@agentproto/runtime 5.6.0 → 5.8.0

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode,
 export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-Gz7q9yfJ.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-DMzCgTVy.js';
-export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-DMzCgTVy.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-SrISpFsH.js';
+export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-SrISpFsH.js';
 import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-DxIIuJFY.js';
 export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-DxIIuJFY.js';
 import { AcpMcpServer } from '@agentproto/acp';
@@ -328,6 +328,46 @@ declare class TunnelRegistry {
  * here rather than the other way around.
  */
 
+/**
+ * One normalized immutable fact, emitted by a provider and landed into a
+ * session's inbox. CloudEvents 1.0 structured JSON plus agentproto extension
+ * attributes (`summary`, `subjects`, `terminal`, `consumerref`, `seq`).
+ *
+ * `type` grammar: `<scheme>.<object>.<action>` (e.g.
+ * `github.pull_request.closed`). `subject` grammar: `<scheme>:<path>` (e.g.
+ * `github:agentproto/ts#1428`). `subjects` is the full hierarchy, most
+ * specific first — a sentinel `subject` ending in `*` prefix-matches it.
+ */
+interface SentinelEvent {
+    readonly specversion: "1.0";
+    /** Stable across retries/redeliveries. Idempotency key is `(sentinelId,
+     *  event.id)` — unaffected by `SentinelSpec.match` fan-out: an event that
+     *  happens to satisfy more than one match clause on the same sentinel is
+     *  still landed at most once. */
+    readonly id: string;
+    /** URI naming the provider instance that emitted this event. */
+    readonly source: string;
+    readonly type: string;
+    /** Primary (most specific) subject this event is filed under. */
+    readonly subject: string;
+    /** ISO-8601. */
+    readonly time: string;
+    readonly datacontenttype: "application/json";
+    /** Normalized projection, <= 32 KiB. Raw provider payloads never appear
+     *  here. */
+    readonly data: Record<string, unknown>;
+    /** One line, used verbatim as inbox text (after a `[<scheme>]` prefix). */
+    readonly summary: string;
+    /** Full subject hierarchy, most specific first. */
+    readonly subjects: readonly string[];
+    /** Ends the subject's lifecycle when `spec.until.kind === "subject_terminal"`. */
+    readonly terminal: boolean;
+    /** Opaque consumer reference the provider was asked to stamp (agentpush's
+     *  `consumerRef`), when applicable. */
+    readonly consumerref?: string;
+    /** Monotonic sequence, when the provider assigns one. */
+    readonly seq?: number;
+}
 /** When a sentinel stops watching. */
 type SentinelUntil = {
     kind: "subject_terminal";
@@ -415,6 +455,14 @@ interface SentinelSpec {
  * Writes are atomic (write to a per-process tmp file, then rename), same
  * idiom as `sandbox-ledger.ts` — a crash mid-write must never leave a
  * corrupt `sentinels.json` behind.
+ *
+ * Secret-at-rest (W-B): a `webhook` target's signing secret never lives
+ * inside the `Sentinel` record (whose `spec` is echoed verbatim by views) —
+ * it is kept in a sidecar row keyed by an opaque `secretRef` handle,
+ * persisted to `sentinels-secrets.json` next to `sentinels.json` with the
+ * SAME 0600 plaintext-at-rest tradeoff every other credential store in this
+ * runtime commits to (`handle.state`, `makeCredsStore` family files). Keys
+ * are never logged; the delivery path is the only consumer of the sidecar.
  */
 
 type SentinelStatus = "active" | "paused" | "expired" | "orphaned" | "error";
@@ -2153,6 +2201,12 @@ interface SpawnAgentSessionDeps {
      *  tool and HTTP route each have their own "not enabled" response
      *  shape for the missing-resolver case). */
     resolveAgentAdapter: AgentAdapterResolver;
+    /** Installed-adapter lister — ONLY used to enumerate the valid slugs in
+     *  the generic `adapter_not_found` error, so a genuinely unknown adapter
+     *  name names what IS installed instead of just saying "install it".
+     *  Omitted ⇒ the error keeps its previous wording. Mirrors
+     *  `CronAdapterCheckDeps.listAgentAdapters` (cron's create-time check). */
+    listAgentAdapters?: AgentAdapterLister;
     /** Optional orchestrator-injection builder (WP3). See
      *  `RegisterAgentToolsOptions.buildOrchestratorMcp` for the full
      *  contract. Omitted → `orchestrator` is rejected with
@@ -2274,6 +2328,21 @@ interface SpawnAgentSessionInput {
     harness?: string;
     cwd?: string;
     workspaceSlug?: string;
+    /** CONTROLLER-side marker (issue #1647): set ONLY by the device-sandbox
+     *  proxy path when the controller dials the TARGET daemon's own
+     *  `agent_start` through the `/device-spawn` bridge (the bridge carries
+     *  no ambient marker paths — the controller-side spawn already knows
+     *  which spawns cross a device). On the TARGET daemon this marks the
+     *  spawn as arriving "through the bridge", so an unresolvable
+     *  `workspaceSlug` there fails loudly with the slug + the target's known
+     *  slugs instead of silently falling through to the active workspace.
+     *  NEVER set (never expose) on a local spawn — local fallback semantics
+     *  are deliberately unchanged. Stripped by the controller before the
+     *  inner `agent_start` call (the target's own schema has no such field;
+     *  an unknown extra key there would 400 an otherwise-fine spawn). Controller
+     *  input arriving with this field is consumed immediately (read + delete,
+     *  never an error) so it can't leak into spawn defaults or the registry. */
+    deviceBridge?: boolean;
     /** Trusted-loopback parent-lineage hint (WP-R1). Attributes this spawn to a
      *  logical parent session so it nests under that node in the sessions tree,
      *  filling the gap that otherwise leaves an anonymous `agent_start` (an
@@ -3756,6 +3825,10 @@ type GhRunner$1 = (args: readonly string[], cwd: string) => Promise<{
  *   B. BRANCH — resolve the OPEN PR for the session cwd's current branch
  *      (via the injected {@link OpenPrResolver} port), the fallback for
  *      adapters whose tool calls aren't recorded.
+ *   C. TEXTUAL — pull-request urls mentioned in the session's own assistant
+ *      output (bounded transcript-tail scan); records on `openedPrs`
+ *      (adapter "output-scan") but never stamps a footer — a mention is
+ *      not proof of creation.
  *
  * Turn-end/exit are only poll checkpoints, never an assertion the PR is
  * ready: the real predicate is "did this session create a PR / does an open
@@ -3792,6 +3865,10 @@ interface ReconcilerSession extends FooterSession {
         url: string;
         number?: number;
     }[];
+    /** Ephemeral transcript path the live registry stamps on every read
+     *  (see `SessionDescriptor.eventsPath`); lane C's bounded tail read
+     *  needs it. Absent from test fakes without a transcript on disk. */
+    eventsPath?: string;
 }
 /** The registry slice the reconciler needs — structurally satisfied by the full
  *  `SessionsRegistry`, and by a trivial fake in tests. It is also a valid
@@ -6404,15 +6481,28 @@ declare function readUsageSnapshots(sessionId: string, baseDir?: string): Promis
  * method, since sentinel creation also needs the provider handle.
  */
 
+/** The wire view of a target: for a `webhook` target this is the REDACTED
+ *  shape — `url` yes, plus `hasSecret:true`/`secretRedacted:true`. The
+ *  secret material (or even its `secretRef` handle) NEVER crosses a
+ *  listing/get view (plan §4 W-B task 4 — code-verified leak closed here). */
+type SentinelTargetView = Exclude<SentinelTarget, {
+    kind: "webhook";
+}> | {
+    kind: "webhook";
+    url: string;
+    hasSecret: true;
+    secretRedacted: true;
+};
 /** Compact wire view of a sentinel for tool/HTTP results — the internal-only
- *  fields (`handle`, `seen`, `terminalSubjects`) never leave the daemon. */
+ *  fields (`handle`, `seen`, `terminalSubjects`) and any secret material
+ *  never leave the daemon. */
 interface SentinelView {
     id: string;
     provider: string;
     status: SentinelStatus;
     match: SentinelMatchClause[];
     until: SentinelUntil;
-    target: SentinelTarget;
+    target: SentinelTargetView;
     group?: string;
     label?: string;
     createdTs: number;
@@ -6677,6 +6767,134 @@ declare function envelopeClampedBytes(event: McpEventEnvelope): {
 };
 declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
 
+/**
+ * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
+ * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
+ *
+ * Why an outbox: the runtime's `processEvents` marks an event `seen` the
+ * moment in-process handling resolves, but a webhook POST is an EXTERNAL
+ * delivery — a crash between ack and delivery loses the event forever (I4).
+ * So the webhook fire path appends a DURABLE row first:
+ *
+ *   `{sentinelId, requestId, eventId, bodyBytes, cursor:null,
+ *     deliveryState, status: pending|delivered|dead}`
+ *
+ * with `bodyBytes` = the EXACT canonical body bytes that will be sent (I2 —
+ * the envelope is serialized once here via `serializeEnvelope`; the dispatch
+ * re-signs those same bytes, and `deliverEventEnvelope`'s internal
+ * serialization is deterministic over the stored envelope — asserted by
+ * tests). The underlying sentinel event is marked seen/acked ONLY when the
+ * row reaches terminal status (`delivered`, or `dead` per the retry cap /
+ * age-out); a dispatch that THREW (crash-shaped) leaves the row `pending`,
+ * the event UN-acked, and a restart re-dispatches it by exact bytes.
+ *
+ * Ordering across events of one subscription is never assumed (I5). Rows
+ * reaped once `delivered` for 24 h; pending rows age out after 7 d (plan
+ * risk table); the file is capped. Feedback-loop guard is data, not policy:
+ * the `ssrfFetch` gate inside `deliverEventEnvelope` inherently blocks
+ * loopback/private delivery targets, so nothing here can ring back into our
+ * own inbound routes — self-delivery cannot even connect.
+ */
+
+type SentinelWebhookOutboxStatus = "pending" | "delivered" | "dead";
+interface SentinelWebhookOutboxRow {
+    sentinelId: string;
+    /** Deterministic sub id over `(sentinelId, eventId)` — stable across
+     *  restarts (I1: a redelivery is a consumer no-op; the wire `webhook-id`
+     *  header stays the EVENT id). */
+    requestId: string;
+    eventId: string;
+    /** The EXACT body bytes, as sent — utf-8 base64 of `serializeEnvelope`
+     *  (I2: bytes stored exactly as sent; resume dispatches the stored bytes). */
+    bodyBytes: string;
+    /** v1 events are non-replayable (plan §2) — always null. */
+    cursor: null;
+    /** Persisted W-A delivery state so a post-restart dispatch makes sense. */
+    deliveryState: {
+        attempts: number;
+        lastError?: string;
+        lastAt?: string;
+    };
+    status: SentinelWebhookOutboxStatus;
+    /** The bounded-retry loop's final `ok:false` reason. */
+    failReason?: string;
+    /** Why the outbox itself went a row `dead` (`sentinel_expired`,
+     *  `sentinel_removed`, `age_out`). */
+    deadReason?: string;
+    createdAt: number;
+    /** Wall-clock ms the row reached terminal status (drives reaping). */
+    terminalAt?: number;
+}
+/** The full row is JSON-persisted; the envelope rides along so a resumed
+ *  dispatch re-delivers byte-identically without re-deriving the projection,
+ *  and the original event rides along for ack-time lifetime bookkeeping
+ *  (terminal flag / subject tracking). */
+type PersistedOutboxRow = SentinelWebhookOutboxRow & {
+    envelope?: McpEventEnvelope;
+    event?: SentinelEvent;
+};
+interface SentinelWebhookOutbox {
+    /** Append a row for a matched webhook-delivery event. Idempotent per
+     *  `(sentinelId, eventId)`: an existing row (pending OR terminal) is never
+     *  duplicated — returns `undefined`, and for a terminal existing row
+     *  re-fires `onTerminal` so a lost ack (crash between the terminal
+     *  transition and the store write) still lands. Kicks dispatch off
+     *  asynchronously. */
+    enqueue(input: {
+        sentinelId: string;
+        event: SentinelEvent;
+    }): Promise<SentinelWebhookOutboxRow | undefined>;
+    /** Dispatch every `pending` row (serialized, one POST in flight). Consults
+     *  `isExpired` per row AND the secrets sidecar BEFORE dispatch — an
+     *  expired or unwound sentinel never delivers another byte. */
+    dispatch(): Promise<void>;
+    /** Startup re-enqueue: re-dispatch every `pending` row by exact stored
+     *  bytes (no payload re-serialization on the resume path). */
+    resumeDeliveries(): Promise<void>;
+    /** Re-`delivered` rows after 24 h are reaped; pending rows age out after
+     *  7 d (plan risk table). Cheap; called on the runtime's periodic tick. */
+    sweep(): void;
+    rows(): PersistedOutboxRow[];
+    /** Synchronous flush for shutdown paths. */
+    flushSync(): void;
+}
+interface SentinelWebhookOutboxOptions {
+    /** Override persist path. Default `~/.agentproto/sentinel-webhook-outbox.json`. */
+    filePath?: string;
+    /** Injectable clock. */
+    nowMs?: () => number;
+    /** Debounce interval for disk persistence. Default 1500 ms. */
+    debounceMs?: number;
+    /** Disable disk persistence (unit tests). Default false unless filePath. */
+    persist?: boolean;
+    /** DI boundary (not module fakes): replaces W-A's `deliverEventEnvelope`
+     *  as the POST boundary. Throws = dispatch did not complete (row stays
+     *  pending, event stays un-acked). Default: the real deliverer. */
+    deliverEvent?: (input: {
+        replay: DeliveryReplay;
+        row: PersistedOutboxRow;
+    }) => Promise<DeliveryOutcome>;
+    /** Signing secrets for a sentinel — `{subId, callbackUrl, secrets[]}`, or
+     *  null when the sentinel/secret sidecar is gone (row goes dead, never
+     *  silently lost). */
+    secretsFor: (sentinelId: string) => DeliveryReplay | null;
+    /** Expiry gate, consulted BEFORE every dispatch (plan §4 W-B task 2b).
+     *  true = the sentinel is past its `until` and must not deliver. */
+    isExpired: (sentinelId: string) => boolean;
+    /** The ack — mark the underlying event seen, after terminal status only. */
+    onTerminal: (sentinelId: string, row: SentinelWebhookOutboxRow) => void;
+    log?: (line: string) => void;
+}
+/** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
+declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
+/** The CloudEvents → MCP-Events-envelope fusion this WP owns (W-C's adapter
+ *  becomes the canonical owner of the same mapping; this shape is the frozen
+ *  §3 wire envelope — insertion order stable, so its serialization is
+ *  byte-stable across restarts). `data` gains `subject`/`summary` so the
+ *  256 KiB clamp's `{summary, subject}` replacement never goes blind. */
+declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
+declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
+
 /**
  * Smart default for `features.llmEndpoint` (daemon-managed-gateway): an
  * operator who already configured a named endpoint, an upstream credential
@@ -6872,6 +7090,53 @@ interface PromptHostSessionResult {
  * snapshot fallback for a write.
  */
 declare function promptHostSession(hosts: HostRegistry | undefined, target: string, sessionId: string, input: PromptHostSessionInput): Promise<PromptHostSessionResult>;
+/** A narrow slice of the sessions registry `promptDeviceSession` needs —
+ *  kept minimal so tests stub one function. */
+interface DevicePromptSessionsLike {
+    findByIdOrName(idOrName: string): {
+        id: string;
+        hostSessionId?: string;
+        hostFingerprint?: string;
+    } | undefined;
+}
+/** Is this failure the "the given session id doesn't exist on the host"
+ *  shape — the only case P7a's controller-id resolution may rescue? A
+ *  `no session "<id>"` envelope (the host's `enqueuePrompt` 404, the shape
+ *  behind the field finding's `{"ok":false,"status":404,…}`) is the match;
+ *  ANY other failure (pairing gate, wait arm, prompt validation) must pass
+ *  through untouched rather than get masked by a mapping retry. */
+declare function isNoSessionPromptFailure(result: PromptHostSessionResult): boolean;
+/** The controller→host mapping for one id, resolved against the LOCAL
+ *  registry — dial-free. Answers `kind: "controller"` only when a local
+ *  descriptor with that controller id carries BOTH `hostSessionId` AND a
+ *  device identity whose fingerprint-or-name belongs to the SAME target
+ *  device (exact-string when no `hosts` registry is wired — the raw
+ *  `device:<…>` target round-tripped; fingerprint-vs-name reversed against
+ *  the host records otherwise). Resolution order at the call site stays
+ *  (a) exact host-id first (promoted by the direct-attempt 404),
+ *  (b) this mapping second. */
+declare function resolveDevicePromptMapping(sessions: DevicePromptSessionsLike | undefined, hosts: HostRegistry | undefined, sessionId: string, target: string): Promise<{
+    kind: "controller";
+    hostSessionId: string;
+} | {
+    kind: "none";
+}>;
+/**
+ * `device_prompt` with P7a id resolution (#1637). Resolution order:
+ *
+ *   (a) exact host session id match — the current behavior, tried FIRST,
+ *       exactly as `promptHostSession` always has;
+ *   (b) controller-id → host-id via the local registry: when (a) fails
+ *       with a no-session failure AND a local device descriptor maps the
+ *       given id (`hostSessionId` stamped at device spawn), retry once
+ *       against the mapped host id.
+ *
+ * Any other failure passes through untouched — the mapping must never mask
+ * a pairing gate, a prompt-validation rejection, or a wait-arm error. When
+ * both fail, the error names the host and the mapping so the operator
+ * knows both halves were checked.
+ */
+declare function promptDeviceSession(hosts: HostRegistry | undefined, sessions: DevicePromptSessionsLike | undefined, target: string, sessionId: string, input: PromptHostSessionInput): Promise<PromptHostSessionResult>;
 
 /**
  * MCP tools over the device registry (DEVICES-PLAN PR-A/PR-C) — `device_list`
@@ -6899,12 +7164,155 @@ interface RegisterDeviceToolsOptions {
      *  would happily answer from cache. When absent, `device_prompt` is not
      *  registered. */
     hosts?: HostRegistry;
+    /** Optional (BOOTSTRAP P7a) — the session registry, for `device_prompt`
+     *  to resolve a CONTROLLER session id onto its mapped HOST session id
+     *  (the issue #1637 id split). Absent ⇒ no controller-id resolution and
+     *  the tool keeps behaving exactly as before. */
+    sessions?: DevicePromptSessionsLike;
     /** Optional (SANDBOX-VISIBILITY-JOIN) — when wired, registers
      *  `join_token_create`/`join_token_list`/`join_token_revoke`. */
     joinTokens?: JoinTokenRegistry;
 }
 declare function registerDeviceTools(server: McpServer, opts: RegisterDeviceToolsOptions): void;
 
+/**
+ * BOOTSTRAP P7b — read-time mirror of a HOST device's turns into the
+ * CONTROLLER's own session reads (issue #1637).
+ *
+ * A `session spawned with sandbox: "device:<fp|name>"` lives on TWO
+ * daemons: the controller keeps a thin proxy-backed descriptor (its `id`,
+ * e.g. `sess_305be17c`) while the real conversation accumulates on the
+ * host' under a DIFFERENT id (`sess_cf318f00`, on the descriptor's
+ * `hostSessionId`). #1640 gave the controller WRITE access across the gap
+ * (`device_prompt`); this module closes the READ half: nothing runs in
+ * the background — every controller READ (`GET /sessions/:id`, the
+ * `/output` tail, `/events`, `/export`, the `agent_output` tool) calls
+ * {@link syncDeviceMirror} first, which:
+ *
+ *   1. derives the dedup cursor from the session's OWN events.jsonl (max
+ *      `hostSeq` across records tagged `origin: "device"` — so the cursor
+ *      survives a daemon restart by construction, P7b-3), seeding it the
+ *      first time from what the controller already knows locally (below),
+ *   2. dials the host ONCE over the existing E2E channel
+ *      (`HostRegistry.forwardHttp`, the same path `device_sessions` uses)
+ *      and pages `GET /sessions/:hostSessionId/events?since=<cursor>` —
+ *      an EXISTING host route; no host-side changes are consumed for this
+ *      (P7b uses today's 1.7.x-compatible endpoints only),
+ *   3. appends the new host records to the controller transcript,
+ *      byte-faithful, tagged `origin: "device"` + `hostSeq` +
+ *      `sourceRef: "device:<fp>"` (idempotent by the hostSeq cursor —
+ *      re-reading never duplicates), and
+ *   4. cheaply refreshes the controller descriptor's live projection
+ *      fields from the host snapshot (`lastActivityAt`, `busy`, usage),
+ *      without touching controller-local fields (label, agentsMdMode…).
+ *
+ * Backward compatibility (P7b constraint): only EXISTING host endpoints
+ * are consumed. An older host, or one whose daemon lacks the events route,
+ * surfaces as `mirrorError` on the descriptor — never a crash, never a
+ * silent stale overwrite.
+ */
+
+/** One raw record off the host's own transcript (the exact on-disk shape —
+ *  `{seq, ts, kind, ...}` — so the mirror is byte-faithful to the host). */
+type HostEventRecord = Record<string, unknown>;
+/**
+ * Dial the host and read its session's transcript from `sinceSeq`
+ * (exclusive), paginating until the host reports the tail complete.
+ *
+ * Same failure semantics as `device_sessions`' tail mode, but WITHOUT its
+ * stale-snapshot fallback: the host's unreachability must surface as
+ * `{ ok: false, error }` so readers can show "host unreachable" rather
+ * than silently rendering the last snapshot (P7b-1). `404 no_transcript`
+ * (a host session with nothing written — most usefully a just-spawned one)
+ * is a NORMAL empty result, not an error.
+ */
+type FetchHostTurnsResult = {
+    ok: true;
+    /** Records strictly AFTER `sinceSeq`, ascending. */
+    events: HostEventRecord[];
+    /** Host-reported tip: the seq the next call should use as `sinceSeq`. */
+    nextSeq: number;
+} | {
+    ok: false;
+    error: string;
+    staleAt?: string;
+};
+declare function fetchHostTurns(hosts: HostRegistry, hostFingerprint: string, hostSessionId: string, sinceSeq: number): Promise<FetchHostTurnsResult>;
+/** The highest `hostSeq` already mirrored into the session's transcript —
+ *  the next sync reads only what is STRICTLY newer, so a daemon restart or
+ *  a re-read can never duplicate or skip turns (P7b-3, the correctness
+ *  core). Scans for `origin === "device"` records; every other line is
+ *  controller-local and owns no `hostSeq`. Standalone fs reader (tests +
+ *  tooling): the LIVE sync path uses the registry's own
+ *  `scanDeviceMirrorState` so custom transcript base dirs can't drift. */
+declare function mirrorCursorForSession(sessionId: string, baseDir?: string): Promise<number>;
+/**
+ * Seed the cursor so a FIRST mirror read (before anything was ever
+ * mirrored) skips the turns the controller already recorded on its own.
+ *
+ * Walks the host transcript in order; a host `user-prompt` whose text
+ * matches the NEXT unmatched known local prompt is a turn the controller
+ * already has (it captured that turn live through the sandbox proxy) —
+ * consume it and keep walking. The first host turn that does NOT match is
+ * where local knowledge ends: the cursor is the last turn-end BEFORE it,
+ * so everything from that turn onward gets mirrored exactly once.
+ *
+ * Ordered (not set-membership) on purpose: re-issued prompts later in a
+ * conversation legitimately reappear in the host transcript and a
+ * set-membership match would wrongly skip them.
+ *
+ * Exit states: every host turn matched → full tip is known, cursor is the
+ * last turn-end; no local prompts (or the first host prompt already
+ * unknown) → 0, mirror everything. A transcript longer than one page
+ * leaves the seed `undefined` — the caller merges from 0 (a possible
+ * duplicate beats any lost content) rather than trusting a partial walk.
+ */
+declare function seedWalkForTranscript(localTexts: readonly string[], hostRecords: readonly HostEventRecord[]): number | undefined;
+/** Turn a raw host record into the controller-transcript record the mirror
+ *  appends — same `kind` (so every existing transcript renderer renders it
+ *  unchanged) plus the three mirror tags, and the HOST's own `ts` preserved
+ *  inside the record. `undefined` for kinds that carry conversations the
+ *  controller doesn't derive value from duplicating (`system-prompt`,
+ *  `usage_update`, derived `tool-call-record`, …). */
+declare function hostRecordToMirrorRecord(rec: HostEventRecord, hostFingerprint: string): Record<string, unknown> | undefined;
+/** The slice of `SessionsRegistry` (and the descriptor) the sync needs —
+ *  kept narrow so tests can stub the registry. */
+interface DeviceMirrorTarget {
+    findByIdOrName(idOrName: string): SessionDescriptor | undefined;
+    appendDeviceMirrorRecords(id: string, records: readonly Record<string, unknown>[]): number;
+    /** Preferred cursor/prompt source — the registry's own scan (correct
+     *  transcript base dir). Falls back to this module's default-dir fs read
+     *  when absent (older registry shapes / direct unit calls). */
+    scanDeviceMirrorState?(id: string): {
+        cursor: number;
+        localPromptTexts: readonly string[];
+    };
+}
+type DeviceMirrorSyncResult = {
+    ok: true;
+    /** New records merged from the host this call. */
+    merged: number;
+    /** The advanced mirror cursor after the merge. */
+    cursor: number;
+} | {
+    ok: false;
+    reason: "no-session" | "not-device" | "no-host-registry";
+    error?: string;
+} | {
+    ok: false;
+    reason: "mirror-error";
+    error: string;
+};
+/**
+ * One read-time sync for a controller id/name. Fast no-op path: no local
+ * descriptor, or not a device-mirrored session (both fields absent) —
+ * local spawns pay ZERO extra reads/calls (P7b test invariant). Reads the
+ * cursor, dials the host, appends new records, refreshes the descriptor's
+ * live projection fields, and stamps/clears `mirrorError` on the
+ * descriptor for unreachable-host surfacing.
+ */
+declare function syncDeviceMirror(sessions: DeviceMirrorTarget, hosts: HostRegistry | undefined, idOrName: string): Promise<DeviceMirrorSyncResult>;
+
 /**
  * Provider-preset family on top of `@agentproto/provider-kit` — the *thin,
  * honest* lister (Option B). Unlike tunnels/sandboxes/eval-reporters, presets
@@ -8261,4 +8669,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type McpEventEnvelope, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, isAgentCliAuthConfigured, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptHostSession, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, writeDaemonRegistryEntry };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type FetchHostTurnsResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type McpEventEnvelope, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, injectMcpAppBridge, isAgentCliAuthConfigured, isNoSessionPromptFailure, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, seedWalkForTranscript, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, withPr, withPrStatus, writeDaemonRegistryEntry };