@agentproto/runtime 5.2.1 → 5.3.0

package/dist/index.d.ts

@@ -1,15 +1,17 @@
 import { DoctypeSpec } from '@agentproto/manifest';
+import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode, R as ResolvedModelRole } from './config-DcESQDmZ.js';
+export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-DcESQDmZ.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as AgentSessionLike, o as UsageReadContext, p as UsageReadResult, q as MessageKind, r as SessionMessage, s as AgentStreamEvent, t as SessionUsage, u as ToolCallRecord, v as UsageRollup, w as RemainingQuotaReader, Q as QuotaReadableProfile, x as UsageSnapshotRecord, y as SessionAwaitingQuestion, z as PolicyRunState, B as PtyFactory } from './sessions-g4fw_zKx.js';
-export { D as ActivityKind, E as ActivitySource, F as ActivityState, G as ActivityWaitingOn, H as AnthropicReaderConfig, I as AnthropicRemainingQuotaReader, J as AttachPolicyInput, K as CommitSpec, L as EagerResumeFailReason, N as EagerResumeOutcome, O as EagerResumeSkipReason, V as GateSpec, W as JudgeGateSpec, X as MAX_MESSAGE_DATA_BYTES, Y as MESSAGE_KINDS, Z as MESSAGE_PREAMBLE, _ as MESSAGE_TAG, $ as MESSAGE_URGENCIES, a0 as MessageDeliveryVia, a1 as MessageFilter, a2 as MessageRelation, a3 as MessageTreeNode, a4 as OnFailSpec, a5 as PendingPermission, a6 as PermissionRespondInput, a7 as PermissionRespondResult, a8 as PolicyRunStatus, a9 as PricingResolver, aa as QuotaStoreFile, ab as QuotaStoreOptions, ac as RegisterBrowserInput, ad as RegisterSessionInput, ae as RemainingQuota, af as ResumeDisabledError, ag as SESSION_END_REASONS, ah as SESSION_ID_ENV, ai as SessionCurrentPhase, aj as SessionKind, ak as SessionMessageFrom, al as SessionOutcome, am as SessionOutcomeArtifact, an as SessionOutcomeCompact, ao as SessionOutcomeLink, ap as SessionSnapshots, aq as SessionStatus, ar as ShellGateSpec, as as SpawnAgentInput, at as SpawnSessionInput, au as StoredProfileQuota, av as TASK_STATUSES, aw as TaskCaller, ax as TaskChangedEvent, ay as TaskClaimInput, az as TaskCreateInput, aA as TaskGateOutcome, aB as TaskGateRunner, aC as TaskLedgerRegistry, aD as TaskLedgerSessionSlice, aE as TaskListFilter, aF as TaskRecord, aG as TaskStatus, aH as TaskUpdateInput, aI as TaskVerification, aJ as TaskVerifySupervisor, aK as TaskWriteResult, aL as TokenPricing, aM as UsageBucket, aN as UsageComputeInput, aO as UsageDetail, aP as UsageSource, aQ as UserPresetsFile, aR as WORKSPACE_SLUG_ENV, aS as activityCounts, aT as compactOutcome, aU as createSessionMessage, aV as createSupervisorTaskGateRunner, aW as createTaskLedger, aX as deleteUserPreset, aY as deriveSessionOutcome, aZ as deriveSessionUsage, a_ as escapeHumanPrompt, a$ as escapeMessageBody, b0 as filterActivities, b1 as getUserPreset, b2 as isClosedTaskStatus, b3 as isKnownSessionEndReason, b4 as isMessageAllowed, b5 as isProviderLimitError, b6 as isTerminalActivityState, b7 as listUserPresets, b8 as loadQuotaStore, b9 as loadUserPresets, ba as matchesMessageFilter, bb as messageFrom, bc as mintMessageId, bd as parseAnthropicRateLimitHeaders, be as parseTaskStatus, bf as parseWindow, bg as pickUsageDetail, bh as policyToActivities, bi as policyWatchesSession, bj as prToActivities, bk as projectSessionUsage, bl as readProfileQuota, bm as recordProfileQuota, bn as renderInboxDigest, bo as renderSessionMessage, bp as renderSessionMessages, bq as resolveRelation, br as rollupUsage, bs as sanitizeLabel, bt as saveUserPreset, bu as turnToActivities, bv as userPresetsPath, bw as workflowToActivities } from './sessions-g4fw_zKx.js';
-import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-RyRL2AbD.js';
-export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-RyRL2AbD.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-DKm6Wqro.js';
+export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-DKm6Wqro.js';
+import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-DxIIuJFY.js';
+export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-DxIIuJFY.js';
 import { AcpMcpServer } from '@agentproto/acp';
 import { SandboxMode } from '@agentproto/command-sandbox';
 import { AdapterHandle, SetupField, AdapterResolver, AdapterLister, CredsStore, HarnessCapabilities, AdapterEntry } from '@agentproto/provider-kit';
-import { S as SpawnDefaultsConfig, D as DefaultsAdapterAuthConfig, R as ResolvedAuthSpec, a as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-CHvz85DD.js';
-export { b as AuthEcho, c as AuthResolutionError, C as CLAUDE_CODE_OAUTH_SOURCE, d as CredentialSource, e as DefaultsAdapterConfig, f as DeferredToolsConfig, g as ResolveSubscriptionCredentialInput, h as ResolvedSpawnAuthMaterial, i as ResolvedSpawnDefaults, j as SubscriptionCredentialResolution, k as SubscriptionSourceError, l as credentialFingerprint, n as normalizeSkillsOption, r as resolveAuthSpec, m as resolveDeferredToolsGatewayOption, o as resolveSpawnDefaults, p as resolveSubscriptionCredential } from './spawn-defaults-CHvz85DD.js';
+import { a as SpawnBrowserMode, S as SpawnDefaultsConfig, b as ResolveHeadlessBrowser, D as DefaultsAdapterAuthConfig, C as ContextContinuityPolicy, c as ResolvedAuthSpec, d as DeclaredAdapterOption, A as AdapterAuthDescriptor } from './spawn-defaults-Cp9SGZex.js';
+export { e as AuthEcho, f as AuthResolutionError, g as CLAUDE_CODE_OAUTH_SOURCE, h as CredentialSource, i as DefaultsAdapterConfig, j as DeferredToolsConfig, k as ResolveSubscriptionCredentialInput, l as ResolvedSpawnAuthMaterial, m as ResolvedSpawnDefaults, n as SubscriptionCredentialResolution, o as SubscriptionSourceError, p as credentialFingerprint, q as normalizeSkillsOption, r as resolveAuthSpec, s as resolveDeferredToolsGatewayOption, t as resolveSpawnDefaults, u as resolveSubscriptionCredential } from './spawn-defaults-Cp9SGZex.js';
 import { CatalogModelsQuery, CatalogModelsResponse } from './catalog-models.js';
 export { CatalogAdapterInput, CatalogAdapterModelInput, CatalogPricing, CatalogProduct, CatalogRoute, CatalogRouteSummary, CatalogVendor, buildCatalogModels } from './catalog-models.js';
 import { FooterSession } from './pr-provenance.js';
@@ -22,13 +24,15 @@ import { ToolContext } from '@agentproto/tool';
 import { z } from 'zod';
 import { DriverHandle } from '@agentproto/driver';
 import { Attestation, LedgerKey, RubricDigest, PackDigest, ReviewPrRef, LaneResult, ReviewLaneExecutor, LaneOutcome, Attestor, PackLoader } from '@agentproto/review';
+import { BundlesFile } from './bundles.js';
 import { ImportedMcpsConfig } from './mcp-imports.js';
 import { CostBudget, AuthProfile, CostBudgetScope } from '@agentproto/auth';
 export { CostBudget, CostBudgetScope } from '@agentproto/auth';
-import { S as SpawnBrowserMode, a as ResolveHeadlessBrowser, C as ContextContinuityPolicy } from './context-continuity-BfNVbX5W.js';
-import { WorktreeIsolationMode, SpawnAttachMode, SpawnDedupeMode } from './config.js';
 import { ResolvedModel } from '@agentproto/model-catalog';
-import { FrameSink, E2eFrameSink } from '@agentproto/acp/tunnel';
+import { BrowserProvider, BrowserCapabilities, BrowserAttachOptions, BrowserInstance } from '@agentproto/driver-browser';
+import { PairingRegistry } from '@agentproto/pairing-host';
+export { CreateOfferInput, CreatedOffer, PAIRINGS_VERSION, PairingChannelContext, PairingChannelHandle, PairingChannelMode, PairingRecord, PairingRegistry, PairingRegistryDeps, ReconnectLogGate, createPairingRegistry, createReconnectLogGate, readPairingsSnapshot } from '@agentproto/pairing-host';
+import { FrameSink } from '@agentproto/acp/tunnel';
 import { DaemonIdentity } from '@agentproto/secrets/identity';
 import { WorkspaceFs } from './workspace-fs.js';
 export { createWorkspaceFs } from './workspace-fs.js';
@@ -40,6 +44,39 @@ import { StepCache } from '@agentproto/workflow-runtime';
 export { PROVIDER_ENV_VARS, ProviderEntry, ProvidersFile, getProviderKey, injectProviderKeysIntoEnv, loadProviders, providerEnvVar, providersPath, removeProviderKey, setProviderKey } from '@agentproto/providers-store';
 import 'node:child_process';
 
+/**
+ * App boundary — filesystem zones for sessions an app (or an app workflow)
+ * spawns.
+ *
+ *   readOnly  the installed app source (dir, `.agentproto/`, `scripts/`, …)
+ *   writable  the workflow run workspace (`~/.agentproto/runs/<runId>/`,
+ *             `$run.workspace`) and the app `data/` dir
+ *   hidden    host trees that must not be readable even though the OS
+ *             sandbox alone would allow them (the daemon workspace, the host
+ *             monorepo the app happens to be installed inside)
+ *   else      denied
+ *
+ * One `AppBoundary` value drives every enforcement surface:
+ *   - daemon file tools (`fs-tools.ts`) and `command_execute`
+ *     (`command-tools.ts`) resolve paths through {@link resolveBoundaryPath};
+ *   - the harness's native tools are confined by the OS sandbox
+ *     (`@agentproto/command-sandbox`) built from {@link boundaryToSandboxZones};
+ *   - the boundary rides on the session descriptor (`meta.appBoundary`) so the
+ *     daemon gateway can recover a caller's boundary from its trusted
+ *     `callerSessionId`, and children/restarts inherit it.
+ */
+
+type AppBoundaryEnforce = "required" | "best-effort";
+interface AppBoundary {
+    readonly appId: string;
+    /** Base for relative paths in the daemon file tools — the app dir. */
+    readonly root: string;
+    readonly readOnly: readonly string[];
+    readonly writable: readonly string[];
+    readonly hidden: readonly string[];
+    readonly enforce: AppBoundaryEnforce;
+}
+
 /**
  * Runtime-side glue for the per-workspace brain: a shared registry of
  * {@link BrainManager}s (one per workspace bucket) plus the two bridges that
@@ -581,229 +618,6 @@ interface RemoteStatus {
     lastError?: string;
 }
 
-/**
- * Daemon-side pairing registry (design: DESIGN §3/§4, PLAN deliverable 2).
- *
- * Owns everything the daemon needs to be *paired with* over an untrusted
- * rendezvous:
- *
- *   - **Offer store** — in-memory, single-use, expiry-checked one-time offer
- *     secrets minted by `pair offer`. A daemon restart voids outstanding offers
- *     (acceptable + documented). The daemon parks on the offer's ROUTE token and
- *     the handshake's `verifyAuthToken` predicate checks the sealed AUTH token,
- *     SPENDING the offer on the first successful handshake (a wrong token spends
- *     nothing).
- *   - **Pairings store** — `~/.agentproto/pairings.json` (0600, atomic write),
- *     one record per paired client: `{clientPub, name, fingerprint, createdAt,
- *     lastSeen, pairRoot, rendezvousUrl}`. `pairRoot` is the long-term shared
- *     secret (`derivePairRoot`) from which reconnect routing tokens derive.
- *   - **Rendezvous connections** — for a fresh offer, and for every persisted
- *     pairing on boot (autoconnect), the daemon dials the rendezvous *outbound*
- *     (`side=daemon&t=<route>`), runs `daemonHandshakeOverSink` with the P1
- *     crypto, and — on success — serves the spliced, E2E-wrapped channel exactly
- *     like `serve --connect` serves a tunnel host. The serving path itself is
- *     injected (`serve`) so this module stays free of pty/adapter concerns and
- *     the CLI can reuse its `createTunnelServer` config verbatim.
- *   - **Reconnect epochs** — a persisted pairing's standing connection parks on
- *     the pairing-derived route `HKDF(pairRoot, "rv-route"‖epoch)`, rotated per
- *     UTC day. The daemon parks on BOTH the current and previous
- *     epoch tokens so a client whose clock straddles midnight still finds it;
- *     reconnect-with-backoff keeps the standing connection alive.
- *   - **Revocation** — removing a pairing drops its rendezvous connections, so
- *     it can no longer be served. For a grace period (`revokedGraceMs`, default
- *     14 days) the daemon keeps a *tombstone*: it still parks on the pairing's
- *     epoch ROUTES, completes the (daemon-signed) handshake only for a hello
- *     carrying that epoch's AUTH token, and answers with a single E2E-encrypted
- *     `error{code:"pairing_revoked"}` frame before closing — never serving the
- *     channel. That is what lets a client tell "unpaired" from "daemon
- *     offline" (which both otherwise look like a park timeout at the broker)
- *     and stop retrying. The signal is authenticated like every tunnel frame:
- *     it arrives inside the AEAD channel of a handshake whose transcript the
- *     client verified against the pinned daemon key, so the broker can't forge
- *     it; and the broker, which knows the routes, can't elicit it either (no
- *     auth token). A tombstone keeps only the per-epoch route + auth tokens for
- *     its window — the pair root is dropped at revoke.
- *
- * ## Reconnect authentication (why no stable client key)
- *
- * The handshake carries only a client *ephemeral* key (regenerated per
- * handshake) — there is no persistent client identity key. So a reconnect
- * authenticates the client by **possession of the epoch AUTH token**
- * `HKDF(pairRoot, "rv-auth"‖epoch)`, which derives from `pairRoot` — a secret
- * only the paired client and daemon share (it fell out of the original ECDH).
- * The daemon parks on the pairing's epoch ROUTE, and on that connection the
- * `verifyAuthToken` predicate accepts a hello whose sealed auth equals the same
- * epoch's auth token (constant-time). The route and auth are separate one-way
- * HKDF outputs: the broker sees every route and can't compute an auth from it.
- * (pair/v1 used ONE value for both, so a broker could replay a logged route as
- * the proof and be served.) The stored `fingerprint` (of the first handshake's
- * ephemeral key) is a stable display/revocation handle, not an auth input.
- *
- * ## Legacy (pair/v1) pairings
- *
- * A v1 `pairings.json` is loaded with every record flagged `legacy`: listed and
- * revocable, never served. The daemon still parks on a legacy pairing's routes
- * (the epoch route is unchanged from v1) so that pairing's not-yet-upgraded
- * client reaches it and is told to re-pair — see `respondToLegacyHandshake` —
- * rather than timing out. v1 records are not upgraded in place: v1 let the
- * broker pair as a client, so any v1 record may be the broker's own.
- */
-
-/** `pairings.json` format. v2 = pairings made under pair/v2 (route/auth
- *  split). A v1 file still loads, every record flagged `legacy`. */
-declare const PAIRINGS_VERSION: 2;
-/** One persisted pairing. Written verbatim to `pairings.json`. */
-interface PairingRecord {
-    /** The client ephemeral public key from the FIRST handshake (a snapshot —
-     *  reconnects use fresh ephemerals; this is not an auth input). */
-    clientPub: string;
-    /** Human-facing label the client chose on `pair accept`. */
-    name: string;
-    /** `identityFingerprint(clientPub)` from the first handshake — the stable
-     *  display + revocation handle. */
-    fingerprint: string;
-    /** ISO-8601 first-pair timestamp. */
-    createdAt: string;
-    /** ISO-8601 of the most recent successful (re)connect. */
-    lastSeen: string;
-    /** Long-term shared secret (base64), from which epoch routing tokens derive. */
-    pairRoot: string;
-    /** Rendezvous endpoint to reconnect through. */
-    rendezvousUrl: string;
-    /** Set on a pairing made under the retired pair/v1 protocol: listed and
-     *  revocable, never served — its client is told to re-pair. */
-    legacy?: true;
-    /** Set when this pairing was made under an offer minted with
-     *  `agentproto pair offer --host` (PR-C) — i.e. the offering daemon's own
-     *  intent, recorded server-side at handshake time from the OfferEntry it
-     *  itself created, never from the (unauthenticated) `scope` param a client
-     *  presented in the offer URL. Absent for an ordinary remote-control
-     *  pairing. Purely informational here — it does not change how this
-     *  pairing is served. */
-    scope?: "host";
-}
-/** Mode of a served channel — first-contact offer vs. an established reconnect. */
-type PairingChannelMode = "offer" | "reconnect";
-/** Context handed to the injected `serve` when a channel comes up. */
-interface PairingChannelContext {
-    mode: PairingChannelMode;
-    /** Stable pairing fingerprint (present for reconnect; for an offer it's the
-     *  freshly-derived one). */
-    fingerprint: string;
-    /** Client label. */
-    name: string;
-    /** This pairing's OWN recorded scope (mirrors `PairingRecord.scope`) —
-     *  `"host"` when the offer that produced it was minted with
-     *  `agentproto pair offer --host`, absent for an ordinary remote-control
-     *  pairing. Present on BOTH the offer and every reconnect context, so
-     *  `serve` can gate scope-restricted routes (e.g. device-inference
-     *  proxying) the same way on first contact and on every later reconnect. */
-    scope?: "host";
-}
-/** Handle to a live served channel — the registry closes it on teardown. */
-interface PairingChannelHandle {
-    close(): Promise<void>;
-}
-interface CreatedOffer {
-    /** The one-time offer secret (base64url) — the URL's `s`. Never on the wire:
-     *  the broker only ever sees its derived route. */
-    secret: string;
-    /** Offer expiry, unix seconds. */
-    exp: number;
-    /** The full `agentproto://pair?…` offer URL. */
-    url: string;
-    /** The daemon's identity fingerprint (shown to the human at accept time). */
-    fingerprint: string;
-    /** The rendezvous the offer routes through. */
-    rendezvousUrl: string;
-    /** True when `rendezvousUrl` is the hosted default — i.e. neither an explicit
-     *  `--rendezvous` nor a configured `pairing.rendezvous` applied, so the offer
-     *  falls back to `HOSTED_RENDEZVOUS_URL`. Surfaced so `pair offer` can flag,
-     *  never silently, that the daemon is relaying through our infrastructure. */
-    rendezvousIsHostedDefault: boolean;
-    /** Echoes `CreateOfferInput.scope`. `"host"` when minted with `--host`;
-     *  absent for a plain offer. */
-    scope?: "host";
-}
-interface CreateOfferInput {
-    /** Time-to-live in ms. Default 10 minutes. */
-    ttlMs?: number;
-    /** Rendezvous URL override; falls back to the configured default. */
-    rendezvousUrl?: string;
-    /** Mint a HOST-scoped offer (PR-C): the accepting side may register this
-     *  daemon as a driveable host (`devices add`), not just remote-control it.
-     *  Recorded on the resulting `OfferEntry`/`PairingRecord` server-side — this
-     *  is the authoritative record of what was granted, independent of the
-     *  `scope` param an accepting client's offer URL happens to carry. */
-    scope?: "host";
-}
-interface PairingRegistryDeps {
-    /** Lazily load (create on first use) the daemon identity. Kept lazy so a
-     *  daemon that never pairs never writes an identity file. */
-    loadIdentity: () => Promise<DaemonIdentity>;
-    /** Path to `pairings.json`. Defaults to `~/.agentproto/pairings.json`. */
-    pairingsPath?: string;
-    /** Configured rendezvous URL (from `config.pairing.rendezvous`). Three states:
-     *  - `undefined` (key absent) → `createOffer` falls back to the hosted default
-     *    (`HOSTED_RENDEZVOUS_URL`).
-     *  - a non-empty URL → that endpoint is the default for offers.
-     *  - `""` (explicitly empty) → an explicit opt-out: no default applies, so an
-     *    offer without `--rendezvous` fails closed. Wire it through verbatim (do
-     *    not coerce `""` to `undefined`) or the opt-out silently reverts to the
-     *    hosted default. */
-    defaultRendezvousUrl?: string;
-    /** Dial a rendezvous WS and adapt it to a FrameSink. Injected by the CLI
-     *  (uses `ws` + `wrapWebSocket`). Rejects if the dial fails. The `signal`
-     *  aborts on registry shutdown. */
-    dial: (wsUrl: string, signal: AbortSignal) => Promise<FrameSink>;
-    /** Serve the E2E-wrapped channel (the CLI builds `createTunnelServer` over
-     *  it with the same config `serve --connect` uses). */
-    serve: (sink: E2eFrameSink, ctx: PairingChannelContext) => PairingChannelHandle;
-    /** Injectable clock (ms). Defaults to Date.now. */
-    now?: () => number;
-    /** Diagnostic log sink. */
-    log?: (line: string) => void;
-    /** Reconnect backoff floor / ceiling (ms). Defaults 1s / 30s. */
-    reconnectMinMs?: number;
-    reconnectMaxMs?: number;
-    /** How long a parked daemon socket waits for a client hello before recycling
-     *  the connection. Kept just under the broker's park timeout. Default 110s. */
-    handshakeTimeoutMs?: number;
-    /** How long a revoked pairing is still answered with `pairing_revoked` (see
-     *  "Revocation" above). Default 14 days; `0` disables tombstones, so a
-     *  revoked client just stops finding the daemon. */
-    revokedGraceMs?: number;
-}
-interface PairingRegistry {
-    /** Mint a one-time offer + start dialing the rendezvous for it. */
-    createOffer(input?: CreateOfferInput): Promise<CreatedOffer>;
-    /** All persisted pairings (copies). Loads `pairings.json` on first call. */
-    list(): Promise<PairingRecord[]>;
-    /** Rename a pairing by fingerprint or name (cosmetic only — no effect on
-     *  auth or routing). Returns false when nothing matched; throws on an
-     *  empty `newName`. */
-    rename(idOrName: string, newName: string): Promise<boolean>;
-    /** Drop a pairing by fingerprint or name; stops its rendezvous connections.
-     *  Returns false when nothing matched. */
-    revoke(idOrName: string): Promise<boolean>;
-    /** Is a channel (offer or reconnect) currently served for this fingerprint? */
-    isOnline(fingerprint: string): boolean;
-    /** Start standing reconnect connections for every persisted pairing. Call
-     *  after the gateway is up (so the injected `serve` can reach it). */
-    startAutoconnect(): Promise<void>;
-    /** Tear down every offer + reconnect connection and served channel. */
-    shutdown(): Promise<void>;
-}
-/**
- * Read-only snapshot of `pairings.json` for callers that just want the
- * persisted records — no `dial`/`serve`/`loadIdentity` deps, no rendezvous
- * connections started (e.g. `agentproto doctor`'s devices check). Mirrors
- * `ensureLoaded`'s parse + v1-legacy flagging; never throws — a missing or
- * malformed file just yields `[]`.
- */
-declare function readPairingsSnapshot(path?: string): Promise<PairingRecord[]>;
-declare function createPairingRegistry(deps: PairingRegistryDeps): PairingRegistry;
-
 /**
  * Daemon-side HOST registry (DEVICES-PLAN PR-C) — the "client" half of
  * pair/v2, living on the daemon so it's reachable over both an HTTP route
@@ -843,16 +657,40 @@ declare function createPairingRegistry(deps: PairingRegistryDeps): PairingRegist
  *
  * ## Online tracking
  *
- * `isOnline(fingerprint)` mirrors `PairingRegistry.isOnline`: it's true only
- * while a `forwardHttp()` call for that fingerprint is in flight (a
- * reference count, incremented on dial and decremented in a `finally`).
- * There is no live probe backing `list()` — that would make `devices list`
- * slow/flaky over N hosts — so `list()`'s `online` is only ever true
- * immediately after (or during) an actual `forwardHttp`/`devices status`
- * call, never a background heartbeat. That's enough to make `devices list`
- * show the right thing right after `devices status`/`exec`, which is what
- * matters for this PR; a standing/autoconnect host connection with a real
- * liveness signal is PR-D's to build.
+ * `isOnline(fingerprint)` is true while a `forwardHttp()` call for that
+ * fingerprint is in flight (a reference count, incremented on dial and
+ * decremented in a `finally`), OR within `onlineGraceMs` of the last time a
+ * dial to it actually succeeded (an `add()` handshake, a `forwardHttp`, or a
+ * background snapshot poll). There is no live probe backing `list()` — that
+ * would make `devices list` slow/flaky over N hosts — so a host answering
+ * every ~15s snapshot poll stays online, and one that stops answering
+ * decays to offline after the grace window. Every contact attempt stamps
+ * `lastProbeAt`; a failed one records `lastError` (cleared by the next success).
+ *
+ * ## Proactive session snapshots
+ *
+ * A join-token-added host (an ephemeral CI runner) lives ~3 minutes, far
+ * shorter than anyone watches it. So from the moment such a host joins, this
+ * registry polls it (`snapshotIntervalMs`, faster while one of its sessions
+ * is running) for its session list plus a capped output tail per session and
+ * keeps the result in memory. Once the host is offline, `getSessionsSnapshot`
+ * serves that — `stale: true` with the capture time. After
+ * `snapshotMaxFailures` consecutive unreachable polls the loop backs off
+ * exponentially (up to `probeBackoffMaxMs`) and keeps the last good capture;
+ * `start()` resumes the loop for every join-added host after a daemon
+ * restart, and background probes share a `probeConcurrency` cap.
+ * `snapshotNow()` lets a departing host trigger one last
+ * capture (see `join-token-registry.ts`'s goodbye hello).
+ *
+ * ## Ended hosts
+ *
+ * A join-added host is an ephemeral CI box, so it is marked `ended` when its
+ * goodbye arrives (`markEnded`) or when it has been unreachable for
+ * `endedTtlMs` (2 h), and deleted `endedRetentionMs` (7 d) after that.
+ * `sweep()` runs that pass (the daemon calls it on a timer; `list()` runs it
+ * too). Ended hosts are still returned by `list()` — hiding them from the
+ * default `device_list` is `device-registry.ts`'s job. A manually added host
+ * is never ended or deleted; `list()` only flags it `stale`.
  */
 
 /** `hosts.json` format. */
@@ -876,8 +714,26 @@ interface HostRecord {
     pairRoot: string;
     /** ISO-8601 first-add timestamp. */
     createdAt: string;
-    /** ISO-8601 of the most recent successful `forwardHttp`. */
+    /** ISO-8601 of the most recent successful contact (join, dial, background poll). */
     lastSeen: string;
+    /** ISO-8601 of the most recent contact attempt, successful or not. Not
+     *  persisted on every attempt — it rides along with the next write. */
+    lastProbeAt?: string;
+    /** Why the most recent contact attempt failed; cleared by the next success. */
+    lastError?: string;
+    /** A join-added host that is gone: it said goodbye, or was unreachable for
+     *  longer than `endedTtlMs`. Ended hosts are no longer polled, read offline,
+     *  and are deleted `endedRetentionMs` after `endedAt`. Never set on a
+     *  manually added host. */
+    ended?: true;
+    /** ISO-8601 of when the host ended (for a TTL end: when the TTL lapsed, not
+     *  when the sweep noticed). */
+    endedAt?: string;
+    endReason?: "goodbye" | "ttl";
+    /** Computed by `list()`, never persisted: a manually added host that has
+     *  been unreachable for longer than `endedTtlMs`. Stale hosts stay listed
+     *  and are never deleted — only join-added hosts are. */
+    stale?: true;
     /** Set on a host added under the retired pair/v1 protocol. Present for
      *  parity with `PairingRecord`/`ClientPairing`; pair/v1 offers are refused
      *  by `parseOfferUrl` before `add()` ever sees them, so this is currently
@@ -896,9 +752,9 @@ interface HostRecord {
      * `"manual"` for the human `pair offer --host` + `devices add` ceremony.
      * Absent on a record persisted before this field existed; treated as
      * `"manual"` (never auto-pruned) rather than assumed ephemeral. Only
-     * `"join"` hosts are eligible for the `joinedHostTtlMs` sweep in `list()`
-     * — a human's own paired machine must never silently disappear just
-     * because it hasn't been dialed in a week.
+     * `"join"` hosts are eligible for the ended/retention sweep — a human's
+     * own paired machine must never silently disappear just because it hasn't
+     * been dialed in a week.
      */
     addedVia?: "join" | "manual";
 }
@@ -929,16 +785,32 @@ interface HostRegistryDeps {
     /** Handshake ceiling per attempt. Default 15s. */
     handshakeTimeoutMs?: number;
     /**
-     * TTL (ms) for a join-token-added host (`HostRecord.addedVia === "join"`)
-     * that hasn't been seen since — swept opportunistically at the top of
-     * every `list()` call rather than on its own timer, since staleness here
-     * is an observability concern (an ephemeral CI box's `hosts.json` entry
-     * outliving it by weeks), not something anything blocks on. Default 7
-     * days. `0` disables pruning entirely. A manually-added host
-     * (`addedVia !== "join"`, including every record persisted before this
-     * field existed) is NEVER pruned, regardless of this setting.
+     * A join-added host (`HostRecord.addedVia === "join"`) unreachable for this
+     * long (ms since `lastSeen`) is marked `ended`. Default 2 h; `0` disables.
+     * Manually added hosts are never ended — `list()` only flags them `stale`.
      */
-    joinedHostTtlMs?: number;
+    endedTtlMs?: number;
+    /**
+     * An ended host is deleted this long (ms) after `endedAt`. Default 7 days;
+     * `0` keeps ended hosts forever. Only join-added hosts are ever deleted.
+     */
+    endedRetentionMs?: number;
+    /** Cadence (ms) of the proactive session snapshot poll for a join-added
+     *  host. Default 15s; `0` disables the poll (and `snapshotNow` becomes a
+     *  no-op that returns false). */
+    snapshotIntervalMs?: number;
+    /** Faster cadence used while a snapshotted session is running. Default 5s. */
+    snapshotActiveIntervalMs?: number;
+    /** Consecutive unreachable polls before the poll starts backing off. Default 3. */
+    snapshotMaxFailures?: number;
+    /** A host stays `online` for this long after a successful dial. Default 2 min. */
+    onlineGraceMs?: number;
+    /** Consecutive-failure poll backoff ceiling (ms). Default 5 min. */
+    probeBackoffMaxMs?: number;
+    /** Max background probes in flight across all hosts. Default 4. */
+    probeConcurrency?: number;
+    /** Min gap between disk writes for a `lastSeen`-only change. Default 30s. */
+    lastSeenPersistIntervalMs?: number;
 }
 interface ForwardHttpRequest {
     method: string;
@@ -1023,6 +895,31 @@ interface HostRegistry {
      * why that's an acceptable trade here.
      */
     getSessionsSnapshot(idOrName: string, path: string): ForwardHttpResponse | undefined;
+    /**
+     * Capture this host's session list + output tails right now (the same
+     * capture the background poll takes). Resolves true when the host was
+     * reached. Never throws; false for an unknown host, an unreachable one, or
+     * when snapshots are disabled.
+     */
+    snapshotNow(idOrName: string): Promise<boolean>;
+    /**
+     * Mark a join-added host ended right now (its CI job said goodbye). Stops
+     * its poll. Returns false for an unknown host or a manually added one,
+     * which is never ended. Idempotent.
+     */
+    markEnded(idOrName: string, reason?: "goodbye" | "ttl"): Promise<boolean>;
+    /**
+     * Run the lifecycle sweep now: mark join-added hosts ended past `endedTtlMs`,
+     * delete those ended past `endedRetentionMs`, persist if anything changed.
+     * Cheap (one pass over the in-memory map); `list()` runs the same pass.
+     */
+    sweep(): Promise<void>;
+    /**
+     * Load `hosts.json` and resume the background poll for every join-added
+     * host, so a daemon restart doesn't leave still-running CI boxes frozen at
+     * their join-time `lastSeen`. Idempotent; call once at boot.
+     */
+    start(): Promise<void>;
 }
 declare function createHostRegistry(deps: HostRegistryDeps): HostRegistry;
 
@@ -1170,6 +1067,17 @@ interface JoinTokenRegistryDeps {
      *  are logged and swallowed: a bad/unreachable offer from one join must not
      *  crash the standing accept loop. */
     addHost: (offerUrl: string, name?: string, meta?: HostJoinMeta) => Promise<unknown>;
+    /** Called when a joined box says goodbye just before it exits (see
+     *  `JoinHello.goodbye`), with its daemon fingerprint — normally
+     *  `hostRegistry.snapshotNow`, so the box's final session output is captured
+     *  while it can still answer. The box waits for this to settle (bounded on
+     *  its side), so it should not hang. Errors are logged and swallowed. */
+    flushHost?: (fingerprint: string) => Promise<unknown>;
+    /** Called after the goodbye's final capture (even if it failed), with the
+     *  same fingerprint — normally `hostRegistry.markEnded`, so a departed CI
+     *  box stops reading as a live host immediately. Errors are logged and
+     *  swallowed. */
+    endHost?: (fingerprint: string) => Promise<unknown>;
     /** Injectable clock (ms). Defaults to Date.now. */
     now?: () => number;
     /** Diagnostic log sink. */
@@ -1471,7 +1379,12 @@ interface InboundRouterDeps {
  * Supports the dialects documented in packages/runtime/docs/TRANSMITTER.md.
  */
 
-type InboundProvider = "agentpush" | "telegram" | "whatsapp" | "slack" | "generic" | "native";
+type InboundProvider = "agentpush" | "telegram" | "whatsapp" | "slack" | "generic" | "native"
+/** GitHub repo webhooks feeding the `webhook` sentinel provider (AIP-60).
+ *  Not a user-registrable endpoint dialect: `handleProviderInbound` routes
+ *  `/inbound/sentinel-<hookKey>` straight into the sentinel runtime, and the
+ *  provider verifies with this dialect's `X-Hub-Signature-256` check. */
+ | "sentinel";
 declare const INBOUND_PROVIDERS: readonly InboundProvider[];
 type NormalizeInboundResult = {
     ok: true;
@@ -2022,29 +1935,6 @@ declare function createActivityProjector(opts: {
     resolvePrState?: PrStateResolver;
 }): ActivityProjector;
 
-/**
- * `~/.agentproto/bundles.json` — named sets of imported MCPs + skills (+
- * optionally the daemon's own `/mcp`), attachable to any harness in one
- * `agent_start({bundles:["research"]})` call.
- *
- * Same load/save/atomic-write pattern as `user-presets.ts`; validation
- * against the live imported-MCP set is the single boundary every writer
- * (MCP tools, HTTP routes) goes through (`saveBundle`).
- */
-
-declare const bundlesFileSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    bundles: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        label: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        mcpImports: z.ZodArray<z.ZodString>;
-        includeDaemon: z.ZodOptional<z.ZodBoolean>;
-        skills: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-type BundlesFile = z.infer<typeof bundlesFileSchema>;
-
 /**
  * Spawn-time role profiles — the primitive that decides whether a
  * spawned agent may itself delegate (spawn further children).
@@ -2177,225 +2067,6 @@ type DeviceProbeResult = {
     message: string;
 };
 
-/**
- * Policy layer for `agent_start.worktree` — the config-driven decision of
- * WHETHER to isolate a spawn into its own git worktree, kept deliberately
- * separate from HOW one is provisioned.
- *
- * This module holds no dependency on `@agentproto/worktree`. Same reasoning
- * as `worktree-identity.ts`'s docblock, only stronger: provisioning runs the
- * `worktree.provision` TOOL (git + the base tree's `agentproto.json` setup
- * hooks), which would drag the driver/harness/provider graph into
- * `@agentproto/runtime` for a capability the runtime only ever *triggers*.
- * So the concrete provisioner is an INJECTED PORT ({@link WorktreeProvisioner})
- * wired at the composition root by a host that already depends on the
- * worktree package (the CLI). The runtime owns only the pure decision
- * ({@link decideWorktreeIsolation}) and the config/env resolution
- * ({@link loadWorktreeIsolation}) — both trivially unit-testable without git.
- *
- * Mirrors `agent_start.sandbox`'s `resolveSandboxProvider` injection shape,
- * except sandbox can default its resolver inside the runtime (the runtime
- * depends on `@agentproto/sandbox`); worktree cannot, so an unwired daemon
- * simply has no provisioner and a spawn that would need one fails loud rather
- * than silently spawning unisolated.
- */
-
-/** Env override for the isolation policy. Highest-priority source, ahead of
- *  the `worktrees.isolation` config field — see `loadWorktreeIsolation`. */
-declare const WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
-/** The default when nothing is configured. Back-compat-preserving: a caller
- *  that passes no `worktree` field spawns exactly where it asked. */
-declare const DEFAULT_WORKTREE_ISOLATION: WorktreeIsolationMode;
-/**
- * The `agent_start.worktree` field. `true` isolates with an auto-minted slug;
- * an object additionally pins the slug and/or base ref, and can opt into
- * async provisioning (`async: true` — see `WorktreeRequest.async`); `false`
- * (or omitted) is "no explicit request" — the policy mode decides.
- */
-type WorktreeField = boolean | {
-    slug?: string;
-    base?: string;
-    async?: boolean;
-};
-/** The caller's explicit request, normalized — `undefined` when the field is
- *  absent or `false`, otherwise the (possibly empty) slug/base overrides. */
-interface WorktreeRequest {
-    slug?: string;
-    base?: string;
-    /** Return a real, registered session as soon as it's minted, provisioning
-     *  the worktree in the BACKGROUND instead of blocking `agent_start`'s
-     *  response on `git worktree add` + the repo's setup hooks (which can run
-     *  minutes — see `session-spawn.ts`'s async-provision branch).
-     *
-     *  DEFAULTS TO TRUE for any spawn that provisions a worktree, UNLESS this
-     *  spawn also carries `wait` (which needs a first turn to block on — see
-     *  `worktree_async_wait_conflict` — so the presence of `wait` alone falls
-     *  back to the synchronous path rather than conflicting by default). That
-     *  default is applied by `session-spawn.ts` itself (WP-H), not by this
-     *  field or `normalizeWorktreeField` — the normalizer leaves `async`
-     *  exactly as the caller sent it (`undefined` when omitted; see its own
-     *  test), so a caller inspecting the normalized request never sees a
-     *  value it didn't write. WP-H incident: the synchronous contract this
-     *  field opts OUT of — hold the RPC open for however long setup hooks
-     *  take, routinely minutes — is exactly what let a client's own request
-     *  timeout retry into a second live agent sharing the first one's
-     *  worktree (closed on the other side too — see `session-spawn.ts`'s
-     *  `findWorktreeLabelCwdCollision`, which now refuses that retry outright
-     *  rather than merely warning). Pass `false` explicitly to keep the old
-     *  blocking ok/fail contract (this package's own `worktree_provision_failed`
-     *  test coverage exercises it deliberately synchronous). */
-    async?: boolean;
-}
-/** What the runtime hands the provisioner. `cwd` is where the session would
- *  otherwise spawn; the provisioner resolves the owning repo from it. */
-interface WorktreeProvisionRequest {
-    cwd: string;
-    /** Explicit slug from the caller; omitted ⇒ the provisioner mints a
-     *  collision-free one (see the host implementation). */
-    slug?: string;
-    /** Base ref the worktree branch is cut from; omitted ⇒ the provisioner's
-     *  default (`origin/main`). */
-    base?: string;
-    /** Free-text label (the session's `label`) the provisioner may fold into a
-     *  minted slug for human readability. Never load-bearing for correctness. */
-    labelHint?: string;
-    /** Absolute path the provisioner should append the setup hooks' FULL
-     *  stdout+stderr to (see `worktree.provision`'s `setupLogPath` input and
-     *  `@agentproto/worktree`'s `runSetup`). `session-spawn.ts` passes the
-     *  spawning session's own transcript dir here, so a failing setup hook's
-     *  full output survives even after a subsequently-reclaimed worktree is
-     *  gone — the short `HookError` message alone only carries a filtered
-     *  tail. Omitted callers (e.g. `agentproto worktree new`, no session to
-     *  log into) simply get no persisted log. */
-    setupLogPath?: string;
-    /** Re-run a failing `worktree.setup` command exactly once before giving
-     *  up — see `worktree.provision`'s `retrySetupOnFailure` input and
-     *  `runSetup`'s doc for why this is a bounded complement, not a
-     *  substitute, and why the daemon opts in while `agentproto worktree new`
-     *  doesn't. */
-    retrySetupOnFailure?: boolean;
-}
-/** The provisioner's outcome. `isolated: false` is NOT a failure — it means
- *  there was nothing to isolate (`cwd` sits in no git repo), and the caller
- *  should spawn plain at the original cwd. A genuine failure throws. */
-type WorktreeProvisionOutcome = {
-    isolated: true;
-    cwd: string;
-    branch: string;
-} | {
-    isolated: false;
-    reason: "not-a-git-repo";
-};
-/**
- * Injected port: provision a git worktree for `req.cwd` and return the
- * worktree's own cwd for the spawn to land in. Wired at the composition root
- * by the CLI (over `@agentproto/worktree`); absent on a bare runtime.
- */
-type WorktreeProvisioner = (req: WorktreeProvisionRequest) => Promise<WorktreeProvisionOutcome>;
-/**
- * Injected port: best-effort attempt to reclaim ONE worktree by path, called
- * when its session reaches a terminal state (see
- * `SessionDescriptor.worktreeAutoProvisioned` and `createSessionsRegistry`'s
- * `runWorktreeAutoReclaim` option in `sessions.ts`). Deliberately scoped to
- * exactly the one path a session's own exit is allowed to touch — never a
- * repo-wide sweep. The implementation (wired by the CLI over
- * `@agentproto/worktree`'s `reclaimOneWorktree`) re-classifies fresh and only
- * ever removes the worktree when that comes back `reclaim` (merged-or-fresh,
- * clean, idle) — a dirty or held worktree is simply left alone. Must never
- * reject in a way the caller can't safely ignore; `sessions.ts` treats any
- * rejection as "couldn't reclaim this time, leave it for a manual or
- * scheduled `gc` sweep" and logs rather than lets it interrupt session
- * teardown. Absent on a bare runtime — auto-reclaim is simply skipped, and a
- * caller-explicit worktree request is never routed through this port at all
- * (see `WorktreeDecision.provision.implicit`).
- */
-type WorktreeAutoReclaimer = (worktreePath: string) => Promise<void>;
-/** The pure decision's three outcomes. `spawn-in-place` may carry a `warn`:
- *  a non-fatal notice the caller should surface (the child is about to run in
- *  a shared, dirty checkout it doesn't own). A `warn` never blocks the spawn —
- *  it's the loud-but-legitimate middle ground between silently spawning into a
- *  shared tree and hard-rejecting an in-place spawn that's normal at depth.
- *  `provision.implicit` is `true` exactly when the caller made no explicit
- *  `worktree` request and the `"always"` policy provisioned one anyway (the
- *  worktree the caller never asked to keep) — `false` whenever the request
- *  came from the caller itself (`on-request`'s only path here, or `"always"`
- *  with an explicit field). This is the signal `session-spawn.ts` threads
- *  onto the session descriptor so exit-time auto-reclaim (`sessions.ts`)
- *  only ever touches a worktree the daemon minted on its own — a worktree a
- *  caller explicitly asked to keep is never auto-removed. */
-type WorktreeDecision = {
-    action: "spawn-in-place";
-    warn?: string;
-} | {
-    action: "provision";
-    request: WorktreeRequest;
-    implicit: boolean;
-} | {
-    action: "reject";
-    message: string;
-};
-/**
- * Normalize the raw field into an explicit request, or `undefined` when the
- * caller made no request (`false` / omitted). An object with no overrides
- * still counts as a request (`{}`) — the caller opted in, just without pins.
- */
-declare function normalizeWorktreeField(field: WorktreeField | undefined): WorktreeRequest | undefined;
-/**
- * The resolution matrix — mode × explicit-request × depth — with no side
- * effects. Every branch is exercised in `worktree-isolation.test.ts`.
- *
- * Depth-0 gate: a nested spawn (`depth > 0`, i.e. made through the scoped
- * orchestrator sub-gateway) NEVER provisions a worktree of its own — it
- * inherits its parent's ground, per AIP-46 §Delegation. This bites before
- * the mode is even consulted, so `always` too provisions only at the root.
- * But "never provisions" is NOT "silently ignore an explicit request": a
- * nested caller that passes an EXPLICIT `worktree` (`true` / `{slug}`) asked
- * for isolation and would silently get none — the spawn quietly runs in the
- * shared checkout, exactly the footgun that nearly clobbered a shared tree.
- * So an explicit request at depth > 0 is REJECTED loudly (same shape as the
- * `never`-policy reject below), pointing the caller at sandbox isolation —
- * child isolation is the sandbox, not a second worktree. Only the IMPLICIT/
- * absent case (`undefined` / `false`) stays an in-place spawn: the child is
- * meant to share the parent's tree and made no request to the contrary.
- *
- * That implicit case still has a footgun, though: the inherited cwd may be a
- * LIVE, DIRTY, shared checkout (the real repo, not a daemon-provisioned
- * worktree) — spawning in place there lets a nested child edit a tree someone
- * else is actively working in. We don't hard-reject it (implicit in-place is
- * legitimate and common), but we DON'T stay silent either: when the caller
- * hands us `sharedDirtyCwd` (an impure signal it computed — see
- * `session-spawn.ts`), the in-place spawn carries a `warn`. A caller that
- * genuinely intends it passes `allowSharedCwd` to acknowledge and silence the
- * warning. The signal is only consulted for the implicit nested case; every
- * other branch ignores it, keeping the root matrix unchanged.
- */
-declare function decideWorktreeIsolation(input: {
-    mode: WorktreeIsolationMode;
-    field: WorktreeField | undefined;
-    depth: number;
-    /** Impure signal, computed by the caller (never inside this pure fn): the
-     *  inherited cwd is a git work tree that is DIRTY and NOT a daemon-
-     *  provisioned worktree — i.e. a shared checkout the child would edit in
-     *  place. Only consulted for an implicit nested spawn. */
-    sharedDirtyCwd?: boolean;
-    /** Caller's explicit acknowledgement that spawning into a shared dirty cwd
-     *  is intended — silences the `sharedDirtyCwd` warning. */
-    allowSharedCwd?: boolean;
-}): WorktreeDecision;
-/** Parse a raw string into a valid mode, or `undefined` when it isn't one. */
-declare function parseWorktreeIsolationMode(raw: string | undefined): WorktreeIsolationMode | undefined;
-/**
- * Resolve the effective isolation mode: env > config field > default. Mirrors
- * `resolveWorktreesRoot`'s precedence (there's no flag layer — this is read
- * daemon-side at spawn, not from an invocation). Never throws: an unreadable
- * config falls through to the default.
- */
-declare function loadWorktreeIsolation(loadCfg?: () => Promise<{
-    worktrees?: {
-        isolation?: WorktreeIsolationMode;
-    };
-}>): Promise<WorktreeIsolationMode>;
-
 /**
  * Policy layer for `agent_start.attach` — the config-driven decision of WHO a
  * spawn nests under, kept deliberately separate (and pure) from the spawn
@@ -2548,7 +2219,9 @@ interface SpawnAgentSessionDeps {
      *  line. Defaults to the real resolver over `loadAgentsMdInlineMaxKb`'s
      *  config-derived threshold when omitted; tests inject a stub to avoid
      *  touching the filesystem, git, and the real config on every spawn. */
-    resolveAgentsMd?: (cwd: string, inlineMaxKb?: number) => Promise<AgentsMdResolution>;
+    resolveAgentsMd?: (cwd: string, inlineMaxKb?: number, opts?: {
+        stopAt?: string;
+    }) => Promise<AgentsMdResolution>;
     /** Resolves + shapes the per-workspace RULES.md for a spawn (see
      *  `workspace-rules.ts`): the path of the workspace's `RULES.md`, inlined
      *  in full when present, absent otherwise. Injected into EVERY spawn in
@@ -2639,6 +2312,18 @@ interface SpawnAgentSessionInput {
      *  the model driving the session has no way to know its own appId unless
      *  told. Absent on a spawn made outside `app_run`. */
     appId?: string;
+    /**
+     * Filesystem boundary for this spawn (see `app-boundary.ts`): app source
+     * read-only, run workspace + data dir writable, the rest denied. Set by
+     * `app_run` and by app-workflow agent steps; a child spawned by an
+     * already-boundaried session inherits its parent's boundary instead (this
+     * field cannot widen it). Makes the spawn: refuse `worktree`, resolve
+     * AGENTS.md no higher than the boundary root, isolate host CLAUDE.md, and
+     * either confine the harness's native tools through the OS sandbox or
+     * warn / refuse (`boundaries.enforce: "required"`) — never silently
+     * downgrade.
+     */
+    appBoundary?: AppBoundary;
     /** Reattach to a pre-existing adapter-native session (claude-code's
      *  conversation id, hermes' chat handle, …) instead of starting
      *  blank. Not exposed on the MCP `agent_start` tool today — only the
@@ -3402,7 +3087,30 @@ type AgentAdapterResolver = (slug: string) => Promise<{
          *  read-only grant; writes and sibling reads stay denied. Adapters
          *  that can't model the grant ignore it. */
         additionalReadPaths?: string[];
+        /** App-boundary filesystem zones (app source read-only, run workspace +
+         *  data dir writable, `hidden` denied) for the adapter's OWN process
+         *  tree — forwarded to the driver's `runtime.start({ fsZones })`, which
+         *  confines it through the OS sandbox (always engaged; refuses
+         *  `commandSandbox: "off"`) and, on claude-code, registers the writable
+         *  zones as `additionalDirectories`. Only passed to adapters whose
+         *  resolver entry sets `supportsFsZones`. */
+        fsZones?: {
+            readOnly: string[];
+            writable: string[];
+            hidden?: string[];
+        };
+        /** Don't load the host repo's CLAUDE.md/AGENTS.md above the session cwd
+         *  (claude-code: `claudeMdExcludes`). Only passed to adapters whose
+         *  resolver entry sets `supportsHostContextIsolation`. */
+        isolateHostContext?: boolean;
     }): Promise<AgentSessionLike>;
+    /** True when `startSession` honours `fsZones` (native tools confined by the
+     *  OS sandbox). Omitted/false ⇒ an app-boundary spawn on this adapter gets
+     *  an explicit `session:harness-warning` (or is refused when the app
+     *  declares `boundaries.enforce: "required"`). */
+    supportsFsZones?: boolean;
+    /** True when `startSession` honours `isolateHostContext`. */
+    supportsHostContextIsolation?: boolean;
     /** Display label for the descriptor's `command` field. */
     commandPreview?: string;
     /** Best-effort per-session usage reader (adapter-specific, e.g. hermes
@@ -3719,6 +3427,41 @@ interface BrowserAdapterInfo {
     defaultPort: number;
 }
 
+/**
+ * `model_roles` — read-only MCP tool listing every model role, the model it
+ * resolves to right now, and which layer supplied it. The precedence itself
+ * (input > workspace > daemon > built-in default) is defined once, in
+ * `model-roles.ts`; this file only loads the layers and exposes the result.
+ *
+ * Workflow `tool` steps call it (the daemon's `dispatchTool` reaches every
+ * root-`/mcp` tool) to resolve a role at RUN time — a workflow's own
+ * `reviewModelSmall`-style input is passed as `inputs` so an explicit input
+ * still wins, and the tool reports `source: "input"` for it.
+ *
+ * Registered on the root `/mcp` server only, next to `config_get`.
+ */
+
+interface ModelRolesInput {
+    /** Narrow to these roles. Omit for every built-in + configured role. */
+    roles?: string[] | undefined;
+    /** Explicit per-role values (layer 1) — e.g. a workflow's own inputs. */
+    inputs?: Record<string, unknown> | undefined;
+    /** Repo whose `agentproto.json` `models` is the workspace layer. */
+    repoRoot?: string | undefined;
+    /** Workspace slug (resolved to its path). The active workspace when both are omitted. */
+    workspaceSlug?: string | undefined;
+}
+interface ModelRolesOutput {
+    roles: ResolvedModelRole[];
+    /** role → resolved model id, for a workflow `$steps.<id>.models["review.small"]`-style read. */
+    models: Record<string, string>;
+    /** Directory whose `agentproto.json` supplied the workspace layer, when one was found. */
+    workspaceRoot?: string;
+    precedence: readonly string[];
+}
+/** `models` from `<root>/agentproto.json`; undefined when absent/unreadable/malformed. */
+declare function loadWorkspaceModelRoles(root: string): Promise<Record<string, unknown> | undefined>;
+
 /**
  * Bounded eager resume-on-boot pass (session-survivability plan §5, PR-4).
  *
@@ -4177,6 +3920,12 @@ interface InboundWatcher {
  * adapter's own already-installed package by its `packageName`.
  */
 
+/** How a harness reaches one imported MCP by default:
+ *  - `native`   — a default bundle mounts it as a native mcpServers entry;
+ *  - `indirect` — only via the daemon's own `/mcp` (`mcp_imported_call`),
+ *                 which the harness gets by default / config / bundle;
+ *  - `none`     — no default path (still reachable on request). */
+type ImportedMcpReach = "native" | "indirect" | "none";
 interface CapabilitiesInventoryImportedMcp {
     id: string;
     alias?: string;
@@ -4188,6 +3937,38 @@ interface CapabilitiesInventoryImportedMcp {
     /** Only present when `status === "connected"` — never connects just to count. */
     toolCount?: number;
     usedBySessions: string[];
+    /** `live` re-reads the source harness config; `snapshot` uses the stored copy. */
+    resolve?: "live" | "snapshot";
+    /** Set when the last resolution fell back (source missing / secret unresolved). */
+    stale?: {
+        reason: string;
+    };
+    /** Header/env KEY names held behind secret refs (never values). */
+    secretRefKeys?: {
+        headers?: string[];
+        env?: string[];
+    };
+    /** Per installed adapter: how it reaches this import with NO per-spawn
+     *  arguments (resolved default bundles + daemon self-mount default). */
+    reach: Record<string, ImportedMcpReach>;
+    /** Double-mount report (P3): OTHER discovered harness-config entries that
+     *  point at the same upstream as this import, i.e. a harness likely
+     *  mounts it natively AND through the daemon. Omitted when none. Identity
+     *  fields only — never url/command/args/headers/env.
+     *  `sameName` = the slugified alias equals the native name (claude-code
+     *  then shadows one with the other: no duplicate tools, but they may
+     *  silently be different servers/creds).
+     *  Limitation: discovery scans the host configs + registered workspaces
+     *  only; a session's own cwd `.mcp.json` outside a registered workspace is
+     *  NOT seen here (only `mcp-app-resolve` sees it). Report only — nothing
+     *  is rewritten. */
+    alsoNativeIn?: CapabilitiesInventoryAlsoNative[];
+}
+interface CapabilitiesInventoryAlsoNative {
+    source: string;
+    scope: string;
+    name: string;
+    sameName: boolean;
 }
 interface CapabilitiesInventoryDiscoveredMcp {
     id: string;
@@ -4923,6 +4704,7 @@ interface FindComposeCandidateInput {
      *  (non-pack) check — nothing extra to require. */
     packDigest?: {
         id: string;
+        alg: string;
         sha256: string;
     };
     baseSha: string;
@@ -5391,6 +5173,80 @@ declare function makeBrowserAdapterLister(opts: {
     listBrowserAdapters: BrowserAdapterLister;
     resolveBrowserAdapter?: BrowserAdapterResolver;
 }): AdapterLister<BrowserAdapterInfo>;
+/**
+ * The one built-in adapter table the daemon, the HTTP route and the CLI share:
+ * the `@agentproto/adapter-browser` facade (kit providers camofox, bureau,
+ * chromium behind the legacy handle shape). Hosts that want a different set
+ * still inject their own `resolveBrowserAdapter` / `listBrowserAdapters`.
+ */
+declare function defaultBrowserAdapterResolution(): {
+    resolveBrowserAdapter: BrowserAdapterResolver;
+    listBrowserAdapters: BrowserAdapterLister;
+};
+/** Ids of the built-in adapters, for "not found, available: ..." messages. */
+declare function defaultBrowserAdapterIds(): string[];
+
+/**
+ * `projectBrowserTools`: project a kit `BrowserInstance` (from
+ * `@agentproto/driver-browser`) onto the page-level `browser_*` MCP tools.
+ *
+ * MCP only. The SDK stays the existing typed client. The lifecycle tools
+ * (`start_browser`, `browser_status`, ...) live in `browser-tools.ts` and are
+ * untouched; this module adds the page-control set on top of an instance:
+ *
+ *   browser_navigate, browser_evaluate, browser_click, browser_fill,
+ *   browser_screenshot, browser_get_dom, browser_list_requests,
+ *   browser_get_request_body, browser_cdp_send
+ *
+ * Capability gating is declarative (`BROWSER_TOOL_GATES` in the kit, AIP-14
+ * capability gate): a tool whose capability the provider lacks answers with a
+ * typed `browser:unsupported` error result naming the capability, before any
+ * driver is attached. It is never a crash and never an empty success.
+ */
+
+/** What the projection needs to know about the provider that owns the instance. */
+type ProjectedProvider = Pick<BrowserProvider, "id"> & {
+    capabilities: Partial<BrowserCapabilities>;
+};
+/** Result of one projected tool call, MCP `CallToolResult` compatible. */
+interface ProjectedToolResult {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent: Record<string, unknown>;
+    isError?: true;
+    [key: string]: unknown;
+}
+interface ProjectedBrowserTool {
+    /** MCP tool name, e.g. `browser_list_requests`. */
+    name: string;
+    description: string;
+    /** Kit tool id used for the capability gate, e.g. `browser.list_requests`. */
+    gateId: string;
+    inputSchema: z.ZodObject<z.ZodRawShape>;
+    call(input: unknown): Promise<ProjectedToolResult>;
+}
+interface ProjectBrowserToolsOptions {
+    /** The provider that launched `instance` (its manifest capabilities gate the tools). */
+    provider: ProjectedProvider;
+    /** Passed to `instance.attach()` on the first tool call. */
+    attach?: BrowserAttachOptions;
+    /**
+     * Writes bytes to a path on the host and returns the resolved path. Needed
+     * only for `path` on `browser_screenshot` and `browser_get_dom`; without it
+     * those calls fail with a clear message instead of writing anywhere.
+     */
+    writeArtifact?: (path: string, bytes: Buffer) => string;
+}
+interface ProjectedBrowserTools {
+    tools: readonly ProjectedBrowserTool[];
+    /** Register every projected tool on an MCP server. */
+    register(server: McpServer): void;
+    /** Close the lazily attached driver, if any. Safe to call twice. */
+    close(): Promise<void>;
+}
+declare function projectBrowserTools(instance: BrowserInstance, opts: ProjectBrowserToolsOptions): ProjectedBrowserTools;
 
 /**
  * AIP-36 `sandbox attach` — Phase 1: CONNECT to an already-existing sandbox
@@ -5759,6 +5615,288 @@ interface SandboxReconcileResult {
  */
 declare function reconcileSandboxLedger(deps: SandboxReconcileDeps): Promise<SandboxReconcileResult>;
 
+/**
+ * Host-level load report - answers "why is this machine on its knees" without
+ * a hand-run `top` / `vm_stat` / `iostat` / `ps` / `lsof` session.
+ *
+ * One collector (`createHostLoadService`) gathers, in parallel and each under
+ * a hard timeout so the whole call stays inside a small budget even at load
+ * 500:
+ *
+ *   - load average vs core count, CPU user/sys/idle
+ *   - RAM used / wired / compressor / cached / free, swap used
+ *   - per-disk transfers/s and MB/s
+ *   - the process table, attributed to sessions with the same rules as
+ *     `session_stats` (`process-stats.ts`), plus per-process memory footprint
+ *     including compressed pages where the OS exposes it
+ *   - listening TCP ports and (for a handful of suspects) the cwd, to spot
+ *     deleted-cwd loops and duplicate dev servers
+ *
+ * and turns them into WARNINGS: swap pressure, reparented (ppid 1) leftovers
+ * that are old and busy or serving, deleted-cwd processes, filesystem-wide
+ * scans, several servers on one port, load far above the core count.
+ *
+ * macOS shells out to `vm_stat`, `sysctl vm.swapusage`, `iostat`, `top`, `ps`,
+ * `lsof`; Linux reads `/proc` (+ `ps`, `ss`). Nothing needs sudo. A probe that
+ * is missing, denied or too slow is skipped and named in `partial` - the rest
+ * of the report still ships. The collector is exported (`getHostLoadService`,
+ * `createHostLoadService`) so a scheduler can gate heavy jobs on it.
+ */
+
+type HostLoadDetail = "summary" | "full";
+interface HostLoadCpu {
+    userPercent: number;
+    sysPercent: number;
+    idlePercent: number;
+    source: "iostat" | "top" | "proc-stat";
+}
+interface HostLoadMemory {
+    totalBytes: number;
+    /** App + wired + compressed (Activity Monitor's "Memory Used"). Absent when
+     *  the platform gives no such split. */
+    usedBytes?: number;
+    wiredBytes?: number;
+    /** Bytes physically occupied by the compressor (macOS). */
+    compressorBytes?: number;
+    /** File cache + purgeable pages. */
+    cachedBytes?: number;
+    /** Never-touched pages only. */
+    freeBytes: number;
+    /** Free + reclaimable: what a new job can actually get without swapping. */
+    availableBytes: number;
+}
+interface HostLoadSwap {
+    totalBytes: number;
+    usedBytes: number;
+    freeBytes: number;
+    percent: number;
+}
+interface DiskLoad {
+    name: string;
+    /** Transfers per second over the sampling interval. */
+    tps: number;
+    mbPerSec: number;
+    /** Average KB per transfer, when the OS reports it. */
+    kbPerTransfer?: number;
+}
+type HostProcessOwner = {
+    kind: "session";
+    sessionId: string;
+    label?: string;
+    detached?: boolean;
+} | {
+    kind: "daemon";
+} | {
+    kind: "provisioning";
+}
+/** Reparented to init by a session that is gone (or never was one). */
+ | {
+    kind: "orphan";
+    sessionHint?: string;
+}
+/** OS services and installed apps. */
+ | {
+    kind: "system";
+}
+/** Anything else: the operator's own shells, editors, other users. */
+ | {
+    kind: "other";
+};
+interface HostProcess {
+    pid: number;
+    ppid: number;
+    uid: number;
+    /** Normalized name (`pnpm install`, `vitest`, `node`, ...). */
+    command: string;
+    /** Raw command line, truncated. */
+    args: string;
+    rssBytes: number;
+    /** Footprint including compressed pages when measured, else RSS. */
+    memoryBytes: number;
+    memorySource: "footprint" | "rss";
+    /** Bytes of this process the OS has compressed / swapped out. */
+    compressedBytes?: number;
+    cpuPercent: number;
+    elapsedSec: number;
+    owner: HostProcessOwner;
+    /** TCP ports it listens on. */
+    listening?: number[];
+    /** Its cwd was deleted out from under it. */
+    cwdDeleted?: boolean;
+}
+type HostWarningKind = "swap" | "load" | "orphan" | "deleted-cwd" | "fs-scan" | "duplicate-port";
+interface HostWarning {
+    kind: HostWarningKind;
+    severity: "warn" | "critical";
+    message: string;
+    pids?: number[];
+}
+interface HostSessionRollup {
+    sessionId: string;
+    label?: string;
+    rssBytes: number;
+    memoryBytes: number;
+    cpuPercent: number;
+    procCount: number;
+}
+interface HostLoadReport {
+    sampledAt: string;
+    detail: HostLoadDetail;
+    /** Wall time the collection took. */
+    elapsedMs: number;
+    /** Probes that failed, timed out or were skipped; the rest is still valid. */
+    partial: string[];
+    platform: NodeJS.Platform;
+    loadAvg: [number, number, number];
+    cpuCount: number;
+    /** 1-minute load divided by core count. */
+    loadPerCore: number;
+    cpu?: HostLoadCpu;
+    memory: HostLoadMemory;
+    swap?: HostLoadSwap;
+    disks: DiskLoad[];
+    topByCpu: HostProcess[];
+    topByMemory: HostProcess[];
+    warnings: HostWarning[];
+    /** `detail: "full"` only. */
+    sessions?: HostSessionRollup[];
+    /** `detail: "full"` only: every process, largest memory first. */
+    processes?: HostProcess[];
+    /** Subtree-scoped caller: only its own sessions' processes are listed. */
+    scoped?: true;
+}
+/** Per-process memory from `top -l 1 -stats pid,mem,cmprs`: `mem` is the
+ *  resident part, `cmprs` the compressed part; footprint is their sum. */
+interface Footprint {
+    memoryBytes: number;
+    compressedBytes: number;
+}
+interface HostLoadThresholds {
+    swapWarnPercent: number;
+    swapCriticalPercent: number;
+    /** Reparented processes younger than this are not flagged. */
+    orphanMinAgeSec: number;
+    orphanCpuPercent: number;
+    /** 1-minute load / cores above which the host is flagged. */
+    loadPerCoreLimit: number;
+}
+declare const DEFAULT_HOST_LOAD_THRESHOLDS: HostLoadThresholds;
+declare function describeOwner(o: HostProcessOwner): string;
+interface HostWarningInput {
+    loadAvg: readonly [number, number, number];
+    cpuCount: number;
+    swap?: HostLoadSwap;
+    processes: readonly HostProcess[];
+    homeDir: string;
+    thresholds?: Partial<HostLoadThresholds>;
+}
+declare function computeHostWarnings(input: HostWarningInput): HostWarning[];
+/** Raw inputs of a Linux CPU/disk sample: two reads of `/proc/stat` and
+ *  `/proc/diskstats`. */
+interface LinuxCpuDiskSample {
+    statBefore: string;
+    statAfter: string;
+    diskBefore: string;
+    diskAfter: string;
+    intervalSec: number;
+}
+interface CwdInfo {
+    path: string;
+    deleted: boolean;
+}
+/** Every external read the collector performs. Each takes the time (ms) it may
+ *  spend; a probe that is not applicable on the platform is left undefined. */
+interface HostProbes {
+    platform: NodeJS.Platform;
+    table: (timeoutMs: number) => Promise<ProcRow[]>;
+    vmStat?: (timeoutMs: number) => Promise<string>;
+    swapUsage?: (timeoutMs: number) => Promise<string>;
+    iostat?: (timeoutMs: number) => Promise<string>;
+    top?: (timeoutMs: number) => Promise<string>;
+    meminfo?: (timeoutMs: number) => Promise<string>;
+    cpuDisk?: (timeoutMs: number) => Promise<LinuxCpuDiskSample>;
+    listeners?: (timeoutMs: number) => Promise<string>;
+    cwds?: (pids: readonly number[], timeoutMs: number) => Promise<Map<number, CwdInfo>>;
+    smaps?: (pids: readonly number[], timeoutMs: number) => Promise<Map<number, Footprint>>;
+    envHints?: (pids: readonly number[], timeoutMs: number) => Promise<Map<number, string>>;
+    /** Pids of the child processes the probes themselves spawned, so they are
+     *  not billed as host load. */
+    ownPids?: () => ReadonlySet<number>;
+    loadAvg?: () => [number, number, number];
+    cpuCount?: () => number;
+    totalMem?: () => number;
+}
+declare function createDefaultHostProbes(): HostProbes;
+interface HostSample {
+    at: number;
+    budgetMs: number;
+    elapsedMs: number;
+    partial: string[];
+    platform: NodeJS.Platform;
+    loadAvg: [number, number, number];
+    cpuCount: number;
+    cpu?: HostLoadCpu;
+    memory: HostLoadMemory;
+    swap?: HostLoadSwap;
+    disks: DiskLoad[];
+    table: ProcRow[];
+    footprints: Map<number, Footprint>;
+    listeners: Map<number, number[]>;
+    cwds: Map<number, CwdInfo>;
+    envHints: Map<number, string>;
+}
+declare const DEFAULT_HOST_LOAD_BUDGET_MS = 1900;
+/**
+ * Run every probe under the budget and fold the results into one sample. A
+ * failed probe is recorded in `partial` and its section left empty.
+ */
+declare function collectHostSample(probes: HostProbes, sessions: readonly StatsSessionDescriptor[], opts?: {
+    budgetMs?: number;
+    now?: () => number;
+    uid?: number;
+    daemonPid?: number;
+}): Promise<HostSample>;
+interface BuildHostLoadOptions {
+    sessions: readonly StatsSessionDescriptor[];
+    detail?: HostLoadDetail;
+    daemonPid?: number;
+    uid?: number;
+    homeDir?: string;
+    provisions?: readonly ProvisionInFlight[];
+    /** Restrict to these sessions' processes (subtree-scoped MCP caller). */
+    visible?: ReadonlySet<string>;
+    thresholds?: Partial<HostLoadThresholds>;
+    topN?: number;
+}
+/** Fold a sample plus the session registry into the report. Pure. */
+declare function buildHostLoadReport(sample: HostSample, opts: BuildHostLoadOptions): HostLoadReport;
+interface HostLoadServiceOptions {
+    probes?: HostProbes;
+    tracker?: ProvisionTracker;
+    daemonPid?: number;
+    uid?: number;
+    homeDir?: string;
+    /** How long a sample is reused. Default 2000 ms. */
+    ttlMs?: number;
+    /** Default per-call budget. */
+    budgetMs?: number;
+    now?: () => number;
+}
+interface HostLoadService {
+    report(sessions: readonly StatsSessionDescriptor[], opts?: {
+        detail?: HostLoadDetail;
+        fresh?: boolean;
+        budgetMs?: number;
+        visible?: ReadonlySet<string>;
+        thresholds?: Partial<HostLoadThresholds>;
+    }): Promise<HostLoadReport>;
+}
+declare function createHostLoadService(opts?: HostLoadServiceOptions): HostLoadService;
+/** Process-wide collector shared by MCP, HTTP and in-process callers (a job
+ *  scheduler gating on `report.loadPerCore` / `report.warnings`), so one probe
+ *  round serves them all within the TTL. */
+declare function getHostLoadService(): HostLoadService;
+
 /**
  * Idle agent-session reaper (PR-6).
  *
@@ -6124,9 +6262,10 @@ declare function rollupSessionSubtree(root: SessionDescriptor, all: readonly Ses
 /**
  * Dependency-injection surface for MCP credential resolution.
  *
- * `packages/runtime` intentionally does NOT depend on `@agentproto/auth`;
- * the daemon bootstrap (e.g. `packages/cli`) can set a broker-backed
- * resolver here, and `session-spawn.ts` will call it when an `mcpServers`
+ * `packages/runtime` does depend on `@agentproto/auth` (e.g. `KeychainStore`
+ * in `session-spawn.ts`), but credential resolution is still injected here
+ * so non-darwin / test stores stay pluggable. The daemon bootstrap (e.g.
+ * `packages/cli`) can set a broker-backed resolver here, and `session-spawn.ts` will call it when an `mcpServers`
  * entry carries `credentialRef`. Errors from the hook are treated as
  * non-fatal by the caller.
  */
@@ -6149,6 +6288,12 @@ interface McpCredentialDeps {
      *  bare `process.env` read at the call site. Returns null when the slug
      *  can't be resolved (missing/unconfigured). */
     resolveSandboxSecret?: (slug: string) => Promise<string | null>;
+    /** Read an imported-MCP secret by opaque ref
+     *  (`agentproto/mcp-import/<importId>#<header|env>:<KEY>`, split on the last
+     *  `#` into keychain path + account). Undefined when the ref is missing. */
+    resolveMcpSecret?: (ref: string) => Promise<string | undefined>;
+    /** Persist an imported-MCP secret under `ref`. */
+    storeMcpSecret?: (ref: string, value: string) => Promise<void>;
 }
 declare function setMcpCredentialDeps(d: McpCredentialDeps): void;
 declare function getMcpCredentialDeps(): McpCredentialDeps;
@@ -6233,8 +6378,11 @@ declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promis
  * "trusted `?callerSessionId=`" pattern `message-tools.ts` uses — so a
  * session watching its own PR doesn't need to know its own id.
  *
- * Provider auto-select isn't implemented yet (design §6): `provider`
- * defaults to `local-gh`, the only built-in that ships as of this step.
+ * Provider auto-select (design §5, `sentinel-provider-select.ts`): with no
+ * explicit `provider`, `agentpush` when it is set up, else `webhook` when a
+ * STABLE public URL exists and it is ready, else `local-gh`. An explicit
+ * `provider` is never second-guessed (and never silently falls back — a
+ * not-ready `webhook` fails `create` with its setup error).
  *
  * `createSentinelWatch`/`cancelSentinelWatch`/`sentinelView` are exported so
  * `http-server.ts`'s `POST/GET/DELETE /sentinels` routes (the daemon-HTTP
@@ -6328,9 +6476,9 @@ interface Device {
     createdAt: string;
     lastSeen: string;
     /** A channel (offer or reconnect) is served for this device right now
-     *  (client) or a `forwardHttp` call is in flight for it right now (host).
-     *  For a host this is NOT a live heartbeat — see host-registry.ts's
-     *  "Online tracking" — it only reflects actual recent/current traffic. */
+     *  (client), or for a host: a forward/snapshot is in flight or one reached
+     *  it within the online grace window (a background poll keeps that fresh
+     *  for joined hosts) — see host-registry.ts's "Online tracking". */
     online: boolean;
     /** A pair/v1 pairing: listed and revocable, but can't connect until
      *  re-paired — see `PairingRecord.legacy`. */
@@ -6346,10 +6494,26 @@ interface Device {
     provider?: string;
     sandboxId?: string;
     labels?: Record<string, string>;
+    /** Host only: when this daemon last tried to reach it, and why the most
+     *  recent attempt failed (absent when the last attempt succeeded). */
+    lastProbeAt?: string;
+    lastError?: string;
+    /** Host only: a join-added (CI) host that is gone — said goodbye or was
+     *  unreachable past the TTL. Hidden from `list()` unless `includeEnded`. */
+    ended?: true;
+    endedAt?: string;
+    /** Host only: a manually added host unreachable past the TTL. Still listed,
+     *  never auto-deleted. */
+    stale?: true;
+}
+interface ListDevicesOptions {
+    /** Include ended (gone) join-added hosts, which `list()` hides by default. */
+    includeEnded?: boolean;
 }
 interface DeviceRegistry {
-    /** Every known device. Read-only. */
-    list(): Promise<Device[]>;
+    /** Every known device, minus ended join-added hosts unless
+     *  `includeEnded`. Read-only. */
+    list(opts?: ListDevicesOptions): Promise<Device[]>;
     /** Rename a device (fingerprint or current name) to a new label. Tries the
      *  pairing registry first, then the host registry. Returns false when
      *  nothing matched. */
@@ -6411,37 +6575,6 @@ interface RegisterDeviceToolsOptions {
 }
 declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
 
-/**
- * Rate-limited failure logging for reconnect loops.
- *
- * A standing reconnect loop (the outbound tunnel, a pairing rendezvous) whose
- * peer is permanently gone re-dials on backoff forever. Logging every single
- * failure buries the daemon log — a single dead pairing produced ~85% of one
- * 2.9MB never-rotated `~/.agentproto/daemon.log`, and the tunnel reconnect
- * spam another chunk. This gate logs the FIRST failure per key immediately,
- * then at most one line per `windowMs`, and when it does emit again it carries
- * the count of failures it swallowed in between. A successful connect resets
- * the key so the next outage logs promptly again.
- *
- * Deliberately dependency-free: a per-key `{ lastLoggedAt, suppressed }` map.
- * `now` is injectable so tests can advance the clock without real timers. This
- * only changes logging cadence — reconnect timing/backoff is untouched.
- */
-interface ReconnectLogGate {
-    /**
-     * Record a failure for `key`. Returns the line to log now — the given
-     * `message`, with a `(N failures suppressed)` suffix when repeats were
-     * swallowed since the last emit — or `null` to stay quiet this time.
-     */
-    onFailure(key: string, message: string): string | null;
-    /** Reset suppression for `key` after a successful connect. */
-    onSuccess(key: string): void;
-}
-declare function createReconnectLogGate(opts?: {
-    windowMs?: number;
-    now?: () => number;
-}): ReconnectLogGate;
-
 /**
  * Provider-preset family on top of `@agentproto/provider-kit` — the *thin,
  * honest* lister (Option B). Unlike tunnels/sandboxes/eval-reporters, presets
@@ -7798,4 +7931,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateOfferInput, type CreateReviewRunnerOptions, type CreatedJoinToken, type CreatedOffer, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type EagerResumeSummary, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostRecord, type HostRegistry, type HostRegistryDeps, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PairingChannelContext, type PairingChannelHandle, type PairingChannelMode, type PairingRecord, type PairingRegistry, type PairingRegistryDeps, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, QuotaReadableProfile, type ReconnectLogGate, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifySignedAttestationResult, WORKTREE_ISOLATION_ENV, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, type WorktreeAutoReclaimer, type WorktreeDecision, type WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, type WorktreeProvisionOutcome, type WorktreeProvisionRequest, type WorktreeProvisioner, type WorktreeRequest, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, composeSessionObservers, composedFromRangeSha, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeWorktreeField, parsePrUrl, parseWorktreeIsolationMode, prHeadSha, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, setDefaultPreset, setMcpCredentialDeps, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, describeOwner, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, readConversationIndex, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, setDefaultPreset, setMcpCredentialDeps, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };