@agentproto/runtime 5.4.1 → 5.6.0

package/dist/index.d.ts

@@ -695,6 +695,10 @@ interface RemoteStatus {
 
 /** `hosts.json` format. */
 declare const HOSTS_VERSION: 1;
+/** One-line remediation logged once per failure streak once the threshold
+ *  is crossed. Deliberately NOT a protocol change — the pairing itself is
+ *  fine; a fresh host-scoped offer re-binds it. */
+declare const HOST_HANDSHAKE_REMEDIATION_HINT: string;
 /** One persisted host — a daemon this daemon can drive. */
 interface HostRecord {
     /** The target daemon's identity fingerprint (32 hex). */
@@ -922,6 +926,13 @@ interface HostRegistry {
     start(): Promise<void>;
 }
 declare function createHostRegistry(deps: HostRegistryDeps): HostRegistry;
+/** Read-only snapshot of `hosts.json` (the read-only twin of
+ *  `readPairingsSnapshot`): for callers that just want the persisted
+ *  records — e.g. `agentproto doctor`'s devices check flagging a host
+ *  channel that persistently fails its handshake (BOOTSTRAP P3 item 4).
+ *  No dial, no rendezvous, no `loadIdentity` deps. Never throws — a
+ *  missing or malformed file yields `[]`. */
+declare function readHostsSnapshot(path?: string): Promise<HostRecord[]>;
 
 /**
  * Daemon-side JOIN TOKEN registry (SANDBOX-VISIBILITY-JOIN, stacked on
@@ -6410,6 +6421,262 @@ interface SentinelView {
     lastError?: string;
 }
 
+/**
+ * Standard Webhooks `whsec_` signing for webhook egress (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`).
+ *
+ * Contract (frozen §3):
+ *   - HMAC-SHA256 over `msgId.timestamp.body` (raw bytes; `.update` chained so
+ *     the body is never re-encoded — payload arrives as `Uint8Array`, I2).
+ *   - Signature print = standard base64 (NOT base64url): `v1,<b64>`.
+ *   - HMAC key = the base64 payload DECODED after the `whsec_` prefix.
+ *   - Multi-secret: space-separated `v1,<sig>` segments (rotation window).
+ *   - Returns ONLY headers — the caller owns the bytes and signs them again
+ *     with a fresh timestamp on retry; signing never re-serializes.
+ */
+interface WebhookSignInput {
+    /** Stable event id (`evt_…` / verification `msg_verification_…`) — same across retries. */
+    msgId: string;
+    /** Seconds, Unix epoch (Standard Webhooks wire format). */
+    timestamp: number;
+    /** Exact bytes — signed once (I2). Caller passes the serialization; signing never re-serializes. */
+    payload: Uint8Array;
+    /** One or, during a rotation window, two secrets (`whsec_…`). */
+    secrets: readonly string[];
+}
+type WebhookSignatureHeaders = {
+    "webhook-id": string;
+    "webhook-timestamp": string;
+    "webhook-signature": string;
+};
+/**
+ * Encode raw secret bytes into the `whsec_<base64>` wire format.
+ * Inverse of {@link decodeWhsecSecret}.
+ */
+declare function encodeWhsecSecret(raw: Uint8Array): string;
+/**
+ * Decode a `whsec_…` secret to its raw HMAC key: standard-base64 payload
+ * after the prefix, which must decode to 24..64 bytes. Returns `null` on any
+ * violation (bad prefix, not base64, length out of range). The canonical
+ * validator for W-C: a submit failing this is `-32602` upstream; egress
+ * surfaces it as a categorized challenge failure.
+ */
+declare function decodeWhsecSecret(secret: string): Buffer | null;
+/**
+ * Sign exactly the bytes given. Throws `Error` when any secret fails
+ * {@link decodeWhsecSecret} (callers must have validated upstream; a bad
+ * secret at this point is a programmer error, never silently signed).
+ */
+declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
+
+/**
+ * SSRF-guarded outbound HTTPS POST for webhook egress (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`).
+ *
+ * Frozen failure-mode reasons: `non_https | private_target | redirect |
+ * timeout | connect` — mapped by challenge to the §3 ChallengeFailureReason
+ * table; the SAME function guards BOTH the challenge and delivery path (I3).
+ * No HTTP client library addition: node http/https only.
+ *
+ * Safety model (one predicate, fail closed):
+ *   1. scheme must be https → `non_https`
+ *   2. ALL DNS-resolved addresses (A + AAAA, plus literal-IP hosts) must pass
+ *      {@link isPubliclyRoutable}, else `private_target` — one rejected
+ *      address fails; unparseable/odd literals fail closed
+ *   3. connect pins the VALIDATED IP (no second resolution → the
+ *      DNS-rebinding TOCTOU is closed) while `servername` keeps the ORIGINAL
+ *      hostname for TLS SNI + certificate verification
+ *   4. redirects are never followed: a 3xx comes back as a plain
+ *      `{status: 3xx}` result (challenge → "non_2xx", delivery → retryable);
+ *      a non-https redirect target additionally throws `redirect`
+ *   5. hard `timeoutMs` budget; request body clamped to 256 KiB here too
+ *      (defense-in-depth — delivery clamps before signing)
+ */
+type SsrfFetchReason = "non_https" | "private_target" | "redirect" | "timeout" | "connect";
+declare class SsrfFetchError extends Error {
+    readonly reason: SsrfFetchReason;
+    constructor(reason: SsrfFetchReason, message: string);
+}
+interface SsrfFetchInit {
+    method?: "POST";
+    headers?: Record<string, string>;
+    /** ≤ 262 144; enforced also on response read (only status + body read). */
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface SsrfFetchResult {
+    status: number;
+    body: string;
+}
+/**
+ * The one predicate for every address this module may connect to. Fails
+ * closed — anything unparseable, IPv4-mapped with an invalid embedded v4, or
+ * inside a non-globally-routable block is NOT public.
+ *
+ * Plan §4 W-A.2 ranges:
+ *   IPv4 — 0/8, 10/8, 127/8, 169.254/16, 172.16/12, 192.0.0.0/24,
+ *          192.0.2.0/24, 198.18/15, 198.51.100.0/24, 203.0.113.0/24,
+ *          100.64/10 (CGNAT), 224/4 (multicast), 240/4 (reserved)
+ *   IPv6 — ::, ::1, fc00::/7 (ULA), fe80::/10 (link-local),
+ *          ff00::/8 (multicast), 2001:db8::/32 (doc range), and ::ffff:
+ *          mapped-v4 whose EMBEDDED v4 re-runs this very predicate
+ */
+declare function isPubliclyRoutable(ipRaw: string): boolean;
+type SsrfResolvers = {
+    /** Replaces both A and AAAA resolution. Returns every address, any family. */
+    lookup?: (host: string) => Promise<Array<{
+        address: string;
+        family: 4 | 6;
+    }>>;
+};
+type EgressDispatcher = (req: {
+    url: string;
+    headers: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}) => Promise<SsrfFetchResult>;
+/** vitest-only: set a recording dispatcher; pass `null` to restore. */
+declare function setEgressDispatcherForTests(dispatcher: EgressDispatcher | null): void;
+declare function ssrfFetch(url: string, init: SsrfFetchInit, io?: {
+    resolvers?: SsrfResolvers;
+}): Promise<SsrfFetchResult>;
+
+/**
+ * Callback challenge verification (W-A of `.plans/sentinel-mcp-events/PLAN.md`,
+ * §3 frozen): POST `{"type":"verification","challenge":"<fresh 64-hex>"}` to
+ * the candidate callback URL, signed with the CANDIDATE secret, carrying
+ * `X-MCP-Subscription-Id`; require 2xx and a constant-time-equal
+ * `{"challenge":"<same>"}` echo in the response body.
+ *
+ * Success cache: keyed (principal, normalized callback URL, sha256(secret)),
+ * bounded TTL 10 min. A NEW secret during rotation NEVER resolves a cache
+ * hit — the sha256(secret) key component structurally forces
+ * re-verification (the cache can never bless an unverified secret).
+ *
+ * The outbound POST runs through the SAME `ssrfFetch` gate as delivery (I3) —
+ * injectable here only for tests; production passes nothing.
+ */
+
+type ChallengeOutcome = {
+    ok: true;
+    verificationBytes: Uint8Array;
+} | {
+    ok: false;
+    reason: ChallengeFailureReason;
+    detail: string;
+};
+type ChallengeFailureReason = "challenge_failed" | "timeout" | "non_https" | "ssrf_blocked" | "non_2xx";
+interface VerifyCallbackInput {
+    principal: string;
+    url: string;
+    subscriptionId: string;
+    secret: string;
+}
+interface VerifyCallbackDeps {
+    /** Replaces the POST boundary. Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<SsrfFetchView>;
+    /** Clock for the bounded TTL. Default: real wall clock. */
+    now?: () => number;
+}
+interface SsrfFetchArgs$1 {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface SsrfFetchView {
+    status: number;
+    body: string;
+}
+/** §4 W-A task 4: the challenge reason table (single mapped, none unmapped). */
+declare function challengeReasonForSsrf(reason: SsrfFetchReason): ChallengeFailureReason;
+declare function challengeCacheSize(): number;
+/** vitest-only: clear the success cache between suites. */
+declare function resetChallengeCacheForTests(): void;
+/** Cache-key URL normalization (never reused for anything else). */
+declare function normalizeCallbackUrl(url: string): string | null;
+declare function verifyCallback(input: VerifyCallbackInput, deps?: VerifyCallbackDeps): Promise<ChallengeOutcome>;
+
+/**
+ * Signed event delivery with bounded retry (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
+ *
+ * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
+ * then the exact bytes are signed per attempt with a FRESH timestamp. An
+ * observer sees a different `webhook-signature` header per attempt while the
+ * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
+ * never re-serializes.
+ *
+ * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
+ * replaced with `{summary, subject}` and the envelope gains `truncated: true`
+ * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
+ * every attempt signs.
+ *
+ * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
+ * network errors retry; 410/413 are terminal with NO further attempt;
+ * 2xx = delivered. The returned `DeliveryState` is what the caller persists
+ * into the store for post-restart resume (W-B's job to wire).
+ */
+type McpEventEnvelope = {
+    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
+     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
+     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
+     *  control notification only — never sent by us (no control events). */
+    eventId: string;
+    name: string;
+    timestamp: string;
+    data: Record<string, unknown>;
+    cursor: string | null;
+    truncated?: boolean;
+};
+interface DeliveryState {
+    attempts: number;
+    lastError?: string;
+    lastAt?: string;
+}
+interface DeliveryReplay {
+    subId: string;
+    callbackUrl: string;
+    secrets: readonly string[];
+}
+/** One event → one POST. Frozen §3 outcome. */
+type DeliveryOutcome = {
+    ok: true;
+    delivery: DeliveryState;
+} | {
+    ok: false;
+    reason: string;
+    delivery: DeliveryState;
+};
+interface SsrfFetchArgs {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface DeliverEventDeps {
+    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs) => Promise<{
+        status: number;
+        body: string;
+    }>;
+    /** Backoff sleep (tests only). Default: real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock (tests only). Default: real wall clock. */
+    now?: () => number;
+}
+declare const CLAMP_LIMIT_BYTES = 262144;
+declare const MAX_ATTEMPTS = 5;
+/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
+declare function deliveryBackoffDelay(attempt: number): number;
+declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
+/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
+declare function envelopeClampedBytes(event: McpEventEnvelope): {
+    bytes: Uint8Array;
+    clamped: boolean;
+};
+declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
+
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -6548,6 +6815,63 @@ interface DeviceRegistry {
     forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
 }
 declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegistry): DeviceRegistry;
+/** The host-side route `promptHostSession` forwards to — served by the HOST
+ *  daemon's `/device-prompt/:sessionId` (http-server.ts), gated by the same
+ *  host-scoped-pairing + `deviceSpawnAllow` two-gate as `/device-spawn/*`. */
+declare const DEVICE_PROMPT_PATH_PREFIX = "/device-prompt";
+interface PromptHostSessionInput {
+    /**
+     * The turn to deliver — same shapes local `agent_prompt` accepts: a
+     * non-empty string, a content block object, or a non-empty array of
+     * content blocks. Validated here (never forwarded ill-formed).
+     */
+    prompt: unknown;
+    /** When the host session is mid-turn, redirect instead of queueing
+     *  (mirrors local `agent_prompt`'s `interrupt`). Default false. */
+    interrupt?: boolean;
+    /** With a mid-turn session, jump the FRONT of the FIFO instead of the
+     *  back (mirrors local `agent_prompt`'s `force`). Default false. */
+    force?: boolean;
+    /** Block until the prompted turn drains (the session goes idle with an
+     *  empty queue) instead of fire-and-forget. Default false. */
+    wait?: boolean;
+    /** Poll cadence while `wait`ing, ms — clamped to [10, 10_000], default
+     *  1_000. Each poll is a fresh E2E dial to the host, so don't set this
+     *  low in production; the clamp floor exists for tests. */
+    pollMs?: number;
+    /** Give up `wait`ing after this long (ms). 0 (default) = wait forever. */
+    maxWaitMs?: number;
+    /** Injectable delay for tests. Default a real setTimeout sleep. */
+    sleep?: (ms: number) => Promise<void>;
+}
+interface PromptHostSessionResult {
+    ok: boolean;
+    /** The enqueue landed in the host session's FIFO (it was mid-turn) —
+     *  present on the fire-and-forget arm only. */
+    pending?: boolean;
+    queueId?: string;
+    queuePosition?: number;
+    /** Present on the `wait` arm: how long the turn took to drain. */
+    waitedMs?: number;
+    /** The host's HTTP status, when the enqueue itself failed. */
+    status?: number;
+    message?: string;
+}
+/**
+ * Prompt a HOST device's session — the write counterpart of `device_sessions`
+ * (BOOTSTRAP P4 item 1). Forwards `POST /device-prompt/:sessionId` over the
+ * host's E2E channel (`HostRegistry.forwardHttp`, the same dial the read
+ * verbs use); the host daemon, if it has opted in (`deviceSpawnAllow`) and
+ * the pairing is host-scoped, calls its own `POST
+ * /sessions/:id/prompt` — queueing rules identical to a local prompt.
+ *
+ * Fire-and-forget by default (the enqueue's 202 comes straight back);
+ * `wait: true` then polls the host's `GET /sessions/:id` until the session
+ * is idle with an empty queue (or dies, or `maxWaitMs` elapses). Never
+ * silently serves stale data — a failed forward throws, there is no
+ * snapshot fallback for a write.
+ */
+declare function promptHostSession(hosts: HostRegistry | undefined, target: string, sessionId: string, input: PromptHostSessionInput): Promise<PromptHostSessionResult>;
 
 /**
  * MCP tools over the device registry (DEVICES-PLAN PR-A/PR-C) — `device_list`
@@ -6569,6 +6893,12 @@ declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegi
 
 interface RegisterDeviceToolsOptions {
     registry: DeviceRegistry;
+    /** Optional — the underlying host registry (`device_add`'s), when wired.
+     *  `device_prompt` needs it directly: its wait-loop dials the host more
+     *  than once, which `DeviceRegistry.forwardHttp`'s snapshot fallback
+     *  would happily answer from cache. When absent, `device_prompt` is not
+     *  registered. */
+    hosts?: HostRegistry;
     /** Optional (SANDBOX-VISIBILITY-JOIN) — when wired, registers
      *  `join_token_create`/`join_token_list`/`join_token_revoke`. */
     joinTokens?: JoinTokenRegistry;
@@ -7931,4 +8261,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, describeOwner, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, readConversationIndex, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, setDefaultPreset, setMcpCredentialDeps, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type McpEventEnvelope, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptHostSession, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };