@agentproto/runtime 5.13.0 → 5.15.0

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode,
 export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-CoLz8Pkh.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as PendingPromptView, x as StatsSessionDescriptor, y as ProcRow, z as ProvisionInFlight, B as ProvisionTracker, D as SessionCrashReason, E as UsageRollup, F as RemainingQuotaReader, Q as QuotaReadableProfile, G as UsageSnapshotRecord, H as SessionAwaitingQuestion, I as PolicyRunState, J as PtyFactory, K as WorktreeAutoReclaimer } from './sessions-DtkidPeI.js';
-export { L as ActivityKind, N as ActivitySource, O as ActivityState, V as ActivityWaitingOn, X as AnthropicReaderConfig, Y as AnthropicRemainingQuotaReader, Z as AttachPolicyInput, _ as CommandGroupStats, $ as CommitSpec, a0 as DEFAULT_WORKTREE_ISOLATION, a1 as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a2 as EagerResumeFailReason, a3 as EagerResumeOutcome, a4 as EagerResumeSkipReason, a5 as GateSpec, a6 as HostInfo, a7 as JudgeGateSpec, a8 as LabeledProcessStatsReport, a9 as LabeledSessionStats, aa as MAX_MESSAGE_DATA_BYTES, ab as MESSAGE_KINDS, ac as MESSAGE_PREAMBLE, ad as MESSAGE_TAG, ae as MESSAGE_URGENCIES, af as MessageDeliveryVia, ag as MessageFilter, ah as MessageRelation, ai as MessageTreeNode, aj as NO_OUTPUT_STALL_TURN_ERROR, ak as OnFailSpec, al as OrphanGroup, am as PendingPermission, an as PermissionRespondInput, ao as PermissionRespondResult, ap as PolicyRunStatus, aq as PricingResolver, ar as ProcessDetail, as as ProcessStatsReport, at as ProcessStatsService, au as QuotaStoreFile, av as QuotaStoreOptions, aw as RegisterBrowserInput, ax as RegisterSessionInput, ay as RemainingQuota, az as ResourceStats, aA as ResumeDisabledError, aB as SESSION_END_REASONS, aC as SESSION_ID_ENV, aD as SessionCurrentPhase, aE as SessionKind, aF as SessionMessageFrom, aG as SessionOutcome, aH as SessionOutcomeArtifact, aI as SessionOutcomeCompact, aJ as SessionOutcomeLink, aK as SessionResourceStats, aL as SessionRetiredError, aM as SessionSnapshots, aN as SessionStatus, aO as ShellGateSpec, aP as SpawnAgentInput, aQ as SpawnSessionInput, aR as StatsDetail, aS as StoredProfileQuota, aT as TASK_STATUSES, aU as TaskCaller, aV as TaskChangedEvent, aW as TaskClaimInput, aX as TaskCreateInput, aY as TaskGateOutcome, aZ as TaskGateRunner, a_ as TaskLedgerRegistry, a$ as TaskLedgerSessionSlice, b0 as TaskListFilter, b1 as TaskRecord, b2 as TaskStatus, b3 as TaskUpdateInput, b4 as TaskVerification, b5 as TaskVerifySupervisor, b6 as TaskWriteResult, b7 as TokenPricing, b8 as UsageBucket, b9 as UsageComputeInput, ba as UsageDetail, bb as UsageSource, bc as UserPresetsFile, bd as WORKSPACE_SLUG_ENV, be as WORKTREE_ISOLATION_ENV, bf as WORKTREE_PROVISION_CONCURRENCY_ENV, bg as WorktreeDecision, bh as WorktreeProvisionOutcome, bi as WorktreeProvisionPhase, bj as WorktreeProvisionProgress, bk as WorktreeProvisionRequest, bl as WorktreeRequest, bm as activityCounts, bn as compactOutcome, bo as createProcessStatsService, bp as createSessionMessage, bq as createSupervisorTaskGateRunner, br as createTaskLedger, bs as decideWorktreeIsolation, bt as deleteUserPreset, bu as deriveSessionOutcome, bv as deriveSessionUsage, bw as escapeHumanPrompt, bx as escapeMessageBody, by as filterActivities, bz as getProcessStatsService, bA as getUserPreset, bB as isClosedTaskStatus, bC as isKnownSessionEndReason, bD as isMessageAllowed, bE as isProviderLimitError, bF as isTerminalActivityState, bG as listUserPresets, bH as loadQuotaStore, bI as loadUserPresets, bJ as loadWorktreeIsolation, bK as matchesMessageFilter, bL as messageFrom, bM as mintMessageId, bN as normalizeCommand, bO as normalizeWorktreeField, bP as parseAnthropicRateLimitHeaders, bQ as parseTaskStatus, bR as parseWindow, bS as parseWorktreeIsolationMode, bT as pickUsageDetail, bU as policyToActivities, bV as policyWatchesSession, bW as prToActivities, bX as projectSessionUsage, bY as readProfileQuota, bZ as recordProfileQuota, b_ as renderInboxDigest, b$ as renderSessionMessage, c0 as renderSessionMessages, c1 as resolveRelation, c2 as rollupUsage, c3 as sanitizeLabel, c4 as saveUserPreset, c5 as trackWorktreeProvision, c6 as turnToActivities, c7 as userPresetsPath, c8 as workflowToActivities } from './sessions-DtkidPeI.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as PendingPromptView, x as StatsSessionDescriptor, y as ProcRow, z as ProvisionInFlight, B as ProvisionTracker, D as SessionCrashReason, E as UsageRollup, F as RemainingQuotaReader, Q as QuotaReadableProfile, G as UsageSnapshotRecord, H as SessionAwaitingQuestion, I as PolicyRunState, J as PtyFactory, K as WorktreeAutoReclaimer } from './sessions-Dq4mAphj.js';
+export { L as ActivityKind, N as ActivitySource, O as ActivityState, V as ActivityWaitingOn, X as AnthropicReaderConfig, Y as AnthropicRemainingQuotaReader, Z as AttachPolicyInput, _ as CommandGroupStats, $ as CommitSpec, a0 as DEFAULT_WORKTREE_ISOLATION, a1 as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a2 as EagerResumeFailReason, a3 as EagerResumeOutcome, a4 as EagerResumeSkipReason, a5 as GateSpec, a6 as HostInfo, a7 as JudgeGateSpec, a8 as LabeledProcessStatsReport, a9 as LabeledSessionStats, aa as MAX_MESSAGE_DATA_BYTES, ab as MESSAGE_KINDS, ac as MESSAGE_PREAMBLE, ad as MESSAGE_TAG, ae as MESSAGE_URGENCIES, af as MessageDeliveryVia, ag as MessageFilter, ah as MessageRelation, ai as MessageTreeNode, aj as NO_OUTPUT_STALL_TURN_ERROR, ak as OnFailSpec, al as OrphanGroup, am as PendingPermission, an as PermissionRespondInput, ao as PermissionRespondResult, ap as PolicyRunStatus, aq as PricingResolver, ar as ProcessDetail, as as ProcessStatsReport, at as ProcessStatsService, au as QuotaStoreFile, av as QuotaStoreOptions, aw as RegisterBrowserInput, ax as RegisterSessionInput, ay as RemainingQuota, az as ResourceStats, aA as ResumeDisabledError, aB as SESSION_END_REASONS, aC as SESSION_ID_ENV, aD as SessionCurrentPhase, aE as SessionKind, aF as SessionMessageFrom, aG as SessionOutcome, aH as SessionOutcomeArtifact, aI as SessionOutcomeCompact, aJ as SessionOutcomeLink, aK as SessionResourceStats, aL as SessionRetiredError, aM as SessionSnapshots, aN as SessionStatus, aO as ShellGateSpec, aP as SpawnAgentInput, aQ as SpawnSessionInput, aR as StatsDetail, aS as StoredProfileQuota, aT as TASK_STATUSES, aU as TaskCaller, aV as TaskChangedEvent, aW as TaskClaimInput, aX as TaskCreateInput, aY as TaskGateOutcome, aZ as TaskGateRunner, a_ as TaskLedgerRegistry, a$ as TaskLedgerSessionSlice, b0 as TaskListFilter, b1 as TaskRecord, b2 as TaskStatus, b3 as TaskUpdateInput, b4 as TaskVerification, b5 as TaskVerifySupervisor, b6 as TaskWriteResult, b7 as TokenPricing, b8 as UsageBucket, b9 as UsageComputeInput, ba as UsageDetail, bb as UsageSource, bc as UserPresetsFile, bd as WORKSPACE_SLUG_ENV, be as WORKTREE_ISOLATION_ENV, bf as WORKTREE_PROVISION_CONCURRENCY_ENV, bg as WorktreeDecision, bh as WorktreeProvisionOutcome, bi as WorktreeProvisionPhase, bj as WorktreeProvisionProgress, bk as WorktreeProvisionRequest, bl as WorktreeRequest, bm as activityCounts, bn as compactOutcome, bo as createProcessStatsService, bp as createSessionMessage, bq as createSupervisorTaskGateRunner, br as createTaskLedger, bs as decideWorktreeIsolation, bt as deleteUserPreset, bu as deriveSessionOutcome, bv as deriveSessionUsage, bw as escapeHumanPrompt, bx as escapeMessageBody, by as filterActivities, bz as getProcessStatsService, bA as getUserPreset, bB as isClosedTaskStatus, bC as isKnownSessionEndReason, bD as isMessageAllowed, bE as isProviderLimitError, bF as isTerminalActivityState, bG as listUserPresets, bH as loadQuotaStore, bI as loadUserPresets, bJ as loadWorktreeIsolation, bK as matchesMessageFilter, bL as messageFrom, bM as mintMessageId, bN as normalizeCommand, bO as normalizeWorktreeField, bP as parseAnthropicRateLimitHeaders, bQ as parseTaskStatus, bR as parseWindow, bS as parseWorktreeIsolationMode, bT as pickUsageDetail, bU as policyToActivities, bV as policyWatchesSession, bW as prToActivities, bX as projectSessionUsage, bY as readProfileQuota, bZ as recordProfileQuota, b_ as renderInboxDigest, b$ as renderSessionMessage, c0 as renderSessionMessages, c1 as resolveRelation, c2 as rollupUsage, c3 as sanitizeLabel, c4 as saveUserPreset, c5 as trackWorktreeProvision, c6 as turnToActivities, c7 as userPresetsPath, c8 as workflowToActivities } from './sessions-Dq4mAphj.js';
 import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-B3PRyxlI.js';
 export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-B3PRyxlI.js';
 import { AcpMcpServer } from '@agentproto/acp';
@@ -532,6 +532,44 @@ type DeliveryPreference = {
     callbackUrl?: string;
     secret?: string;
 };
+/** One polled item the provider could not turn into a {@link SentinelEvent}
+ *  (poison envelope). Reported — never silently skipped — so the runtime can
+ *  quarantine it durably BEFORE the cursor moves past it. Deliberately carries
+ *  no payload `data`: identifiers, the parse error, and a digest only, so the
+ *  quarantine record can be inspected without exposing secrets. */
+interface SentinelMalformedItem {
+    /** Provider sequence number, when the item had one. */
+    seq?: number;
+    /** The provider's own delivery id (agentpush `delivery_id`). */
+    remoteDeliveryId?: string;
+    error: string;
+    /** Best-effort string identifiers lifted from the envelope. */
+    excerpt?: {
+        id?: string;
+        type?: string;
+        subject?: string;
+        source?: string;
+    };
+    /** sha256 hex of the item's JSON, for correlating with the remote copy. */
+    digest?: string;
+    bytes?: number;
+}
+/** Result of one provider poll. */
+interface SentinelPollResult {
+    events: SentinelEvent[];
+    cursor: string;
+    /** Items that could not be parsed. The runtime quarantines each before it
+     *  acknowledges `cursor`. */
+    malformed?: SentinelMalformedItem[];
+}
+/** `renew` found the backing remote subscription already expired or deleted.
+ *  The caller must unsubscribe and recreate; a provider never silently
+ *  provisions a replacement. */
+declare class SentinelBackingExpiredError extends Error {
+    readonly code: "backing_subscription_expired";
+    readonly remoteId?: string;
+    constructor(message: string, remoteId?: string);
+}
 /** Extra context the runtime/tools hand to `create` beyond the spec. */
 interface SentinelCreateContext {
     /** The id the store will record this sentinel under (`sen_<ulid>`), minted
@@ -563,6 +601,19 @@ interface SentinelProviderHandle extends AdapterHandle {
      *  cursor). */
     attach(handle: SentinelHandle, delivery: DeliveryPreference): Promise<SentinelHandle>;
     cancel(handle: SentinelHandle): Promise<void>;
+    /** True when every handle owns a DISTINCT remote resource (agentpush: one
+     *  subscription per sentinel), so a failed `cancel` is worth persisting and
+     *  retrying as a cancel tombstone keyed by `provider + remoteId`. Providers
+     *  that share one remote across handles (the webhook provider's per-repo
+     *  hook, refcounted by holder) leave this unset and keep the best-effort
+     *  cancel. */
+    exclusiveRemote?: boolean;
+    /** Extend the backing remote watch to `until` (MCP Events refresh). Throws
+     *  {@link SentinelBackingExpiredError} when the remote is already expired or
+     *  deleted; any other throw is a transient failure. Absent = the provider
+     *  holds no remote lifetime to extend (local-only watches). Returns the
+     *  (possibly updated) handle. */
+    renew?(handle: SentinelHandle, until: SentinelUntil): Promise<SentinelHandle>;
     status(handle: SentinelHandle): Promise<{
         ok: boolean;
         detail?: string;
@@ -570,10 +621,7 @@ interface SentinelProviderHandle extends AdapterHandle {
     }>;
     /** Poll mode: events after `handle.cursor`, oldest first, plus the new
      *  cursor. */
-    poll?(handle: SentinelHandle, limit: number): Promise<{
-        events: SentinelEvent[];
-        cursor: string;
-    }>;
+    poll?(handle: SentinelHandle, limit: number): Promise<SentinelPollResult>;
     ack?(handle: SentinelHandle, cursor: string): Promise<void>;
     /** Push mode: verify + parse one inbound HTTP request into events (called
      *  by the `"sentinel"` dialect on `POST /inbound/sentinel-<hookKey>`). */
@@ -832,6 +880,304 @@ interface SessionFollowStoreOptions {
 }
 declare function createSessionFollowStore(opts?: SessionFollowStoreOptions): SessionFollowStore;
 
+/**
+ * Persisted cancel tombstones — the remote-deletion half of unwatching.
+ *
+ * Removing a local sentinel while the backing remote subscription is
+ * unreachable used to orphan the remote (a best-effort `provider.cancel` whose
+ * failure was swallowed). Now the intent to delete is recorded durably FIRST,
+ * keyed by `provider + remoteId` — the identity of the remote resource, NOT the
+ * (deterministic) MCP subscription id, so an immediate re-subscribe, which
+ * provisions a new remote with a new id, is never touched by the old tombstone.
+ * A sweep retries (with backoff) until the provider reports the remote gone
+ * (`cancel` is idempotent: 404/204 both resolve).
+ *
+ * Only identifiers are persisted; any state field that looks like a secret or
+ * route key is stripped from the stored handle.
+ */
+
+interface CancelTombstone {
+    /** `provider|remoteId`. */
+    key: string;
+    provider: string;
+    remoteId: string;
+    /** The handle with secrets stripped — enough for `provider.cancel`. */
+    handle: SentinelHandle;
+    createdAt: number;
+    attempts: number;
+    nextAttemptAt: number;
+    lastAttemptAt?: number;
+    lastError?: string;
+}
+interface CancelResult {
+    /** The provider confirmed the remote is gone (deleted or already absent). */
+    converged: boolean;
+    tombstone?: CancelTombstone;
+}
+interface CancelTombstoneStore {
+    /** Record the deletion intent durably, run `afterRecorded` (the caller drops
+     *  its local record there, so delivery eligibility ends BEFORE any network
+     *  call), attempt the remote delete, and remove the tombstone once the
+     *  provider confirms. Rejects only when the intent could not be made
+     *  durable — nothing local has been dropped yet at that point. */
+    cancel(handle: SentinelHandle, afterRecorded?: () => void): Promise<CancelResult>;
+    /** Retry every tombstone whose backoff elapsed. */
+    sweep(): Promise<{
+        attempted: number;
+        converged: number;
+        remaining: number;
+    }>;
+    list(): CancelTombstone[];
+    has(provider: string, remoteId: string): boolean;
+}
+
+/**
+ * Signed event delivery with bounded retry (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
+ *
+ * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
+ * then the exact bytes are signed per attempt with a FRESH timestamp. An
+ * observer sees a different `webhook-signature` header per attempt while the
+ * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
+ * never re-serializes.
+ *
+ * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
+ * replaced with `{summary, subject}` and the envelope gains `truncated: true`
+ * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
+ * every attempt signs.
+ *
+ * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
+ * network errors retry; 410/413 are terminal with NO further attempt;
+ * 2xx = delivered. The returned `DeliveryState` is what the caller persists
+ * into the store for post-restart resume (W-B's job to wire).
+ */
+type McpEventEnvelope = {
+    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
+     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
+     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
+     *  control notification only — never sent by us (no control events). */
+    eventId: string;
+    name: string;
+    timestamp: string;
+    data: Record<string, unknown>;
+    cursor: string | null;
+    truncated?: boolean;
+};
+interface DeliveryState {
+    attempts: number;
+    lastError?: string;
+    lastAt?: string;
+}
+interface DeliveryReplay {
+    subId: string;
+    callbackUrl: string;
+    secrets: readonly string[];
+}
+/** One event → one POST. Frozen §3 outcome. */
+type DeliveryOutcome = {
+    ok: true;
+    delivery: DeliveryState;
+} | {
+    ok: false;
+    reason: string;
+    delivery: DeliveryState;
+};
+interface SsrfFetchArgs$1 {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface DeliverEventDeps {
+    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<{
+        status: number;
+        body: string;
+    }>;
+    /** Backoff sleep (tests only). Default: real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock (tests only). Default: real wall clock. */
+    now?: () => number;
+    /** Observability hook: one call per attempt outcome. Carries NO url, body or
+     *  secret — only the attempt number, HTTP status / redacted error reason,
+     *  and whether the attempt ended the delivery (`delivered`/`dead`) or will
+     *  be retried. A throwing hook never affects delivery. */
+    onAttempt?: (info: DeliveryAttemptInfo) => void;
+}
+interface DeliveryAttemptInfo {
+    attempt: number;
+    /** HTTP status when the receiver answered. */
+    status?: number;
+    /** Redacted failure reason (no URL) when there is no usable status. */
+    error?: string;
+    outcome: "delivered" | "retry" | "dead";
+}
+declare const CLAMP_LIMIT_BYTES = 262144;
+declare const MAX_ATTEMPTS = 5;
+/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
+declare function deliveryBackoffDelay(attempt: number): number;
+declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
+/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
+declare function envelopeClampedBytes(event: McpEventEnvelope): {
+    bytes: Uint8Array;
+    clamped: boolean;
+};
+declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
+
+/**
+ * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
+ * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
+ *
+ * Why an outbox: the runtime's `processEvents` marks an event `seen` the
+ * moment in-process handling resolves, but a webhook POST is an EXTERNAL
+ * delivery — a crash between ack and delivery loses the event forever (I4).
+ * So the webhook fire path appends a DURABLE row first:
+ *
+ *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
+ *     deliveryState, status: pending|delivered|dead}`
+ *
+ * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
+ * the envelope is serialized once here via `serializeEnvelope`; the dispatch
+ * re-signs those same bytes, and `deliverEventEnvelope`'s internal
+ * serialization is deterministic over the stored envelope — asserted by
+ * tests). The underlying sentinel event is marked seen/acked ONLY when the
+ * row reaches terminal status (`delivered`, or `dead` per the retry cap /
+ * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
+ * the event UN-acked, and a restart re-dispatches it by exact bytes.
+ *
+ * Ordering across events of one subscription is never assumed (I5). Rows
+ * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
+ * risk table); the file is capped. Feedback-loop guard is data, not policy:
+ * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
+ * loopback/private delivery targets, so nothing here can ring back into our
+ * own inbound routes — self-delivery cannot even connect.
+ */
+
+type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
+interface SentinelWebhookOutboxRow {
+    sentinelId: string;
+    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
+     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
+     *  header stays the EVENT id). */
+    requestId: string;
+    eventId: string;
+    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
+     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
+    bodyBytes: string;
+    /** v1 events are non-replayable (plan §2) — always null. */
+    cursor: null;
+    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
+    deliveryState: {
+        attempts: number;
+        lastError?: string;
+        lastAt?: string;
+    };
+    status: SentinelWebhookOutboxStatus;
+    /** The bounded-retry loop's final `ok:false` reason. */
+    failReason?: string;
+    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
+     *  `sentinel_removed`, `age_out`). */
+    deadReason?: string;
+    createdAt: number;
+    /** Wall-clock ms the row reached terminal status (drives reaping). */
+    terminalAt?: number;
+}
+/** The full row is JSON-persisted; the envelope rides along so a resumed
+ *  dispatch re-delivers byte-identically without re-deriving the projection,
+ *  and the original event rides along for ack-time lifetime bookkeeping
+ *  (terminal flag / subject tracking). */
+type PersistedOutboxRow = SentinelWebhookOutboxRow & {
+    envelope?: McpEventEnvelope;
+    event?: SentinelEvent;
+};
+/** Per-sentinel delivery health, derived from the outbox rows. Carries no
+ *  URL, body or secret — `lastError` is URL-redacted. */
+interface SentinelDeliveryStatus {
+    /** At least one row is still `pending` (being delivered / retried). */
+    active: boolean;
+    /** ISO time of the most recent delivery attempt, when any ran. */
+    lastDeliveryAt?: string;
+    /** Status of the most recent row. */
+    lastStatus: SentinelWebhookOutboxStatus;
+    lastError?: string;
+    /** Attempts spent on the most recent row. */
+    attempts: number;
+    /** Count of `dead` rows still held by the outbox. */
+    dead: number;
+}
+interface SentinelWebhookOutbox {
+    /** Delivery health for one sentinel, or `undefined` when the outbox holds no
+     *  row for it (never delivered anything / reaped). */
+    deliveryStatus(sentinelId: string): SentinelDeliveryStatus | undefined;
+    /** Append a row for a matched webhook-delivery event. Resolves ONLY after
+     *  the row is crash-durable (atomic write + fsync + rename + dir fsync) —
+     *  callers ack the upstream (Agentpush cursor, push HTTP 2xx) on resolve.
+     *  A persistence failure rejects and rolls the row back, so the caller
+     *  leaves the upstream un-acked. Idempotent per `(sentinelId, eventId)`: an
+     *  existing row (pending OR terminal) is never duplicated — returns
+     *  `undefined` (after waiting for any in-flight write that carries it), and
+     *  for a terminal existing row re-fires `onTerminal` so a lost ack (crash
+     *  between the terminal transition and the store write) still lands. Kicks
+     *  dispatch off asynchronously once durable. */
+    enqueue(input: {
+        sentinelId: string;
+        event: SentinelEvent;
+    }): Promise<SentinelWebhookOutboxRow | undefined>;
+    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
+     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
+     *  expired or unwound sentinel never delivers another byte. */
+    dispatch(): Promise<void>;
+    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
+     *  bytes (no payload re-serialization on the resume path). */
+    resumeDeliveries(): Promise<void>;
+    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
+     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
+    sweep(): void;
+    rows(): PersistedOutboxRow[];
+    /** Synchronous flush for shutdown paths. */
+    flushSync(): void;
+}
+interface SentinelWebhookOutboxOptions {
+    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
+    filePath?: string;
+    /** Injectable clock. */
+    nowMs?: () => number;
+    /** Debounce interval for the non-critical (status-transition) disk writes.
+     *  Enqueue never debounces. Default 1500 ms. */
+    debounceMs?: number;
+    /** Disable disk persistence (unit tests). Default false unless filePath. */
+    persist?: boolean;
+    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
+     *  as the POST boundary. Throws = dispatch did not complete (row stays
+     *  pending, event stays un-acked). Default: the real deliverer. */
+    deliverEvent?: (input: {
+        replay: DeliveryReplay;
+        row: PersistedOutboxRow;
+    }) => Promise<DeliveryOutcome>;
+    /** Test seam for the DEFAULT deliverer only (fetch / sleep / clock). */
+    deliverDeps?: Pick<DeliverEventDeps, "fetch" | "sleep" | "now">;
+    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
+     *  null when the sentinel/secret sidecar is gone (row goes dead, never
+     *  silently lost). */
+    secretsFor: (sentinelId: string) => DeliveryReplay | null;
+    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
+     *  true = the sentinel is past its `until` and must not deliver. */
+    isExpired: (sentinelId: string) => boolean;
+    /** The ack — mark the underlying event seen, after terminal status only. */
+    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
+    log?: (line: string) => void;
+}
+/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
+declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
+/** The CloudEvents → MCP-Events-envelope fusion. W-C's `mcp-events/adapter.ts`
+ *  is now the canonical owner of this mapping (`toMcpEvent`); this alias keeps
+ *  the W-B call sites/tests working. The shape is the frozen §3 wire envelope —
+ *  insertion order stable, so its serialization is byte-stable across
+ *  restarts. `data` gains `subject`/`summary` so the 256 KiB clamp's
+ *  `{summary, subject}` replacement never goes blind. */
+declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
+declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
+
 /**
  * LlmEndpointRegistry — supervised-sidecar manager for the
  * `@agentproto/llm-endpoint` proxy gateway.
@@ -3354,18 +3700,44 @@ interface BranchGcOutcomeView {
     to?: BranchGcClass;
     message?: string;
 }
-type BranchGcResult = {
-    mode: "plan";
-    plan: BranchGcPlanView;
-    summary: BranchGcSummaryView;
-} | {
+/** Per-scope tally of apply outcomes. `skipped` = everything that was not
+ *  deleted and did not fail (held, skipped-review, aborted-*); the exact
+ *  per-result counts stay in `byResult`. */
+interface BranchGcApplyScopeCounts {
+    deleted: number;
+    skipped: number;
+    failed: number;
+}
+interface BranchGcApplySummary {
+    /** `ok` = deletes only, no failures/aborts; `partial` = some deleted but
+     *  also failed or aborted; `failed` = failures and nothing deleted;
+     *  `noop` = nothing deleted, nothing failed. */
+    status: "ok" | "partial" | "failed" | "noop";
+    totals: BranchGcApplyScopeCounts;
+    byScope: Record<BranchGcKind, BranchGcApplyScopeCounts>;
+    byResult: Partial<Record<BranchGcOutcomeView["result"], number>>;
+    restoreLog: string | null;
+}
+type BranchGcApplyResult = {
     mode: "apply";
     plan: BranchGcPlanView;
     summary: BranchGcSummaryView;
     outcomes: BranchGcOutcomeView[];
     /** Restore log written before the first delete; `null` when nothing was deleted. */
     restoreLog: string | null;
+    /** Same value as `applySummary.status`, hoisted so a caller can branch on it. */
+    status?: BranchGcApplySummary["status"];
+    applySummary?: BranchGcApplySummary;
 };
+type BranchGcResult = {
+    mode: "plan";
+    plan: BranchGcPlanView;
+    summary: BranchGcSummaryView;
+} | BranchGcApplyResult;
+/** Pure: tally an apply result's outcomes per scope. */
+declare function summarizeBranchGcApply(result: BranchGcApplyResult): BranchGcApplySummary;
+/** Attach `status` + `applySummary` to an apply result; a plan passes through. */
+declare function withBranchGcApplySummary(result: BranchGcResult): BranchGcResult;
 /** Input to the injected runner. `apply` defaults to false at the tool/route
  *  boundary — a bare call is a dry run — and an apply requires `scopes`. */
 interface BranchGcRunInput {
@@ -6147,6 +6519,101 @@ interface SandboxReconcileResult {
  */
 declare function reconcileSandboxLedger(deps: SandboxReconcileDeps): Promise<SandboxReconcileResult>;
 
+/**
+ * Server-side narrowing for the session listers — the `session_list` MCP
+ * tool and `GET /sessions` (+ `agentproto sessions --json`) share this one
+ * module so the vocabulary and the semantics cannot drift between surfaces.
+ *
+ * Every filter is optional and AND-ed with the others. Vocabulary reuses
+ * `session_follow`'s selector/exclude names (`rootOnly`, labels,
+ * `parentSessionId`) rather than inventing a second one.
+ *
+ * Pure: no registry, no I/O, an injectable clock. The callers own subtree
+ * scoping, archived/kind/status handling and pagination.
+ */
+
+/** Raised for caller-fixable filter input (an unparsable time bound). */
+declare class SessionListFilterError extends Error {
+    constructor(message: string);
+}
+/** A string or a list of strings. HTTP callers send `a,b` or repeat the key. */
+type StringOrList = string | readonly string[];
+interface SessionListFilterInput {
+    /** Case-insensitive substring over id, name, label, title and cwd. */
+    q?: string;
+    /** Drop sessions whose `label` starts with any of these (case-sensitive). */
+    excludeLabelPrefix?: StringOrList;
+    /** Drop sessions whose `label` equals any of these (as `session_follow`'s `exclude.labels`). */
+    excludeLabels?: StringOrList;
+    /** Drop sessions of these kinds (`terminal` | `agent-cli` | `command`). */
+    excludeKinds?: StringOrList;
+    /** Only sessions with no parent (as `session_follow`'s `selector.rootOnly`). */
+    rootOnly?: boolean;
+    /** Only direct children of this session (the caller resolves a name to an id first). */
+    parentSessionId?: string;
+    /** Only sessions whose last activity (else start) is at/after this: ISO-8601 or relative (`30m`, `24h`, `7d`, `2w`). */
+    updatedSince?: string;
+    /** Only sessions started at/after this: ISO-8601 or relative. */
+    startedSince?: string;
+    /** Preset: drop review lanes, workflow stages and ended one-shot command runs (see {@link isNoiseSession}). */
+    excludeNoise?: boolean;
+}
+/** Names of every filter key, for surfaces that parse them from a query string. */
+declare const SESSION_LIST_FILTER_KEYS: readonly ["q", "excludeLabelPrefix", "excludeLabels", "excludeKinds", "rootOnly", "parentSessionId", "updatedSince", "startedSince", "excludeNoise"];
+/** Copy only the filter keys (a tool input carries many other params). */
+declare function pickSessionListFilters(input: SessionListFilterInput): SessionListFilterInput;
+/**
+ * Parse an ISO-8601 instant or a relative age (`90s`, `30m`, `24h`, `7d`,
+ * `2w` = "that long before `now`") into epoch ms. Throws
+ * {@link SessionListFilterError} on anything else.
+ */
+declare function parseTimeBound(raw: string, field: string, now?: number): number;
+type NoiseView = Pick<SessionDescriptor, "kind" | "status" | "label" | "origin" | "adapterSlug">;
+/**
+ * What `excludeNoise: true` drops — exactly these, nothing else:
+ *  1. review lanes: `label` starts with `review:` or `origin === "review"`;
+ *  2. workflow stage sessions: `label` starts with `wf:` or `origin === "workflow"`;
+ *  3. ended one-shot command runs: `status` is `exited` or `killed` and the
+ *     session is a plain command — `kind: "command"`, or `kind: "terminal"`
+ *     with no `adapterSlug` (an interactive agent TUI such as `claude` carries
+ *     one, so it is kept).
+ * A live session of kind 3 (a running dev server, a `bash` you are typing in)
+ * and every agent-cli session outside 1–2 are kept, as is anything `error`ed.
+ */
+declare function isNoiseSession(s: NoiseView): boolean;
+/** Epoch ms of a session's last activity, falling back to its start. */
+declare function sessionActivityMs(s: Pick<SessionDescriptor, "lastActivityAt" | "startedAt">): number;
+/** Newest activity first; ties broken by id so cursors stay stable. Returns a new array. */
+declare function sortNewestActivityFirst<T extends Pick<SessionDescriptor, "id" | "lastActivityAt" | "startedAt">>(rows: readonly T[]): T[];
+/** True when `input` carries at least one filter (an empty `q` / `false` flag does not count). */
+declare function hasSessionListFilters(input: SessionListFilterInput): boolean;
+type FilterableSession = Pick<SessionDescriptor, "id" | "kind" | "status" | "name" | "label" | "title" | "cwd" | "origin" | "adapterSlug" | "parentSessionId" | "lastActivityAt" | "startedAt">;
+/**
+ * Compile `input` into a row predicate. Validates (and resolves relative
+ * times against `now`) once, up front, so a bad `updatedSince` fails the
+ * whole call instead of silently matching nothing.
+ */
+declare function compileSessionListFilters(input: SessionListFilterInput, now?: number): (s: FilterableSession) => boolean;
+/** Filter `rows` (order preserved). Throws {@link SessionListFilterError} on a bad time bound. */
+declare function applySessionListFilters<T extends FilterableSession>(rows: readonly T[], input: SessionListFilterInput, now?: number): T[];
+/**
+ * Read the filters off an HTTP query string. Array-valued keys accept
+ * `a,b` or a repeated key; booleans accept `true`/`1` (anything else is off).
+ */
+declare function parseSessionListFilterParams(params: URLSearchParams): SessionListFilterInput;
+/** Zod fragment spread into `session_list`'s input schema. */
+declare const sessionListFilterShape: {
+    readonly q: z.ZodOptional<z.ZodString>;
+    readonly excludeLabelPrefix: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly excludeLabels: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly excludeKinds: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly rootOnly: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean, unknown>>;
+    readonly parentSessionId: z.ZodOptional<z.ZodString>;
+    readonly updatedSince: z.ZodOptional<z.ZodString>;
+    readonly startedSince: z.ZodOptional<z.ZodString>;
+    readonly excludeNoise: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean, unknown>>;
+};
+
 /**
  * Per-session structured event capture — one append-only JSONL file per
  * agent-cli session, written at the same tap point where `projectEvent`
@@ -7167,6 +7634,52 @@ interface SentinelView {
     eventCount: number;
     lastEventTs?: number;
     lastError?: string;
+    /** Webhook-target sentinels only, once the outbox holds a row for it. */
+    deliveryStatus?: SentinelDeliveryStatus;
+}
+
+/**
+ * Poison-item quarantine for polled sentinel batches.
+ *
+ * A provider that cannot turn a polled item into a `SentinelEvent` reports it
+ * as malformed. The runtime must not advance (and acknowledge) the cursor past
+ * it without a durable trace, or the item is lost the moment the remote drops
+ * acked rows — yet it also must not stall the subscription forever on an item
+ * that will never parse. So: record it here (fsynced append), THEN ack.
+ *
+ * Records carry identifiers, the parse error and a digest only — never the
+ * envelope `data` or any credential — so the file is safe to inspect and ship
+ * in a bug report. Recording is idempotent per
+ * (sentinel, provider, remote delivery id | seq, digest): a redelivered batch
+ * after a crash between "quarantined" and "acked" does not duplicate lines.
+ */
+
+interface SentinelQuarantineRecord {
+    /** Idempotency key. */
+    key: string;
+    quarantinedAt: string;
+    sentinelId: string;
+    provider: string;
+    remoteId?: string;
+    seq?: number;
+    remoteDeliveryId?: string;
+    error: string;
+    excerpt?: SentinelMalformedItem["excerpt"];
+    digest?: string;
+    bytes?: number;
+}
+interface SentinelQuarantine {
+    /** Durably record one poison item (idempotent). Throws when the write
+     *  fails — the caller must then NOT acknowledge the cursor. */
+    record(input: {
+        sentinelId: string;
+        provider: string;
+        remoteId?: string;
+        item: SentinelMalformedItem;
+    }): SentinelQuarantineRecord;
+    list(filter?: {
+        sentinelId?: string;
+    }): SentinelQuarantineRecord[];
 }
 
 /**
@@ -7343,11 +7856,11 @@ interface VerifyCallbackInput {
 }
 interface VerifyCallbackDeps {
     /** Replaces the POST boundary. Default: the shared `ssrfFetch` gate. */
-    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<SsrfFetchView>;
+    fetch?: (url: string, init: SsrfFetchArgs) => Promise<SsrfFetchView>;
     /** Clock for the bounded TTL. Default: real wall clock. */
     now?: () => number;
 }
-interface SsrfFetchArgs$1 {
+interface SsrfFetchArgs {
     method?: "POST";
     headers?: Record<string, string>;
     body?: Uint8Array;
@@ -7366,86 +7879,6 @@ declare function resetChallengeCacheForTests(): void;
 declare function normalizeCallbackUrl(url: string): string | null;
 declare function verifyCallback(input: VerifyCallbackInput, deps?: VerifyCallbackDeps): Promise<ChallengeOutcome>;
 
-/**
- * Signed event delivery with bounded retry (W-A of
- * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
- *
- * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
- * then the exact bytes are signed per attempt with a FRESH timestamp. An
- * observer sees a different `webhook-signature` header per attempt while the
- * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
- * never re-serializes.
- *
- * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
- * replaced with `{summary, subject}` and the envelope gains `truncated: true`
- * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
- * every attempt signs.
- *
- * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
- * network errors retry; 410/413 are terminal with NO further attempt;
- * 2xx = delivered. The returned `DeliveryState` is what the caller persists
- * into the store for post-restart resume (W-B's job to wire).
- */
-type McpEventEnvelope = {
-    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
-     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
-     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
-     *  control notification only — never sent by us (no control events). */
-    eventId: string;
-    name: string;
-    timestamp: string;
-    data: Record<string, unknown>;
-    cursor: string | null;
-    truncated?: boolean;
-};
-interface DeliveryState {
-    attempts: number;
-    lastError?: string;
-    lastAt?: string;
-}
-interface DeliveryReplay {
-    subId: string;
-    callbackUrl: string;
-    secrets: readonly string[];
-}
-/** One event → one POST. Frozen §3 outcome. */
-type DeliveryOutcome = {
-    ok: true;
-    delivery: DeliveryState;
-} | {
-    ok: false;
-    reason: string;
-    delivery: DeliveryState;
-};
-interface SsrfFetchArgs {
-    method?: "POST";
-    headers?: Record<string, string>;
-    body?: Uint8Array;
-    timeoutMs: number;
-}
-interface DeliverEventDeps {
-    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
-    fetch?: (url: string, init: SsrfFetchArgs) => Promise<{
-        status: number;
-        body: string;
-    }>;
-    /** Backoff sleep (tests only). Default: real `setTimeout`. */
-    sleep?: (ms: number) => Promise<void>;
-    /** Clock (tests only). Default: real wall clock. */
-    now?: () => number;
-}
-declare const CLAMP_LIMIT_BYTES = 262144;
-declare const MAX_ATTEMPTS = 5;
-/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
-declare function deliveryBackoffDelay(attempt: number): number;
-declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
-/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
-declare function envelopeClampedBytes(event: McpEventEnvelope): {
-    bytes: Uint8Array;
-    clamped: boolean;
-};
-declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
-
 /**
  * MCP Events registry (W-C of `.plans/sentinel-mcp-events/PLAN.md`, §2/§3).
  *
@@ -7558,8 +7991,8 @@ declare function findEventDefinition(name: string): EventRegistration | undefine
  * `runtime/index.ts`.
  *
  * INVARIANTS v1 (plan §2, code-verified):
- *   - every event is NON-REPLAYABLE → `cursor` is always `null`, `truncated`
- *     is never set;
+ *   - every event is NON-REPLAYABLE → `cursor` is always `null`; subscribe
+ *     results carry `truncated: false`, events never set `truncated`;
  *   - no `read` tool, no separate package, no batching.
  *
  * Subscription ids are deterministic (`subscription-id.ts`): subscribe upserts
@@ -7646,6 +8079,10 @@ interface EventsUnsubscribeContext {
     principal: Principal;
     store: SentinelStore;
     resolveProvider: (slug: string) => Promise<SentinelProviderHandle | null>;
+    /** Persisted remote-cancel store. Present ⇒ unsubscribe records a tombstone
+     *  keyed by provider + remote id, drops the local row (delivery eligibility
+     *  ends immediately) and lets the sweep converge an unreachable remote. */
+    tombstones?: CancelTombstoneStore;
 }
 declare function eventsList(r: EventsListRequest, ctx: EventsListContext): Promise<EventsListResult>;
 declare function eventsSubscribe(input: EventsSubscribeInput, ctx: EventsSubscribeContext): Promise<EventsSubscribeResult>;
@@ -7756,135 +8193,6 @@ declare function decodeWhsecSecret(secret: string): Buffer | null;
  */
 declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
 
-/**
- * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
- * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
- *
- * Why an outbox: the runtime's `processEvents` marks an event `seen` the
- * moment in-process handling resolves, but a webhook POST is an EXTERNAL
- * delivery — a crash between ack and delivery loses the event forever (I4).
- * So the webhook fire path appends a DURABLE row first:
- *
- *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
- *     deliveryState, status: pending|delivered|dead}`
- *
- * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
- * the envelope is serialized once here via `serializeEnvelope`; the dispatch
- * re-signs those same bytes, and `deliverEventEnvelope`'s internal
- * serialization is deterministic over the stored envelope — asserted by
- * tests). The underlying sentinel event is marked seen/acked ONLY when the
- * row reaches terminal status (`delivered`, or `dead` per the retry cap /
- * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
- * the event UN-acked, and a restart re-dispatches it by exact bytes.
- *
- * Ordering across events of one subscription is never assumed (I5). Rows
- * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
- * risk table); the file is capped. Feedback-loop guard is data, not policy:
- * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
- * loopback/private delivery targets, so nothing here can ring back into our
- * own inbound routes — self-delivery cannot even connect.
- */
-
-type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
-interface SentinelWebhookOutboxRow {
-    sentinelId: string;
-    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
-     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
-     *  header stays the EVENT id). */
-    requestId: string;
-    eventId: string;
-    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
-     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
-    bodyBytes: string;
-    /** v1 events are non-replayable (plan §2) — always null. */
-    cursor: null;
-    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
-    deliveryState: {
-        attempts: number;
-        lastError?: string;
-        lastAt?: string;
-    };
-    status: SentinelWebhookOutboxStatus;
-    /** The bounded-retry loop's final `ok:false` reason. */
-    failReason?: string;
-    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
-     *  `sentinel_removed`, `age_out`). */
-    deadReason?: string;
-    createdAt: number;
-    /** Wall-clock ms the row reached terminal status (drives reaping). */
-    terminalAt?: number;
-}
-/** The full row is JSON-persisted; the envelope rides along so a resumed
- *  dispatch re-delivers byte-identically without re-deriving the projection,
- *  and the original event rides along for ack-time lifetime bookkeeping
- *  (terminal flag / subject tracking). */
-type PersistedOutboxRow = SentinelWebhookOutboxRow & {
-    envelope?: McpEventEnvelope;
-    event?: SentinelEvent;
-};
-interface SentinelWebhookOutbox {
-    /** Append a row for a matched webhook-delivery event. Idempotent per
-     *  `(sentinelId, eventId)`: an existing row (pending OR terminal) is never
-     *  duplicated — returns `undefined`, and for a terminal existing row
-     *  re-fires `onTerminal` so a lost ack (crash between the terminal
-     *  transition and the store write) still lands. Kicks dispatch off
-     *  asynchronously. */
-    enqueue(input: {
-        sentinelId: string;
-        event: SentinelEvent;
-    }): Promise<SentinelWebhookOutboxRow | undefined>;
-    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
-     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
-     *  expired or unwound sentinel never delivers another byte. */
-    dispatch(): Promise<void>;
-    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
-     *  bytes (no payload re-serialization on the resume path). */
-    resumeDeliveries(): Promise<void>;
-    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
-     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
-    sweep(): void;
-    rows(): PersistedOutboxRow[];
-    /** Synchronous flush for shutdown paths. */
-    flushSync(): void;
-}
-interface SentinelWebhookOutboxOptions {
-    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
-    filePath?: string;
-    /** Injectable clock. */
-    nowMs?: () => number;
-    /** Debounce interval for disk persistence. Default 1500 ms. */
-    debounceMs?: number;
-    /** Disable disk persistence (unit tests). Default false unless filePath. */
-    persist?: boolean;
-    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
-     *  as the POST boundary. Throws = dispatch did not complete (row stays
-     *  pending, event stays un-acked). Default: the real deliverer. */
-    deliverEvent?: (input: {
-        replay: DeliveryReplay;
-        row: PersistedOutboxRow;
-    }) => Promise<DeliveryOutcome>;
-    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
-     *  null when the sentinel/secret sidecar is gone (row goes dead, never
-     *  silently lost). */
-    secretsFor: (sentinelId: string) => DeliveryReplay | null;
-    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
-     *  true = the sentinel is past its `until` and must not deliver. */
-    isExpired: (sentinelId: string) => boolean;
-    /** The ack — mark the underlying event seen, after terminal status only. */
-    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
-    log?: (line: string) => void;
-}
-/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
-declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
-/** The CloudEvents → MCP-Events-envelope fusion. W-C's `mcp-events/adapter.ts`
- *  is now the canonical owner of this mapping (`toMcpEvent`); this alias keeps
- *  the W-B call sites/tests working. The shape is the frozen §3 wire envelope —
- *  insertion order stable, so its serialization is byte-stable across
- *  restarts. `data` gains `subject`/`summary` so the 256 KiB clamp's
- *  `{summary, subject}` replacement never goes blind. */
-declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
-declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
-
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -9696,4 +10004,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type ArgumentsResult, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_TTL_MS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, EVENT_REGISTRY, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type EventDefinition, type EventRegistration, type EventsListContext, type EventsListRequest, type EventsListResult, type EventsSubscribeContext, type EventsSubscribeInput, type EventsSubscribeResult, type EventsUnsubscribeContext, type EventsUnsubscribeInput, FOLLOW_EVENTS, type FetchHostTurnsResult, type FindComposeCandidateInput, type FollowEvent, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, GITHUB_SCHEME, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, INDEX_DEFAULT_LIMIT, INDEX_MAX_OUTPUT, INDEX_MAX_PROMPT, INDEX_TAIL_BYTES, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type InternalEventMeta, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_TTL_MS, MCP_APP_BRIDGE_SCRIPT, MIN_TTL_MS, type McpCredentialDeps, type McpEventEnvelope, McpEventsError, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type Principal, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type SchemeRegistry, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, type SessionFollow, type SessionFollowHandle, type SessionFollowStore, type SessionIndexEntry, SessionMessage, type SessionMessageSentRecord, type SessionObserver, type SessionRecap, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubscriptionIdentity, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TranscriptPrompt, type TranscriptTail, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, backfillSessionIndexes, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, buildSessionRecap, canonicalForModeId, canonicalizeJcs, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, computeRefreshBefore, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createSessionFollowStore, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonBearerPrincipal, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defaultTranscriptBaseDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, deriveIndexFromTranscript, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, eventsList, eventsSubscribe, eventsUnsubscribe, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findEventDefinition, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, indexEntryFromDescriptor, injectMcpAppBridge, isAgentCliAuthConfigured, isAutomatedPromptSource, isNoSessionPromptFailure, isPubliclyRoutable, isRetired, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeRestartForRouting, makeSandboxCredsStore, makeSandboxResolver, matchesSessionQuery, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readAllSessionIndexes, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readSessionIndex, readTranscriptTail, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, resolveSuccessor, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, searchSessionIndexes, seedWalkForTranscript, serializeEnvelope, sessionEventsPath, sessionIndexPath, sessionPrincipal, sessionTranscriptDir, setDefaultPreset, setDefaultSessionsBaseDir, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, subscriptionId, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, tenantScope, toMcpEvent, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, untilForTtl, updateHarnessPreset, upsertSandboxLedger, validateAgainstInputSchema, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, wireSessionFollow, withPr, withPrStatus, writeDaemonRegistryEntry, writeSessionIndex };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type ArgumentsResult, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcApplyScopeCounts, type BranchGcApplySummary, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, type CancelTombstone, type CancelTombstoneStore, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_TTL_MS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, EVENT_REGISTRY, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type EventDefinition, type EventRegistration, type EventsListContext, type EventsListRequest, type EventsListResult, type EventsSubscribeContext, type EventsSubscribeInput, type EventsSubscribeResult, type EventsUnsubscribeContext, type EventsUnsubscribeInput, FOLLOW_EVENTS, type FetchHostTurnsResult, type FindComposeCandidateInput, type FollowEvent, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, GITHUB_SCHEME, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, INDEX_DEFAULT_LIMIT, INDEX_MAX_OUTPUT, INDEX_MAX_PROMPT, INDEX_TAIL_BYTES, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type InternalEventMeta, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_TTL_MS, MCP_APP_BRIDGE_SCRIPT, MIN_TTL_MS, type McpCredentialDeps, type McpEventEnvelope, McpEventsError, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type Principal, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_LIST_FILTER_KEYS, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type SchemeRegistry, type ScopeTokenRegistry, SentinelBackingExpiredError, type SentinelMalformedItem, type SentinelMatchClause, type SentinelPollResult, type SentinelQuarantine, type SentinelQuarantineRecord, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, type SessionFollow, type SessionFollowHandle, type SessionFollowStore, type SessionIndexEntry, SessionListFilterError, type SessionListFilterInput, SessionMessage, type SessionMessageSentRecord, type SessionObserver, type SessionRecap, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubscriptionIdentity, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TranscriptPrompt, type TranscriptTail, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, applySessionListFilters, attachSandbox, backfillSessionIndexes, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, buildSessionRecap, canonicalForModeId, canonicalizeJcs, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, compileSessionListFilters, composeSessionObservers, composedFromRangeSha, computeHostWarnings, computeRefreshBefore, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createSessionFollowStore, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonBearerPrincipal, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defaultTranscriptBaseDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, deriveIndexFromTranscript, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, eventsList, eventsSubscribe, eventsUnsubscribe, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findEventDefinition, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hasSessionListFilters, hostPlaceholders, hostRecordToMirrorRecord, indexEntryFromDescriptor, injectMcpAppBridge, isAgentCliAuthConfigured, isAutomatedPromptSource, isNoSessionPromptFailure, isNoiseSession, isPubliclyRoutable, isRetired, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeRestartForRouting, makeSandboxCredsStore, makeSandboxResolver, matchesSessionQuery, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, parseSessionListFilterParams, parseTimeBound, pickSessionListFilters, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readAllSessionIndexes, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readSessionIndex, readTranscriptTail, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, resolveSuccessor, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, searchSessionIndexes, seedWalkForTranscript, serializeEnvelope, sessionActivityMs, sessionEventsPath, sessionIndexPath, sessionListFilterShape, sessionPrincipal, sessionTranscriptDir, setDefaultPreset, setDefaultSessionsBaseDir, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, sortNewestActivityFirst, ssrfFetch, subscriptionId, summarizeBranchGcApply, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, tenantScope, toMcpEvent, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, untilForTtl, updateHarnessPreset, upsertSandboxLedger, validateAgainstInputSchema, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, wireSessionFollow, withBranchGcApplySummary, withPr, withPrStatus, writeDaemonRegistryEntry, writeSessionIndex };