * `add()`-ing it — `host-registry.ts` is not touched by this module at all.
+ *
+ * What the join token replaces is only the relay step: this daemon parks a
+ * STANDING accept loop (`side=daemon`, exactly like a `pair offer`'s park,
+ * except never single-use) on a route deterministically derived from the
+ * token's own secret. A box holding the token dials that route as the
+ * CLIENT — the role a browser/CLI plays consuming a normal offer — and its
+ * sealed hello's `clientName` carries a small JSON envelope: the box's own
+ * self-minted host-scoped offer URL (freshly created, in-process, via its
+ * own `PairingRegistry.createOffer({scope:"host"})` — see
+ * `packages/cli/src/commands/serve.ts`'s `AGENTPROTO_JOIN` boot wiring) plus
+ * a self-reported name/provider/sandboxId/labels. On receipt, this daemon
+ * just calls `HostRegistry.add(offerUrl, name, meta)` — the exact call a
+ * human would type — closes the bootstrap channel, and re-parks for the next
+ * box. No new wire messages, no new crypto: two ordinary pair/v2 handshakes
+ * back to back, the first only ever used to carry one string.
+ *
+ * ## Reuse and revocation
+ *
+ * Unlike an `OfferEntry` (`pairing-registry.ts`), a join token's
+ * `{route, auth}` never rotates and is never "spent" — `useCount`/`maxUses`/
+ * `expiresAt`/`revokedAt` (all checked inside `verifyAuthToken`, which may be
+ * async) gate reuse instead. This is the same trust shape as an existing
+ * epoch reconnect token (valid, unrotated, for its whole day) stretched over
+ * a longer, explicit, revocable window — not a new security primitive.
+ *
+ * ## A known limitation
+ *
+ * One token parks on exactly one fixed route, so exactly one box can be
+ * mid-handshake on it at a time; a second box dialing in the same instant
+ * either waits for the loop to re-park (typical: the ceremony is a single
+ * short-TTL round trip) or, in the worst case, times out and retries with
+ * backoff. Fine for the sequential-CI-review case this exists for; a fleet
+ * of concurrently-joining boxes would want multiple parked slots per token,
+ * deferred (see PR body).
+ *
+ * Persisted to `~/.agentproto/join-tokens.json`, same atomic-write + lazy-
+ * load discipline as `hosts.json`/`pairings.json`. The raw `secret` — not a
+ * hash — is stored, exactly like `pairings.json` stores `pairRoot` in the
+ * clear: it is crypto material this daemon must re-derive `{route, auth}`
+ * from on every boot, not a password to be hashed.
+ */
+
+/** `join-tokens.json` format. */
+declare const JOIN_TOKENS_VERSION: 1;
+/** One persisted join token. `secret` is the crypto material a box's
+ *  `AGENTPROTO_JOIN` value carries too — never log or echo it once minted. */
+interface JoinTokenRecord {
+    /** Short random id (CLI/MCP target), distinct from `secret`. */
+    id: string;
+    /** Human-facing label (e.g. "ci-reviewer"). */
+    name: string;
+    /** One-time-offer-shaped secret (base64url) — re-derives `{route, auth}`
+     *  via `deriveOfferTokens`. Never rotates for this token's lifetime. */
+    secret: string;
+    /** Rendezvous endpoint boxes dial through. */
+    rendezvousUrl: string;
+    /** ISO-8601 mint time. */
+    createdAt: string;
+    /** ISO-8601 expiry — always set (`create()` defaults `ttlMs`). */
+    expiresAt: string;
+    /** Reuse ceiling. Absent = unlimited (until `expiresAt`/revoke). */
+    maxUses?: number;
+    /** Successful joins so far. */
+    useCount: number;
+    /** ISO-8601 of the most recent successful join. */
+    lastUsedAt?: string;
+    /** ISO-8601 revoke time. Present ⇒ inactive; kept for `list()` history. */
+    revokedAt?: string;
+}
+interface CreateJoinTokenInput {
+    name: string;
+    /** Time-to-live in ms. Default 90 days. */
+    ttlMs?: number;
+    /** Reuse ceiling. Absent = unlimited. */
+    maxUses?: number;
+    /** Rendezvous URL override; falls back to the configured default. */
+    rendezvousUrl?: string;
+}
+interface CreatedJoinToken {
+    id: string;
+    name: string;
+    /** The `AGENTPROTO_JOIN` value — an `agentproto://pair?…&scope=host` URL.
+     *  Shown ONCE; `list()` never returns it. */
+    token: string;
+    rendezvousUrl: string;
+    expiresAt: string;
+}
+interface JoinTokenRegistryDeps {
+    /** Lazily load (create on first use) the daemon identity — same contract
+     *  as `PairingRegistryDeps.loadIdentity`. */
+    loadIdentity: () => Promise<DaemonIdentity>;
+    /** Path to `join-tokens.json`. Defaults to `~/.agentproto/join-tokens.json`. */
+    joinTokensPath?: string;
+    /** Configured rendezvous URL default — same three-state contract as
+     *  `PairingRegistryDeps.defaultRendezvousUrl` (absent → hosted default;
+     *  `""` → explicit opt-out, fails closed without `--rendezvous`). */
+    defaultRendezvousUrl?: string;
+    /** Dial a rendezvous WS and adapt it to a `FrameSink`. Same shape as
+     *  `PairingRegistryDeps.dial`/`HostRegistryDeps.dial`. */
+    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
+    /** Called once per successful join, with the box's self-minted host offer
+     *  URL and self-reported name/meta — normally `hostRegistry.add`. Errors
+     *  are logged and swallowed: a bad/unreachable offer from one join must not
+     *  crash the standing accept loop. */
+    addHost: (offerUrl: string, name?: string, meta?: HostJoinMeta) => Promise<unknown>;
+    /** Injectable clock (ms). Defaults to Date.now. */
+    now?: () => number;
+    /** Diagnostic log sink. */
+    log?: (line: string) => void;
+    /** Handshake ceiling per attempt. Default 110s (mirrors PairingRegistry's
+     *  park timeout, kept just under the broker's own). */
+    handshakeTimeoutMs?: number;
+    /** Reconnect backoff floor / ceiling (ms) after a failed dial. Defaults 1s/30s. */
+    reconnectMinMs?: number;
+    reconnectMaxMs?: number;
+}
+interface JoinTokenRegistry {
+    /** Mint a token and start its standing accept loop. */
+    create(input: CreateJoinTokenInput): Promise<CreatedJoinToken>;
+    /** All persisted tokens (copies), `secret` stripped. Loads on first call. */
+    list(): Promise<Omit<JoinTokenRecord, "secret">[]>;
+    /** Revoke by id or name — stops its accept loop. Returns false if nothing
+     *  matched or it was already revoked. */
+    revoke(idOrName: string): Promise<boolean>;
+    /** Start standing accept loops for every active persisted token. Call once
+     *  at boot, after the gateway/hostRegistry are wired. */
+    startAutoconnect(): Promise<void>;
+    /** Tear down every accept loop. */
+    shutdown(): Promise<void>;
+}
+declare function createJoinTokenRegistry(deps: JoinTokenRegistryDeps): JoinTokenRegistry;
+
 /**
  * Shared types for pluggable sandbox providers.
  *
@@ -4196,6 +4646,29 @@ declare function createActivityProjector(opts: {
     resolvePrState?: PrStateResolver;
 }): ActivityProjector;
 
+/**
+ * `~/.agentproto/bundles.json` — named sets of imported MCPs + skills (+
+ * optionally the daemon's own `/mcp`), attachable to any harness in one
+ * `agent_start({bundles:["research"]})` call.
+ *
+ * Same load/save/atomic-write pattern as `user-presets.ts`; validation
+ * against the live imported-MCP set is the single boundary every writer
+ * (MCP tools, HTTP routes) goes through (`saveBundle`).
+ */
+
+declare const bundlesFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    bundles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        mcpImports: z.ZodArray<z.ZodString>;
+        includeDaemon: z.ZodOptional<z.ZodBoolean>;
+        skills: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type BundlesFile = z.infer<typeof bundlesFileSchema>;
+
 /**
  * Spawn-time role profiles — the primitive that decides whether a
  * spawned agent may itself delegate (spawn further children).
@@ -4436,6 +4909,21 @@ interface WorktreeProvisionRequest {
     /** Free-text label (the session's `label`) the provisioner may fold into a
      *  minted slug for human readability. Never load-bearing for correctness. */
     labelHint?: string;
+    /** Absolute path the provisioner should append the setup hooks' FULL
+     *  stdout+stderr to (see `worktree.provision`'s `setupLogPath` input and
+     *  `@agentproto/worktree`'s `runSetup`). `session-spawn.ts` passes the
+     *  spawning session's own transcript dir here, so a failing setup hook's
+     *  full output survives even after a subsequently-reclaimed worktree is
+     *  gone — the short `HookError` message alone only carries a filtered
+     *  tail. Omitted callers (e.g. `agentproto worktree new`, no session to
+     *  log into) simply get no persisted log. */
+    setupLogPath?: string;
+    /** Re-run a failing `worktree.setup` command exactly once before giving
+     *  up — see `worktree.provision`'s `retrySetupOnFailure` input and
+     *  `runSetup`'s doc for why this is a bounded complement, not a
+     *  substitute, and why the daemon opts in while `agentproto worktree new`
+     *  doesn't. */
+    retrySetupOnFailure?: boolean;
 }
 /** The provisioner's outcome. `isolated: false` is NOT a failure — it means
  *  there was nothing to isolate (`cwd` sits in no git repo), and the caller
@@ -4652,6 +5140,15 @@ interface SpawnAgentSessionDeps {
      *  `loadConfig` when omitted; tests inject a stub to avoid touching
      *  the real file. */
     loadDefaultsConfig?: () => Promise<SpawnDefaultsConfig | undefined>;
+    /** Loads `~/.agentproto/bundles.json` for capability-bundle expansion
+     *  (`agent_start.bundles` / config `defaults.bundles`, PLAN D phase 1).
+     *  Defaults to the real loader when omitted; tests inject a stub to avoid
+     *  touching the real file. */
+    loadBundlesConfig?: () => Promise<BundlesFile>;
+    /** Loads `~/.agentproto/imported-mcps.json` — resolves a bundle's
+     *  `mcpImports` ids to their alias/snapshot and detects dangling ones.
+     *  Defaults to the real loader when omitted; tests inject a stub. */
+    loadImportedMcpsConfig?: () => Promise<ImportedMcpsConfig>;
     /** Builds the per-session headless-browser mount for `browser:
      *  "headless"` (see `browser-mount.ts`). Defaults to the real resolver
      *  (installs chrome-devtools-mcp on first use); tests inject a stub. */
@@ -4824,6 +5321,22 @@ interface SpawnAgentSessionInput {
      *  such option (e.g. claude-code, which auto-discovers skills) ignore
      *  it. See `resolveSpawnDefaults` / `normalizeSkillsOption`. */
     skills?: string[];
+    /** Capability bundle ids (`bundle_list`) to attach (PLAN D phase 1). Merged
+     *  with config.json's `defaults.bundles` / `defaults.adapters.<slug>.bundles`
+     *  with the same precedence/replace semantics as `skills` — see
+     *  `resolveBundleDefaults`. Each bundle expands to its `mcpImports` (mounted
+     *  as native MCP servers via the daemon's `/mcp/imported/<id>` passthrough,
+     *  never the two-step `mcp_imported_*` indirection), optionally the
+     *  daemon's own `/mcp` (`includeDaemon`), and its `skills` (unioned into
+     *  the resolved skill list). Ignored (with a warning) for a sandbox spawn —
+     *  the box cannot reach this daemon's loopback `/mcp`. */
+    bundles?: string[];
+    /** Explicitly mount the daemon's own scoped `/mcp` for this spawn — the
+     *  only way an adapter outside `shouldInjectDaemonSelfMount`'s allowlist
+     *  (opencode, codex, gemini, …) gets it. Merged with config's
+     *  `defaults.adapters.<slug>.daemonMount` (per-spawn wins). Ignored (with a
+     *  warning) for a sandbox spawn. */
+    daemonMount?: boolean;
     model?: string;
     effort?: string;
     /** Decomposed route identity.  This is canonical transport; `mode` remains
@@ -4962,6 +5475,12 @@ interface SpawnAgentSessionInput {
      *  external webhook path (`notifyUrl`) already fires regardless of this
      *  flag. */
     notifyParentOnCrash?: boolean;
+    /** Per-spawn opt-out of sentinel auto-link (AIP-60 §6/step 4): `false`
+     *  means a PR this session opens is never auto-watched, regardless of
+     *  `config.sentinel.autoWatchPrs`. Recorded verbatim onto
+     *  {@link SessionDescriptor.sentinelAutoWatch}; `undefined`/`true` = allowed
+     *  (still gated by the config default). */
+    sentinel?: boolean;
     /** Exempt this session from the idle-reaper (`isReapable` in
      *  idle-reaper.ts) regardless of how long it sits idle. Stamped straight
      *  onto the descriptor — see `SessionDescriptor.keepAlive`. Default false
@@ -5382,6 +5901,22 @@ interface BranchGcVerdictLookupInput {
  *  lookup, so a caller can check one tip without re-running a whole `branch_gc` plan. */
 type BranchGcVerdictReader = (input: BranchGcVerdictLookupInput) => Promise<BranchGcVerdictRecordView | null>;
 
+/**
+ * Set by the tunnel server (never a caller) on every `http_request` it
+ * forwards from a HOST-scoped pairing (DEVICES-PLAN item 1) —
+ * `buildDaemonTunnelServerOptions`'s `pairingScope` in
+ * `packages/cli/src/util/tunnel-serve.ts`. `httpInjectHeaders` overrides any
+ * same-named header the ORIGINAL caller's frame carried, so this can never be
+ * spoofed by whoever dials in over a pairing — only the daemon's own
+ * server-side scope decision at serve time ever sets it.
+ *
+ * Deliberately NOT paired with an `isLoopback` bypass the way most other
+ * routes are: every `http_request` a tunnel forwards to THIS server lands as
+ * a loopback socket (the daemon dialing its own gateway via `fetch`), so
+ * `isLoopback` is true for ALL forwarded traffic — host-scoped or not — and
+ * cannot distinguish them. `handleDeviceInference` checks this header alone.
+ */
+declare const HOST_SCOPE_HEADER = "x-agentproto-host-scope";
 /**
  * Pluggable adapter resolver — keeps the runtime package free of any
  * @agentproto/cli dep. The host (cli `serve`, playground, embedding
@@ -5703,127 +6238,6 @@ interface SessionBackgroundTask {
     startedAt: string;
 }
 
-/**
- * Typed inter-session message envelope (AIP-46 §Session messages).
- *
- * A PROMPT is an instruction from whoever drives a session; a MESSAGE is a
- * report between sessions in the same tree whose sender the DAEMON attests.
- * Everything in `from` is computed here from the caller's verified identity
- * and the session forest — a send request can never set it.
- *
- * Pure module: no registry, no I/O. The registry (sessions.ts) carries a
- * `SessionMessage` on a queued prompt (`QueuedPrompt.envelope`), renders it
- * into the model's context with `renderSessionMessages`, and records it as
- * its own `session-message` transcript record — never a `user-prompt`.
- */
-/** Sender's position in the tree, relative to the recipient. */
-type MessageRelation = "child" | "parent" | "sibling" | "human" | "system";
-type MessageKind = "report" | "question" | "blocker" | "done" | "notice";
-type MessageUrgency = "fyi" | "next-turn" | "steer" | "interrupt";
-type MessageDeliveryVia = "wait" | "steer" | "turn" | "interrupt" | "inbox";
-declare const MESSAGE_KINDS: readonly MessageKind[];
-declare const MESSAGE_URGENCIES: readonly MessageUrgency[];
-interface SessionMessageFrom {
-    /** Absent only for relation `human` | `system`. */
-    sessionId?: string;
-    /** Registry label at send time — display only, never identity. */
-    label?: string;
-    role?: string;
-    adapter?: string;
-    relation: MessageRelation;
-}
-interface SessionMessage {
-    /** `msg_<uuid8>`, daemon-minted. */
-    id: string;
-    ts: string;
-    /** Recipient sessionId. */
-    to: string;
-    from: SessionMessageFrom;
-    kind: MessageKind;
-    /** Requested urgency. */
-    urgency: MessageUrgency;
-    /** Stamped on delivery. */
-    delivered?: {
-        via: MessageDeliveryVia;
-        at: string;
-        turnSeq?: number;
-    };
-    /** Thread id; defaults to the first message's id. */
-    correlationId?: string;
-    /** A `SessionMessage.id` this answers. */
-    replyTo?: string;
-    text: string;
-    /** Optional structured payload (≤ `MAX_MESSAGE_DATA_BYTES`). */
-    data?: Record<string, unknown>;
-    ackedAt?: string;
-}
-declare const MAX_MESSAGE_DATA_BYTES: number;
-/** The slice of a session descriptor relation/ACL resolution needs. */
-interface MessageTreeNode {
-    id: string;
-    parentSessionId?: string;
-    label?: string;
-    role?: string;
-    adapterSlug?: string;
-}
-/**
- * Relation of `sender` to `recipient` in the session forest, or `undefined`
- * when they're not tree neighbours (cousins, strangers, self). `sender`
- * absent ⇒ `human` (an HTTP/CLI operator); daemon-originated notices pass
- * `"system"` explicitly instead of calling this.
- */
-declare function resolveRelation(sender: MessageTreeNode | undefined, recipient: MessageTreeNode): Exclude<MessageRelation, "system"> | undefined;
-/**
- * ACL: child→parent, parent→direct child, human/system→any. Sibling↔sibling
- * only when `allowSiblings` (config-gated, default off). Anything else — a
- * cousin, a stranger, yourself — is refused.
- */
-declare function isMessageAllowed(relation: MessageRelation | undefined, opts?: {
-    allowSiblings?: boolean;
-}): relation is MessageRelation;
-/** Build a `from` block from the verified sender + the resolved relation. */
-declare function messageFrom(sender: MessageTreeNode | undefined, relation: MessageRelation): SessionMessageFrom;
-declare function mintMessageId(): string;
-declare function createSessionMessage(input: {
-    to: string;
-    from: SessionMessageFrom;
-    text: string;
-    kind?: MessageKind;
-    urgency?: MessageUrgency;
-    replyTo?: string;
-    correlationId?: string;
-    data?: Record<string, unknown>;
-}): SessionMessage;
-interface MessageFilter {
-    /** Sender session ids, or `"children"` for any message whose relation is
-     *  `child` (i.e. from one of the recipient's own children). */
-    from?: readonly string[] | "children";
-    kind?: readonly MessageKind[];
-    correlationId?: string;
-}
-declare function matchesMessageFilter(msg: SessionMessage, filter: MessageFilter): boolean;
-declare const MESSAGE_TAG = "agentproto-message";
-/** Child-settable label → attribute-safe: `[A-Za-z0-9._-]`, ≤ 48 chars. */
-declare function sanitizeLabel(label: string | undefined): string | undefined;
-/** Escape every envelope/body sentinel inside a message body, so a sender
- *  can't close the tag early and forge a second header. */
-declare function escapeMessageBody(text: string): string;
-/** A human prompt is NOT wrapped (humans keep today's UX), but a line that
- *  starts with the envelope sentinel is escaped, so the invariant "text
- *  outside an `<agentproto-message>` tag is the human" holds. Nothing else
- *  in human text changes. */
-declare function escapeHumanPrompt(text: string): string;
-declare function renderSessionMessage(msg: SessionMessage): string;
-/** A coalesced batch → sibling tags, one per message, in order. */
-declare function renderSessionMessages(msgs: readonly SessionMessage[]): string;
-/** One-line typed digest of `fyi` messages that never woke the session —
- *  prepended (as a `system-prompt` slice) to the next turn it runs anyway. */
-declare function renderInboxDigest(msgs: readonly SessionMessage[]): string;
-/** Taught once, the first time a session RECEIVES a message (recorded as a
- *  `system-prompt`). Children also get the same invariant in their lineage
- *  line at spawn. */
-declare const MESSAGE_PREAMBLE: string;
-
 /**
  * A per-session observer — the pluggable seam behind the runtime's transcript
  * tap. `sessions.ts` drives one observer per turn (prompt in, each stream event,
@@ -5884,6 +6298,94 @@ interface SessionObserver {
  */
 declare function composeSessionObservers(observers: readonly SessionObserver[]): SessionObserver;
 
+/**
+ * Session-scoped artifact store — durable, content-addressed documents
+ * (image, pdf, html, presentation, site, generic file) attached to an
+ * agent-cli session, kept across restarts and browsable in the session's
+ * "Artifacts" section, distinct from the ephemeral inline card a chat
+ * message renders.
+ *
+ * Deliberately mirrors `transcript-writer.ts`'s `AttachmentEntry`, which
+ * itself mirrors AIP-58's `ArtifactEntry` (`packages/workflow-runtime/src/
+ * types.ts`) field-for-field — `key`/`path`/`sha256`/`size`/`contentType` —
+ * so promoting an attachment to an artifact is a metadata copy, never a
+ * data migration. What this module adds on top of a bare `ArtifactEntry`
+ * is the session-artifact-specific envelope AIP-58 has no notion of:
+ * `kind`, `label`, `pinned`, `createdBy`, `sourceRef`, and version history
+ * under one stable `key`.
+ *
+ * Storage layout, under `sessionTranscriptDir(sessionId)`:
+ *
+ *   artifacts/<sha256>.<ext>      — one file per single-file version
+ *   artifacts/<sha256>/           — one directory per "site" version
+ *   artifacts.jsonl               — append-only ledger, one JSON line per
+ *                                    mutation (`artifact.added` |
+ *                                    `artifact.pinned`)
+ *
+ * The ledger is the single source of truth, same posture AIP-58 §5 takes
+ * for its run event log: `listSessionArtifacts`/`getSessionArtifact` are
+ * folds over it, never a second store that could disagree with it. A
+ * `key`'s version history is append-only; nothing here ever rewrites a
+ * prior version's file or ledger line.
+ */
+type ArtifactKind = "image" | "document" | "pdf" | "html" | "presentation" | "site" | "file";
+type ArtifactCreator = "agent" | "user";
+interface ArtifactVersionEntry {
+    version: number;
+    /** Content hash — sha256 of the file's bytes for a single-file version,
+     *  or a manifest hash (sorted relative paths + sizes) for a "site"
+     *  directory version. Not a cryptographic content-integrity guarantee
+     *  for the directory case, only a stable change-detection key. */
+    sha256: string;
+    /** Relative to `sessionTranscriptDir(sessionId)` — `"artifacts/<sha>.<ext>"`
+     *  for a single file, `"artifacts/<sha>"` (a directory) for a site. */
+    path: string;
+    /** True when `path` names a directory (a "site"). */
+    isDirectory: boolean;
+    size: number;
+    contentType?: string;
+    createdAt: string;
+    createdBy: ArtifactCreator;
+    sourceRef?: string;
+}
+interface ArtifactRecord {
+    key: string;
+    kind: ArtifactKind;
+    label?: string;
+    pinned: boolean;
+    updatedAt: string;
+    versions: ArtifactVersionEntry[];
+}
+interface AddSessionArtifactInput {
+    /** Stable id this version is filed under. Versions accrue when the same
+     *  key is added again with different content. Defaults to a slug of
+     *  `name`, else the content hash. */
+    key?: string;
+    kind?: ArtifactKind;
+    label?: string;
+    createdBy: ArtifactCreator;
+    /** e.g. `"attachment:attachments/<sha>.<ext>"`, `"workflow-run:<runId>/
+     *  <artifactKey>"`, `"canvakit:<exportPath>"` — free-form provenance. */
+    sourceRef?: string;
+    /** Inline content, base64-encoded. Mutually exclusive with `sourcePath`. */
+    bytes?: string;
+    /** Display name — also the default `key`/extension source. */
+    name?: string;
+    mimeType?: string;
+    /** Absolute path to an existing file or directory (e.g. a canvakit
+     *  export) to copy into the store. A directory implies `kind: "site"`
+     *  unless overridden. Mutually exclusive with `bytes`. */
+    sourcePath?: string;
+}
+interface GetSessionArtifactResult {
+    record: ArtifactRecord;
+    version: ArtifactVersionEntry;
+    /** Absent for a "site" (directory) version — browse it via the raw-serve
+     *  route instead; nothing here bounds a whole directory's bytes. */
+    content?: Buffer;
+    truncated: boolean;
+}
+
 /** Where a session's `contextSize` came from — see the module doc. */
 type ContextSizeSource = "adapter" | "catalog" | "reported";
 
@@ -5907,8 +6409,11 @@ type ContextSizeSource = "adapter" | "catalog" | "reported";
  */
 
 interface SessionOutcomeArtifact {
-    type: "pr" | "commit" | "url";
-    /** The artifact's canonical reference — a PR url, a commit sha, a url. */
+    type: "pr" | "commit" | "url" | "file";
+    /** The artifact's canonical reference — a PR url, a commit sha, a url,
+     *  or (for `type: "file"`) the session artifact's `key`
+     *  (`session-artifacts.ts`) — resolve it via `session_artifact_get` /
+     *  `GET /sessions/:id/artifacts/:key`. */
     ref: string;
     title?: string;
 }
@@ -5921,12 +6426,26 @@ interface SessionOutcomeLink {
     title?: string;
 }
 interface SessionOutcome {
-    /** Level 1 only ever writes `"derived"`; a declared outcome (Level 2) is a
-     *  later addition. */
-    source: "derived";
+    /** Level 1 (`deriveSessionOutcome`) only ever writes `"derived"` — what an
+     *  ended session produced, with zero agent/human cooperation. Level 2 adds
+     *  `"judged"` (a judge agent decided the verdict, `judgedBy` names the
+     *  judge session) and `"declared"` (a deterministic rule or an operator
+     *  declared it, `judgedBy` is `"steward-rules"` or absent). See
+     *  `registry.closeWithOutcome`. */
+    source: "derived" | "judged" | "declared";
     /** `produced` — the session said something or left an artifact;
      *  `empty` — no assistant text and no artifacts. */
     status: "produced" | "empty";
+    /** Level 2 only: what a judge/declaration decided the session's work
+     *  amounted to. Absent on a plain Level 1 `"derived"` outcome. */
+    verdict?: "done" | "abandoned" | "blocked" | "needs-input";
+    /** Level 2 only: who reached `verdict` — a session id (a judge agent) or
+     *  the literal `"steward-rules"` for a deterministic close with no judge
+     *  in the loop. Absent on a plain Level 1 `"derived"` outcome. */
+    judgedBy?: string;
+    /** Level 2 only: free-text note from the judge/declaration explaining
+     *  `verdict` — never populated by `deriveSessionOutcome` itself. */
+    note?: string;
     /** Last assistant message of the session, trimmed to
      *  {@link OUTCOME_SUMMARY_MAX} chars (the TAIL is kept — the conclusion,
      *  not the preamble). Absent when the session never said anything. */
@@ -5972,6 +6491,12 @@ interface SessionOutcomeCompact {
 interface DeriveSessionOutcomeInput {
     /** The last assistant message the registry observed (raw, untrimmed). */
     lastAssistantText?: string;
+    /** Extra `type: "file"` artifacts to merge alongside the PR-derived ones
+     *  — the registry passes the session's PINNED `session-artifacts.ts`
+     *  records here so the ended block can show them (an unpinned artifact
+     *  still lists in the session's "Artifacts" section, just not surfaced
+     *  in the terse outcome). */
+    artifacts?: SessionOutcomeArtifact[];
     now?: Date;
 }
 /**
@@ -6502,7 +7027,10 @@ interface SessionDescriptor {
      *     `"parent-exited"` (an orchestrator's dying subtree reap),
      *     `"provider-limit"` (a driver-reported subscription/usage-cap error,
      *     e.g. Claude Code's "hit your session limit"), `"forgotten"` (a live
-     *     session killed as part of an operator `DELETE`).
+     *     session killed as part of an operator `DELETE`), `"steward-completed"` /
+     *     `"steward-abandoned"` (the session steward's `closeWithOutcome` —
+     *     verdict `"done"` vs. `"abandoned"`; a `"blocked"`/`"needs-input"`
+     *     verdict doesn't close at all, see `SessionDescriptor.wrapupFlag`).
      *  Absent for every terminal path this file doesn't tag (a plain natural
      *  exit, an ordinary turn error) — the session's own fault, or at least
      *  not something worth a special label. A string outside this list is
@@ -6535,6 +7063,20 @@ interface SessionDescriptor {
      *  revives the row. Persisted, so it survives restarts and archiving. See
      *  `session-outcome.ts`. */
     outcome?: SessionOutcome;
+    /** A steward verdict of `"blocked"` or `"needs-input"` from
+     *  `registry.closeWithOutcome` (`session-wrapup.ts` / FIX-9A) — recorded
+     *  INSTEAD of closing, since neither verdict means the session is done.
+     *  The session stays exactly as alive as it was; this is a signal for a
+     *  human/orchestrator to look, not a termination. Persisted; overwritten
+     *  (not accumulated) by the next flag, and left stale on the descriptor
+     *  until something clears it (nothing here does — a later successful
+     *  turn/close is a separate, more informative signal than deleting this). */
+    wrapupFlag?: {
+        verdict: "blocked" | "needs-input";
+        note?: string;
+        judgedBy?: string;
+        at: string;
+    };
     /** Last time anything was written to stdout/stderr. Lets the UI
      *  spot stuck sessions ("running for 2h, last output 12min ago"). */
     lastOutputAt?: string;
@@ -6572,6 +7114,12 @@ interface SessionDescriptor {
      *  every read since it's a live OS query, stale the instant it's
      *  written to disk. */
     processAlive?: boolean;
+    /** Summed RSS in bytes of this session's process and all its OS-level
+     *  descendants (`processTreeRss`, `process-memory.ts`). Ephemeral,
+     *  never persisted — stamped only when a caller opts in (`session_list`'s
+     *  `withMemory: true`) since it costs a `ps` spawn; absent otherwise, and
+     *  absent for a row with no `pid` or that `ps` didn't report. */
+    rssBytes?: number;
     /** Count of live supervisors currently blocked waiting on this session —
      *  HTTP `GET /sessions/:id/wait` long-polls and `session_monitor`
      *  subscriptions, both via `monitorSessionWait` (#session-visibility).
@@ -6722,11 +7270,14 @@ interface SessionDescriptor {
      *  the underlying `killedMidTurn`/`endedReason`). The in-place resume path
      *  never auto-retries the interrupted prompt. */
     interrupted?: boolean;
-    /** The `SessionsRegistry.bootId` of the FIRST daemon boot that found this
-     *  row interrupted — i.e. which restart cut its turn off. Stamped by the
-     *  boot reload (`loadHistorySnapshot`) on an interrupted row that doesn't
-     *  carry one yet; dropped whenever the row is interrupted AGAIN (so the next
-     *  boot restamps it) and on the next successful turn-end (with the markers it
+    /** The `SessionsRegistry.bootId` of the daemon boot that followed the
+     *  restart which cut this row's turn off. The graceful shutdown that
+     *  interrupts a turn parks `INTERRUPTED_PENDING_BOOT` here; the next boot
+     *  reload (`loadHistorySnapshot`) swaps that — or, after an unclean exit, a
+     *  row still alive on disk — for its own `bootId`. Nothing else is ever
+     *  stamped: an interrupted row carrying no marker was persisted by a daemon
+     *  predating it, i.e. by an older restart, and stays stale. Cleared on the
+     *  next successful turn-end (with the markers it
      *  qualifies). `interruptedAtBoot === registry.bootId` is how the
      *  continue-interrupted verb and boot pass pick "interrupted by the LAST
      *  restart" apart from a stale interruption nobody picked back up. PERSISTED
@@ -7175,6 +7726,20 @@ interface SessionDescriptor {
      *  — so this carries no secrets today. Should the shape ever grow
      *  headers/tokens, NEVER log this field's contents. */
     mcpServers?: AcpMcpServer[];
+    /** Resolved skills list at spawn time — explicit ∪ preset ∪ config
+     *  defaults (`resolveSpawnDefaults`'s own merge), recorded regardless of
+     *  whether the adapter actually CONSUMES a `skills` spawn option (today
+     *  only hermes does — see `normalizeSkillsOption`). Persisted so it
+     *  survives restart/resume like `mcpServers`, and so a read surface
+     *  (`session_capabilities`) can show what was resolved even for an
+     *  adapter (claude-code) that auto-discovers skills on its own and never
+     *  reads this list back. */
+    skills?: string[];
+    /** Capability bundle ids (`bundle_list`) resolved for this spawn (PLAN D
+     *  phase 1) — ids only, never the expanded imported-MCP snapshots (those
+     *  live only in `mcpServers` above, as reference-only proxy URLs). Absent
+     *  ⇒ no bundle was attached. */
+    bundles?: string[];
     /** Provider-specific resume hints sniffed from the session's
      *  output. claude-code prints `claude --resume <uuid>` on exit;
      *  we capture that uuid as `claudeResumeId`. On `restart`, when a
@@ -7277,6 +7842,12 @@ interface SessionDescriptor {
      *  want. Threaded like `permissionHold` — set at spawn time, immutable
      *  thereafter. */
     notifyParentOnCrash?: boolean;
+    /** Per-spawn opt-out of sentinel auto-link (AIP-60 §6/step 4,
+     *  `agent_start.sentinel: false`). `undefined`/`true` = allowed (subject to
+     *  `config.sentinel.autoWatchPrs`); `false` = this session's opened PRs are
+     *  never auto-watched, no matter the config. Set once at spawn, immutable
+     *  thereafter — same threading as `notifyParentOnCrash`. */
+    sentinelAutoWatch?: boolean;
     /** True when the session was spawned in permission-hold mode. */
     permissionHold?: boolean;
     /** Effective OS-level confinement of the adapter's own process
@@ -7311,9 +7882,17 @@ interface SessionDescriptor {
      *  time (spawn / resume) — shown in `session_list` so a sender can predict
      *  a message's delivery tier. `steering`: the agent accepts ACP steering
      *  (`_session/steering`) — a `steer` message can be injected into its
-     *  running turn instead of waiting for it to end. */
+     *  running turn instead of waiting for it to end. `commandsSupported`:
+     *  the live agent session is the ACP protocol arm (has a working `steer`
+     *  method — only the ACP arm implements it, per `AgentSessionLike`'s own
+     *  doc), which is what actually emits `available_commands_update`
+     *  notifications; false for the print/proprietary arms regardless of
+     *  `steeringSupported`, since a harness can be ACP without advertising
+     *  the steering extension. Read by `session_capabilities` to derive its
+     *  `arm`/`commandsSupported` fields without re-deriving the signal. */
     capabilities?: {
         steering: boolean;
+        commandsSupported: boolean;
     };
     /** FIFO of prompts that arrived while this session was mid-turn and
      *  asked to be QUEUED rather than rejected (`enqueuePrompt`'s
@@ -7767,6 +8346,28 @@ type PermissionRespondResult = {
     error: "not_found" | "session_gone" | "no_matching_option" | "unsupported";
     message: string;
 };
+/** Input to `SessionsRegistry.closeWithOutcome`. `verdict: "done" |
+ *  "abandoned"` records the Level 2 fields onto the session's
+ *  `SessionOutcome` and actually closes it; `"blocked" | "needs-input"`
+ *  records the SAME `note`/`judgedBy` onto `SessionDescriptor.wrapupFlag`
+ *  instead and never touches the session's liveness. See {@link
+ *  SessionOutcome} / {@link SessionDescriptor.wrapupFlag} for the field
+ *  meanings. */
+interface CloseWithOutcomeInput {
+    verdict: "done" | "abandoned" | "blocked" | "needs-input";
+    /** Overrides the outcome's derived summary when given (e.g. a judge's own
+     *  written summary) — trimmed the same way `deriveSessionOutcome` trims
+     *  `lastAssistantText`. Omitted keeps whatever `deriveSessionOutcome`
+     *  computed from the session's own last assistant message. Ignored for a
+     *  `"blocked"`/`"needs-input"` verdict (there's no outcome to summarize —
+     *  nothing closed). */
+    summary?: string;
+    note?: string;
+    /** A judge session id, or `"steward-rules"` for a deterministic close with
+     *  no judge in the loop. */
+    judgedBy?: string;
+    source: "judged" | "declared";
+}
 interface SessionsRegistry {
     spawn(input: SpawnSessionInput): SessionDescriptor;
     /** Adopt a ChildProcess that was spawned outside the registry —
@@ -8275,6 +8876,29 @@ interface SessionsRegistry {
      *  touches `keepAlive`, reaper eligibility, or any notification path —
      *  pin is quiet, structural state only. Throws when the id is unknown. */
     setPinned(id: string, pinned: boolean): SessionDescriptor;
+    /** Materialize a new artifact (or version of one) into the session's
+     *  durable artifact store (`session_artifact_add` MCP verb / `POST
+     *  /sessions/:id/artifacts`) — see `session-artifacts.ts`. Emits
+     *  `session:artifact-added` on a real (non-deduped) write. Throws when
+     *  the id is unknown. */
+    addSessionArtifact(id: string, input: AddSessionArtifactInput): ArtifactRecord;
+    /** Current-state fold of the session's artifact store — every key's
+     *  version history, most-recently-updated first. Empty array for a
+     *  known session with no artifacts yet. Throws when the id is unknown. */
+    listSessionArtifacts(id: string): ArtifactRecord[];
+    /** One artifact version's metadata plus its bounded file content (single-
+     *  file kinds only — a "site" version's content is browsed via the raw-
+     *  serve HTTP route instead). Undefined when the key/version doesn't
+     *  exist. Throws when the session id is unknown. */
+    getSessionArtifact(id: string, key: string, opts?: {
+        version?: number;
+        maxBytes?: number;
+    }): GetSessionArtifactResult | undefined;
+    /** Set or clear an artifact's pin (`session_artifact_pin` MCP verb /
+     *  `POST /sessions/:id/artifacts/:key/pin`). Emits
+     *  `session:artifact-pinned-changed`. Undefined when the key doesn't
+     *  exist. Throws when the session id is unknown. */
+    setArtifactPinned(id: string, key: string, pinned: boolean): ArtifactRecord | undefined;
     /**
      * Manually override `awaitingInput`/`awaitingQuestion` (the
      * `session_flag_status` MCP verb) — the ONE write path for this pair
@@ -8380,6 +9004,34 @@ interface SessionsRegistry {
      *  reason (including `"operator-stopped"` or none) on a terminal row
      *  stays the plain no-op. */
     kill(id: string, signal?: NodeJS.Signals, reason?: SessionEndReason): boolean;
+    /** Close a LIVE agent-cli session with a Level 2 (judged/declared) outcome
+     *  — the primitive the session steward (FIX-9A/9B) drives once a wrap-up
+     *  plan (`planSessionWrapup`, `session-wrapup.ts`) puts a session in the
+     *  `close`/`stuck` class, or a judge agent reaches a verdict on a `judge`
+     *  one. Verdict `"done"` or `"abandoned"` actually closes: terminates the
+     *  same graceful way `kill()` does, tags `endedReason: "steward-completed"`
+     *  (`"done"`) or `"steward-abandoned"` (`"abandoned"`), and — like
+     *  `reapIdle`, unlike a plain `kill()` — CLEARS the in-memory
+     *  `agentSession` binding so the row stays lazy-resumable in place. The
+     *  recorded outcome's `source`/`verdict`/`judgedBy`/`note` are stamped onto
+     *  the row's `SessionOutcome` (see `session-outcome.ts`) on top of what
+     *  `deriveSessionOutcome` would otherwise compute (last assistant message,
+     *  PRs, cost) — a declared close still shows what the session actually
+     *  produced. Verdict `"blocked"` or `"needs-input"` is NOT a completion —
+     *  nothing is terminated; the verdict is recorded as
+     *  `SessionDescriptor.wrapupFlag` instead, and the session is left exactly
+     *  as alive as it was.
+     *
+     *  Refuses (returns false, no-op) a session that is not a live
+     *  (`running`/`starting`) agent-cli row, or that AT THE MOMENT OF THE CALL
+     *  is `busy`/`awaitingInput`/`awaitingPermission` or has a background task
+     *  outstanding (`pendingBgTasks`/`backgroundTasks`) — a plan computed
+     *  moments earlier can be stale; this is the re-check that keeps an
+     *  autonomous close from ever landing on a session that just picked up a
+     *  turn, asked a question, or still has something in flight. Applies to
+     *  BOTH branches (close and flag-only) — a stale plan is refused either
+     *  way, never silently acted on. */
+    closeWithOutcome(id: string, input: CloseWithOutcomeInput): boolean;
     /** Retire a long-idle agent-cli session to free its adapter process — the
      *  primitive the idle-session reaper (`runIdleReapPass`, PR-6) drives on a
      *  periodic sweep. Terminates the underlying adapter/child the SAME graceful
@@ -8487,6 +9139,18 @@ interface SessionsRegistry {
      *  window keeps aging out naturally rather than being wiped by the
      *  give-up itself. Returns false (no-op) for an unknown id. */
     giveUpRestart(id: string, message: string): boolean;
+    /** Record a daemon-authored DISPLAY-ONLY notice into an agent-cli
+     *  session's transcript — the same `kind: "notice"` event `markCrashed`/
+     *  `giveUpRestart`/`interruptInFlightTurn` already stamp on their own
+     *  teardown/interrupt paths (see transcript-writer.ts's "notice" case),
+     *  exposed generically for a caller with just a session id, no `rt`
+     *  in hand. Appends to `events.jsonl` (so `session_story`/`live_session`
+     *  render it as a system message) and the ring buffer — nothing else:
+     *  it does NOT touch `promptQueue`, the inbox, or `busy`, so it can never
+     *  enqueue a prompt, wake an idle session into a turn, or interrupt a busy
+     *  one. Returns false (no-op) for an unknown id or a non-`agent-cli`
+     *  session. */
+    recordNotice(id: string, text: string): boolean;
     /** List permission requests currently parked in the pending-permissions
      *  inbox across all permission-hold sessions, newest last. Optionally
      *  filtered to one session. */
@@ -8617,6 +9281,13 @@ interface SpawnAgentInput {
      *  the resume/re-spawn path can re-mount the same toolset (orchestrator
      *  WP1). */
     mcpServers?: AcpMcpServer[];
+    /** Resolved skills list at spawn time (`resolveSpawnDefaults`'s merged
+     *  explicit ∪ preset ∪ config-defaults result) — recorded verbatim onto
+     *  {@link SessionDescriptor.skills}. See that field's doc. */
+    skills?: string[];
+    /** Capability bundle ids resolved for this spawn — recorded verbatim onto
+     *  {@link SessionDescriptor.bundles}; see that field's doc. */
+    bundles?: string[];
     /** Persistent isolated-config dir this spawn passed to
      *  `startSession({ configDir })` — recorded verbatim onto
      *  {@link SessionDescriptor.adapterConfigDir} so restart/lazy-resume can
@@ -8720,6 +9391,9 @@ interface SpawnAgentInput {
     /** Recorded verbatim onto {@link SessionDescriptor.notifyParentOnCrash} —
      *  see that field's doc. Default false. */
     notifyParentOnCrash?: boolean;
+    /** Recorded verbatim onto {@link SessionDescriptor.sentinelAutoWatch} — see
+     *  that field's doc. `undefined` = allowed. */
+    sentinelAutoWatch?: boolean;
     /** Exempt this session from the idle-reaper (`isReapable` in
      *  idle-reaper.ts) regardless of how long it sits idle — stamped straight
      *  onto `SessionDescriptor.keepAlive`. Default false. */
@@ -9048,10 +9722,13 @@ declare function runEagerResumePass(opts: {
  * Eligibility (both modes): an agent-cli row that is `interrupted` BY THE LAST
  * RESTART (`interruptedAtBoot === registry.bootId` — a stale interruption from
  * an older restart that nobody picked up is left alone), resumable under the
- * attempt cap (`canResume`), and not already busy. The prompt goes through
- * `enqueuePrompt`, the normal prompt path, so a dead-but-resumable row
- * lazy-resumes with its billing auth re-resolved exactly as a human prompt
- * would.
+ * attempt cap (`canResume`), not already busy, and whose `cwd` still exists
+ * (a removed worktree fails the adapter respawn every time — knowable up front,
+ * so the dry run must not call such a row eligible). The prompt goes through
+ * `enqueuePrompt`, the same entry MCP `agent_prompt` uses, so a
+ * dead-but-resumable row lazy-resumes with its billing auth re-resolved exactly
+ * as a human prompt would. When that resume fails, the outcome says so instead
+ * of passing on the bare post-resume "not alive" admission error.
  *
  * No-loop rules (boot mode only — a human pressing the button is intent):
  *   - never auto-continue a row whose resume has failed (`resumeAttempts > 0`:
@@ -9091,6 +9768,8 @@ type ContinueInterruptedSkipReason =
  | "resume-cap-exhausted"
 /** Mid-turn already — someone got there first. */
  | "busy"
+/** The row's `cwd` is gone (removed worktree) — the resume would fail. */
+ | "cwd-missing"
 /** Boot mode: a resume attempt has failed on this row. */
  | "resume-failed"
 /** Boot mode: already auto-continued by this boot. */
@@ -9160,6 +9839,8 @@ declare function continueInterruptedSessions(opts: {
     /** Extra visibility filter (a scoped orchestrator's subtree). Rows it
      *  rejects are dropped silently — never reported, never sent. */
     visible?: (desc: SessionDescriptor) => boolean;
+    /** Filesystem probe for the `cwd-missing` check. Default `existsSync`. */
+    cwdExists?: (cwd: string) => boolean;
 }): Promise<ContinueInterruptedResult>;
 /** Tally of the boot-time continue pass, for the boot-banner line. */
 interface ContinueOnBootSummary {
@@ -9387,6 +10068,89 @@ interface InboundWatcher {
     shutdown(): void;
 }
 
+/**
+ * `capabilities_inventory` — one read that answers "what MCP servers and
+ * skills does this daemon actually know about, and which harnesses can
+ * reach them?" Backs both the `capabilities_inventory` MCP tool
+ * (session-tools.ts) and its HTTP twin (`GET /capabilities/inventory`,
+ * http-server.ts) so the two surfaces can never drift.
+ *
+ * Read-only, never throws: a failure in one source (MCP discovery, the
+ * proxy registry, an adapter package that fails to import) becomes an
+ * `error` string on that block alone — the rest of the inventory still
+ * returns. Redaction: nothing here ever carries command/args/env/headers/
+ * url — only the identity/status fields a UI needs (same discipline as
+ * `compactDiscoveredMcp` / `compactImportedMcpEntry`).
+ *
+ * The `skills` block's per-adapter `metadata.skills` / `options` read uses
+ * the same dynamic-`import()` + duck-typed-export technique as
+ * `role-registry.ts`'s adapter-carried role discovery — reused rather than
+ * reinvented, and importantly NOT a `packages/cli` dependency: it walks the
+ * exact adapter list `listAgentAdapters` already returned (so `byHarness`
+ * is guaranteed the same installed set as `adapter_list`), importing each
+ * adapter's own already-installed package by its `packageName`.
+ */
+
+interface CapabilitiesInventoryImportedMcp {
+    id: string;
+    alias?: string;
+    name: string;
+    type: string;
+    source: string;
+    status: "connected" | "idle" | "error" | "unknown";
+    error?: string;
+    /** Only present when `status === "connected"` — never connects just to count. */
+    toolCount?: number;
+    usedBySessions: string[];
+}
+interface CapabilitiesInventoryDiscoveredMcp {
+    id: string;
+    source: string;
+    scope: string;
+    name: string;
+    type: string;
+    imported: boolean;
+}
+interface CapabilitiesInventoryMcp {
+    imported: CapabilitiesInventoryImportedMcp[];
+    discovered: CapabilitiesInventoryDiscoveredMcp[];
+    /** Which harnesses get the daemon's own `/mcp` (and so the imported pool)
+     *  mounted by default — derived from `shouldInjectDaemonSelfMount` +
+     *  each installed adapter's declared protocol, never a hardcoded list. */
+    daemonMountByHarness: Record<string, "default" | "on-request" | "none">;
+    error?: string;
+}
+interface SkillPackInventoryEntry {
+    name: string;
+    version?: string;
+    path: string;
+    skills: string[];
+}
+interface SkillsByHarnessEntry {
+    adapter: string;
+    target?: {
+        format: string;
+        dir: string;
+        unit?: string;
+    };
+    installed: string[];
+    native: string[];
+    spawnOption: boolean;
+}
+interface CapabilitiesInventorySkills {
+    packs: SkillPackInventoryEntry[];
+    byHarness: SkillsByHarnessEntry[];
+    defaults: {
+        global: string[];
+        byAdapter: Record<string, string[]>;
+    };
+    error?: string;
+}
+interface CapabilitiesInventory {
+    mcp: CapabilitiesInventoryMcp;
+    skills: CapabilitiesInventorySkills;
+}
+
 /**
  * Dynamic MCP-app panels for installed `@agentproto/app-kit` apps that ship
  * a `ui` block (`defineApp({ ui: { html, title?, tools?, csp? } })`,
@@ -9648,6 +10412,9 @@ interface PrStatusSnapshot {
         name: string;
         conclusion: string | null;
     }>;
+    /** The PR's head commit at fetch time — absent from snapshots taken
+     *  before this field existed. */
+    headSha?: string;
 }
 /** The mutable annotations sidecar of a ledger entry. */
 interface LedgerAnnotations {
@@ -9660,6 +10427,13 @@ interface ReviewLedgerFilter {
     rangeSha?: string;
     binding?: string;
     manifestSha?: string;
+    /** Keep only entries whose `attestation.requester.sessionId` is one of
+     *  these — backs `review_ledger({requesterSessionId, subtree})`: a single
+     *  id, or (with `subtree: true`) that session's whole subtree, resolved by
+     *  the caller before reaching the ledger. Answered from an in-memory
+     *  `requesterSessionId -> ledger keys` index (built lazily on first use,
+     *  kept current on every `put()`), never a full re-scan. */
+    requesterSessionIds?: readonly string[];
 }
 interface ReviewLedger {
     /** Absolute root directory of the ledger. */
@@ -9842,12 +10616,27 @@ interface ReviewRun {
     /** Where the attestation was written in the ledger. */
     ledgerPath?: string;
     error?: string;
+    /** The session that requested this run (`input.requesterSessionId ??
+     *  input.parentSessionId`), when known — mirrors
+     *  `Attestation.requester.sessionId` for a run that hasn't (or never will)
+     *  reach the ledger, so `review_ledger({includeRunning: true})` and the
+     *  `session_tree` badge (WP-review-panel) can attribute an in-flight/
+     *  cancelled/failed run to its requester without waiting for an
+     *  attestation. */
+    requesterSessionId?: string;
 }
 interface ReviewRunner {
     start(input: ReviewRunInput): ReviewRun;
     status(runId: string): Promise<ReviewRun | undefined>;
     wait(runId: string): Promise<ReviewRun | undefined>;
     cancel(runId: string): boolean;
+    /** Every run this daemon process has started, newest first — running runs
+     *  plus ones that settled (done/failed/cancelled) without a daemon
+     *  restart in between. Runs live in memory only for the process lifetime
+     *  (a restart loses this list, same as the rest of `runs` — the ATTESTATION
+     *  is what persists, in the ledger). Backs `review_ledger({includeRunning:
+     *  true})` and the `session_tree` review badge. */
+    list(): ReviewRun[];
     readonly ledger: ReviewLedger;
 }
 interface CreateReviewRunnerOptions {
@@ -9857,6 +10646,14 @@ interface CreateReviewRunnerOptions {
     reviewers?: ReviewerSessionHost;
     /** Attestor identity. Default: `agentproto-runtime@<hostname>`. */
     daemonId?: string;
+    /** Called once a run with a `requesterSessionId` reaches `done` — never
+     *  for `failed`/`cancelled` (no verdict to report). Display-only: the
+     *  daemon writes `text` into the requester's transcript as a `notice`
+     *  (see `sessions.ts`'s `recordNotice`) so `session_story`/`live_session`
+     *  show it — this never enqueues a prompt, touches the inbox, or starts a
+     *  turn. Fire-and-forget from the runner's perspective; a throw here is
+     *  swallowed. */
+    notifyRequester?: (sessionId: string, text: string) => void;
 }
 /** Placeholder values the daemon binds for every review. `{changed}` is a
  *  shell-quoted turbo filter for the packages changed since the range base
@@ -10086,6 +10883,12 @@ interface RegisterReviewToolsOptions {
     /** `gh` runner for `review_pr` — injectable for tests. Default: the real
      *  `gh` on the daemon's PATH. */
     gh?: GhRunner;
+    /** Resolve a session id to its subtree (itself + every session it
+     *  transitively spawned) — backs `review_ledger({requesterSessionId,
+     *  subtree: true})`. Omitted ⇒ `subtree` is ignored (scoped to the exact
+     *  id only), so a caller without sessions-registry access still works,
+     *  just without the subtree expansion. */
+    resolveSubtree?: (sessionId: string) => readonly string[];
 }
 declare function registerReviewTools(server: McpServer, opts: RegisterReviewToolsOptions): void;
 
@@ -11085,6 +11888,43 @@ declare function enrichRollupWithProviderQuota(rollup: UsageRollup, window: stri
  *  such lines; skips any malformed or non-`usage_snapshot` line. Never throws. */
 declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promise<UsageSnapshotRecord[]>;
 
+/**
+ * MCP surface for the sentinel primitive (AIP-60 §6): `sentinel_watch`,
+ * `sentinel_list`, `sentinel_unwatch`, `sentinel_poll_now`.
+ *
+ * `sentinel_watch`'s `sessionId` defaults to the calling session — same
+ * "trusted `?callerSessionId=`" pattern `message-tools.ts` uses — so a
+ * session watching its own PR doesn't need to know its own id.
+ *
+ * Provider auto-select isn't implemented yet (design §6): `provider`
+ * defaults to `local-gh`, the only built-in that ships as of this step.
+ *
+ * `createSentinelWatch`/`cancelSentinelWatch`/`sentinelView` are exported so
+ * `http-server.ts`'s `POST/GET/DELETE /sentinels` routes (the daemon-HTTP
+ * surface `agentproto sentinel` talks to) share the exact same
+ * validation/sugar-resolution logic as this MCP surface — same pattern as
+ * `TunnelRegistry` backing both `tunnel_create` and `POST /tunnels`, except
+ * here the shared logic is a plain function rather than a stateful registry
+ * method, since sentinel creation also needs the provider handle.
+ */
+
+/** Compact wire view of a sentinel for tool/HTTP results — the internal-only
+ *  fields (`handle`, `seen`, `terminalSubjects`) never leave the daemon. */
+interface SentinelView {
+    id: string;
+    provider: string;
+    status: SentinelStatus;
+    match: SentinelMatchClause[];
+    until: SentinelUntil;
+    target: SentinelTarget;
+    group?: string;
+    label?: string;
+    createdTs: number;
+    eventCount: number;
+    lastEventTs?: number;
+    lastError?: string;
+}
+
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -11164,6 +12004,11 @@ interface Device {
      *  a user can see, from EITHER daemon, which of their pairings/hosts grant
      *  host control. */
     scope?: "host";
+    /** Self-reported by a host at join time (SANDBOX-VISIBILITY-JOIN) — see
+     *  `HostRecord.provider`/`sandboxId`/`labels`. Absent for a client device. */
+    provider?: string;
+    sandboxId?: string;
+    labels?: Record<string, string>;
 }
 interface DeviceRegistry {
     /** Every known device. Read-only. */
@@ -11184,6 +12029,10 @@ interface DeviceRegistry {
         name: string;
         rendezvousUrl: string;
     }>;
+    /** Forward one HTTP request to a HOST device on demand (delegates to
+     *  `HostRegistry.forwardHttp`) — the basis for `device_sessions`. Rejects
+     *  if no `HostRegistry` was wired, or if `idOrName` doesn't match a host. */
+    forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
 }
 declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegistry): DeviceRegistry;
 
@@ -11207,6 +12056,9 @@ declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegi
 
 interface RegisterDeviceToolsOptions {
     registry: DeviceRegistry;
+    /** Optional (SANDBOX-VISIBILITY-JOIN) — when wired, registers
+     *  `join_token_create`/`join_token_list`/`join_token_revoke`. */
+    joinTokens?: JoinTokenRegistry;
 }
 declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
 
@@ -12475,11 +13327,27 @@ interface CreateGatewayOptions {
      * autoconnect or tear down on shutdown.
      */
     hostRegistry?: HostRegistry;
+    /**
+     * Optional JOIN TOKEN registry (see `createJoinTokenRegistry`,
+     * SANDBOX-VISIBILITY-JOIN). When wired alongside `pairingRegistry` +
+     * `hostRegistry`, the gateway mounts `POST/GET /devices/join-tokens` +
+     * `DELETE /devices/join-tokens/:id`, the `join_token_create/list/revoke`
+     * MCP tools, and `device_sessions`/`GET /devices/:id/sessions[/…/output]`.
+     * Autoconnect is the caller's to start (after this returns), same as
+     * `pairingRegistry`.
+     */
+    joinTokens?: JoinTokenRegistry;
     /** Enable the local LLM Endpoint proxy sidecar (route registration,
      *  MCP tools, child-process lifecycle). Default false — the endpoint is
      *  an opt-in feature; when off, the `llm-endpoint` custom route is not
      *  registered and the `llm_endpoint_*` MCP tools are not exposed. */
     llmEndpoint?: boolean;
+    /** Mirrors `config.features.deviceInferenceShare` (DEVICES-PLAN item 1).
+     *  Default false. Only meaningful alongside `llmEndpoint: true` — passed
+     *  straight through to `startHttpServer`'s `deviceInferenceShare`, which
+     *  gates `/device-inference/*` (see http-server.ts's `HOST_SCOPE_HEADER`
+     *  doc comment for the full scope-gate story). */
+    deviceInferenceShare?: boolean;
 }
 /**
  * Default always-on set when `deferredTools` is enabled without an
@@ -12490,10 +13358,10 @@ interface CreateGatewayOptions {
  * `toolPolicy.delegation: "deny"`, so those two names are simply absent
  * from a deny-role's registry and cost nothing) but still needs to report
  * back to its parent (`message_parent`), coordinate over the task ledger
- * (`task_*`), and observe its own session/turn state
- * (`session_context_status` alongside the pre-existing `session_list` /
- * `session_monitor` / `session_events_poll`). Everything else (fs_*,
- * directory_*, command_*, remote_*, browser_*, terminal_*, mcp_*,
+ * (`task_*`), and observe its own session/turn state and capabilities
+ * (`session_context_status` / `session_capabilities` alongside the
+ * pre-existing `session_list` / `session_monitor` / `session_events_poll`).
+ * Everything else (fs_*, directory_*, command_*, remote_*, browser_*, terminal_*, mcp_*,
  * routine_*, workflow_*, policy_*, inbound_watcher_*, session_tree,
  * agent_export, adapter_list, every `app_ui_*` panel tool, ...) starts
  * deferred — reachable via `tool_search`, never removed from `tools/call`.
@@ -12520,6 +13388,11 @@ interface GatewayHandle {
      *  (DEVICES-PLAN PR-C). Undefined otherwise. No autoconnect/shutdown to
      *  call on it — see that option's doc comment. */
     hosts?: HostRegistry;
+    /** JOIN TOKEN registry, when one was wired via
+     *  `CreateGatewayOptions.joinTokens` (SANDBOX-VISIBILITY-JOIN). Undefined
+     *  otherwise. Exposed so the CLI can `startAutoconnect()` after boot and
+     *  `shutdown()` it, same as `pairing`. */
+    joinTokens?: JoinTokenRegistry;
     /** Per-boot bearer token required on mutating /sessions/* routes
      *  + WS PTY upgrades. Exposed so an embedding host (e.g. the CLI
      *  shell that hosts the gateway in-process) can pass it to child
@@ -12570,4 +13443,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, HOSTS_VERSION, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostRecord, type HostRegistry, type HostRegistryDeps, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, type SubtreeChildUsage, type SubtreeUsageTotals, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageDetail, type UsageReadContext, type UsageReadResult, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
+export { type ActivityKind, type ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, type ActivityRecord, type ActivitySource, type ActivityState, type ActivityWaitingOn, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, type AgentSessionLike, type AgentStreamEvent, type AnthropicReaderConfig, AnthropicRemainingQuotaReader, type AttachPolicyInput, type AttachSandboxOpts, type AttachSandboxResult, AuthMethod, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, type CommitSpec, type CompletionPolicySupervisor, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedJoinToken, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type EagerResumeFailReason, type EagerResumeOutcome, type EagerResumeSkipReason, type EagerResumeSummary, EffortLevel, type EnableInput, type EnableResult, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GateSpec, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostRecord, type HostRegistry, type HostRegistryDeps, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, type JudgeGateSpec, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, type MessageDeliveryVia, type MessageFilter, type MessageKind, type MessageRelation, type MessageTreeNode, type MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OnFailSpec, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, type PendingPermission, type PermissionRespondInput, type PermissionRespondResult, type PolicyRunState, type PolicyRunStatus, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, type PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type PricingResolver, type QuotaReadableProfile, type QuotaStoreFile, type QuotaStoreOptions, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterBrowserInput, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterSessionInput, type RegisterWebSearchToolsOptions, type RemainingQuota, type RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResumeDisabledError, type ReuseResolution, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_END_REASONS, SESSION_ID_ENV, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionConfig, type SessionCurrentPhase, type SessionDescriptor, type SessionEndReason, type SessionKind, type SessionMessage, type SessionMessageFrom, type SessionMessageSentRecord, type SessionObserver, type SessionOutcome, type SessionOutcomeArtifact, type SessionOutcomeCompact, type SessionOutcomeLink, type SessionSnapshots, type SessionStatus, type SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, type SessionsRegistry, type ShellGateSpec, type SkillPackInventoryEntry, type SkillsByHarnessEntry, type SpawnAgentInput, SpawnDefaultsConfig, type SpawnSessionInput, type StallWatchdogRegistry, type StallWatchdogSummary, type StoredProfileQuota, type SubtreeChildUsage, type SubtreeUsageTotals, TASK_STATUSES, type TaskCaller, type TaskChangedEvent, type TaskClaimInput, type TaskCreateInput, type TaskGateOutcome, type TaskGateRunner, type TaskLedger, type TaskLedgerRegistry, type TaskLedgerSessionSlice, type TaskListFilter, type TaskRecord, type TaskStatus, type TaskUpdateInput, type TaskVerification, type TaskVerifySupervisor, type TaskWriteResult, type TokenPricing, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, type UsageBucket, type UsageComputeInput, type UsageDetail, type UsageReadContext, type UsageReadResult, type UsageRollup, type UsageSnapshotRecord, type UsageSource, UserPreset, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeSessionObservers, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadQuotaStore, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, setDefaultPreset, setMcpCredentialDeps, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };