@agentproto/runtime 5.5.0 → 5.7.0

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode,
 export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-Gz7q9yfJ.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-DMzCgTVy.js';
-export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-DMzCgTVy.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-DHSLsPHA.js';
+export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-DHSLsPHA.js';
 import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-DxIIuJFY.js';
 export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-DxIIuJFY.js';
 import { AcpMcpServer } from '@agentproto/acp';
@@ -328,6 +328,46 @@ declare class TunnelRegistry {
  * here rather than the other way around.
  */
 
+/**
+ * One normalized immutable fact, emitted by a provider and landed into a
+ * session's inbox. CloudEvents 1.0 structured JSON plus agentproto extension
+ * attributes (`summary`, `subjects`, `terminal`, `consumerref`, `seq`).
+ *
+ * `type` grammar: `<scheme>.<object>.<action>` (e.g.
+ * `github.pull_request.closed`). `subject` grammar: `<scheme>:<path>` (e.g.
+ * `github:agentproto/ts#1428`). `subjects` is the full hierarchy, most
+ * specific first — a sentinel `subject` ending in `*` prefix-matches it.
+ */
+interface SentinelEvent {
+    readonly specversion: "1.0";
+    /** Stable across retries/redeliveries. Idempotency key is `(sentinelId,
+     *  event.id)` — unaffected by `SentinelSpec.match` fan-out: an event that
+     *  happens to satisfy more than one match clause on the same sentinel is
+     *  still landed at most once. */
+    readonly id: string;
+    /** URI naming the provider instance that emitted this event. */
+    readonly source: string;
+    readonly type: string;
+    /** Primary (most specific) subject this event is filed under. */
+    readonly subject: string;
+    /** ISO-8601. */
+    readonly time: string;
+    readonly datacontenttype: "application/json";
+    /** Normalized projection, <= 32 KiB. Raw provider payloads never appear
+     *  here. */
+    readonly data: Record<string, unknown>;
+    /** One line, used verbatim as inbox text (after a `[<scheme>]` prefix). */
+    readonly summary: string;
+    /** Full subject hierarchy, most specific first. */
+    readonly subjects: readonly string[];
+    /** Ends the subject's lifecycle when `spec.until.kind === "subject_terminal"`. */
+    readonly terminal: boolean;
+    /** Opaque consumer reference the provider was asked to stamp (agentpush's
+     *  `consumerRef`), when applicable. */
+    readonly consumerref?: string;
+    /** Monotonic sequence, when the provider assigns one. */
+    readonly seq?: number;
+}
 /** When a sentinel stops watching. */
 type SentinelUntil = {
     kind: "subject_terminal";
@@ -415,6 +455,14 @@ interface SentinelSpec {
  * Writes are atomic (write to a per-process tmp file, then rename), same
  * idiom as `sandbox-ledger.ts` — a crash mid-write must never leave a
  * corrupt `sentinels.json` behind.
+ *
+ * Secret-at-rest (W-B): a `webhook` target's signing secret never lives
+ * inside the `Sentinel` record (whose `spec` is echoed verbatim by views) —
+ * it is kept in a sidecar row keyed by an opaque `secretRef` handle,
+ * persisted to `sentinels-secrets.json` next to `sentinels.json` with the
+ * SAME 0600 plaintext-at-rest tradeoff every other credential store in this
+ * runtime commits to (`handle.state`, `makeCredsStore` family files). Keys
+ * are never logged; the delivery path is the only consumer of the sidecar.
  */
 
 type SentinelStatus = "active" | "paused" | "expired" | "orphaned" | "error";
@@ -2274,6 +2322,21 @@ interface SpawnAgentSessionInput {
     harness?: string;
     cwd?: string;
     workspaceSlug?: string;
+    /** CONTROLLER-side marker (issue #1647): set ONLY by the device-sandbox
+     *  proxy path when the controller dials the TARGET daemon's own
+     *  `agent_start` through the `/device-spawn` bridge (the bridge carries
+     *  no ambient marker paths — the controller-side spawn already knows
+     *  which spawns cross a device). On the TARGET daemon this marks the
+     *  spawn as arriving "through the bridge", so an unresolvable
+     *  `workspaceSlug` there fails loudly with the slug + the target's known
+     *  slugs instead of silently falling through to the active workspace.
+     *  NEVER set (never expose) on a local spawn — local fallback semantics
+     *  are deliberately unchanged. Stripped by the controller before the
+     *  inner `agent_start` call (the target's own schema has no such field;
+     *  an unknown extra key there would 400 an otherwise-fine spawn). Controller
+     *  input arriving with this field is consumed immediately (read + delete,
+     *  never an error) so it can't leak into spawn defaults or the registry. */
+    deviceBridge?: boolean;
     /** Trusted-loopback parent-lineage hint (WP-R1). Attributes this spawn to a
      *  logical parent session so it nests under that node in the sessions tree,
      *  filling the gap that otherwise leaves an anonymous `agent_start` (an
@@ -6404,15 +6467,28 @@ declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promis
  * method, since sentinel creation also needs the provider handle.
  */
 
+/** The wire view of a target: for a `webhook` target this is the REDACTED
+ *  shape — `url` yes, plus `hasSecret:true`/`secretRedacted:true`. The
+ *  secret material (or even its `secretRef` handle) NEVER crosses a
+ *  listing/get view (plan §4 W-B task 4 — code-verified leak closed here). */
+type SentinelTargetView = Exclude<SentinelTarget, {
+    kind: "webhook";
+}> | {
+    kind: "webhook";
+    url: string;
+    hasSecret: true;
+    secretRedacted: true;
+};
 /** Compact wire view of a sentinel for tool/HTTP results — the internal-only
- *  fields (`handle`, `seen`, `terminalSubjects`) never leave the daemon. */
+ *  fields (`handle`, `seen`, `terminalSubjects`) and any secret material
+ *  never leave the daemon. */
 interface SentinelView {
     id: string;
     provider: string;
     status: SentinelStatus;
     match: SentinelMatchClause[];
     until: SentinelUntil;
-    target: SentinelTarget;
+    target: SentinelTargetView;
     group?: string;
     label?: string;
     createdTs: number;
@@ -6421,6 +6497,390 @@ interface SentinelView {
     lastError?: string;
 }
 
+/**
+ * Standard Webhooks `whsec_` signing for webhook egress (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`).
+ *
+ * Contract (frozen §3):
+ *   - HMAC-SHA256 over `msgId.timestamp.body` (raw bytes; `.update` chained so
+ *     the body is never re-encoded — payload arrives as `Uint8Array`, I2).
+ *   - Signature print = standard base64 (NOT base64url): `v1,<b64>`.
+ *   - HMAC key = the base64 payload DECODED after the `whsec_` prefix.
+ *   - Multi-secret: space-separated `v1,<sig>` segments (rotation window).
+ *   - Returns ONLY headers — the caller owns the bytes and signs them again
+ *     with a fresh timestamp on retry; signing never re-serializes.
+ */
+interface WebhookSignInput {
+    /** Stable event id (`evt_…` / verification `msg_verification_…`) — same across retries. */
+    msgId: string;
+    /** Seconds, Unix epoch (Standard Webhooks wire format). */
+    timestamp: number;
+    /** Exact bytes — signed once (I2). Caller passes the serialization; signing never re-serializes. */
+    payload: Uint8Array;
+    /** One or, during a rotation window, two secrets (`whsec_…`). */
+    secrets: readonly string[];
+}
+type WebhookSignatureHeaders = {
+    "webhook-id": string;
+    "webhook-timestamp": string;
+    "webhook-signature": string;
+};
+/**
+ * Encode raw secret bytes into the `whsec_<base64>` wire format.
+ * Inverse of {@link decodeWhsecSecret}.
+ */
+declare function encodeWhsecSecret(raw: Uint8Array): string;
+/**
+ * Decode a `whsec_…` secret to its raw HMAC key: standard-base64 payload
+ * after the prefix, which must decode to 24..64 bytes. Returns `null` on any
+ * violation (bad prefix, not base64, length out of range). The canonical
+ * validator for W-C: a submit failing this is `-32602` upstream; egress
+ * surfaces it as a categorized challenge failure.
+ */
+declare function decodeWhsecSecret(secret: string): Buffer | null;
+/**
+ * Sign exactly the bytes given. Throws `Error` when any secret fails
+ * {@link decodeWhsecSecret} (callers must have validated upstream; a bad
+ * secret at this point is a programmer error, never silently signed).
+ */
+declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
+
+/**
+ * SSRF-guarded outbound HTTPS POST for webhook egress (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`).
+ *
+ * Frozen failure-mode reasons: `non_https | private_target | redirect |
+ * timeout | connect` — mapped by challenge to the §3 ChallengeFailureReason
+ * table; the SAME function guards BOTH the challenge and delivery path (I3).
+ * No HTTP client library addition: node http/https only.
+ *
+ * Safety model (one predicate, fail closed):
+ *   1. scheme must be https → `non_https`
+ *   2. ALL DNS-resolved addresses (A + AAAA, plus literal-IP hosts) must pass
+ *      {@link isPubliclyRoutable}, else `private_target` — one rejected
+ *      address fails; unparseable/odd literals fail closed
+ *   3. connect pins the VALIDATED IP (no second resolution → the
+ *      DNS-rebinding TOCTOU is closed) while `servername` keeps the ORIGINAL
+ *      hostname for TLS SNI + certificate verification
+ *   4. redirects are never followed: a 3xx comes back as a plain
+ *      `{status: 3xx}` result (challenge → "non_2xx", delivery → retryable);
+ *      a non-https redirect target additionally throws `redirect`
+ *   5. hard `timeoutMs` budget; request body clamped to 256 KiB here too
+ *      (defense-in-depth — delivery clamps before signing)
+ */
+type SsrfFetchReason = "non_https" | "private_target" | "redirect" | "timeout" | "connect";
+declare class SsrfFetchError extends Error {
+    readonly reason: SsrfFetchReason;
+    constructor(reason: SsrfFetchReason, message: string);
+}
+interface SsrfFetchInit {
+    method?: "POST";
+    headers?: Record<string, string>;
+    /** ≤ 262 144; enforced also on response read (only status + body read). */
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface SsrfFetchResult {
+    status: number;
+    body: string;
+}
+/**
+ * The one predicate for every address this module may connect to. Fails
+ * closed — anything unparseable, IPv4-mapped with an invalid embedded v4, or
+ * inside a non-globally-routable block is NOT public.
+ *
+ * Plan §4 W-A.2 ranges:
+ *   IPv4 — 0/8, 10/8, 127/8, 169.254/16, 172.16/12, 192.0.0.0/24,
+ *          192.0.2.0/24, 198.18/15, 198.51.100.0/24, 203.0.113.0/24,
+ *          100.64/10 (CGNAT), 224/4 (multicast), 240/4 (reserved)
+ *   IPv6 — ::, ::1, fc00::/7 (ULA), fe80::/10 (link-local),
+ *          ff00::/8 (multicast), 2001:db8::/32 (doc range), and ::ffff:
+ *          mapped-v4 whose EMBEDDED v4 re-runs this very predicate
+ */
+declare function isPubliclyRoutable(ipRaw: string): boolean;
+type SsrfResolvers = {
+    /** Replaces both A and AAAA resolution. Returns every address, any family. */
+    lookup?: (host: string) => Promise<Array<{
+        address: string;
+        family: 4 | 6;
+    }>>;
+};
+type EgressDispatcher = (req: {
+    url: string;
+    headers: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}) => Promise<SsrfFetchResult>;
+/** vitest-only: set a recording dispatcher; pass `null` to restore. */
+declare function setEgressDispatcherForTests(dispatcher: EgressDispatcher | null): void;
+declare function ssrfFetch(url: string, init: SsrfFetchInit, io?: {
+    resolvers?: SsrfResolvers;
+}): Promise<SsrfFetchResult>;
+
+/**
+ * Callback challenge verification (W-A of `.plans/sentinel-mcp-events/PLAN.md`,
+ * §3 frozen): POST `{"type":"verification","challenge":"<fresh 64-hex>"}` to
+ * the candidate callback URL, signed with the CANDIDATE secret, carrying
+ * `X-MCP-Subscription-Id`; require 2xx and a constant-time-equal
+ * `{"challenge":"<same>"}` echo in the response body.
+ *
+ * Success cache: keyed (principal, normalized callback URL, sha256(secret)),
+ * bounded TTL 10 min. A NEW secret during rotation NEVER resolves a cache
+ * hit — the sha256(secret) key component structurally forces
+ * re-verification (the cache can never bless an unverified secret).
+ *
+ * The outbound POST runs through the SAME `ssrfFetch` gate as delivery (I3) —
+ * injectable here only for tests; production passes nothing.
+ */
+
+type ChallengeOutcome = {
+    ok: true;
+    verificationBytes: Uint8Array;
+} | {
+    ok: false;
+    reason: ChallengeFailureReason;
+    detail: string;
+};
+type ChallengeFailureReason = "challenge_failed" | "timeout" | "non_https" | "ssrf_blocked" | "non_2xx";
+interface VerifyCallbackInput {
+    principal: string;
+    url: string;
+    subscriptionId: string;
+    secret: string;
+}
+interface VerifyCallbackDeps {
+    /** Replaces the POST boundary. Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs$1) => Promise<SsrfFetchView>;
+    /** Clock for the bounded TTL. Default: real wall clock. */
+    now?: () => number;
+}
+interface SsrfFetchArgs$1 {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface SsrfFetchView {
+    status: number;
+    body: string;
+}
+/** §4 W-A task 4: the challenge reason table (single mapped, none unmapped). */
+declare function challengeReasonForSsrf(reason: SsrfFetchReason): ChallengeFailureReason;
+declare function challengeCacheSize(): number;
+/** vitest-only: clear the success cache between suites. */
+declare function resetChallengeCacheForTests(): void;
+/** Cache-key URL normalization (never reused for anything else). */
+declare function normalizeCallbackUrl(url: string): string | null;
+declare function verifyCallback(input: VerifyCallbackInput, deps?: VerifyCallbackDeps): Promise<ChallengeOutcome>;
+
+/**
+ * Signed event delivery with bounded retry (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
+ *
+ * I2 — the body is serialized ONCE: the clamp (when needed) happens first,
+ * then the exact bytes are signed per attempt with a FRESH timestamp. An
+ * observer sees a different `webhook-signature` header per attempt while the
+ * body bytes stay bitwise identical — `signWebhook` returns ONLY headers and
+ * never re-serializes.
+ *
+ * ≤ 256 KiB — when the serialized body exceeds 262 144 bytes, `data` is
+ * replaced with `{summary, subject}` and the envelope gains `truncated: true`
+ * (no read tool — plan §5), and the CLAMPED bytes (not the original) are what
+ * every attempt signs.
+ *
+ * Retry — exponential backoff bounded to 5 attempts; 3xx / other 4xx / 5xx /
+ * network errors retry; 410/413 are terminal with NO further attempt;
+ * 2xx = delivered. The returned `DeliveryState` is what the caller persists
+ * into the store for post-restart resume (W-B's job to wire).
+ */
+type McpEventEnvelope = {
+    /** OpenAI doc wire shape VERBATIM (developers.openai.com/plugins/build/mcp-events):
+     *  `eventId` (NOT `id` — the `webhook-id` header carries eventId), `name`,
+     *  `timestamp`, `data`, `cursor`. A top-level `type` field = protocol
+     *  control notification only — never sent by us (no control events). */
+    eventId: string;
+    name: string;
+    timestamp: string;
+    data: Record<string, unknown>;
+    cursor: string | null;
+    truncated?: boolean;
+};
+interface DeliveryState {
+    attempts: number;
+    lastError?: string;
+    lastAt?: string;
+}
+interface DeliveryReplay {
+    subId: string;
+    callbackUrl: string;
+    secrets: readonly string[];
+}
+/** One event → one POST. Frozen §3 outcome. */
+type DeliveryOutcome = {
+    ok: true;
+    delivery: DeliveryState;
+} | {
+    ok: false;
+    reason: string;
+    delivery: DeliveryState;
+};
+interface SsrfFetchArgs {
+    method?: "POST";
+    headers?: Record<string, string>;
+    body?: Uint8Array;
+    timeoutMs: number;
+}
+interface DeliverEventDeps {
+    /** Replaces the POST boundary (tests only). Default: the shared `ssrfFetch` gate. */
+    fetch?: (url: string, init: SsrfFetchArgs) => Promise<{
+        status: number;
+        body: string;
+    }>;
+    /** Backoff sleep (tests only). Default: real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock (tests only). Default: real wall clock. */
+    now?: () => number;
+}
+declare const CLAMP_LIMIT_BYTES = 262144;
+declare const MAX_ATTEMPTS = 5;
+/** Bounded exponential backoff: 250, 500, 1000, 2000, capped at 4000 (attempt ≥ 4). */
+declare function deliveryBackoffDelay(attempt: number): number;
+declare function serializeEnvelope(envelope: McpEventEnvelope): Uint8Array;
+/** Serialize once; over-size → `{summary, subject}` + `truncated:true` (§3). */
+declare function envelopeClampedBytes(event: McpEventEnvelope): {
+    bytes: Uint8Array;
+    clamped: boolean;
+};
+declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
+
+/**
+ * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
+ * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
+ *
+ * Why an outbox: the runtime's `processEvents` marks an event `seen` the
+ * moment in-process handling resolves, but a webhook POST is an EXTERNAL
+ * delivery — a crash between ack and delivery loses the event forever (I4).
+ * So the webhook fire path appends a DURABLE row first:
+ *
+ *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
+ *     deliveryState, status: pending|delivered|dead}`
+ *
+ * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
+ * the envelope is serialized once here via `serializeEnvelope`; the dispatch
+ * re-signs those same bytes, and `deliverEventEnvelope`'s internal
+ * serialization is deterministic over the stored envelope — asserted by
+ * tests). The underlying sentinel event is marked seen/acked ONLY when the
+ * row reaches terminal status (`delivered`, or `dead` per the retry cap /
+ * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
+ * the event UN-acked, and a restart re-dispatches it by exact bytes.
+ *
+ * Ordering across events of one subscription is never assumed (I5). Rows
+ * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
+ * risk table); the file is capped. Feedback-loop guard is data, not policy:
+ * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
+ * loopback/private delivery targets, so nothing here can ring back into our
+ * own inbound routes — self-delivery cannot even connect.
+ */
+
+type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
+interface SentinelWebhookOutboxRow {
+    sentinelId: string;
+    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
+     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
+     *  header stays the EVENT id). */
+    requestId: string;
+    eventId: string;
+    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
+     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
+    bodyBytes: string;
+    /** v1 events are non-replayable (plan §2) — always null. */
+    cursor: null;
+    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
+    deliveryState: {
+        attempts: number;
+        lastError?: string;
+        lastAt?: string;
+    };
+    status: SentinelWebhookOutboxStatus;
+    /** The bounded-retry loop's final `ok:false` reason. */
+    failReason?: string;
+    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
+     *  `sentinel_removed`, `age_out`). */
+    deadReason?: string;
+    createdAt: number;
+    /** Wall-clock ms the row reached terminal status (drives reaping). */
+    terminalAt?: number;
+}
+/** The full row is JSON-persisted; the envelope rides along so a resumed
+ *  dispatch re-delivers byte-identically without re-deriving the projection,
+ *  and the original event rides along for ack-time lifetime bookkeeping
+ *  (terminal flag / subject tracking). */
+type PersistedOutboxRow = SentinelWebhookOutboxRow & {
+    envelope?: McpEventEnvelope;
+    event?: SentinelEvent;
+};
+interface SentinelWebhookOutbox {
+    /** Append a row for a matched webhook-delivery event. Idempotent per
+     *  `(sentinelId, eventId)`: an existing row (pending OR terminal) is never
+     *  duplicated — returns `undefined`, and for a terminal existing row
+     *  re-fires `onTerminal` so a lost ack (crash between the terminal
+     *  transition and the store write) still lands. Kicks dispatch off
+     *  asynchronously. */
+    enqueue(input: {
+        sentinelId: string;
+        event: SentinelEvent;
+    }): Promise<SentinelWebhookOutboxRow | undefined>;
+    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
+     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
+     *  expired or unwound sentinel never delivers another byte. */
+    dispatch(): Promise<void>;
+    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
+     *  bytes (no payload re-serialization on the resume path). */
+    resumeDeliveries(): Promise<void>;
+    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
+     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
+    sweep(): void;
+    rows(): PersistedOutboxRow[];
+    /** Synchronous flush for shutdown paths. */
+    flushSync(): void;
+}
+interface SentinelWebhookOutboxOptions {
+    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
+    filePath?: string;
+    /** Injectable clock. */
+    nowMs?: () => number;
+    /** Debounce interval for disk persistence. Default 1500 ms. */
+    debounceMs?: number;
+    /** Disable disk persistence (unit tests). Default false unless filePath. */
+    persist?: boolean;
+    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
+     *  as the POST boundary. Throws = dispatch did not complete (row stays
+     *  pending, event stays un-acked). Default: the real deliverer. */
+    deliverEvent?: (input: {
+        replay: DeliveryReplay;
+        row: PersistedOutboxRow;
+    }) => Promise<DeliveryOutcome>;
+    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
+     *  null when the sentinel/secret sidecar is gone (row goes dead, never
+     *  silently lost). */
+    secretsFor: (sentinelId: string) => DeliveryReplay | null;
+    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
+     *  true = the sentinel is past its `until` and must not deliver. */
+    isExpired: (sentinelId: string) => boolean;
+    /** The ack — mark the underlying event seen, after terminal status only. */
+    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
+    log?: (line: string) => void;
+}
+/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
+declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
+/** The CloudEvents → MCP-Events-envelope fusion this WP owns (W-C's adapter
+ *  becomes the canonical owner of the same mapping; this shape is the frozen
+ *  §3 wire envelope — insertion order stable, so its serialization is
+ *  byte-stable across restarts). `data` gains `subject`/`summary` so the
+ *  256 KiB clamp's `{summary, subject}` replacement never goes blind. */
+declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
+declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
+
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -6559,6 +7019,110 @@ interface DeviceRegistry {
     forwardHttp(idOrName: string, req: ForwardHttpRequest): Promise<ForwardHttpResponse>;
 }
 declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegistry): DeviceRegistry;
+/** The host-side route `promptHostSession` forwards to — served by the HOST
+ *  daemon's `/device-prompt/:sessionId` (http-server.ts), gated by the same
+ *  host-scoped-pairing + `deviceSpawnAllow` two-gate as `/device-spawn/*`. */
+declare const DEVICE_PROMPT_PATH_PREFIX = "/device-prompt";
+interface PromptHostSessionInput {
+    /**
+     * The turn to deliver — same shapes local `agent_prompt` accepts: a
+     * non-empty string, a content block object, or a non-empty array of
+     * content blocks. Validated here (never forwarded ill-formed).
+     */
+    prompt: unknown;
+    /** When the host session is mid-turn, redirect instead of queueing
+     *  (mirrors local `agent_prompt`'s `interrupt`). Default false. */
+    interrupt?: boolean;
+    /** With a mid-turn session, jump the FRONT of the FIFO instead of the
+     *  back (mirrors local `agent_prompt`'s `force`). Default false. */
+    force?: boolean;
+    /** Block until the prompted turn drains (the session goes idle with an
+     *  empty queue) instead of fire-and-forget. Default false. */
+    wait?: boolean;
+    /** Poll cadence while `wait`ing, ms — clamped to [10, 10_000], default
+     *  1_000. Each poll is a fresh E2E dial to the host, so don't set this
+     *  low in production; the clamp floor exists for tests. */
+    pollMs?: number;
+    /** Give up `wait`ing after this long (ms). 0 (default) = wait forever. */
+    maxWaitMs?: number;
+    /** Injectable delay for tests. Default a real setTimeout sleep. */
+    sleep?: (ms: number) => Promise<void>;
+}
+interface PromptHostSessionResult {
+    ok: boolean;
+    /** The enqueue landed in the host session's FIFO (it was mid-turn) —
+     *  present on the fire-and-forget arm only. */
+    pending?: boolean;
+    queueId?: string;
+    queuePosition?: number;
+    /** Present on the `wait` arm: how long the turn took to drain. */
+    waitedMs?: number;
+    /** The host's HTTP status, when the enqueue itself failed. */
+    status?: number;
+    message?: string;
+}
+/**
+ * Prompt a HOST device's session — the write counterpart of `device_sessions`
+ * (BOOTSTRAP P4 item 1). Forwards `POST /device-prompt/:sessionId` over the
+ * host's E2E channel (`HostRegistry.forwardHttp`, the same dial the read
+ * verbs use); the host daemon, if it has opted in (`deviceSpawnAllow`) and
+ * the pairing is host-scoped, calls its own `POST
+ * /sessions/:id/prompt` — queueing rules identical to a local prompt.
+ *
+ * Fire-and-forget by default (the enqueue's 202 comes straight back);
+ * `wait: true` then polls the host's `GET /sessions/:id` until the session
+ * is idle with an empty queue (or dies, or `maxWaitMs` elapses). Never
+ * silently serves stale data — a failed forward throws, there is no
+ * snapshot fallback for a write.
+ */
+declare function promptHostSession(hosts: HostRegistry | undefined, target: string, sessionId: string, input: PromptHostSessionInput): Promise<PromptHostSessionResult>;
+/** A narrow slice of the sessions registry `promptDeviceSession` needs —
+ *  kept minimal so tests stub one function. */
+interface DevicePromptSessionsLike {
+    findByIdOrName(idOrName: string): {
+        id: string;
+        hostSessionId?: string;
+        hostFingerprint?: string;
+    } | undefined;
+}
+/** Is this failure the "the given session id doesn't exist on the host"
+ *  shape — the only case P7a's controller-id resolution may rescue? A
+ *  `no session "<id>"` envelope (the host's `enqueuePrompt` 404, the shape
+ *  behind the field finding's `{"ok":false,"status":404,…}`) is the match;
+ *  ANY other failure (pairing gate, wait arm, prompt validation) must pass
+ *  through untouched rather than get masked by a mapping retry. */
+declare function isNoSessionPromptFailure(result: PromptHostSessionResult): boolean;
+/** The controller→host mapping for one id, resolved against the LOCAL
+ *  registry — dial-free. Answers `kind: "controller"` only when a local
+ *  descriptor with that controller id carries BOTH `hostSessionId` AND a
+ *  device identity whose fingerprint-or-name belongs to the SAME target
+ *  device (exact-string when no `hosts` registry is wired — the raw
+ *  `device:<…>` target round-tripped; fingerprint-vs-name reversed against
+ *  the host records otherwise). Resolution order at the call site stays
+ *  (a) exact host-id first (promoted by the direct-attempt 404),
+ *  (b) this mapping second. */
+declare function resolveDevicePromptMapping(sessions: DevicePromptSessionsLike | undefined, hosts: HostRegistry | undefined, sessionId: string, target: string): Promise<{
+    kind: "controller";
+    hostSessionId: string;
+} | {
+    kind: "none";
+}>;
+/**
+ * `device_prompt` with P7a id resolution (#1637). Resolution order:
+ *
+ *   (a) exact host session id match — the current behavior, tried FIRST,
+ *       exactly as `promptHostSession` always has;
+ *   (b) controller-id → host-id via the local registry: when (a) fails
+ *       with a no-session failure AND a local device descriptor maps the
+ *       given id (`hostSessionId` stamped at device spawn), retry once
+ *       against the mapped host id.
+ *
+ * Any other failure passes through untouched — the mapping must never mask
+ * a pairing gate, a prompt-validation rejection, or a wait-arm error. When
+ * both fail, the error names the host and the mapping so the operator
+ * knows both halves were checked.
+ */
+declare function promptDeviceSession(hosts: HostRegistry | undefined, sessions: DevicePromptSessionsLike | undefined, target: string, sessionId: string, input: PromptHostSessionInput): Promise<PromptHostSessionResult>;
 
 /**
  * MCP tools over the device registry (DEVICES-PLAN PR-A/PR-C) — `device_list`
@@ -6580,12 +7144,161 @@ declare function createDeviceRegistry(pairing: PairingRegistry, hosts?: HostRegi
 
 interface RegisterDeviceToolsOptions {
     registry: DeviceRegistry;
+    /** Optional — the underlying host registry (`device_add`'s), when wired.
+     *  `device_prompt` needs it directly: its wait-loop dials the host more
+     *  than once, which `DeviceRegistry.forwardHttp`'s snapshot fallback
+     *  would happily answer from cache. When absent, `device_prompt` is not
+     *  registered. */
+    hosts?: HostRegistry;
+    /** Optional (BOOTSTRAP P7a) — the session registry, for `device_prompt`
+     *  to resolve a CONTROLLER session id onto its mapped HOST session id
+     *  (the issue #1637 id split). Absent ⇒ no controller-id resolution and
+     *  the tool keeps behaving exactly as before. */
+    sessions?: DevicePromptSessionsLike;
     /** Optional (SANDBOX-VISIBILITY-JOIN) — when wired, registers
      *  `join_token_create`/`join_token_list`/`join_token_revoke`. */
     joinTokens?: JoinTokenRegistry;
 }
 declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
 
+/**
+ * BOOTSTRAP P7b — read-time mirror of a HOST device's turns into the
+ * CONTROLLER's own session reads (issue #1637).
+ *
+ * A `session spawned with sandbox: "device:<fp|name>"` lives on TWO
+ * daemons: the controller keeps a thin proxy-backed descriptor (its `id`,
+ * e.g. `sess_305be17c`) while the real conversation accumulates on the
+ * host' under a DIFFERENT id (`sess_cf318f00`, on the descriptor's
+ * `hostSessionId`). #1640 gave the controller WRITE access across the gap
+ * (`device_prompt`); this module closes the READ half: nothing runs in
+ * the background — every controller READ (`GET /sessions/:id`, the
+ * `/output` tail, `/events`, `/export`, the `agent_output` tool) calls
+ * {@link syncDeviceMirror} first, which:
+ *
+ *   1. derives the dedup cursor from the session's OWN events.jsonl (max
+ *      `hostSeq` across records tagged `origin: "device"` — so the cursor
+ *      survives a daemon restart by construction, P7b-3), seeding it the
+ *      first time from what the controller already knows locally (below),
+ *   2. dials the host ONCE over the existing E2E channel
+ *      (`HostRegistry.forwardHttp`, the same path `device_sessions` uses)
+ *      and pages `GET /sessions/:hostSessionId/events?since=<cursor>` —
+ *      an EXISTING host route; no host-side changes are consumed for this
+ *      (P7b uses today's 1.7.x-compatible endpoints only),
+ *   3. appends the new host records to the controller transcript,
+ *      byte-faithful, tagged `origin: "device"` + `hostSeq` +
+ *      `sourceRef: "device:<fp>"` (idempotent by the hostSeq cursor —
+ *      re-reading never duplicates), and
+ *   4. cheaply refreshes the controller descriptor's live projection
+ *      fields from the host snapshot (`lastActivityAt`, `busy`, usage),
+ *      without touching controller-local fields (label, agentsMdMode…).
+ *
+ * Backward compatibility (P7b constraint): only EXISTING host endpoints
+ * are consumed. An older host, or one whose daemon lacks the events route,
+ * surfaces as `mirrorError` on the descriptor — never a crash, never a
+ * silent stale overwrite.
+ */
+
+/** One raw record off the host's own transcript (the exact on-disk shape —
+ *  `{seq, ts, kind, ...}` — so the mirror is byte-faithful to the host). */
+type HostEventRecord = Record<string, unknown>;
+/**
+ * Dial the host and read its session's transcript from `sinceSeq`
+ * (exclusive), paginating until the host reports the tail complete.
+ *
+ * Same failure semantics as `device_sessions`' tail mode, but WITHOUT its
+ * stale-snapshot fallback: the host's unreachability must surface as
+ * `{ ok: false, error }` so readers can show "host unreachable" rather
+ * than silently rendering the last snapshot (P7b-1). `404 no_transcript`
+ * (a host session with nothing written — most usefully a just-spawned one)
+ * is a NORMAL empty result, not an error.
+ */
+type FetchHostTurnsResult = {
+    ok: true;
+    /** Records strictly AFTER `sinceSeq`, ascending. */
+    events: HostEventRecord[];
+    /** Host-reported tip: the seq the next call should use as `sinceSeq`. */
+    nextSeq: number;
+} | {
+    ok: false;
+    error: string;
+    staleAt?: string;
+};
+declare function fetchHostTurns(hosts: HostRegistry, hostFingerprint: string, hostSessionId: string, sinceSeq: number): Promise<FetchHostTurnsResult>;
+/** The highest `hostSeq` already mirrored into the session's transcript —
+ *  the next sync reads only what is STRICTLY newer, so a daemon restart or
+ *  a re-read can never duplicate or skip turns (P7b-3, the correctness
+ *  core). Scans for `origin === "device"` records; every other line is
+ *  controller-local and owns no `hostSeq`. Standalone fs reader (tests +
+ *  tooling): the LIVE sync path uses the registry's own
+ *  `scanDeviceMirrorState` so custom transcript base dirs can't drift. */
+declare function mirrorCursorForSession(sessionId: string, baseDir?: string): Promise<number>;
+/**
+ * Seed the cursor so a FIRST mirror read (before anything was ever
+ * mirrored) skips the turns the controller already recorded on its own.
+ *
+ * Walks the host transcript in order; a host `user-prompt` whose text
+ * matches the NEXT unmatched known local prompt is a turn the controller
+ * already has (it captured that turn live through the sandbox proxy) —
+ * consume it and keep walking. The first host turn that does NOT match is
+ * where local knowledge ends: the cursor is the last turn-end BEFORE it,
+ * so everything from that turn onward gets mirrored exactly once.
+ *
+ * Ordered (not set-membership) on purpose: re-issued prompts later in a
+ * conversation legitimately reappear in the host transcript and a
+ * set-membership match would wrongly skip them.
+ *
+ * Exit states: every host turn matched → full tip is known, cursor is the
+ * last turn-end; no local prompts (or the first host prompt already
+ * unknown) → 0, mirror everything. A transcript longer than one page
+ * leaves the seed `undefined` — the caller merges from 0 (a possible
+ * duplicate beats any lost content) rather than trusting a partial walk.
+ */
+declare function seedWalkForTranscript(localTexts: readonly string[], hostRecords: readonly HostEventRecord[]): number | undefined;
+/** Turn a raw host record into the controller-transcript record the mirror
+ *  appends — same `kind` (so every existing transcript renderer renders it
+ *  unchanged) plus the three mirror tags, and the HOST's own `ts` preserved
+ *  inside the record. `undefined` for kinds that carry conversations the
+ *  controller doesn't derive value from duplicating (`system-prompt`,
+ *  `usage_update`, derived `tool-call-record`, …). */
+declare function hostRecordToMirrorRecord(rec: HostEventRecord, hostFingerprint: string): Record<string, unknown> | undefined;
+/** The slice of `SessionsRegistry` (and the descriptor) the sync needs —
+ *  kept narrow so tests can stub the registry. */
+interface DeviceMirrorTarget {
+    findByIdOrName(idOrName: string): SessionDescriptor | undefined;
+    appendDeviceMirrorRecords(id: string, records: readonly Record<string, unknown>[]): number;
+    /** Preferred cursor/prompt source — the registry's own scan (correct
+     *  transcript base dir). Falls back to this module's default-dir fs read
+     *  when absent (older registry shapes / direct unit calls). */
+    scanDeviceMirrorState?(id: string): {
+        cursor: number;
+        localPromptTexts: readonly string[];
+    };
+}
+type DeviceMirrorSyncResult = {
+    ok: true;
+    /** New records merged from the host this call. */
+    merged: number;
+    /** The advanced mirror cursor after the merge. */
+    cursor: number;
+} | {
+    ok: false;
+    reason: "no-session" | "not-device" | "no-host-registry";
+    error?: string;
+} | {
+    ok: false;
+    reason: "mirror-error";
+    error: string;
+};
+/**
+ * One read-time sync for a controller id/name. Fast no-op path: no local
+ * descriptor, or not a device-mirrored session (both fields absent) —
+ * local spawns pay ZERO extra reads/calls (P7b test invariant). Reads the
+ * cursor, dials the host, appends new records, refreshes the descriptor's
+ * live projection fields, and stamps/clears `mirrorError` on the
+ * descriptor for unreachable-host surfacing.
+ */
+declare function syncDeviceMirror(sessions: DeviceMirrorTarget, hosts: HostRegistry | undefined, idOrName: string): Promise<DeviceMirrorSyncResult>;
+
 /**
  * Provider-preset family on top of `@agentproto/provider-kit` — the *thin,
  * honest* lister (Option B). Unlike tunnels/sandboxes/eval-reporters, presets
@@ -7942,4 +8655,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, describeOwner, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, setDefaultPreset, setMcpCredentialDeps, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type FetchHostTurnsResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type McpEventEnvelope, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, injectMcpAppBridge, isAgentCliAuthConfigured, isNoSessionPromptFailure, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, seedWalkForTranscript, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, withPr, withPrStatus, writeDaemonRegistryEntry };