@agentproto/runtime 5.14.0 → 5.15.0

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode,
 export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-CoLz8Pkh.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as PendingPromptView, x as StatsSessionDescriptor, y as ProcRow, z as ProvisionInFlight, B as ProvisionTracker, D as SessionCrashReason, E as UsageRollup, F as RemainingQuotaReader, Q as QuotaReadableProfile, G as UsageSnapshotRecord, H as SessionAwaitingQuestion, I as PolicyRunState, J as PtyFactory, K as WorktreeAutoReclaimer } from './sessions-DtkidPeI.js';
-export { L as ActivityKind, N as ActivitySource, O as ActivityState, V as ActivityWaitingOn, X as AnthropicReaderConfig, Y as AnthropicRemainingQuotaReader, Z as AttachPolicyInput, _ as CommandGroupStats, $ as CommitSpec, a0 as DEFAULT_WORKTREE_ISOLATION, a1 as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a2 as EagerResumeFailReason, a3 as EagerResumeOutcome, a4 as EagerResumeSkipReason, a5 as GateSpec, a6 as HostInfo, a7 as JudgeGateSpec, a8 as LabeledProcessStatsReport, a9 as LabeledSessionStats, aa as MAX_MESSAGE_DATA_BYTES, ab as MESSAGE_KINDS, ac as MESSAGE_PREAMBLE, ad as MESSAGE_TAG, ae as MESSAGE_URGENCIES, af as MessageDeliveryVia, ag as MessageFilter, ah as MessageRelation, ai as MessageTreeNode, aj as NO_OUTPUT_STALL_TURN_ERROR, ak as OnFailSpec, al as OrphanGroup, am as PendingPermission, an as PermissionRespondInput, ao as PermissionRespondResult, ap as PolicyRunStatus, aq as PricingResolver, ar as ProcessDetail, as as ProcessStatsReport, at as ProcessStatsService, au as QuotaStoreFile, av as QuotaStoreOptions, aw as RegisterBrowserInput, ax as RegisterSessionInput, ay as RemainingQuota, az as ResourceStats, aA as ResumeDisabledError, aB as SESSION_END_REASONS, aC as SESSION_ID_ENV, aD as SessionCurrentPhase, aE as SessionKind, aF as SessionMessageFrom, aG as SessionOutcome, aH as SessionOutcomeArtifact, aI as SessionOutcomeCompact, aJ as SessionOutcomeLink, aK as SessionResourceStats, aL as SessionRetiredError, aM as SessionSnapshots, aN as SessionStatus, aO as ShellGateSpec, aP as SpawnAgentInput, aQ as SpawnSessionInput, aR as StatsDetail, aS as StoredProfileQuota, aT as TASK_STATUSES, aU as TaskCaller, aV as TaskChangedEvent, aW as TaskClaimInput, aX as TaskCreateInput, aY as TaskGateOutcome, aZ as TaskGateRunner, a_ as TaskLedgerRegistry, a$ as TaskLedgerSessionSlice, b0 as TaskListFilter, b1 as TaskRecord, b2 as TaskStatus, b3 as TaskUpdateInput, b4 as TaskVerification, b5 as TaskVerifySupervisor, b6 as TaskWriteResult, b7 as TokenPricing, b8 as UsageBucket, b9 as UsageComputeInput, ba as UsageDetail, bb as UsageSource, bc as UserPresetsFile, bd as WORKSPACE_SLUG_ENV, be as WORKTREE_ISOLATION_ENV, bf as WORKTREE_PROVISION_CONCURRENCY_ENV, bg as WorktreeDecision, bh as WorktreeProvisionOutcome, bi as WorktreeProvisionPhase, bj as WorktreeProvisionProgress, bk as WorktreeProvisionRequest, bl as WorktreeRequest, bm as activityCounts, bn as compactOutcome, bo as createProcessStatsService, bp as createSessionMessage, bq as createSupervisorTaskGateRunner, br as createTaskLedger, bs as decideWorktreeIsolation, bt as deleteUserPreset, bu as deriveSessionOutcome, bv as deriveSessionUsage, bw as escapeHumanPrompt, bx as escapeMessageBody, by as filterActivities, bz as getProcessStatsService, bA as getUserPreset, bB as isClosedTaskStatus, bC as isKnownSessionEndReason, bD as isMessageAllowed, bE as isProviderLimitError, bF as isTerminalActivityState, bG as listUserPresets, bH as loadQuotaStore, bI as loadUserPresets, bJ as loadWorktreeIsolation, bK as matchesMessageFilter, bL as messageFrom, bM as mintMessageId, bN as normalizeCommand, bO as normalizeWorktreeField, bP as parseAnthropicRateLimitHeaders, bQ as parseTaskStatus, bR as parseWindow, bS as parseWorktreeIsolationMode, bT as pickUsageDetail, bU as policyToActivities, bV as policyWatchesSession, bW as prToActivities, bX as projectSessionUsage, bY as readProfileQuota, bZ as recordProfileQuota, b_ as renderInboxDigest, b$ as renderSessionMessage, c0 as renderSessionMessages, c1 as resolveRelation, c2 as rollupUsage, c3 as sanitizeLabel, c4 as saveUserPreset, c5 as trackWorktreeProvision, c6 as turnToActivities, c7 as userPresetsPath, c8 as workflowToActivities } from './sessions-DtkidPeI.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as PendingPromptView, x as StatsSessionDescriptor, y as ProcRow, z as ProvisionInFlight, B as ProvisionTracker, D as SessionCrashReason, E as UsageRollup, F as RemainingQuotaReader, Q as QuotaReadableProfile, G as UsageSnapshotRecord, H as SessionAwaitingQuestion, I as PolicyRunState, J as PtyFactory, K as WorktreeAutoReclaimer } from './sessions-Dq4mAphj.js';
+export { L as ActivityKind, N as ActivitySource, O as ActivityState, V as ActivityWaitingOn, X as AnthropicReaderConfig, Y as AnthropicRemainingQuotaReader, Z as AttachPolicyInput, _ as CommandGroupStats, $ as CommitSpec, a0 as DEFAULT_WORKTREE_ISOLATION, a1 as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a2 as EagerResumeFailReason, a3 as EagerResumeOutcome, a4 as EagerResumeSkipReason, a5 as GateSpec, a6 as HostInfo, a7 as JudgeGateSpec, a8 as LabeledProcessStatsReport, a9 as LabeledSessionStats, aa as MAX_MESSAGE_DATA_BYTES, ab as MESSAGE_KINDS, ac as MESSAGE_PREAMBLE, ad as MESSAGE_TAG, ae as MESSAGE_URGENCIES, af as MessageDeliveryVia, ag as MessageFilter, ah as MessageRelation, ai as MessageTreeNode, aj as NO_OUTPUT_STALL_TURN_ERROR, ak as OnFailSpec, al as OrphanGroup, am as PendingPermission, an as PermissionRespondInput, ao as PermissionRespondResult, ap as PolicyRunStatus, aq as PricingResolver, ar as ProcessDetail, as as ProcessStatsReport, at as ProcessStatsService, au as QuotaStoreFile, av as QuotaStoreOptions, aw as RegisterBrowserInput, ax as RegisterSessionInput, ay as RemainingQuota, az as ResourceStats, aA as ResumeDisabledError, aB as SESSION_END_REASONS, aC as SESSION_ID_ENV, aD as SessionCurrentPhase, aE as SessionKind, aF as SessionMessageFrom, aG as SessionOutcome, aH as SessionOutcomeArtifact, aI as SessionOutcomeCompact, aJ as SessionOutcomeLink, aK as SessionResourceStats, aL as SessionRetiredError, aM as SessionSnapshots, aN as SessionStatus, aO as ShellGateSpec, aP as SpawnAgentInput, aQ as SpawnSessionInput, aR as StatsDetail, aS as StoredProfileQuota, aT as TASK_STATUSES, aU as TaskCaller, aV as TaskChangedEvent, aW as TaskClaimInput, aX as TaskCreateInput, aY as TaskGateOutcome, aZ as TaskGateRunner, a_ as TaskLedgerRegistry, a$ as TaskLedgerSessionSlice, b0 as TaskListFilter, b1 as TaskRecord, b2 as TaskStatus, b3 as TaskUpdateInput, b4 as TaskVerification, b5 as TaskVerifySupervisor, b6 as TaskWriteResult, b7 as TokenPricing, b8 as UsageBucket, b9 as UsageComputeInput, ba as UsageDetail, bb as UsageSource, bc as UserPresetsFile, bd as WORKSPACE_SLUG_ENV, be as WORKTREE_ISOLATION_ENV, bf as WORKTREE_PROVISION_CONCURRENCY_ENV, bg as WorktreeDecision, bh as WorktreeProvisionOutcome, bi as WorktreeProvisionPhase, bj as WorktreeProvisionProgress, bk as WorktreeProvisionRequest, bl as WorktreeRequest, bm as activityCounts, bn as compactOutcome, bo as createProcessStatsService, bp as createSessionMessage, bq as createSupervisorTaskGateRunner, br as createTaskLedger, bs as decideWorktreeIsolation, bt as deleteUserPreset, bu as deriveSessionOutcome, bv as deriveSessionUsage, bw as escapeHumanPrompt, bx as escapeMessageBody, by as filterActivities, bz as getProcessStatsService, bA as getUserPreset, bB as isClosedTaskStatus, bC as isKnownSessionEndReason, bD as isMessageAllowed, bE as isProviderLimitError, bF as isTerminalActivityState, bG as listUserPresets, bH as loadQuotaStore, bI as loadUserPresets, bJ as loadWorktreeIsolation, bK as matchesMessageFilter, bL as messageFrom, bM as mintMessageId, bN as normalizeCommand, bO as normalizeWorktreeField, bP as parseAnthropicRateLimitHeaders, bQ as parseTaskStatus, bR as parseWindow, bS as parseWorktreeIsolationMode, bT as pickUsageDetail, bU as policyToActivities, bV as policyWatchesSession, bW as prToActivities, bX as projectSessionUsage, bY as readProfileQuota, bZ as recordProfileQuota, b_ as renderInboxDigest, b$ as renderSessionMessage, c0 as renderSessionMessages, c1 as resolveRelation, c2 as rollupUsage, c3 as sanitizeLabel, c4 as saveUserPreset, c5 as trackWorktreeProvision, c6 as turnToActivities, c7 as userPresetsPath, c8 as workflowToActivities } from './sessions-Dq4mAphj.js';
 import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-B3PRyxlI.js';
 export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-B3PRyxlI.js';
 import { AcpMcpServer } from '@agentproto/acp';
@@ -931,6 +931,253 @@ interface CancelTombstoneStore {
     has(provider: string, remoteId: string): boolean;
 }
 
+/**
+ * Signed event delivery with bounded retry (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
+ *
+ * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
+ * then the exact bytes are signed per attempt with a FRESH timestamp. An
+ * observer sees a different `webhook-signature` header per attempt while the
+ * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
+ * never re-serializes.
+ *
+ * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
+ * replaced with `{summary, subject}` and the envelope gains `truncated: true`
+ * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
+ * every attempt signs.
+ *
+ * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
+ * network errors retry; 410/413 are terminal with NO further attempt;
+ * 2xx = delivered. The returned `DeliveryState` is what the caller persists
+ * into the store for post-restart resume (W-B's job to wire).
+ */
+type McpEventEnvelope = {
+    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
+     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
+     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
+     *  control notification only — never sent by us (no control events). */
+    eventId: string;
+    name: string;
+    timestamp: string;
+    data: Record<string, unknown>;
+    cursor: string | null;
+    truncated?: boolean;
+};
+interface DeliveryState {
+    attempts: number;
+    lastError?: string;
+    lastAt?: string;
+}
+interface DeliveryReplay {
+    subId: string;
+    callbackUrl: string;
+    secrets: readonly string[];
+}
+/** One event → one POST. Frozen §3 outcome. */
+type DeliveryOutcome = {
+    ok: true;
+    delivery: DeliveryState;
+} | {
+    ok: false;
+    reason: string;
+    delivery: DeliveryState;
+};
+interface SsrfFetchArgs$1 {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface DeliverEventDeps {
+    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<{
+        status: number;
+        body: string;
+    }>;
+    /** Backoff sleep (tests only). Default: real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock (tests only). Default: real wall clock. */
+    now?: () => number;
+    /** Observability hook: one call per attempt outcome. Carries NO url, body or
+     *  secret — only the attempt number, HTTP status / redacted error reason,
+     *  and whether the attempt ended the delivery (`delivered`/`dead`) or will
+     *  be retried. A throwing hook never affects delivery. */
+    onAttempt?: (info: DeliveryAttemptInfo) => void;
+}
+interface DeliveryAttemptInfo {
+    attempt: number;
+    /** HTTP status when the receiver answered. */
+    status?: number;
+    /** Redacted failure reason (no URL) when there is no usable status. */
+    error?: string;
+    outcome: "delivered" | "retry" | "dead";
+}
+declare const CLAMP_LIMIT_BYTES = 262144;
+declare const MAX_ATTEMPTS = 5;
+/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
+declare function deliveryBackoffDelay(attempt: number): number;
+declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
+/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
+declare function envelopeClampedBytes(event: McpEventEnvelope): {
+    bytes: Uint8Array;
+    clamped: boolean;
+};
+declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
+
+/**
+ * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
+ * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
+ *
+ * Why an outbox: the runtime's `processEvents` marks an event `seen` the
+ * moment in-process handling resolves, but a webhook POST is an EXTERNAL
+ * delivery — a crash between ack and delivery loses the event forever (I4).
+ * So the webhook fire path appends a DURABLE row first:
+ *
+ *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
+ *     deliveryState, status: pending|delivered|dead}`
+ *
+ * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
+ * the envelope is serialized once here via `serializeEnvelope`; the dispatch
+ * re-signs those same bytes, and `deliverEventEnvelope`'s internal
+ * serialization is deterministic over the stored envelope — asserted by
+ * tests). The underlying sentinel event is marked seen/acked ONLY when the
+ * row reaches terminal status (`delivered`, or `dead` per the retry cap /
+ * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
+ * the event UN-acked, and a restart re-dispatches it by exact bytes.
+ *
+ * Ordering across events of one subscription is never assumed (I5). Rows
+ * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
+ * risk table); the file is capped. Feedback-loop guard is data, not policy:
+ * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
+ * loopback/private delivery targets, so nothing here can ring back into our
+ * own inbound routes — self-delivery cannot even connect.
+ */
+
+type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
+interface SentinelWebhookOutboxRow {
+    sentinelId: string;
+    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
+     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
+     *  header stays the EVENT id). */
+    requestId: string;
+    eventId: string;
+    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
+     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
+    bodyBytes: string;
+    /** v1 events are non-replayable (plan §2) — always null. */
+    cursor: null;
+    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
+    deliveryState: {
+        attempts: number;
+        lastError?: string;
+        lastAt?: string;
+    };
+    status: SentinelWebhookOutboxStatus;
+    /** The bounded-retry loop's final `ok:false` reason. */
+    failReason?: string;
+    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
+     *  `sentinel_removed`, `age_out`). */
+    deadReason?: string;
+    createdAt: number;
+    /** Wall-clock ms the row reached terminal status (drives reaping). */
+    terminalAt?: number;
+}
+/** The full row is JSON-persisted; the envelope rides along so a resumed
+ *  dispatch re-delivers byte-identically without re-deriving the projection,
+ *  and the original event rides along for ack-time lifetime bookkeeping
+ *  (terminal flag / subject tracking). */
+type PersistedOutboxRow = SentinelWebhookOutboxRow & {
+    envelope?: McpEventEnvelope;
+    event?: SentinelEvent;
+};
+/** Per-sentinel delivery health, derived from the outbox rows. Carries no
+ *  URL, body or secret — `lastError` is URL-redacted. */
+interface SentinelDeliveryStatus {
+    /** At least one row is still `pending` (being delivered / retried). */
+    active: boolean;
+    /** ISO time of the most recent delivery attempt, when any ran. */
+    lastDeliveryAt?: string;
+    /** Status of the most recent row. */
+    lastStatus: SentinelWebhookOutboxStatus;
+    lastError?: string;
+    /** Attempts spent on the most recent row. */
+    attempts: number;
+    /** Count of `dead` rows still held by the outbox. */
+    dead: number;
+}
+interface SentinelWebhookOutbox {
+    /** Delivery health for one sentinel, or `undefined` when the outbox holds no
+     *  row for it (never delivered anything / reaped). */
+    deliveryStatus(sentinelId: string): SentinelDeliveryStatus | undefined;
+    /** Append a row for a matched webhook-delivery event. Resolves ONLY after
+     *  the row is crash-durable (atomic write + fsync + rename + dir fsync) —
+     *  callers ack the upstream (Agentpush cursor, push HTTP 2xx) on resolve.
+     *  A persistence failure rejects and rolls the row back, so the caller
+     *  leaves the upstream un-acked. Idempotent per `(sentinelId, eventId)`: an
+     *  existing row (pending OR terminal) is never duplicated — returns
+     *  `undefined` (after waiting for any in-flight write that carries it), and
+     *  for a terminal existing row re-fires `onTerminal` so a lost ack (crash
+     *  between the terminal transition and the store write) still lands. Kicks
+     *  dispatch off asynchronously once durable. */
+    enqueue(input: {
+        sentinelId: string;
+        event: SentinelEvent;
+    }): Promise<SentinelWebhookOutboxRow | undefined>;
+    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
+     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
+     *  expired or unwound sentinel never delivers another byte. */
+    dispatch(): Promise<void>;
+    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
+     *  bytes (no payload re-serialization on the resume path). */
+    resumeDeliveries(): Promise<void>;
+    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
+     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
+    sweep(): void;
+    rows(): PersistedOutboxRow[];
+    /** Synchronous flush for shutdown paths. */
+    flushSync(): void;
+}
+interface SentinelWebhookOutboxOptions {
+    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
+    filePath?: string;
+    /** Injectable clock. */
+    nowMs?: () => number;
+    /** Debounce interval for the non-critical (status-transition) disk writes.
+     *  Enqueue never debounces. Default 1500 ms. */
+    debounceMs?: number;
+    /** Disable disk persistence (unit tests). Default false unless filePath. */
+    persist?: boolean;
+    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
+     *  as the POST boundary. Throws = dispatch did not complete (row stays
+     *  pending, event stays un-acked). Default: the real deliverer. */
+    deliverEvent?: (input: {
+        replay: DeliveryReplay;
+        row: PersistedOutboxRow;
+    }) => Promise<DeliveryOutcome>;
+    /** Test seam for the DEFAULT deliverer only (fetch / sleep / clock). */
+    deliverDeps?: Pick<DeliverEventDeps, "fetch" | "sleep" | "now">;
+    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
+     *  null when the sentinel/secret sidecar is gone (row goes dead, never
+     *  silently lost). */
+    secretsFor: (sentinelId: string) => DeliveryReplay | null;
+    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
+     *  true = the sentinel is past its `until` and must not deliver. */
+    isExpired: (sentinelId: string) => boolean;
+    /** The ack — mark the underlying event seen, after terminal status only. */
+    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
+    log?: (line: string) => void;
+}
+/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
+declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
+/** The CloudEvents → MCP-Events-envelope fusion. W-C's `mcp-events/adapter.ts`
+ *  is now the canonical owner of this mapping (`toMcpEvent`); this alias keeps
+ *  the W-B call sites/tests working. The shape is the frozen §3 wire envelope —
+ *  insertion order stable, so its serialization is byte-stable across
+ *  restarts. `data` gains `subject`/`summary` so the 256 KiB clamp's
+ *  `{summary, subject}` replacement never goes blind. */
+declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
+declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
+
 /**
  * LlmEndpointRegistry — supervised-sidecar manager for the
  * `@agentproto/llm-endpoint` proxy gateway.
@@ -6272,6 +6519,101 @@ interface SandboxReconcileResult {
  */
 declare function reconcileSandboxLedger(deps: SandboxReconcileDeps): Promise<SandboxReconcileResult>;
 
+/**
+ * Server-side narrowing for the session listers — the `session_list` MCP
+ * tool and `GET /sessions` (+ `agentproto sessions --json`) share this one
+ * module so the vocabulary and the semantics cannot drift between surfaces.
+ *
+ * Every filter is optional and AND-ed with the others. Vocabulary reuses
+ * `session_follow`'s selector/exclude names (`rootOnly`, labels,
+ * `parentSessionId`) rather than inventing a second one.
+ *
+ * Pure: no registry, no I/O, an injectable clock. The callers own subtree
+ * scoping, archived/kind/status handling and pagination.
+ */
+
+/** Raised for caller-fixable filter input (an unparsable time bound). */
+declare class SessionListFilterError extends Error {
+    constructor(message: string);
+}
+/** A string or a list of strings. HTTP callers send `a,b` or repeat the key. */
+type StringOrList = string | readonly string[];
+interface SessionListFilterInput {
+    /** Case-insensitive substring over id, name, label, title and cwd. */
+    q?: string;
+    /** Drop sessions whose `label` starts with any of these (case-sensitive). */
+    excludeLabelPrefix?: StringOrList;
+    /** Drop sessions whose `label` equals any of these (as `session_follow`'s `exclude.labels`). */
+    excludeLabels?: StringOrList;
+    /** Drop sessions of these kinds (`terminal` | `agent-cli` | `command`). */
+    excludeKinds?: StringOrList;
+    /** Only sessions with no parent (as `session_follow`'s `selector.rootOnly`). */
+    rootOnly?: boolean;
+    /** Only direct children of this session (the caller resolves a name to an id first). */
+    parentSessionId?: string;
+    /** Only sessions whose last activity (else start) is at/after this: ISO-8601 or relative (`30m`, `24h`, `7d`, `2w`). */
+    updatedSince?: string;
+    /** Only sessions started at/after this: ISO-8601 or relative. */
+    startedSince?: string;
+    /** Preset: drop review lanes, workflow stages and ended one-shot command runs (see {@link isNoiseSession}). */
+    excludeNoise?: boolean;
+}
+/** Names of every filter key, for surfaces that parse them from a query string. */
+declare const SESSION_LIST_FILTER_KEYS: readonly ["q", "excludeLabelPrefix", "excludeLabels", "excludeKinds", "rootOnly", "parentSessionId", "updatedSince", "startedSince", "excludeNoise"];
+/** Copy only the filter keys (a tool input carries many other params). */
+declare function pickSessionListFilters(input: SessionListFilterInput): SessionListFilterInput;
+/**
+ * Parse an ISO-8601 instant or a relative age (`90s`, `30m`, `24h`, `7d`,
+ * `2w` = "that long before `now`") into epoch ms. Throws
+ * {@link SessionListFilterError} on anything else.
+ */
+declare function parseTimeBound(raw: string, field: string, now?: number): number;
+type NoiseView = Pick<SessionDescriptor, "kind" | "status" | "label" | "origin" | "adapterSlug">;
+/**
+ * What `excludeNoise: true` drops — exactly these, nothing else:
+ *  1. review lanes: `label` starts with `review:` or `origin === "review"`;
+ *  2. workflow stage sessions: `label` starts with `wf:` or `origin === "workflow"`;
+ *  3. ended one-shot command runs: `status` is `exited` or `killed` and the
+ *     session is a plain command — `kind: "command"`, or `kind: "terminal"`
+ *     with no `adapterSlug` (an interactive agent TUI such as `claude` carries
+ *     one, so it is kept).
+ * A live session of kind 3 (a running dev server, a `bash` you are typing in)
+ * and every agent-cli session outside 1–2 are kept, as is anything `error`ed.
+ */
+declare function isNoiseSession(s: NoiseView): boolean;
+/** Epoch ms of a session's last activity, falling back to its start. */
+declare function sessionActivityMs(s: Pick<SessionDescriptor, "lastActivityAt" | "startedAt">): number;
+/** Newest activity first; ties broken by id so cursors stay stable. Returns a new array. */
+declare function sortNewestActivityFirst<T extends Pick<SessionDescriptor, "id" | "lastActivityAt" | "startedAt">>(rows: readonly T[]): T[];
+/** True when `input` carries at least one filter (an empty `q` / `false` flag does not count). */
+declare function hasSessionListFilters(input: SessionListFilterInput): boolean;
+type FilterableSession = Pick<SessionDescriptor, "id" | "kind" | "status" | "name" | "label" | "title" | "cwd" | "origin" | "adapterSlug" | "parentSessionId" | "lastActivityAt" | "startedAt">;
+/**
+ * Compile `input` into a row predicate. Validates (and resolves relative
+ * times against `now`) once, up front, so a bad `updatedSince` fails the
+ * whole call instead of silently matching nothing.
+ */
+declare function compileSessionListFilters(input: SessionListFilterInput, now?: number): (s: FilterableSession) => boolean;
+/** Filter `rows` (order preserved). Throws {@link SessionListFilterError} on a bad time bound. */
+declare function applySessionListFilters<T extends FilterableSession>(rows: readonly T[], input: SessionListFilterInput, now?: number): T[];
+/**
+ * Read the filters off an HTTP query string. Array-valued keys accept
+ * `a,b` or a repeated key; booleans accept `true`/`1` (anything else is off).
+ */
+declare function parseSessionListFilterParams(params: URLSearchParams): SessionListFilterInput;
+/** Zod fragment spread into `session_list`'s input schema. */
+declare const sessionListFilterShape: {
+    readonly q: z.ZodOptional<z.ZodString>;
+    readonly excludeLabelPrefix: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly excludeLabels: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly excludeKinds: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    readonly rootOnly: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean, unknown>>;
+    readonly parentSessionId: z.ZodOptional<z.ZodString>;
+    readonly updatedSince: z.ZodOptional<z.ZodString>;
+    readonly startedSince: z.ZodOptional<z.ZodString>;
+    readonly excludeNoise: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean, unknown>>;
+};
+
 /**
  * Per-session structured event capture — one append-only JSONL file per
  * agent-cli session, written at the same tap point where `projectEvent`
@@ -7292,6 +7634,8 @@ interface SentinelView {
     eventCount: number;
     lastEventTs?: number;
     lastError?: string;
+    /** Webhook-target sentinels only, once the outbox holds a row for it. */
+    deliveryStatus?: SentinelDeliveryStatus;
 }
 
 /**
@@ -7512,11 +7856,11 @@ interface VerifyCallbackInput {
 }
 interface VerifyCallbackDeps {
     /** Replaces the POST boundary. Default: the shared `ssrfFetch` gate. */
-    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<SsrfFetchView>;
+    fetch?: (url: string, init: SsrfFetchArgs) => Promise<SsrfFetchView>;
     /** Clock for the bounded TTL. Default: real wall clock. */
     now?: () => number;
 }
-interface SsrfFetchArgs$1 {
+interface SsrfFetchArgs {
     method?: "POST";
     headers?: Record<string, string>;
     body?: Uint8Array;
@@ -7535,86 +7879,6 @@ declare function resetChallengeCacheForTests(): void;
 declare function normalizeCallbackUrl(url: string): string | null;
 declare function verifyCallback(input: VerifyCallbackInput, deps?: VerifyCallbackDeps): Promise<ChallengeOutcome>;
 
-/**
- * Signed event delivery with bounded retry (W-A of
- * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
- *
- * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
- * then the exact bytes are signed per attempt with a FRESH timestamp. An
- * observer sees a different `webhook-signature` header per attempt while the
- * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
- * never re-serializes.
- *
- * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
- * replaced with `{summary, subject}` and the envelope gains `truncated: true`
- * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
- * every attempt signs.
- *
- * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
- * network errors retry; 410/413 are terminal with NO further attempt;
- * 2xx = delivered. The returned `DeliveryState` is what the caller persists
- * into the store for post-restart resume (W-B's job to wire).
- */
-type McpEventEnvelope = {
-    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
-     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
-     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
-     *  control notification only — never sent by us (no control events). */
-    eventId: string;
-    name: string;
-    timestamp: string;
-    data: Record<string, unknown>;
-    cursor: string | null;
-    truncated?: boolean;
-};
-interface DeliveryState {
-    attempts: number;
-    lastError?: string;
-    lastAt?: string;
-}
-interface DeliveryReplay {
-    subId: string;
-    callbackUrl: string;
-    secrets: readonly string[];
-}
-/** One event → one POST. Frozen §3 outcome. */
-type DeliveryOutcome = {
-    ok: true;
-    delivery: DeliveryState;
-} | {
-    ok: false;
-    reason: string;
-    delivery: DeliveryState;
-};
-interface SsrfFetchArgs {
-    method?: "POST";
-    headers?: Record<string, string>;
-    body?: Uint8Array;
-    timeoutMs: number;
-}
-interface DeliverEventDeps {
-    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
-    fetch?: (url: string, init: SsrfFetchArgs) => Promise<{
-        status: number;
-        body: string;
-    }>;
-    /** Backoff sleep (tests only). Default: real `setTimeout`. */
-    sleep?: (ms: number) => Promise<void>;
-    /** Clock (tests only). Default: real wall clock. */
-    now?: () => number;
-}
-declare const CLAMP_LIMIT_BYTES = 262144;
-declare const MAX_ATTEMPTS = 5;
-/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
-declare function deliveryBackoffDelay(attempt: number): number;
-declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
-/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
-declare function envelopeClampedBytes(event: McpEventEnvelope): {
-    bytes: Uint8Array;
-    clamped: boolean;
-};
-declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
-
 /**
  * MCP Events registry (W-C of `.plans/sentinel-mcp-events/PLAN.md`, §2/§3).
  *
@@ -7929,140 +8193,6 @@ declare function decodeWhsecSecret(secret: string): Buffer | null;
  */
 declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
 
-/**
- * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
- * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
- *
- * Why an outbox: the runtime's `processEvents` marks an event `seen` the
- * moment in-process handling resolves, but a webhook POST is an EXTERNAL
- * delivery — a crash between ack and delivery loses the event forever (I4).
- * So the webhook fire path appends a DURABLE row first:
- *
- *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
- *     deliveryState, status: pending|delivered|dead}`
- *
- * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
- * the envelope is serialized once here via `serializeEnvelope`; the dispatch
- * re-signs those same bytes, and `deliverEventEnvelope`'s internal
- * serialization is deterministic over the stored envelope — asserted by
- * tests). The underlying sentinel event is marked seen/acked ONLY when the
- * row reaches terminal status (`delivered`, or `dead` per the retry cap /
- * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
- * the event UN-acked, and a restart re-dispatches it by exact bytes.
- *
- * Ordering across events of one subscription is never assumed (I5). Rows
- * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
- * risk table); the file is capped. Feedback-loop guard is data, not policy:
- * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
- * loopback/private delivery targets, so nothing here can ring back into our
- * own inbound routes — self-delivery cannot even connect.
- */
-
-type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
-interface SentinelWebhookOutboxRow {
-    sentinelId: string;
-    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
-     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
-     *  header stays the EVENT id). */
-    requestId: string;
-    eventId: string;
-    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
-     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
-    bodyBytes: string;
-    /** v1 events are non-replayable (plan §2) — always null. */
-    cursor: null;
-    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
-    deliveryState: {
-        attempts: number;
-        lastError?: string;
-        lastAt?: string;
-    };
-    status: SentinelWebhookOutboxStatus;
-    /** The bounded-retry loop's final `ok:false` reason. */
-    failReason?: string;
-    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
-     *  `sentinel_removed`, `age_out`). */
-    deadReason?: string;
-    createdAt: number;
-    /** Wall-clock ms the row reached terminal status (drives reaping). */
-    terminalAt?: number;
-}
-/** The full row is JSON-persisted; the envelope rides along so a resumed
- *  dispatch re-delivers byte-identically without re-deriving the projection,
- *  and the original event rides along for ack-time lifetime bookkeeping
- *  (terminal flag / subject tracking). */
-type PersistedOutboxRow = SentinelWebhookOutboxRow & {
-    envelope?: McpEventEnvelope;
-    event?: SentinelEvent;
-};
-interface SentinelWebhookOutbox {
-    /** Append a row for a matched webhook-delivery event. Resolves ONLY after
-     *  the row is crash-durable (atomic write + fsync + rename + dir fsync) —
-     *  callers ack the upstream (Agentpush cursor, push HTTP 2xx) on resolve.
-     *  A persistence failure rejects and rolls the row back, so the caller
-     *  leaves the upstream un-acked. Idempotent per `(sentinelId, eventId)`: an
-     *  existing row (pending OR terminal) is never duplicated — returns
-     *  `undefined` (after waiting for any in-flight write that carries it), and
-     *  for a terminal existing row re-fires `onTerminal` so a lost ack (crash
-     *  between the terminal transition and the store write) still lands. Kicks
-     *  dispatch off asynchronously once durable. */
-    enqueue(input: {
-        sentinelId: string;
-        event: SentinelEvent;
-    }): Promise<SentinelWebhookOutboxRow | undefined>;
-    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
-     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
-     *  expired or unwound sentinel never delivers another byte. */
-    dispatch(): Promise<void>;
-    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
-     *  bytes (no payload re-serialization on the resume path). */
-    resumeDeliveries(): Promise<void>;
-    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
-     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
-    sweep(): void;
-    rows(): PersistedOutboxRow[];
-    /** Synchronous flush for shutdown paths. */
-    flushSync(): void;
-}
-interface SentinelWebhookOutboxOptions {
-    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
-    filePath?: string;
-    /** Injectable clock. */
-    nowMs?: () => number;
-    /** Debounce interval for the non-critical (status-transition) disk writes.
-     *  Enqueue never debounces. Default 1500 ms. */
-    debounceMs?: number;
-    /** Disable disk persistence (unit tests). Default false unless filePath. */
-    persist?: boolean;
-    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
-     *  as the POST boundary. Throws = dispatch did not complete (row stays
-     *  pending, event stays un-acked). Default: the real deliverer. */
-    deliverEvent?: (input: {
-        replay: DeliveryReplay;
-        row: PersistedOutboxRow;
-    }) => Promise<DeliveryOutcome>;
-    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
-     *  null when the sentinel/secret sidecar is gone (row goes dead, never
-     *  silently lost). */
-    secretsFor: (sentinelId: string) => DeliveryReplay | null;
-    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
-     *  true = the sentinel is past its `until` and must not deliver. */
-    isExpired: (sentinelId: string) => boolean;
-    /** The ack — mark the underlying event seen, after terminal status only. */
-    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
-    log?: (line: string) => void;
-}
-/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
-declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
-/** The CloudEvents → MCP-Events-envelope fusion. W-C's `mcp-events/adapter.ts`
- *  is now the canonical owner of this mapping (`toMcpEvent`); this alias keeps
- *  the W-B call sites/tests working. The shape is the frozen §3 wire envelope —
- *  insertion order stable, so its serialization is byte-stable across
- *  restarts. `data` gains `subject`/`summary` so the 256 KiB clamp's
- *  `{summary, subject}` replacement never goes blind. */
-declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
-declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
-
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -9874,4 +10004,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type ArgumentsResult, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcApplyScopeCounts, type BranchGcApplySummary, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, type CancelTombstone, type CancelTombstoneStore, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_TTL_MS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, EVENT_REGISTRY, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type EventDefinition, type EventRegistration, type EventsListContext, type EventsListRequest, type EventsListResult, type EventsSubscribeContext, type EventsSubscribeInput, type EventsSubscribeResult, type EventsUnsubscribeContext, type EventsUnsubscribeInput, FOLLOW_EVENTS, type FetchHostTurnsResult, type FindComposeCandidateInput, type FollowEvent, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, GITHUB_SCHEME, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, INDEX_DEFAULT_LIMIT, INDEX_MAX_OUTPUT, INDEX_MAX_PROMPT, INDEX_TAIL_BYTES, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type InternalEventMeta, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_TTL_MS, MCP_APP_BRIDGE_SCRIPT, MIN_TTL_MS, type McpCredentialDeps, type McpEventEnvelope, McpEventsError, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type Principal, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type SchemeRegistry, type ScopeTokenRegistry, SentinelBackingExpiredError, type SentinelMalformedItem, type SentinelMatchClause, type SentinelPollResult, type SentinelQuarantine, type SentinelQuarantineRecord, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, type SessionFollow, type SessionFollowHandle, type SessionFollowStore, type SessionIndexEntry, SessionMessage, type SessionMessageSentRecord, type SessionObserver, type SessionRecap, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubscriptionIdentity, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TranscriptPrompt, type TranscriptTail, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, backfillSessionIndexes, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, buildSessionRecap, canonicalForModeId, canonicalizeJcs, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, computeRefreshBefore, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createSessionFollowStore, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonBearerPrincipal, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defaultTranscriptBaseDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, deriveIndexFromTranscript, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, eventsList, eventsSubscribe, eventsUnsubscribe, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findEventDefinition, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, indexEntryFromDescriptor, injectMcpAppBridge, isAgentCliAuthConfigured, isAutomatedPromptSource, isNoSessionPromptFailure, isPubliclyRoutable, isRetired, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeRestartForRouting, makeSandboxCredsStore, makeSandboxResolver, matchesSessionQuery, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readAllSessionIndexes, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readSessionIndex, readTranscriptTail, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, resolveSuccessor, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, searchSessionIndexes, seedWalkForTranscript, serializeEnvelope, sessionEventsPath, sessionIndexPath, sessionPrincipal, sessionTranscriptDir, setDefaultPreset, setDefaultSessionsBaseDir, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, subscriptionId, summarizeBranchGcApply, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, tenantScope, toMcpEvent, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, untilForTtl, updateHarnessPreset, upsertSandboxLedger, validateAgainstInputSchema, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, wireSessionFollow, withBranchGcApplySummary, withPr, withPrStatus, writeDaemonRegistryEntry, writeSessionIndex };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type ArgumentsResult, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcApplyScopeCounts, type BranchGcApplySummary, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, type CancelTombstone, type CancelTombstoneStore, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_TTL_MS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, EVENT_REGISTRY, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type EventDefinition, type EventRegistration, type EventsListContext, type EventsListRequest, type EventsListResult, type EventsSubscribeContext, type EventsSubscribeInput, type EventsSubscribeResult, type EventsUnsubscribeContext, type EventsUnsubscribeInput, FOLLOW_EVENTS, type FetchHostTurnsResult, type FindComposeCandidateInput, type FollowEvent, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, GITHUB_SCHEME, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, INDEX_DEFAULT_LIMIT, INDEX_MAX_OUTPUT, INDEX_MAX_PROMPT, INDEX_TAIL_BYTES, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type InternalEventMeta, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_TTL_MS, MCP_APP_BRIDGE_SCRIPT, MIN_TTL_MS, type McpCredentialDeps, type McpEventEnvelope, McpEventsError, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type Principal, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SESSION_LIST_FILTER_KEYS, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type SchemeRegistry, type ScopeTokenRegistry, SentinelBackingExpiredError, type SentinelMalformedItem, type SentinelMatchClause, type SentinelPollResult, type SentinelQuarantine, type SentinelQuarantineRecord, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, type SessionFollow, type SessionFollowHandle, type SessionFollowStore, type SessionIndexEntry, SessionListFilterError, type SessionListFilterInput, SessionMessage, type SessionMessageSentRecord, type SessionObserver, type SessionRecap, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubscriptionIdentity, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TranscriptPrompt, type TranscriptTail, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, applySessionListFilters, attachSandbox, backfillSessionIndexes, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, buildSessionRecap, canonicalForModeId, canonicalizeJcs, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, compileSessionListFilters, composeSessionObservers, composedFromRangeSha, computeHostWarnings, computeRefreshBefore, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createSessionFollowStore, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonBearerPrincipal, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defaultTranscriptBaseDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, deriveIndexFromTranscript, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, eventsList, eventsSubscribe, eventsUnsubscribe, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findEventDefinition, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hasSessionListFilters, hostPlaceholders, hostRecordToMirrorRecord, indexEntryFromDescriptor, injectMcpAppBridge, isAgentCliAuthConfigured, isAutomatedPromptSource, isNoSessionPromptFailure, isNoiseSession, isPubliclyRoutable, isRetired, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeRestartForRouting, makeSandboxCredsStore, makeSandboxResolver, matchesSessionQuery, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, parseSessionListFilterParams, parseTimeBound, pickSessionListFilters, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readAllSessionIndexes, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readSessionIndex, readTranscriptTail, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, resolveSuccessor, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, searchSessionIndexes, seedWalkForTranscript, serializeEnvelope, sessionActivityMs, sessionEventsPath, sessionIndexPath, sessionListFilterShape, sessionPrincipal, sessionTranscriptDir, setDefaultPreset, setDefaultSessionsBaseDir, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, sortNewestActivityFirst, ssrfFetch, subscriptionId, summarizeBranchGcApply, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, tenantScope, toMcpEvent, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, untilForTtl, updateHarnessPreset, upsertSandboxLedger, validateAgainstInputSchema, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, wireSessionFollow, withBranchGcApplySummary, withPr, withPrStatus, writeDaemonRegistryEntry, writeSessionIndex };