@agentproto/runtime 5.5.0 → 5.6.0

package/dist/index.mjs

@@ -19,9 +19,12 @@ import { resolvePairPageUrl, DEFAULT_PAIR_PAGE } from '@agentproto/secrets/pairi
 import { ListToolsRequestSchema, CallToolRequestSchema, SUPPORTED_PROTOCOL_VERSIONS, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 import { makeCredsStore, makeAdapterResolver, makeAdapterLister, discoverAdapterPackages, makeSetupLedger, makeListTool, makeSetupTool } from '@agentproto/provider-kit';
 import { syncPiModels, getConfiguredEndpoints, checkHarnessFit, connectorById } from '@agentproto/llm-endpoint';
+import { createServer } from 'http';
+import { createServer as createServer$1 } from 'net';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPError, StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { createServer as createServer$1 } from 'net';
 import { SandboxSpecSchema, resolveLifecyclePolicy, createSandboxAgentSessionHost, isSandboxBoxGoneError, SandboxHostBootFailedError } from '@agentproto/sandbox';
 import { APP_UI_DISCOVERY_TOOLS, RUNNER_SELECT_SCRIPT } from '@agentproto/app-client/runner-select';
 import { DISPLAY_MODE_SCRIPT } from '@agentproto/app-client/display-mode';
@@ -35,8 +38,6 @@ import { createBrainManager, parseKnowledgeConfig } from '@agentproto/workspace-
 import { browserAdapters, getBrowserAdapter } from '@agentproto/adapter-browser';
 import { defineHttpDriver } from '@agentproto/driver-http';
 import matter2 from 'gray-matter';
-import { createServer } from 'http';
-import { Readable } from 'stream';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { WebSocketServer } from 'ws';
@@ -67,7 +68,8 @@ import { createRequire } from 'module';
 import { signArtifact, recordAuditEvent } from '@agentproto/governance-engine';
 import { parseRoutineManifest } from '@agentproto/routine';
 import { navigateOptionsSchema, evaluateOptionsSchema, clickOptionsSchema, fillOptionsSchema, screenshotOptionsSchema, assertToolSupported } from '@agentproto/driver-browser';
-import { pipeline } from 'stream/promises';
+import { lookup } from 'dns/promises';
+import { request } from 'https';
 import { identityFingerprint } from '@agentproto/secrets/identity';
 
 /**
@@ -4874,16 +4876,16 @@ var init_workspaces_config = __esm({
 function normalizeWorktreeField(field) {
   if (field === void 0 || field === false) return void 0;
   if (field === true) return {};
-  const request = {};
-  if (field.slug !== void 0) request.slug = field.slug;
-  if (field.base !== void 0) request.base = field.base;
-  if (field.async !== void 0) request.async = field.async;
-  return request;
+  const request2 = {};
+  if (field.slug !== void 0) request2.slug = field.slug;
+  if (field.base !== void 0) request2.base = field.base;
+  if (field.async !== void 0) request2.async = field.async;
+  return request2;
 }
 function decideWorktreeIsolation(input) {
-  const request = normalizeWorktreeField(input.field);
+  const request2 = normalizeWorktreeField(input.field);
   if (input.depth > 0) {
-    if (request !== void 0) {
+    if (request2 !== void 0) {
       return {
         action: "reject",
         message: `agent_start: \`worktree\` isolation was requested on a nested spawn (depth ${input.depth}), but a spawn made through an orchestrator inherits its parent's working tree and cannot provision a worktree of its own. Remove the \`worktree\` field; for an isolated child use \`sandbox\` (the box already isolates) instead.`
@@ -4899,7 +4901,7 @@ function decideWorktreeIsolation(input) {
   }
   switch (input.mode) {
     case "never":
-      if (request !== void 0) {
+      if (request2 !== void 0) {
         return {
           action: "reject",
           message: `agent_start: \`worktree\` was requested but this daemon's \`worktrees.isolation\` policy is set to "never". Remove the \`worktree\` field, or change the policy (config \`worktrees.isolation\` / env ${WORKTREE_ISOLATION_ENV}).`
@@ -4907,9 +4909,9 @@ function decideWorktreeIsolation(input) {
       }
       return { action: "spawn-in-place" };
     case "on-request":
-      return request !== void 0 ? { action: "provision", request, implicit: false } : { action: "spawn-in-place" };
+      return request2 !== void 0 ? { action: "provision", request: request2, implicit: false } : { action: "spawn-in-place" };
     case "always":
-      return { action: "provision", request: request ?? {}, implicit: request === void 0 };
+      return { action: "provision", request: request2 ?? {}, implicit: request2 === void 0 };
   }
 }
 function parseWorktreeIsolationMode(raw) {
@@ -4942,16 +4944,16 @@ function normalizeAttachField(field) {
   if (field === void 0) return void 0;
   if (field === false) return { detached: true };
   if (field === true) return { optIn: true };
-  const request = { optIn: true };
-  if (field.parent !== void 0) request.parent = field.parent;
-  return request;
+  const request2 = { optIn: true };
+  if (field.parent !== void 0) request2.parent = field.parent;
+  return request2;
 }
 function decideSpawnAttach(input) {
-  const request = normalizeAttachField(input.field);
-  if (request?.detached) return { parent: void 0, detached: true };
-  if (request?.parent) return { parent: request.parent, detached: false };
+  const request2 = normalizeAttachField(input.field);
+  if (request2?.detached) return { parent: void 0, detached: true };
+  if (request2?.parent) return { parent: request2.parent, detached: false };
   const candidate = input.hint ?? input.autoParent;
-  if (request?.optIn) return { parent: candidate, detached: false };
+  if (request2?.optIn) return { parent: candidate, detached: false };
   switch (input.mode) {
     case "always":
       return { parent: candidate, detached: false };
@@ -5676,8 +5678,8 @@ function pathSegmentsMatch(entryPath, concretePath) {
   return entrySegs.every((seg, i) => seg === "*" || seg === concreteSegs[i]);
 }
 function findConfigKey(path) {
-  const lookup = path.startsWith("models.") && path.length > "models.".length ? "models.*" : path;
-  return CONFIG_KEYS.find((entry) => pathSegmentsMatch(entry.path, lookup));
+  const lookup2 = path.startsWith("models.") && path.length > "models.".length ? "models.*" : path;
+  return CONFIG_KEYS.find((entry) => pathSegmentsMatch(entry.path, lookup2));
 }
 function validateConfig(raw) {
   const result = agentprotoConfigSchema.safeParse(raw);
@@ -9243,6 +9245,139 @@ var init_sandbox_agent_session_proxy = __esm({
     ]);
   }
 });
+function collectHeaders(raw) {
+  const headers = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (v === void 0 || HOP_BY_HOP.has(k.toLowerCase())) continue;
+    headers[k] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  return headers;
+}
+function isPrematureCloseError(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ERR_STREAM_PREMATURE_CLOSE";
+}
+async function readBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  if (chunks.length === 0) return void 0;
+  return new Uint8Array(Buffer.concat(chunks));
+}
+async function startDeviceSandboxBridge(opts) {
+  const { hostRegistry, target } = opts;
+  const server = createServer((req, res) => {
+    void handleRequest(req, res).catch((err) => {
+      if (res.writableEnded) return;
+      if (!res.headersSent) {
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            error: "device_sandbox_bridge_failed",
+            message: err instanceof Error ? err.message : String(err)
+          })
+        );
+        return;
+      }
+      res.end();
+    });
+  });
+  async function handleRequest(req, res) {
+    const body = await readBody(req);
+    let upstream;
+    try {
+      upstream = await hostRegistry.forwardHttpStream(target, {
+        method: req.method ?? "GET",
+        path: `/device-spawn${req.url ?? "/"}`,
+        headers: collectHeaders(req.headers),
+        ...body ? { body } : {}
+      });
+    } catch (err) {
+      res.writeHead(502, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: "device_unreachable",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
+      return;
+    }
+    const resHeaders = {};
+    for (const [k, v] of Object.entries(upstream.headers)) {
+      if (HOP_BY_HOP.has(k.toLowerCase()) || k.toLowerCase() === "content-length") continue;
+      resHeaders[k] = v;
+    }
+    res.writeHead(upstream.status, resHeaders);
+    try {
+      await pipeline(
+        Readable.fromWeb(upstream.body),
+        res
+      );
+    } catch (err) {
+      if (!isPrematureCloseError(err)) throw err;
+    }
+  }
+  const port = await getFreePort();
+  await new Promise((resolve41, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve41());
+  });
+  return {
+    mcpUrl: `http://127.0.0.1:${port}/mcp`,
+    async close() {
+      await new Promise((resolve41) => server.close(() => resolve41()));
+    }
+  };
+}
+async function getFreePort() {
+  return new Promise((resolve41, reject) => {
+    const srv = createServer$1();
+    srv.once("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const address = srv.address();
+      if (address === null || typeof address === "string") {
+        srv.close(() => reject(new Error("failed to allocate a free port")));
+        return;
+      }
+      const { port } = address;
+      srv.close(() => resolve41(port));
+    });
+  });
+}
+var HOP_BY_HOP;
+var init_device_sandbox_bridge = __esm({
+  "src/device-sandbox-bridge.ts"() {
+    HOP_BY_HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "host"]);
+  }
+});
+function isDeviceSandboxTarget(sandbox) {
+  const slug = typeof sandbox === "string" ? sandbox : sandbox?.provider ?? "";
+  return slug.startsWith("device:");
+}
+function createDeviceSandboxProvider(target, hostRegistry) {
+  return {
+    async boot(_spec, _opts) {
+      const hosts = await hostRegistry.list();
+      const known = hosts.some((h) => h.fingerprint === target || h.name === target);
+      if (!known) {
+        throw new Error(
+          `device sandbox: no paired host device matches "${target}" \u2014 run \`agentproto devices add <offer-url>\` here first (the offer must come from \`agentproto pair offer --host\` run ON that device). Check \`agentproto devices list\` for known devices.`
+        );
+      }
+      const bridge = await startDeviceSandboxBridge({ hostRegistry, target });
+      return {
+        mcpUrl: bridge.mcpUrl,
+        sandboxId: `device-${target}-${randomUUID()}`,
+        async stop() {
+          await bridge.close();
+        }
+      };
+    }
+  };
+}
+var init_device = __esm({
+  "src/sandbox-providers/device.ts"() {
+    init_device_sandbox_bridge();
+  }
+});
 async function connectBoxToolClient(mcpUrl) {
   const client = new Client(
     { name: "agentproto-sandbox-app-serve", version: "0.1.0" },
@@ -9471,7 +9606,7 @@ var init_sandbox_app_serve = __esm({
     REQUIRED_ALLOWLIST_BASENAMES = ["sh", "agentproto"];
   }
 });
-async function getFreePort() {
+async function getFreePort2() {
   return new Promise((resolve41, reject) => {
     const srv = createServer$1();
     srv.once("error", reject);
@@ -9505,7 +9640,7 @@ var init_local = __esm({
     POLL_INTERVAL_MS = 250;
     localSandboxProvider = {
       async boot(_spec, opts) {
-        const port = await getFreePort();
+        const port = await getFreePort2();
         const workspace = await mkdtemp(join(tmpdir(), "agentproto-sandbox-local-"));
         const child = spawn(
           "agentproto",
@@ -10159,6 +10294,9 @@ ${callerPrompt}`;
   const pre = composed.slice(0, composed.length - tail.length);
   return pre || void 0;
 }
+function deviceContractLine(device) {
+  return `This session was spawned remotely on paired device "${device}" by the controlling daemon \u2014 its own workspace (and any AGENTS.md along that path) is on ANOTHER machine and has not been injected here. If your resolved cwd has an AGENTS.md, treat it as binding on your next tool call (read it first); if you \`cd\` somewhere else (a nested repo included), re-resolve and re-read the AGENTS.md of wherever you end up.`;
+}
 async function spawnAgentSession(deps2, input) {
   if (input.inference) {
     if (input.model || input.route || input.access) {
@@ -10972,22 +11110,30 @@ async function spawnAgentSession(deps2, input) {
   let effectivePrompt = input.prompt;
   let agentsMdResolution;
   const resolveAgentsMdForSpawn = resolveAgentsMd2 ?? (async (cwdArg, _kb, o) => resolveAgentsMd(cwdArg, await loadAgentsMdInlineMaxKb(), void 0, o?.stopAt));
-  try {
-    agentsMdResolution = appBoundary ? await resolveAgentsMdForSpawn(cwd, void 0, { stopAt: appBoundary.root }) : await resolveAgentsMdForSpawn(cwd);
-  } catch {
-    agentsMdResolution = { mode: "absent", contractLine: cdContractLine };
+  const isDeviceSandboxSpawn = isDeviceSandboxTarget(input.sandbox);
+  const deviceTargetName = typeof input.sandbox === "string" ? input.sandbox.slice("device:".length) : (input.sandbox?.provider ?? "").slice("device:".length);
+  if (isDeviceSandboxSpawn) {
+    agentsMdResolution = { mode: "absent", contractLine: deviceContractLine(deviceTargetName) };
+  } else {
+    try {
+      agentsMdResolution = appBoundary ? await resolveAgentsMdForSpawn(cwd, void 0, { stopAt: appBoundary.root }) : await resolveAgentsMdForSpawn(cwd);
+    } catch {
+      agentsMdResolution = { mode: "absent", contractLine: cdContractLine };
+    }
   }
   const agentsMdParts = [agentsMdResolution.block, agentsMdResolution.contractLine].filter(
     (p) => !!p
   );
-  const agentsMdReadPaths = additionalReadPathsForAgentsMd(agentsMdResolution, cwd);
+  const agentsMdReadPaths = isDeviceSandboxSpawn ? void 0 : additionalReadPathsForAgentsMd(agentsMdResolution, cwd);
   const additionalReadPaths = [...agentsMdReadPaths ?? [], ...browserReadPaths];
   let workspaceRulesResolution = {};
   const resolveWorkspaceRulesForSpawn = resolveWorkspaceRules2 ?? resolveWorkspaceRules;
-  try {
-    workspaceRulesResolution = await resolveWorkspaceRulesForSpawn(resolvedSlug);
-  } catch {
-    workspaceRulesResolution = {};
+  if (!isDeviceSandboxSpawn) {
+    try {
+      workspaceRulesResolution = await resolveWorkspaceRulesForSpawn(resolvedSlug);
+    } catch {
+      workspaceRulesResolution = {};
+    }
   }
   const rulesMdParts = workspaceRulesResolution.block ? [workspaceRulesResolution.block] : [];
   if (input.prompt && typeof input.prompt === "string") {
@@ -11941,6 +12087,7 @@ var init_session_spawn = __esm({
     init_inference_binding();
     init_mcp_credential_deps();
     init_sandbox_agent_session_proxy();
+    init_device();
     init_sandbox_ledger();
     init_sandbox_app_serve();
     init_sandbox_adapters();
@@ -12667,21 +12814,21 @@ function injectStandaloneAppBridge(html, baseUrl) {
   return injectAfterStructuralTag(html, script);
 }
 function createUiHtmlCache() {
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   return {
     async get(path, version) {
       const st = await stat(path);
       const stamp = `${version}:${st.mtimeMs}:${st.size}`;
-      const cached = cache2.get(path);
+      const cached = cache3.get(path);
       if (cached && cached.stamp === stamp) return cached.html;
       const raw = await readFile(path, "utf8");
       const html = injectMcpAppBridge(raw);
-      cache2.set(path, { stamp, html });
+      cache3.set(path, { stamp, html });
       return html;
     }
   };
 }
-async function makeInstalledAppUiApps(appRegistry, cache2, existingToolNames) {
+async function makeInstalledAppUiApps(appRegistry, cache3, existingToolNames) {
   const apps = [];
   const seen = new Set(existingToolNames);
   for (const app of appRegistry.listApps()) {
@@ -12714,7 +12861,7 @@ async function makeInstalledAppUiApps(appRegistry, cache2, existingToolNames) {
         });
       }
       try {
-        return await cache2.get(ui.path, app.updatedAt);
+        return await cache3.get(ui.path, app.updatedAt);
       } catch (err) {
         return renderAppUiErrorHtml({
           appName,
@@ -24217,7 +24364,7 @@ function createDefaultHostProbes() {
     );
     if (child.pid !== void 0) own.add(child.pid);
   });
-  const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
   const probes = {
     platform,
     table: (t) => createProcessTableSource(t)(),
@@ -24245,7 +24392,7 @@ function createDefaultHostProbes() {
       const read = () => Promise.all([readFile("/proc/stat", "utf8"), readFile("/proc/diskstats", "utf8").catch(() => "")]);
       const t0 = Date.now();
       const [statBefore, diskBefore] = await read();
-      await sleep2(400);
+      await sleep3(400);
       const [statAfter, diskAfter] = await read();
       return { statBefore, statAfter, diskBefore, diskAfter, intervalSec: (Date.now() - t0) / 1e3 };
     };
@@ -24790,7 +24937,7 @@ async function callJevSystemOne(state, questions, opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const url = (opts.baseUrl ?? JEV_DEFAULT_URL).replace(/\/+$/, "");
   const maxRetries = opts.maxRetries ?? 3;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const model = opts.model ?? JEV_DEFAULT_MODEL;
   const timeoutMs = opts.timeoutMs ?? 3e4;
   let attempt = 0;
@@ -24831,7 +24978,7 @@ async function callJevSystemOne(state, questions, opts) {
     }
     if (RETRYABLE_STATUSES.has(res.status) && attempt < maxRetries) {
       attempt++;
-      await sleep2(backoffDelayMs(attempt, res.headers.get("retry-after")));
+      await sleep3(backoffDelayMs(attempt, res.headers.get("retry-after")));
       continue;
     }
     const body = await res.text().catch(() => "");
@@ -35218,7 +35365,8 @@ function createHostRegistry(deps2) {
     const attempts = [epoch, epoch - 1];
     let lastErr;
     let hungUpOnHello = 0;
-    for (const e of attempts) {
+    for (let attempt = 1; attempt <= attempts.length; attempt++) {
+      const e = attempts[attempt - 1];
       const { route, auth } = await deriveEpochTokens(record2.pairRoot, e);
       let raw;
       try {
@@ -35228,32 +35376,45 @@ function createHostRegistry(deps2) {
         continue;
       }
       try {
-        const started = await startClientHandshake({
-          daemonX25519Pub: record2.daemonX25519Pub,
-          daemonEd25519Pub: record2.daemonEd25519Pub,
-          authToken: auth,
-          clientName: record2.name
+        let rawCloseReason;
+        const offRawClose = raw.onClose((reason) => {
+          rawCloseReason = reason ?? "unknown";
         });
-        const wrapped = await clientHandshakeOverSink(
-          raw,
-          encodePairingMessage(started.hello),
-          (replyBytes) => started.complete(decodePairingReply(replyBytes)),
-          { timeoutMs: handshakeTimeoutMs }
-        );
-        const client = createTunnelClient({ sink: wrapped });
-        await client.ready();
+        let client;
+        try {
+          const started = await startClientHandshake({
+            daemonX25519Pub: record2.daemonX25519Pub,
+            daemonEd25519Pub: record2.daemonEd25519Pub,
+            authToken: auth,
+            clientName: record2.name
+          });
+          const wrapped = await clientHandshakeOverSink(
+            raw,
+            encodePairingMessage(started.hello),
+            (replyBytes) => started.complete(decodePairingReply(replyBytes)),
+            { timeoutMs: handshakeTimeoutMs }
+          );
+          client = createTunnelClient({ sink: wrapped });
+          await awaitTunnelHello(client, wrapped, record2, () => rawCloseReason);
+        } finally {
+          offRawClose();
+        }
         await markReached(record2);
         return client;
       } catch (err) {
         lastErr = err;
         if (err instanceof Error && /transport closed during handshake/.test(err.message)) hungUpOnHello++;
+        log(
+          `[hosts] ${record2.name} (${record2.fingerprint}) attempt ${attempt}/${attempts.length} failed: ${errMsg3(err)}`
+        );
         try {
           raw.close("handshake failed");
         } catch {
         }
       }
     }
-    const hint = hungUpOnHello === attempts.length ? ` \u2014 the host hung up on the pair/v2 hello; if it runs an older agentproto (pair/v1), upgrade it and re-pair: run \`agentproto pair offer --host\` on the host, then \`agentproto devices add\` here. (${PAIRING_PROTOCOL_OUTDATED_MESSAGE})` : "";
+    const helloTimedOut = lastErr instanceof Error && /did not send hello/.test(lastErr.message);
+    const hint = hungUpOnHello === attempts.length || helloTimedOut ? ` \u2014 the host hung up on (or never sent) the post-handshake tunnel hello; if it runs an older agentproto (pair/v1), upgrade it and re-pair: run \`agentproto pair offer --host\` on the host, then \`agentproto devices add\` here. (${PAIRING_PROTOCOL_OUTDATED_MESSAGE})` : "";
     const failure = `could not reach host ${record2.fingerprint} via ${record2.rendezvousUrl}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}${hint}`;
     await markUnreachable(record2, errMsg3(lastErr));
     throw new Error(failure);
@@ -35490,6 +35651,35 @@ function createHostRegistry(deps2) {
     start: sweep
   };
 }
+async function awaitTunnelHello(client, sink, record2, closeReason) {
+  return new Promise((resolve41, reject) => {
+    if (!sink.isOpen) {
+      reject(
+        new Error(
+          `host ${record2.fingerprint} (${record2.name}) closed the channel after handshake: ${closeReason() ?? "unknown"}`
+        )
+      );
+      return;
+    }
+    const offClose = sink.onClose((reason) => {
+      reject(
+        new Error(
+          `host ${record2.fingerprint} (${record2.name}) closed the channel after handshake: ${reason ?? "unknown"}`
+        )
+      );
+    });
+    client.ready().then(
+      () => {
+        offClose();
+        resolve41();
+      },
+      (err) => {
+        offClose();
+        reject(err);
+      }
+    );
+  });
+}
 function wrapStreamWithCleanup(source, cleanup) {
   const reader = source.getReader();
   let cleanedUp = false;
@@ -35752,6 +35942,114 @@ function createDeviceRegistry(pairing, hosts) {
     }
   };
 }
+var DEVICE_PROMPT_PATH_PREFIX = "/device-prompt";
+function isValidPrompt(prompt) {
+  if (typeof prompt === "string") return prompt.length > 0;
+  if (Array.isArray(prompt)) {
+    return prompt.length > 0 && prompt.every((b) => b !== null && typeof b === "object");
+  }
+  return prompt !== null && typeof prompt === "object";
+}
+function sleep(ms) {
+  return new Promise((resolve41) => setTimeout(resolve41, ms));
+}
+function httpErrorMessage(body) {
+  const raw = Buffer.from(body).toString("utf8");
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && typeof parsed["message"] === "string") {
+      return parsed["message"];
+    }
+  } catch {
+  }
+  return raw;
+}
+async function promptHostSession(hosts, target, sessionId, input) {
+  if (!hosts) {
+    throw new Error(
+      "this daemon has no host registry wired \u2014 device prompt is unavailable (internal configuration issue, not a user error)"
+    );
+  }
+  if (!isValidPrompt(input.prompt)) {
+    return {
+      ok: false,
+      message: "`prompt` must be a non-empty string, a content block object, or an array of content blocks."
+    };
+  }
+  const pollMs = Math.min(Math.max(input.pollMs ?? 1e3, 10), 1e4);
+  const delay2 = input.sleep ?? sleep;
+  const enqueueBody = { prompt: input.prompt, queue: true };
+  if (input.interrupt) enqueueBody.interrupt = true;
+  if (input.force) enqueueBody.force = true;
+  const startedAt = Date.now();
+  let enqueueRes;
+  try {
+    enqueueRes = await hosts.forwardHttp(target, {
+      method: "POST",
+      path: `${DEVICE_PROMPT_PATH_PREFIX}/${encodeURIComponent(sessionId)}?wait=false`,
+      headers: { "content-type": "application/json" },
+      body: new Uint8Array(Buffer.from(JSON.stringify(enqueueBody), "utf8"))
+    });
+  } catch (err) {
+    return { ok: false, message: err instanceof Error ? err.message : String(err) };
+  }
+  if (enqueueRes.status < 200 || enqueueRes.status >= 300) {
+    return { ok: false, status: enqueueRes.status, message: httpErrorMessage(enqueueRes.body) };
+  }
+  let enqueueParsed = {};
+  try {
+    const parsed = JSON.parse(Buffer.from(enqueueRes.body).toString("utf8"));
+    if (parsed !== null && typeof parsed === "object") enqueueParsed = parsed;
+  } catch {
+  }
+  if (!input.wait) {
+    const pending = enqueueParsed["pending"] === true;
+    return {
+      ok: true,
+      ...pending ? {
+        pending: true,
+        ...typeof enqueueParsed["queueId"] === "string" ? { queueId: enqueueParsed["queueId"] } : {},
+        ...typeof enqueueParsed["queuePosition"] === "number" ? { queuePosition: enqueueParsed["queuePosition"] } : {}
+      } : {}
+    };
+  }
+  for (; ; ) {
+    await delay2(pollMs);
+    const waitedMs = Date.now() - startedAt;
+    let descRes;
+    try {
+      descRes = await hosts.forwardHttp(target, {
+        method: "GET",
+        path: `/sessions/${encodeURIComponent(sessionId)}`
+      });
+    } catch (err) {
+      return { ok: false, waitedMs, message: err instanceof Error ? err.message : String(err) };
+    }
+    if (descRes.status === 404) {
+      return { ok: false, waitedMs, status: 404, message: `session ${sessionId} not found on host ${target}` };
+    }
+    if (descRes.status < 200 || descRes.status >= 300) {
+      return { ok: false, waitedMs, status: descRes.status, message: httpErrorMessage(descRes.body) };
+    }
+    let descriptor = {};
+    try {
+      const parsed = JSON.parse(Buffer.from(descRes.body).toString("utf8"));
+      if (parsed !== null && typeof parsed === "object") descriptor = parsed;
+    } catch {
+      return { ok: false, waitedMs, status: descRes.status, message: "host returned a non-JSON session descriptor" };
+    }
+    if (descriptor["alive"] === false) {
+      return { ok: false, waitedMs, message: `session ${sessionId} ended while waiting for its turn to drain` };
+    }
+    const queue = Array.isArray(descriptor["promptQueue"]) ? descriptor["promptQueue"] : [];
+    if (descriptor["busy"] !== true && queue.length === 0) {
+      return { ok: true, waitedMs };
+    }
+    if (input.maxWaitMs !== void 0 && input.maxWaitMs > 0 && waitedMs >= input.maxWaitMs) {
+      return { ok: false, waitedMs, message: `timed out after ${waitedMs}ms waiting for the turn to drain` };
+    }
+  }
+}
 
 // src/app-tools.ts
 init_app_ui_build();
@@ -37339,7 +37637,7 @@ function createLedgerAppender(app, appRunId, runId, item) {
   };
   return { append, flush: () => chain };
 }
-async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvents, cache2, cacheKey, input, persist, appRegistry, eventLog, lease, runsRoot) {
+async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvents, cache3, cacheKey, input, persist, appRegistry, eventLog, lease, runsRoot) {
   if (lease) {
     const renew = () => {
       state.run.lease = { ownerId: lease.ownerId, heartbeatAt: lease.now().toISOString() };
@@ -37371,7 +37669,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
       workspaceSlug: state.workspaceSlug,
       ...workspacePaths ? { workspace: workspacePaths.scratch, artifactsDir: workspacePaths.artifactsDir, runId: state.run.runId, onArtifact } : {},
       input,
-      ...cache2 ? { cache: cache2, cacheKey } : {},
+      ...cache3 ? { cache: cache3, cacheKey } : {},
       // WP-S — human-resolved approval steps: a `kind: "approval"` step parks
       // the run as "awaiting-approval" with a pending inbox entry, instead of
       // the engine's silent auto-approve. A human answers through
@@ -38057,9 +38355,9 @@ function createWorkflowRunner(opts) {
         }
       );
       state.agents = agents;
-      const cache2 = input.cacheKey ? journal ? teeIntoInternalJournal(createFileStepCache(input.cacheKey), journal) : createFileStepCache(input.cacheKey) : journal?.cache;
+      const cache3 = input.cacheKey ? journal ? teeIntoInternalJournal(createFileStepCache(input.cacheKey), journal) : createFileStepCache(input.cacheKey) : journal?.cache;
       const effectiveCacheKey = input.cacheKey ?? journal?.cacheKey;
-      void executeRunWorkflow(state, workflow, agents, abort.signal, sessionEvents, cache2, effectiveCacheKey, void 0, persist, opts.appRegistry, eventLog, leaseOpts, workspace).then(() => {
+      void executeRunWorkflow(state, workflow, agents, abort.signal, sessionEvents, cache3, effectiveCacheKey, void 0, persist, opts.appRegistry, eventLog, leaseOpts, workspace).then(() => {
         for (const [sid, binding] of sessionToRun) {
           if (binding.runId === runId) sessionToRun.delete(sid);
         }
@@ -38190,7 +38488,7 @@ function createWorkflowRunner(opts) {
       );
       state.agents = agents;
       const journal = internalJournal(workspaceRoot, runId);
-      const cache2 = args.cacheKey ? journal ? teeIntoInternalJournal(createFileStepCache(args.cacheKey), journal) : createFileStepCache(args.cacheKey) : journal?.cache;
+      const cache3 = args.cacheKey ? journal ? teeIntoInternalJournal(createFileStepCache(args.cacheKey), journal) : createFileStepCache(args.cacheKey) : journal?.cache;
       const effectiveCacheKey = args.cacheKey ?? journal?.cacheKey;
       const execWorkflow = journal && args.cacheKey === void 0 ? forceCacheableWorkflow(workflow) : workflow;
       void executeRunWorkflow(
@@ -38199,7 +38497,7 @@ function createWorkflowRunner(opts) {
         agents,
         abort.signal,
         sessionEvents,
-        cache2,
+        cache3,
         effectiveCacheKey,
         args.input,
         persist,
@@ -39663,7 +39961,7 @@ function createTaskLedger(opts) {
     conflict: false,
     error: `task "${taskId}" not found`
   });
-  const lookup = (taskId, caller) => {
+  const lookup2 = (taskId, caller) => {
     const task = tasks.get(taskId);
     if (!task) return void 0;
     if (!canAccessBoard(caller, task.boardId)) return void 0;
@@ -39808,7 +40106,7 @@ function createTaskLedger(opts) {
     return Array.from(tasks.values()).filter((t) => t.boardId === boardId).filter((t) => filter?.status !== void 0 ? t.status === filter.status : true).filter((t) => includeClosed || !isClosedTaskStatus(t.status)).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
   };
   const claim = (input, caller) => {
-    const task = lookup(input.taskId, caller);
+    const task = lookup2(input.taskId, caller);
     if (!task) return notFound(input.taskId);
     if (input.rev !== task.rev || task.owner !== void 0) {
       return { ok: false, conflict: true, current: task };
@@ -39831,7 +40129,7 @@ function createTaskLedger(opts) {
     return { ok: true, task };
   };
   const update = (input, caller) => {
-    const task = lookup(input.taskId, caller);
+    const task = lookup2(input.taskId, caller);
     if (!task) return notFound(input.taskId);
     if (input.rev !== task.rev) {
       return { ok: false, conflict: true, current: task };
@@ -40014,7 +40312,7 @@ function createTaskLedger(opts) {
     return { ok: true, task };
   };
   const linkApproval = (taskId, approvalId, caller) => {
-    const task = lookup(taskId, caller);
+    const task = lookup2(taskId, caller);
     if (!task) return notFound(taskId);
     const manager = isManager(caller, task);
     const owner = isOwner(caller, task);
@@ -40059,7 +40357,7 @@ function createTaskLedger(opts) {
   return {
     create,
     list,
-    get: (taskId, caller) => lookup(taskId, caller),
+    get: (taskId, caller) => lookup2(taskId, caller),
     claim,
     update,
     linkApproval,
@@ -42506,7 +42804,7 @@ function createRemoteCatalogClient(options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_REMOTE_CATALOG_TIMEOUT_MS;
   const fetchImpl = options.fetchImpl ?? fetch;
   const now = options.now ?? Date.now;
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   async function fetchOne(url) {
     let body;
     try {
@@ -42538,13 +42836,13 @@ function createRemoteCatalogClient(options = {}) {
     async fetchSources(sources, opts = {}) {
       const results = await Promise.all(
         sources.map(async ({ url }) => {
-          const hit = cache2.get(url);
+          const hit = cache3.get(url);
           if (!opts.refresh && hit && now() - hit.at < ttlMs) return hit.result;
           const result = await fetchOne(url);
           if (result.entries.length > 0 || result.warnings.length === 0) {
-            cache2.set(url, { at: now(), result });
+            cache3.set(url, { at: now(), result });
           } else {
-            cache2.delete(url);
+            cache3.delete(url);
           }
           return result;
         })
@@ -43880,7 +44178,7 @@ function send(res, status, body) {
   res.writeHead(status, { "content-type": "application/json" });
   res.end(JSON.stringify(body));
 }
-async function readBody(req) {
+async function readBody2(req) {
   const chunks = [];
   let size = 0;
   for await (const chunk of req) {
@@ -43917,7 +44215,7 @@ async function handleA2aTaskRequest(req, res, path, deps2) {
     return true;
   }
   if (appId.includes("/.well-known/")) return false;
-  const body = await readBody(req);
+  const body = await readBody2(req);
   if ("tooLarge" in body) {
     send(res, 413, { jsonrpc: "2.0", id: null, error: { code: JSON_RPC_ERROR.invalidRequest, message: "request body too large" } });
     return true;
@@ -45303,8 +45601,8 @@ async function startHttpServer(opts) {
         }))
       };
     });
-    server2.server.setRequestHandler(CallToolRequestSchema, async (request) => {
-      const out = await proxy.callTool(importId, request.params.name, request.params.arguments ?? {});
+    server2.server.setRequestHandler(CallToolRequestSchema, async (request2) => {
+      const out = await proxy.callTool(importId, request2.params.name, request2.params.arguments ?? {});
       if (!out.ok) {
         return { content: [{ type: "text", text: out.error }], isError: true };
       }
@@ -46993,6 +47291,16 @@ async function startHttpServer(opts) {
           );
           if (handled) return;
         }
+        if (path.startsWith("/device-prompt/")) {
+          const handled = await handleDevicePrompt(
+            req,
+            res,
+            path,
+            opts.port,
+            opts.deviceSpawnAllow === true
+          );
+          if (handled) return;
+        }
         if (opts.remote && path.startsWith("/remote")) {
           const handled = await handleRemoteControl(req, res, path, opts.remote);
           if (handled) return;
@@ -49623,6 +49931,79 @@ async function handleDeviceSpawn(req, res, path, port, spawnAllowed) {
   Readable.fromWeb(upstreamRes.body).pipe(res);
   return true;
 }
+async function handleDevicePrompt(req, res, path, port, spawnAllowed) {
+  const json3 = (status, body2) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body2));
+  };
+  const promptMatch = path.match(/^\/device-prompt\/([^/?]+)(\?.*)?$/);
+  if (!promptMatch) return false;
+  const sessionId = decodeURIComponent(promptMatch[1] ?? "");
+  if (!sessionId) return false;
+  if (req.headers[HOST_SCOPE_HEADER] !== "1") {
+    json3(403, {
+      error: "host_scope_required",
+      message: "device-prompt is reachable only over a host-scoped pairing (the far end must have registered this daemon via `agentproto pair offer --host` + `agentproto devices add`)"
+    });
+    return true;
+  }
+  if (!spawnAllowed) {
+    json3(403, {
+      error: "spawn_disabled",
+      message: "this host has not opted in \u2014 run `agentproto devices allow-spawn on` on it"
+    });
+    return true;
+  }
+  if (req.method !== "POST") {
+    json3(405, { error: "method_not_allowed", message: "POST /device-prompt/:sessionId" });
+    return true;
+  }
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  const body = Buffer.concat(chunks);
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (v === void 0) continue;
+    const lower = k.toLowerCase();
+    if (lower === "connection" || lower === "keep-alive" || lower === "transfer-encoding") continue;
+    if (lower === "upgrade" || lower === "host" || lower === "content-length") continue;
+    if (lower === HOST_SCOPE_HEADER) continue;
+    headers[k] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  const rawUrl = req.url ?? "";
+  const query = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
+  let upstreamRes;
+  try {
+    upstreamRes = await fetch(
+      `http://127.0.0.1:${port}/sessions/${encodeURIComponent(sessionId)}/prompt${query}`,
+      {
+        method: "POST",
+        headers,
+        ...body.length > 0 ? { body } : {}
+        // Cast rationale — see `handleDeviceSpawn`'s identical cast above.
+      }
+    );
+  } catch (err) {
+    json3(502, {
+      error: "self_proxy_unreachable",
+      message: err instanceof Error ? err.message : String(err)
+    });
+    return true;
+  }
+  const resHeaders = {};
+  upstreamRes.headers.forEach((v, k) => {
+    if (k === "content-length" || k === "connection") return;
+    resHeaders[k] = v;
+  });
+  res.writeHead(upstreamRes.status, resHeaders);
+  if (!upstreamRes.body) {
+    res.end();
+    return true;
+  }
+  const resBuf = Buffer.from(await upstreamRes.arrayBuffer());
+  res.end(resBuf);
+  return true;
+}
 async function handleRemoteControl(req, res, path, controller) {
   const json3 = (status, body) => {
     res.writeHead(status, { "content-type": "application/json" });
@@ -50386,6 +50767,33 @@ async function handleDevices(req, res, path, registry, hostRegistry, joinTokens)
     }
     return true;
   }
+  const deviceSessionPromptMatch = path.match(/^\/devices\/([^/]+)\/sessions\/([^/]+)\/prompt$/);
+  if (deviceSessionPromptMatch && req.method === "POST") {
+    if (!hostRegistry) {
+      json3(404, { error: "no_host_registry", message: "this daemon has no host registry wired" });
+      return true;
+    }
+    const target = decodeURIComponent(deviceSessionPromptMatch[1] ?? "");
+    const sessionId = decodeURIComponent(deviceSessionPromptMatch[2] ?? "");
+    const body = await readJsonBody2(req);
+    const b = body && typeof body === "object" ? body : {};
+    const reqUrl = req.url ?? "";
+    const qs = new URLSearchParams(reqUrl.includes("?") ? reqUrl.slice(reqUrl.indexOf("?") + 1) : "");
+    try {
+      const result = await promptHostSession(hostRegistry, target, sessionId, {
+        prompt: b["prompt"],
+        interrupt: b["interrupt"] === true,
+        force: b["force"] === true,
+        wait: ["1", "true"].includes(qs.get("wait") ?? ""),
+        ...qs.get("waitPollMs") ? { pollMs: Number(qs.get("waitPollMs")) } : {},
+        ...qs.get("maxWaitMs") ? { maxWaitMs: Number(qs.get("maxWaitMs")) } : {}
+      });
+      json3(result.ok ? 200 : result.status ?? 400, result);
+    } catch (err) {
+      json3(502, { error: "prompt_forward_failed", message: err instanceof Error ? err.message : String(err) });
+    }
+    return true;
+  }
   const idMatch = path.match(/^\/devices\/([^/]+)$/);
   if (idMatch && req.method === "PATCH") {
     const target = decodeURIComponent(idMatch[1] ?? "");
@@ -55793,7 +56201,7 @@ function waitingOnKey(w) {
 var PR_SETTLE_SWEEP_INTERVAL_MS = 5 * 6e4;
 var PR_SETTLE_SWEEP_MAX_URLS = 10;
 function createActivityProjector(opts) {
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   const prStates = /* @__PURE__ */ new Map();
   const projectOwnerRaw = (owner) => {
     switch (owner) {
@@ -55854,9 +56262,9 @@ function createActivityProjector(opts) {
     const seen = /* @__PURE__ */ new Set();
     for (const rec of next) {
       seen.add(rec.id);
-      const prev = cache2.get(rec.id);
+      const prev = cache3.get(rec.id);
       const changed = !prev || prev.state !== rec.state || prev.taskId !== rec.taskId || waitingOnKey(prev.waitingOn) !== waitingOnKey(rec.waitingOn);
-      cache2.set(rec.id, rec);
+      cache3.set(rec.id, rec);
       if (changed && announce) {
         opts.sessionEvents.emit({
           type: "activity:changed",
@@ -55865,8 +56273,8 @@ function createActivityProjector(opts) {
         });
       }
     }
-    for (const [id, rec] of cache2) {
-      if (OWNER_OF_SOURCE[rec.source] === owner && !seen.has(id)) cache2.delete(id);
+    for (const [id, rec] of cache3) {
+      if (OWNER_OF_SOURCE[rec.source] === owner && !seen.has(id)) cache3.delete(id);
     }
   };
   const ownersTouchedBy = (type) => {
@@ -55978,7 +56386,7 @@ function createActivityProjector(opts) {
     dispose() {
       unsubscribe();
       if (sweepTimer) clearInterval(sweepTimer);
-      cache2.clear();
+      cache3.clear();
       prStates.clear();
     }
   };
@@ -56163,7 +56571,7 @@ function createApprovalsEngine(opts) {
     const record2 = approvals.get(id);
     return record2 ? checkExpiry(record2) : void 0;
   };
-  const request = (input, requester) => {
+  const request2 = (input, requester) => {
     const id = `apr_${randomUUID().replace(/-/g, "").slice(0, 20)}`;
     const requestedChannels = input.channels && input.channels.length > 0 ? input.channels.filter((c) => enabledChannels.includes(c)) : enabledChannels;
     const canonicalJson2 = canonicalPayloadFor(input.payload);
@@ -56329,7 +56737,7 @@ function createApprovalsEngine(opts) {
   };
   return {
     enabledChannels,
-    request,
+    request: request2,
     get,
     list,
     wait,
@@ -58235,127 +58643,9 @@ function registerPairingTools(server, opts) {
     }
   );
 }
-var HOP_BY_HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "host"]);
-function collectHeaders(raw) {
-  const headers = {};
-  for (const [k, v] of Object.entries(raw)) {
-    if (v === void 0 || HOP_BY_HOP.has(k.toLowerCase())) continue;
-    headers[k] = Array.isArray(v) ? v.join(", ") : v;
-  }
-  return headers;
-}
-function isPrematureCloseError(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ERR_STREAM_PREMATURE_CLOSE";
-}
-async function readBody2(req) {
-  const chunks = [];
-  for await (const chunk of req) chunks.push(chunk);
-  if (chunks.length === 0) return void 0;
-  return new Uint8Array(Buffer.concat(chunks));
-}
-async function startDeviceSandboxBridge(opts) {
-  const { hostRegistry, target } = opts;
-  const server = createServer((req, res) => {
-    void handleRequest(req, res).catch((err) => {
-      if (res.writableEnded) return;
-      if (!res.headersSent) {
-        res.writeHead(502, { "content-type": "application/json" });
-        res.end(
-          JSON.stringify({
-            error: "device_sandbox_bridge_failed",
-            message: err instanceof Error ? err.message : String(err)
-          })
-        );
-        return;
-      }
-      res.end();
-    });
-  });
-  async function handleRequest(req, res) {
-    const body = await readBody2(req);
-    let upstream;
-    try {
-      upstream = await hostRegistry.forwardHttpStream(target, {
-        method: req.method ?? "GET",
-        path: `/device-spawn${req.url ?? "/"}`,
-        headers: collectHeaders(req.headers),
-        ...body ? { body } : {}
-      });
-    } catch (err) {
-      res.writeHead(502, { "content-type": "application/json" });
-      res.end(
-        JSON.stringify({
-          error: "device_unreachable",
-          message: err instanceof Error ? err.message : String(err)
-        })
-      );
-      return;
-    }
-    const resHeaders = {};
-    for (const [k, v] of Object.entries(upstream.headers)) {
-      if (HOP_BY_HOP.has(k.toLowerCase()) || k.toLowerCase() === "content-length") continue;
-      resHeaders[k] = v;
-    }
-    res.writeHead(upstream.status, resHeaders);
-    try {
-      await pipeline(
-        Readable.fromWeb(upstream.body),
-        res
-      );
-    } catch (err) {
-      if (!isPrematureCloseError(err)) throw err;
-    }
-  }
-  const port = await getFreePort2();
-  await new Promise((resolve41, reject) => {
-    server.once("error", reject);
-    server.listen(port, "127.0.0.1", () => resolve41());
-  });
-  return {
-    mcpUrl: `http://127.0.0.1:${port}/mcp`,
-    async close() {
-      await new Promise((resolve41) => server.close(() => resolve41()));
-    }
-  };
-}
-async function getFreePort2() {
-  return new Promise((resolve41, reject) => {
-    const srv = createServer$1();
-    srv.once("error", reject);
-    srv.listen(0, "127.0.0.1", () => {
-      const address = srv.address();
-      if (address === null || typeof address === "string") {
-        srv.close(() => reject(new Error("failed to allocate a free port")));
-        return;
-      }
-      const { port } = address;
-      srv.close(() => resolve41(port));
-    });
-  });
-}
 
-// src/sandbox-providers/device.ts
-function createDeviceSandboxProvider(target, hostRegistry) {
-  return {
-    async boot(_spec, _opts) {
-      const hosts = await hostRegistry.list();
-      const known = hosts.some((h) => h.fingerprint === target || h.name === target);
-      if (!known) {
-        throw new Error(
-          `device sandbox: no paired host device matches "${target}" \u2014 run \`agentproto devices add <offer-url>\` here first (the offer must come from \`agentproto pair offer --host\` run ON that device). Check \`agentproto devices list\` for known devices.`
-        );
-      }
-      const bridge = await startDeviceSandboxBridge({ hostRegistry, target });
-      return {
-        mcpUrl: bridge.mcpUrl,
-        sandboxId: `device-${target}-${randomUUID()}`,
-        async stop() {
-          await bridge.close();
-        }
-      };
-    }
-  };
-}
+// src/index.ts
+init_device();
 function text9(value) {
   return {
     content: [
@@ -58367,7 +58657,7 @@ function text9(value) {
   };
 }
 function registerDeviceTools(server, opts) {
-  const { registry, joinTokens } = opts;
+  const { registry, hosts: registryHosts, joinTokens } = opts;
   server.tool(
     "device_list",
     "List devices known to this daemon: fingerprint, name, role (client|host), kind (browser|cli|daemon, best-effort from the client's self-reported name; always daemon for a host), rendezvous, createdAt, lastSeen, scope (host, when granted via `pair offer --host`), online (a channel/forward is active right now or a recent contact succeeded), and for hosts lastProbeAt/lastError (last contact attempt and why it failed). Joined CI hosts that are gone (said goodbye, or unreachable past the TTL) are hidden unless includeEnded is set; a manually added host unreachable past the TTL shows stale: true. Read-only.",
@@ -58449,6 +58739,37 @@ function registerDeviceTools(server, opts) {
       }
     }
   );
+  if (registryHosts) {
+    server.tool(
+      "device_prompt",
+      "Send a prompt (a follow-up turn) to a session on a registered HOST device \u2014 the write counterpart of device_sessions, forwarded live over the host's E2E channel. Queueing rules are identical to a local agent_prompt: fire-and-forget by default, queued behind the session's in-flight turn, `interrupt`/`force` to redirect or jump the queue. wait: true blocks until the prompted turn drains. Requires the HOST daemon to have opted in (agentproto devices allow-spawn on) over a host-scoped pairing \u2014 the same gate as device spawn; refused for a plain remote-control pairing or an unknown target.",
+      {
+        target: z.string().describe("The host's fingerprint or name (see device_list)."),
+        sessionId: z.string().min(1).describe("The session id ON the host to prompt."),
+        prompt: z.union([z.string(), z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).describe("Non-empty string, a content block, or an array of content blocks."),
+        wait: z.boolean().optional().describe("Block until the prompted turn drains. Default false."),
+        interrupt: z.boolean().optional().describe("Mid-turn: redirect instead of queueing (agent_prompt's interrupt). Default false."),
+        force: z.boolean().optional().describe("Mid-turn: jump the FRONT of the FIFO (agent_prompt's force). Default false."),
+        pollMs: z.number().int().min(10).max(1e4).optional().describe("Poll cadence while waiting, ms. Default 1000. Each poll is a fresh E2E dial."),
+        maxWaitMs: z.number().int().positive().optional().describe("Give up waiting after this long (ms). Default: wait forever.")
+      },
+      async ({ target, sessionId, prompt, wait, interrupt, force, pollMs, maxWaitMs }) => {
+        try {
+          const result = await promptHostSession(registryHosts, target, sessionId, {
+            prompt,
+            ...wait ? { wait: true } : {},
+            ...interrupt ? { interrupt: true } : {},
+            ...force ? { force: true } : {},
+            ...pollMs !== void 0 ? { pollMs } : {},
+            ...maxWaitMs !== void 0 ? { maxWaitMs } : {}
+          });
+          return text9(result);
+        } catch (err) {
+          return text9({ ok: false, message: err instanceof Error ? err.message : String(err) });
+        }
+      }
+    );
+  }
   if (joinTokens) {
     server.tool(
       "join_token_create",
@@ -60116,6 +60437,440 @@ function createWorkspaceFs(opts) {
 
 // src/index.ts
 init_role();
+var WHSEC_PREFIX = "whsec_";
+function encodeWhsecSecret(raw) {
+  return WHSEC_PREFIX + Buffer.from(raw).toString("base64");
+}
+function decodeWhsecSecret(secret) {
+  if (typeof secret !== "string" || !secret.startsWith(WHSEC_PREFIX)) return null;
+  const encoded = secret.slice(WHSEC_PREFIX.length);
+  if (encoded.length === 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded) || encoded.length % 4 !== 0) {
+    return null;
+  }
+  let key;
+  try {
+    key = Buffer.from(encoded, "base64");
+  } catch {
+    return null;
+  }
+  if (key.length < 24 || key.length > 64) return null;
+  return key;
+}
+function signWebhook(input) {
+  if (input.secrets.length === 0) throw new Error("signWebhook: at least one secret is required");
+  const prefix = Buffer.from(`${input.msgId}.${input.timestamp}.`, "utf8");
+  const payload = Buffer.from(input.payload.buffer, input.payload.byteOffset, input.payload.byteLength);
+  const segments = input.secrets.map((secret) => {
+    const key = decodeWhsecSecret(secret);
+    if (!key) throw new Error(`signWebhook: invalid webhooks secret format: ${redactPrefix(secret)}`);
+    const mac = createHmac("sha256", key).update(prefix).update(payload).digest();
+    return `v1,${mac.toString("base64")}`;
+  });
+  return {
+    "webhook-id": input.msgId,
+    "webhook-timestamp": String(input.timestamp),
+    "webhook-signature": segments.join(" ")
+  };
+}
+function redactPrefix(secret) {
+  return `${WHSEC_PREFIX}<${secret.length - WHSEC_PREFIX.length} b64 chars, invalid>`;
+}
+var SsrfFetchError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsrfFetchError";
+  }
+  reason;
+};
+var MAX_REQUEST_BODY_BYTES = 262144;
+var MAX_RESPONSE_DIAGNOSTIC_BYTES = 4096;
+function isPubliclyRoutable(ipRaw) {
+  const ip = ipRaw.includes("%") ? ipRaw.slice(0, ipRaw.indexOf("%")) : ipRaw;
+  const v4 = parseIpv4(ip);
+  if (v4) return ipv4Public(v4[0], v4[1], v4[2], v4[3]);
+  const v6 = parseIpv6Bytes(ip);
+  if (v6) return ipv6Public(v6);
+  return false;
+}
+function ipv4Public(a, b, c, d) {
+  if (a === 0) return false;
+  if (a === 10) return false;
+  if (a === 127) return false;
+  if (a === 100 && b >= 64 && b <= 127) return false;
+  if (a === 169 && b === 254) return false;
+  if (a === 172 && b >= 16 && b <= 31) return false;
+  if (a === 192 && b === 168) return false;
+  if (a === 192 && b === 0 && c === 0) return false;
+  if (a === 192 && b === 0 && c === 2) return false;
+  if (a === 198 && b === 51 && c === 100) return false;
+  if (a === 198 && (b === 18 || b === 19)) return false;
+  if (a === 203 && b === 0 && c === 113) return false;
+  if (a >= 224) return false;
+  return true;
+}
+function ipv6Public(v6) {
+  if (v6.mapped) return ipv4Public(v6.mapped[0], v6.mapped[1], v6.mapped[2], v6.mapped[3]);
+  const b = v6.bytes;
+  const v = new DataView(b.buffer, b.byteOffset, b.byteLength);
+  const b0 = v.getUint8(0);
+  const b1 = v.getUint8(1);
+  const b2 = v.getUint8(2);
+  const b3 = v.getUint8(3);
+  const b15 = v.getUint8(15);
+  const tailZero = b.slice(1, 15).every((x) => x === 0);
+  if (b.every((x) => x === 0)) return false;
+  if (tailZero && b0 === 0 && b15 === 1) return false;
+  if ((b0 & 254) === 252) return false;
+  if (b0 === 254 && (b1 & 192) === 128) return false;
+  if (b0 === 255) return false;
+  if (b0 === 32 && b1 === 1 && b2 === 13 && b3 === 184) return false;
+  return true;
+}
+function parseIpv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const o = [];
+  for (const part of parts) {
+    if (!/^(?:0|[1-9]\d{0,2})$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    o.push(n);
+  }
+  const first = o[0];
+  const second = o[1];
+  const third = o[2];
+  const fourth = o[3];
+  if (first === void 0 || second === void 0 || third === void 0 || fourth === void 0) return null;
+  return [first, second, third, fourth];
+}
+function parseIpv6Bytes(rawIp) {
+  const ip = rawIp.replace(/^\[|\]$/g, "");
+  if (!ip.includes(":")) return null;
+  if (ip.lastIndexOf("::") !== ip.indexOf("::")) return null;
+  const v4Match = ip.match(/^(?:.*:)(\d{1,3}(?:\.\d{1,3}){3})$/);
+  const compressed = ip.includes("::");
+  if (compressed) {
+    const halves = ip.split("::");
+    const before = halves[0] ?? "";
+    const after = halves[1] ?? "";
+    const head = before === "" ? [] : before.split(":");
+    if (head.some((g) => !isHexGroup(g))) return null;
+    const tail = after === "" ? [] : after.replace(/(\d{1,3}(?:\.\d{1,3}){3})$/, "").split(":").filter((g) => g !== "");
+    if (tail.some((g) => !isHexGroup(g))) return null;
+    return fromGroups(head, tail, v4Match?.[1]);
+  }
+  const all = ip.split(":");
+  const v4 = v4Match ? [all[all.length - 1]] : [];
+  const hexGroups = all.slice(0, all.length - (v4Match ? 1 : 0));
+  if (all.length !== (v4Match ? 6 : 8) + (v4Match ? 1 : 0)) return null;
+  if (hexGroups.some((g) => !isHexGroup(g))) return null;
+  return fromGroups(hexGroups, [], v4 ? v4[0] : void 0);
+}
+function isHexGroup(g) {
+  return /^[\da-fA-F]{1,4}$/.test(g);
+}
+function fromGroups(head, tail, v4) {
+  if (head.length + tail.length > (v4 ? 6 : 8)) return null;
+  const bytes = new Uint8Array(16);
+  const writeGroup = (g, offset) => {
+    if (g === void 0) return false;
+    const v = parseInt(g, 16);
+    bytes[offset] = v >> 8;
+    bytes[offset + 1] = v & 255;
+    return true;
+  };
+  head.forEach((g, i) => writeGroup(g, i * 2));
+  const tailStart = 16 - tail.length * 2 - (v4 ? 4 : 0);
+  tail.forEach((g, i) => writeGroup(g, tailStart + i * 2));
+  if (v4) {
+    const o = parseIpv4(v4);
+    if (!o) return null;
+    bytes[12] = o[0];
+    bytes[13] = o[1];
+    bytes[14] = o[2];
+    bytes[15] = o[3];
+    const mapped = bytes.slice(0, 10).every((x) => x === 0) && bytes[10] === 255 && bytes[11] === 255;
+    return { bytes, mapped: mapped ? o : void 0 };
+  }
+  return { bytes };
+}
+async function resolveHost(hostname6, resolvers) {
+  if (parseIpv4(hostname6)) return [hostname6];
+  const bracketless = hostname6.replace(/^\[|\]$/g, "");
+  if (bracketless.includes(":")) return [bracketless];
+  if (resolvers.lookup) return (await resolvers.lookup(bracketless)).map((r) => r.address);
+  const found2 = await lookup(bracketless, { all: true, verbatim: true });
+  return found2.map((f) => f.address);
+}
+var testDispatcher = null;
+function setEgressDispatcherForTests(dispatcher) {
+  testDispatcher = dispatcher;
+}
+async function ssrfFetch(url, init, io = {}) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new SsrfFetchError("non_https", "unparseable callback URL");
+  }
+  if (parsed.protocol !== "https:") {
+    throw new SsrfFetchError("non_https", `scheme ${parsed.protocol} \u2014 https only`);
+  }
+  if ((init.body?.byteLength ?? 0) > MAX_REQUEST_BODY_BYTES) {
+    throw new SsrfFetchError("connect", `request body exceeds the ${MAX_REQUEST_BODY_BYTES}-byte clamp`);
+  }
+  if (testDispatcher) {
+    const literal = parseIpv4(parsed.hostname);
+    if (literal && !ipv4Public(literal[0], literal[1], literal[2], literal[3])) {
+      throw new SsrfFetchError("private_target", `literal non-public address ${parsed.hostname}`);
+    }
+    return await testDispatcher({ url, headers: init.headers ?? {}, body: init.body, timeoutMs: init.timeoutMs });
+  }
+  const candidates = await resolveHost(parsed.hostname, io.resolvers ?? {});
+  if (candidates.length === 0) {
+    throw new SsrfFetchError("connect", `no addresses resolved for ${parsed.hostname}`);
+  }
+  const rejected = candidates.find((ip) => !isPubliclyRoutable(ip));
+  if (rejected !== void 0) {
+    throw new SsrfFetchError("private_target", `${parsed.hostname} resolves to non-public address ${rejected}`);
+  }
+  const connectIp = candidates[0] ?? candidates[candidates.length - 1];
+  if (connectIp === void 0) throw new SsrfFetchError("connect", "no address available for connect");
+  const port = parsed.port ? Number(parsed.port) : 443;
+  return await rawPost({
+    connectIp,
+    servername: parsed.hostname,
+    port,
+    path: `${parsed.pathname}${parsed.search}`,
+    headers: init.headers ?? {},
+    body: init.body,
+    timeoutMs: init.timeoutMs
+  });
+}
+function rawPost(args) {
+  return new Promise((resolve41, reject) => {
+    const req = request({
+      // Connect to the PRE-VALIDATED address; keep the original hostname in
+      // `servername` so SNI and the certificate check never loosen.
+      host: args.connectIp,
+      port: args.port,
+      path: args.path,
+      method: "POST",
+      servername: args.servername,
+      headers: args.headers,
+      rejectUnauthorized: true
+    });
+    let settled = false;
+    const fail3 = (reason, message) => {
+      if (settled) return;
+      settled = true;
+      req.destroy();
+      reject(new SsrfFetchError(reason, message));
+    };
+    const ok3 = (status, body) => {
+      if (settled) return;
+      settled = true;
+      resolve41({ status, body });
+    };
+    req.setTimeout(args.timeoutMs, () => fail3("timeout", `no response within ${args.timeoutMs}ms`));
+    req.on("error", (err) => {
+      fail3("connect", err.message);
+    });
+    req.on("response", (res) => {
+      const status = res.statusCode ?? 0;
+      let diags = Buffer.alloc(0);
+      res.on("data", (chunk) => {
+        if (diags.length < MAX_RESPONSE_DIAGNOSTIC_BYTES) {
+          diags = Buffer.concat([diags, chunk.subarray(0, MAX_RESPONSE_DIAGNOSTIC_BYTES - diags.length)]);
+        }
+        if (diags.length >= MAX_RESPONSE_DIAGNOSTIC_BYTES) res.destroy();
+      });
+      res.on("end", () => {
+        if (status >= 300 && status < 400) {
+          const location = res.headers["location"];
+          if (typeof location === "string" && !new URL(location, `https://${args.servername}`).protocol.startsWith("https")) {
+            fail3("redirect", `redirect target ${location} is not https \u2014 never chased`);
+            return;
+          }
+        }
+        ok3(status, diags.toString("utf8"));
+      });
+      res.on("error", (err) => {
+        fail3("connect", err.message);
+      });
+    });
+    if (args.body) req.write(Buffer.from(args.body));
+    req.end();
+  });
+}
+function challengeReasonForSsrf(reason) {
+  if (reason === "non_https") return "non_https";
+  if (reason === "private_target" || reason === "redirect") return "ssrf_blocked";
+  return "timeout";
+}
+var CHALLENGE_TTL_MS = 10 * 60 * 1e3;
+var encoder = new TextEncoder();
+var cache2 = /* @__PURE__ */ new Map();
+function challengeCacheSize() {
+  return cache2.size;
+}
+function resetChallengeCacheForTests() {
+  cache2.clear();
+}
+function normalizeCallbackUrl(url) {
+  try {
+    const u = new URL(url);
+    const port = u.port === "443" ? "" : `:${u.port}`;
+    return `${u.protocol.toLowerCase()}//${u.hostname.toLowerCase()}${port}${u.pathname}${u.search}`;
+  } catch {
+    return null;
+  }
+}
+function hashSecret(secret) {
+  return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+function constantTimeEq(a, b) {
+  const da = createHash("sha256").update(a, "utf8").digest();
+  const db = createHash("sha256").update(b, "utf8").digest();
+  return timingSafeEqual(da, db);
+}
+async function verifyCallback(input, deps2 = {}) {
+  const now = deps2.now ?? (() => Date.now());
+  const normalized = normalizeCallbackUrl(input.url);
+  if (normalized === null || !normalized.startsWith("https://")) {
+    return { ok: false, reason: "non_https", detail: "callback URL must be an https URL" };
+  }
+  if (decodeWhsecSecret(input.secret) === null) {
+    return {
+      ok: false,
+      reason: "challenge_failed",
+      detail: "invalid secret format \u2014 must be whsec_ + base64 decoding to 24..64 bytes (the caller validates before this; a bad secret is never cached)"
+    };
+  }
+  const cacheKey = `${input.principal}|${normalized}|${hashSecret(input.secret)}`;
+  const cached = cache2.get(cacheKey);
+  if (cached && cached.expiresAt > now()) {
+    return { ok: true, verificationBytes: cached.requestBytes };
+  }
+  if (cached) cache2.delete(cacheKey);
+  const challenge = randomBytes(32).toString("hex");
+  const requestBytes = encoder.encode(JSON.stringify({ type: "verification", challenge }));
+  const msgId = `msg_verification_${randomBytes(12).toString("hex")}`;
+  const timestamp = Math.floor(now() / 1e3);
+  let headers;
+  try {
+    const signed = signWebhook({ msgId, timestamp, payload: requestBytes, secrets: [input.secret] });
+    headers = {
+      ...signed,
+      "content-type": "application/json",
+      "X-MCP-Subscription-Id": input.subscriptionId
+    };
+  } catch (err) {
+    return { ok: false, reason: "challenge_failed", detail: `signing failed: ${err.message}` };
+  }
+  let response;
+  try {
+    response = await (deps2.fetch ?? ssrfFetch)(input.url, {
+      method: "POST",
+      headers,
+      body: requestBytes,
+      timeoutMs: 1e4
+      // default challenge timeout (delivery uses 15_000)
+    });
+  } catch (err) {
+    if (err instanceof SsrfFetchError) {
+      return { ok: false, reason: challengeReasonForSsrf(err.reason), detail: `${err.reason}: ${err.message}` };
+    }
+    return { ok: false, reason: "timeout", detail: err.message };
+  }
+  if (response.status < 200 || response.status > 299) {
+    return { ok: false, reason: "non_2xx", detail: `callback responded with status ${response.status}` };
+  }
+  let parsedBody;
+  try {
+    parsedBody = JSON.parse(response.body);
+  } catch {
+    return { ok: false, reason: "challenge_failed", detail: "response body is not JSON" };
+  }
+  const echoed = parsedBody?.challenge;
+  if (typeof echoed !== "string" || !constantTimeEq(echoed, challenge)) {
+    return { ok: false, reason: "challenge_failed", detail: "response did not echo the fresh challenge" };
+  }
+  cache2.set(cacheKey, { requestBytes, expiresAt: now() + CHALLENGE_TTL_MS });
+  return { ok: true, verificationBytes: requestBytes };
+}
+
+// src/webhook-egress/delivery.ts
+var CLAMP_LIMIT_BYTES = 262144;
+var MAX_ATTEMPTS = 5;
+var BACKOFF_BASE_MS = 250;
+var BACKOFF_CAP_MS = 4e3;
+function deliveryBackoffDelay(attempt) {
+  return Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS);
+}
+var TERMINAL_NO_RETRY_STATUSES = /* @__PURE__ */ new Set([410, 413]);
+function serializeEnvelope(envelope) {
+  return new TextEncoder().encode(JSON.stringify(envelope));
+}
+function envelopeClampedBytes(event) {
+  let bytes = serializeEnvelope(event);
+  if (bytes.byteLength <= CLAMP_LIMIT_BYTES) return { bytes, clamped: false };
+  const data = event.data;
+  const clampedEvent = {
+    ...event,
+    data: {
+      summary: `Payload exceeded the ${CLAMP_LIMIT_BYTES}-byte wire clamp and was truncated`,
+      subject: data && typeof data === "object" && "subject" in data ? data.subject : null
+    },
+    truncated: true
+  };
+  bytes = serializeEnvelope(clampedEvent);
+  return { bytes, clamped: true };
+}
+async function deliverEventEnvelope(replay, event, deps2 = {}) {
+  const now = deps2.now ?? (() => Date.now());
+  const sleep3 = deps2.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const fetcher = deps2.fetch ?? ((url, init) => ssrfFetch(url, init));
+  const { bytes: payloadBytes } = envelopeClampedBytes(event);
+  const delivery = { attempts: 0 };
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    if (attempt > 0) await sleep3(deliveryBackoffDelay(attempt));
+    delivery.attempts += 1;
+    delivery.lastAt = new Date(now()).toISOString();
+    const timestamp = Math.floor(now() / 1e3);
+    let signed;
+    try {
+      signed = signWebhook({ msgId: event.eventId, timestamp, payload: payloadBytes, secrets: replay.secrets });
+    } catch (err) {
+      delivery.lastError = `signing failed: ${err.message}`;
+      return { ok: false, reason: "invalid_secret", delivery };
+    }
+    let response;
+    try {
+      response = await fetcher(replay.callbackUrl, {
+        method: "POST",
+        headers: { ...signed, "content-type": "application/json" },
+        body: payloadBytes,
+        timeoutMs: 15e3
+        // delivery default (challenge uses 10_000)
+      });
+    } catch (err) {
+      delivery.lastError = err instanceof Error ? err.message : String(err);
+      if (attempt < MAX_ATTEMPTS - 1) continue;
+      return { ok: false, reason: "network", delivery };
+    }
+    if (response.status >= 200 && response.status <= 299) {
+      return { ok: true, delivery };
+    }
+    if (TERMINAL_NO_RETRY_STATUSES.has(response.status)) {
+      delivery.lastError = `terminal status ${response.status}`;
+      return { ok: false, reason: `http_${response.status}`, delivery };
+    }
+    delivery.lastError = `retryable status ${response.status}`;
+  }
+  return { ok: false, reason: "retries_exhausted", delivery };
+}
 async function hasNamedLlmEndpoints() {
   const override = process.env.LLM_ENDPOINT_ENDPOINTS_FILE?.trim();
   const path = override && override.length > 0 ? override : join(homedir(), ".agentproto", "llm-endpoints.json");
@@ -60376,13 +61131,13 @@ function createJoinTokenRegistry(deps2) {
       } catch (err) {
         if (signal.aborted) break;
         log(`[join-tokens] "${record2.name}": dial failed: ${errMsg4(err)}`);
-        await sleep(backoff, signal);
+        await sleep2(backoff, signal);
         backoff = Math.min(backoff * 2, reconnectMaxMs);
         continue;
       }
       if (!sink.isOpen) {
         if (signal.aborted) break;
-        await sleep(backoff, signal);
+        await sleep2(backoff, signal);
         backoff = Math.min(backoff * 2, reconnectMaxMs);
         continue;
       }
@@ -60411,12 +61166,17 @@ function createJoinTokenRegistry(deps2) {
             capturedSession = result.session;
             return { reply: encodePairingMessage(result.reply), keys: result.session };
           },
-          { timeoutMs: handshakeTimeoutMs }
+          {
+            timeoutMs: handshakeTimeoutMs,
+            // Post-handshake close reason (BOOTSTRAP P4 item 2) — same
+            // diagnostic hook the pairing-host accept-loop wires.
+            log: (line) => log(`[join-tokens] "${record2.name}": ${line}`)
+          }
         );
       } catch (err) {
         if (signal.aborted) break;
         log(`[join-tokens] "${record2.name}": handshake failed: ${errMsg4(err)}`);
-        await sleep(backoff, signal);
+        await sleep2(backoff, signal);
         backoff = Math.min(backoff * 2, reconnectMaxMs);
         continue;
       }
@@ -60442,7 +61202,7 @@ function createJoinTokenRegistry(deps2) {
   }
   return { create, list, revoke, startAutoconnect, shutdown };
 }
-function sleep(ms, signal) {
+function sleep2(ms, signal) {
   return new Promise((resolve41) => {
     if (signal.aborted) return resolve41();
     const timer = setTimeout(resolve41, ms);
@@ -61178,6 +61938,7 @@ async function createGateway(opts) {
       registerPairingTools(server, { registry: opts.pairingRegistry });
       registerDeviceTools(server, {
         registry: createDeviceRegistry(opts.pairingRegistry, opts.hostRegistry),
+        ...opts.hostRegistry ? { hosts: opts.hostRegistry } : {},
         ...opts.joinTokens ? { joinTokens: opts.joinTokens } : {}
       });
     }
@@ -61804,6 +62565,6 @@ var export_readPairingsSnapshot = pairing_registry_exports.readPairingsSnapshot;
 var export_removeProviderKey = providers_store_exports.removeProviderKey;
 var export_setProviderKey = providers_store_exports.setProviderKey;
 
-export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAUDE_CODE_OAUTH_SOURCE, CONTINUE_PROMPT_SOURCE, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_MODEL_ROLES, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DEFAULT_WORKTREE_PROVISION_CONCURRENCY, GC_REAPABLE_STATES, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, HarnessPresetValidationError, INBOUND_PROVIDERS, JOIN_TOKENS_VERSION, LEGACY_SESSIONS_FILE, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, MODEL_ROLE_REF_PREFIX, export_PAIRINGS_VERSION as PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, PrLookupError, ResumeDisabledError, SESSION_END_REASONS, SESSION_ID_ENV, SIGN_NAMESPACE, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, WORKTREE_PROVISION_CONCURRENCY_ENV, activityCounts, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, collectHostSample, compactOutcome, composeMode, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, export_createPairingRegistry as createPairingRegistry, createPrProvenanceReconciler, createProcessStatsService, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deriveSessionOutcome, deriveSessionUsage, describeOwner, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileConversationStore, fileExists3 as fileExists, filterActivities, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getProcessStatsService, export_getProviderKey as getProviderKey, getToolHelp, getUserPreset, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listModelRoles, listPresets, listToolHelpTopics, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorkspaceModelRoles, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCommand, normalizeInbound, normalizeModeId, normalizeRemote, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parseModelRoleRef, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectBrowserTools, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readHostsSnapshot, export_readPairingsSnapshot as readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveAuthSpec, resolveBucketSlug, resolveDeferredToolsGatewayOption, resolveEffectiveLlmEndpointFlag, resolveModelRole, resolveNativeLink, resolvePosture, resolvePrincipal, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, resolveSpawnDefaults, resolveSubscriptionCredential, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, saveUserPreset, setDefaultPreset, setMcpCredentialDeps, export_setProviderKey as setProviderKey, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, trackWorktreeProvision, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, userPresetsPath, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
+export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAMP_LIMIT_BYTES, CLAUDE_CODE_OAUTH_SOURCE, CONTINUE_PROMPT_SOURCE, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_MODEL_ROLES, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, DEFAULT_WORKTREE_PROVISION_CONCURRENCY, DEVICE_PROMPT_PATH_PREFIX, GC_REAPABLE_STATES, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, HarnessPresetValidationError, INBOUND_PROVIDERS, JOIN_TOKENS_VERSION, LEGACY_SESSIONS_FILE, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, MODEL_ROLE_REF_PREFIX, export_PAIRINGS_VERSION as PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, PrLookupError, ResumeDisabledError, SESSION_END_REASONS, SESSION_ID_ENV, SIGN_NAMESPACE, SsrfFetchError, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, WORKTREE_PROVISION_CONCURRENCY_ENV, activityCounts, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, compactOutcome, composeMode, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, export_createPairingRegistry as createPairingRegistry, createPrProvenanceReconciler, createProcessStatsService, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decodeWhsecSecret, decomposeMode, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deliverEventEnvelope, deliveryBackoffDelay, deriveSessionOutcome, deriveSessionUsage, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileConversationStore, fileExists3 as fileExists, filterActivities, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getProcessStatsService, export_getProviderKey as getProviderKey, getToolHelp, getUserPreset, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isPubliclyRoutable, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listModelRoles, listPresets, listToolHelpTopics, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorkspaceModelRoles, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeCommand, normalizeInbound, normalizeModeId, normalizeRemote, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parseModelRoleRef, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectBrowserTools, projectSessionUsage, promptHostSession, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readHostsSnapshot, export_readPairingsSnapshot as readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resetChallengeCacheForTests, resolveAuthSpec, resolveBucketSlug, resolveDeferredToolsGatewayOption, resolveEffectiveLlmEndpointFlag, resolveModelRole, resolveNativeLink, resolvePosture, resolvePrincipal, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, resolveSpawnDefaults, resolveSubscriptionCredential, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, saveUserPreset, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, export_setProviderKey as setProviderKey, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, trackWorktreeProvision, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, userPresetsPath, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map