@agentproto/runtime 5.7.0 → 5.9.0

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { h as WorktreeIsolationMode, i as SpawnAttachMode, j as SpawnDedupeMode,
 export { k as DEFAULT_MODEL_ROLES, M as MODEL_ROLE_REF_PREFIX, l as ModelRoleContext, m as ModelRoleEntry, n as ModelRoleSource, o as ModelRoleValue, p as ModelRolesConfig, q as listModelRoles, r as parseModelRoleRef, s as resolveModelRole } from './config-Gz7q9yfJ.js';
 import { B as BuildHeartbeatAgent } from './heartbeat-BJtxbDb9.js';
 export { H as HeartbeatAgent, a as HeartbeatRunner, R as RuntimeEvent, b as RuntimeEvents, p as parseDuration } from './heartbeat-BJtxbDb9.js';
-import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as UsageRollup, D as RemainingQuotaReader, Q as QuotaReadableProfile, E as UsageSnapshotRecord, F as SessionAwaitingQuestion, G as PolicyRunState, H as PtyFactory, I as WorktreeAutoReclaimer } from './sessions-DHSLsPHA.js';
-export { J as ActivityKind, K as ActivitySource, L as ActivityState, N as ActivityWaitingOn, O as AnthropicReaderConfig, V as AnthropicRemainingQuotaReader, X as AttachPolicyInput, Y as CommandGroupStats, Z as CommitSpec, _ as DEFAULT_WORKTREE_ISOLATION, $ as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a0 as EagerResumeFailReason, a1 as EagerResumeOutcome, a2 as EagerResumeSkipReason, a3 as GateSpec, a4 as HostInfo, a5 as JudgeGateSpec, a6 as LabeledProcessStatsReport, a7 as LabeledSessionStats, a8 as MAX_MESSAGE_DATA_BYTES, a9 as MESSAGE_KINDS, aa as MESSAGE_PREAMBLE, ab as MESSAGE_TAG, ac as MESSAGE_URGENCIES, ad as MessageDeliveryVia, ae as MessageFilter, af as MessageRelation, ag as MessageTreeNode, ah as OnFailSpec, ai as OrphanGroup, aj as PendingPermission, ak as PermissionRespondInput, al as PermissionRespondResult, am as PolicyRunStatus, an as PricingResolver, ao as ProcessDetail, ap as ProcessStatsReport, aq as ProcessStatsService, ar as QuotaStoreFile, as as QuotaStoreOptions, at as RegisterBrowserInput, au as RegisterSessionInput, av as RemainingQuota, aw as ResourceStats, ax as ResumeDisabledError, ay as SESSION_END_REASONS, az as SESSION_ID_ENV, aA as SessionCurrentPhase, aB as SessionKind, aC as SessionMessageFrom, aD as SessionOutcome, aE as SessionOutcomeArtifact, aF as SessionOutcomeCompact, aG as SessionOutcomeLink, aH as SessionResourceStats, aI as SessionSnapshots, aJ as SessionStatus, aK as ShellGateSpec, aL as SpawnAgentInput, aM as SpawnSessionInput, aN as StatsDetail, aO as StoredProfileQuota, aP as TASK_STATUSES, aQ as TaskCaller, aR as TaskChangedEvent, aS as TaskClaimInput, aT as TaskCreateInput, aU as TaskGateOutcome, aV as TaskGateRunner, aW as TaskLedgerRegistry, aX as TaskLedgerSessionSlice, aY as TaskListFilter, aZ as TaskRecord, a_ as TaskStatus, a$ as TaskUpdateInput, b0 as TaskVerification, b1 as TaskVerifySupervisor, b2 as TaskWriteResult, b3 as TokenPricing, b4 as UsageBucket, b5 as UsageComputeInput, b6 as UsageDetail, b7 as UsageSource, b8 as UserPresetsFile, b9 as WORKSPACE_SLUG_ENV, ba as WORKTREE_ISOLATION_ENV, bb as WORKTREE_PROVISION_CONCURRENCY_ENV, bc as WorktreeDecision, bd as WorktreeProvisionOutcome, be as WorktreeProvisionPhase, bf as WorktreeProvisionProgress, bg as WorktreeProvisionRequest, bh as WorktreeRequest, bi as activityCounts, bj as compactOutcome, bk as createProcessStatsService, bl as createSessionMessage, bm as createSupervisorTaskGateRunner, bn as createTaskLedger, bo as decideWorktreeIsolation, bp as deleteUserPreset, bq as deriveSessionOutcome, br as deriveSessionUsage, bs as escapeHumanPrompt, bt as escapeMessageBody, bu as filterActivities, bv as getProcessStatsService, bw as getUserPreset, bx as isClosedTaskStatus, by as isKnownSessionEndReason, bz as isMessageAllowed, bA as isProviderLimitError, bB as isTerminalActivityState, bC as listUserPresets, bD as loadQuotaStore, bE as loadUserPresets, bF as loadWorktreeIsolation, bG as matchesMessageFilter, bH as messageFrom, bI as mintMessageId, bJ as normalizeCommand, bK as normalizeWorktreeField, bL as parseAnthropicRateLimitHeaders, bM as parseTaskStatus, bN as parseWindow, bO as parseWorktreeIsolationMode, bP as pickUsageDetail, bQ as policyToActivities, bR as policyWatchesSession, bS as prToActivities, bT as projectSessionUsage, bU as readProfileQuota, bV as recordProfileQuota, bW as renderInboxDigest, bX as renderSessionMessage, bY as renderSessionMessages, bZ as resolveRelation, b_ as rollupUsage, b$ as sanitizeLabel, c0 as saveUserPreset, c1 as trackWorktreeProvision, c2 as turnToActivities, c3 as userPresetsPath, c4 as workflowToActivities } from './sessions-DHSLsPHA.js';
+import { M as MessageUrgency, S as SessionEvent, a as SessionEventType, b as SessionEventBus, c as SessionsRegistry, C as CompletionPolicySupervisor, T as TaskLedger, d as SessionDescriptor, e as SessionEndReason, A as ActivityPolicySlice, f as ActivityListFilter, g as ActivityRecord, h as ActivityTurnSession, i as ActivityPrSession, j as ActivityWorkflowRunSlice, P as PrResolvedState, k as ActivityTaskSlice, W as WorktreeProvisioner, l as AgentsMdResolution, U as UserPreset, R as RestartPolicy, m as SandboxAppServeSpec, n as WorktreeField, o as AgentSessionLike, p as UsageReadContext, q as UsageReadResult, r as MessageKind, s as SessionMessage, t as AgentStreamEvent, u as SessionUsage, v as ToolCallRecord, w as StatsSessionDescriptor, x as ProcRow, y as ProvisionInFlight, z as ProvisionTracker, B as SessionCrashReason, D as UsageRollup, E as RemainingQuotaReader, Q as QuotaReadableProfile, F as UsageSnapshotRecord, G as SessionAwaitingQuestion, H as PolicyRunState, I as PtyFactory, J as WorktreeAutoReclaimer } from './sessions-Cse9PhLG.js';
+export { K as ActivityKind, L as ActivitySource, N as ActivityState, O as ActivityWaitingOn, V as AnthropicReaderConfig, X as AnthropicRemainingQuotaReader, Y as AttachPolicyInput, Z as CommandGroupStats, _ as CommitSpec, $ as DEFAULT_WORKTREE_ISOLATION, a0 as DEFAULT_WORKTREE_PROVISION_CONCURRENCY, a1 as EagerResumeFailReason, a2 as EagerResumeOutcome, a3 as EagerResumeSkipReason, a4 as GateSpec, a5 as HostInfo, a6 as JudgeGateSpec, a7 as LabeledProcessStatsReport, a8 as LabeledSessionStats, a9 as MAX_MESSAGE_DATA_BYTES, aa as MESSAGE_KINDS, ab as MESSAGE_PREAMBLE, ac as MESSAGE_TAG, ad as MESSAGE_URGENCIES, ae as MessageDeliveryVia, af as MessageFilter, ag as MessageRelation, ah as MessageTreeNode, ai as OnFailSpec, aj as OrphanGroup, ak as PendingPermission, al as PermissionRespondInput, am as PermissionRespondResult, an as PolicyRunStatus, ao as PricingResolver, ap as ProcessDetail, aq as ProcessStatsReport, ar as ProcessStatsService, as as QuotaStoreFile, at as QuotaStoreOptions, au as RegisterBrowserInput, av as RegisterSessionInput, aw as RemainingQuota, ax as ResourceStats, ay as ResumeDisabledError, az as SESSION_END_REASONS, aA as SESSION_ID_ENV, aB as SessionCurrentPhase, aC as SessionKind, aD as SessionMessageFrom, aE as SessionOutcome, aF as SessionOutcomeArtifact, aG as SessionOutcomeCompact, aH as SessionOutcomeLink, aI as SessionResourceStats, aJ as SessionSnapshots, aK as SessionStatus, aL as ShellGateSpec, aM as SpawnAgentInput, aN as SpawnSessionInput, aO as StatsDetail, aP as StoredProfileQuota, aQ as TASK_STATUSES, aR as TaskCaller, aS as TaskChangedEvent, aT as TaskClaimInput, aU as TaskCreateInput, aV as TaskGateOutcome, aW as TaskGateRunner, aX as TaskLedgerRegistry, aY as TaskLedgerSessionSlice, aZ as TaskListFilter, a_ as TaskRecord, a$ as TaskStatus, b0 as TaskUpdateInput, b1 as TaskVerification, b2 as TaskVerifySupervisor, b3 as TaskWriteResult, b4 as TokenPricing, b5 as UsageBucket, b6 as UsageComputeInput, b7 as UsageDetail, b8 as UsageSource, b9 as UserPresetsFile, ba as WORKSPACE_SLUG_ENV, bb as WORKTREE_ISOLATION_ENV, bc as WORKTREE_PROVISION_CONCURRENCY_ENV, bd as WorktreeDecision, be as WorktreeProvisionOutcome, bf as WorktreeProvisionPhase, bg as WorktreeProvisionProgress, bh as WorktreeProvisionRequest, bi as WorktreeRequest, bj as activityCounts, bk as compactOutcome, bl as createProcessStatsService, bm as createSessionMessage, bn as createSupervisorTaskGateRunner, bo as createTaskLedger, bp as decideWorktreeIsolation, bq as deleteUserPreset, br as deriveSessionOutcome, bs as deriveSessionUsage, bt as escapeHumanPrompt, bu as escapeMessageBody, bv as filterActivities, bw as getProcessStatsService, bx as getUserPreset, by as isClosedTaskStatus, bz as isKnownSessionEndReason, bA as isMessageAllowed, bB as isProviderLimitError, bC as isTerminalActivityState, bD as listUserPresets, bE as loadQuotaStore, bF as loadUserPresets, bG as loadWorktreeIsolation, bH as matchesMessageFilter, bI as messageFrom, bJ as mintMessageId, bK as normalizeCommand, bL as normalizeWorktreeField, bM as parseAnthropicRateLimitHeaders, bN as parseTaskStatus, bO as parseWindow, bP as parseWorktreeIsolationMode, bQ as pickUsageDetail, bR as policyToActivities, bS as policyWatchesSession, bT as prToActivities, bU as projectSessionUsage, bV as readProfileQuota, bW as recordProfileQuota, bX as renderInboxDigest, bY as renderSessionMessage, bZ as renderSessionMessages, b_ as resolveRelation, b$ as rollupUsage, c0 as sanitizeLabel, c1 as saveUserPreset, c2 as trackWorktreeProvision, c3 as turnToActivities, c4 as userPresetsPath, c5 as workflowToActivities } from './sessions-Cse9PhLG.js';
 import { R as RouteSpec, P as Posture, C as ContextProfile, a as CanonicalPosture } from './session-config-DxIIuJFY.js';
 export { A as AuthMethod, D as DeclaredAdapterMode, E as EffortLevel, S as SessionConfig, c as composeMode, d as decomposeMode } from './session-config-DxIIuJFY.js';
 import { AcpMcpServer } from '@agentproto/acp';
@@ -440,6 +440,112 @@ interface SentinelSpec {
      *  descriptive, same as `group`. */
     label?: string;
 }
+/** Declared capabilities of a sentinel provider — pure metadata, surfaced in
+ *  `list_sentinel_adapters`. Never carries secrets. */
+interface SentinelProviderCapabilities {
+    /** Subject schemes it can watch, e.g. `["github"]`, or `["*"]`. */
+    subjects: string[];
+    /** Can deliver by calling back into the daemon (push ingress). */
+    push: boolean;
+    /** Supports `poll`/`ack`. */
+    poll: boolean;
+    /** Events survive daemon downtime (hosted queue). */
+    durable: boolean;
+    /** Push mode requires a reachable daemon (public URL). */
+    needsPublicUrl: boolean;
+    requiresAuth: boolean;
+    /** Documentation only — surfaced in `list_sentinel_adapters`. */
+    typicalLatencyMs: number;
+}
+/** Opaque provider-owned state for one sentinel. Persisted on the
+ *  `Sentinel` record; round-tripped through `create`/`attach`/`cancel`. */
+interface SentinelHandle {
+    provider: string;
+    /** Remote id — agentpush subscription id, GitHub hook id, … */
+    remoteId?: string;
+    /** Poll cursor — agentpush seq, local-gh snapshot hash, … */
+    cursor?: string;
+    state?: Record<string, unknown>;
+}
+/** How the daemon wants events delivered — passed to `create`/`attach` so a
+ *  provider can register a webhook (push) or just start polling. */
+type DeliveryPreference = {
+    mode: "poll";
+    intervalMs: number;
+} | {
+    mode: "push";
+    /** Public daemon origin the provider should call back into. A push
+     *  provider that owns its own secret/route (the `webhook` provider)
+     *  ignores or derives both; absent when no public URL is known. */
+    callbackUrl?: string;
+    secret?: string;
+};
+/** Extra context the runtime/tools hand to `create` beyond the spec. */
+interface SentinelCreateContext {
+    /** The id the store will record this sentinel under (`sen_<ulid>`), minted
+     *  BEFORE `create` so a provider that stamps it remotely (agentpush's
+     *  `consumerRef`) names the same sentinel the daemon does. */
+    sentinelId?: string;
+}
+/** Whether a provider can operate right now, and if not, why. */
+interface SentinelProviderReadiness {
+    ready: boolean;
+    /** Human-readable, actionable reason when `ready` is false. */
+    reason?: string;
+}
+/**
+ * A pluggable adapter that turns a sentinel spec into a stream of
+ * {@link SentinelEvent}s. Same registry/adapter-kit pattern as the tunnel and
+ * sandbox provider families (`AdapterHandle` gives slug/name/version/
+ * description/requiresSetup/check).
+ */
+interface SentinelProviderHandle extends AdapterHandle {
+    readonly capabilities: SentinelProviderCapabilities;
+    /** Credential fields this provider accepts via `setup_sentinel_provider`.
+     *  Omit (or empty) when the provider needs no credentials. */
+    readonly setupFields?: readonly SetupField[];
+    /** Start watching. `delivery` tells the provider how the daemon wants
+     *  events. */
+    create(spec: SentinelSpec, delivery: DeliveryPreference, ctx?: SentinelCreateContext): Promise<SentinelHandle>;
+    /** Re-attach after a daemon restart (re-point a callback, resume a
+     *  cursor). */
+    attach(handle: SentinelHandle, delivery: DeliveryPreference): Promise<SentinelHandle>;
+    cancel(handle: SentinelHandle): Promise<void>;
+    status(handle: SentinelHandle): Promise<{
+        ok: boolean;
+        detail?: string;
+        pending?: number;
+    }>;
+    /** Poll mode: events after `handle.cursor`, oldest first, plus the new
+     *  cursor. */
+    poll?(handle: SentinelHandle, limit: number): Promise<{
+        events: SentinelEvent[];
+        cursor: string;
+    }>;
+    ack?(handle: SentinelHandle, cursor: string): Promise<void>;
+    /** Push mode: verify + parse one inbound HTTP request into events (called
+     *  by the `"sentinel"` dialect on `POST /inbound/sentinel-<hookKey>`). */
+    parseInbound?(req: {
+        rawBody: string;
+        headers: Record<string, string | string[] | undefined>;
+    }, handle: SentinelHandle): {
+        ok: true;
+        events: SentinelEvent[];
+    } | {
+        ok: false;
+        reason: string;
+    };
+    /** Delivery a provider that supports both modes wants by default. Absent =
+     *  poll when `capabilities.poll`, else push (see {@link deliveryPreferenceFor}). */
+    preferredDelivery?(intervalMs: number): DeliveryPreference;
+    /** Default `types` for a subject scheme when the spec leaves it undefined. */
+    defaultTypes(subject: string): string[];
+    /** Optional operational-readiness probe (public URL known, auth scope
+     *  sufficient, ...). Consulted by `list_sentinel_adapters` and provider
+     *  auto-selection. Absent = always ready. Never throws — a probe failure
+     *  is `{ready:false, reason}`. */
+    readiness?(): Promise<SentinelProviderReadiness>;
+}
 
 /**
  * SentinelStore — persists `~/.agentproto/sentinels.json` (AIP-60 §2).
@@ -466,6 +572,114 @@ interface SentinelSpec {
  */
 
 type SentinelStatus = "active" | "paused" | "expired" | "orphaned" | "error";
+interface Sentinel {
+    /** `sen_<ulid>`, daemon-minted. */
+    id: string;
+    spec: SentinelSpec;
+    /** Resolved provider slug (never undefined once created, even when
+     *  `spec.provider` was left for auto-select). */
+    provider: string;
+    /** Opaque provider state (remote id, cursor, hook id, …). */
+    handle: SentinelHandle;
+    status: SentinelStatus;
+    createdTs: number;
+    lastEventTs?: number;
+    eventCount: number;
+    lastError?: string;
+    /** Last `SEEN_CAP` event ids delivered/skipped for this sentinel — the
+     *  dedup window (design §2: "last 1000 event ids, dedup across providers/
+     *  restarts"). */
+    seen: string[];
+    /** For `spec.until.kind === "subject_terminal"` with more than one
+     *  `spec.match` clause: the clause subjects that have already seen a
+     *  terminal event. The sentinel only expires once every clause's subject
+     *  is present here. Stays `[]` for other `until` kinds (unused) and for a
+     *  single-clause spec is immediately superseded by expiry on that one
+     *  clause's terminal event — same behaviour as before multi-clause
+     *  `match` existed. */
+    terminalSubjects: string[];
+    /** Concrete event subjects (e.g. `github:o/r#12`) that have already seen a
+     *  terminal event (PR merged/closed) — any later NON-terminal event for one
+     *  of them is post-mortem noise (a check_suite failing after the merge) and
+     *  is parked instead of delivered. Independent of `spec.until`. Absent on
+     *  sentinels persisted before this field existed. */
+    closedSubjects?: string[];
+}
+interface SentinelCreateInput {
+    /** Pre-minted id (see {@link mintSentinelId}); minted by the store when
+     *  omitted. */
+    id?: string;
+    spec: SentinelSpec;
+    provider: string;
+    handle: SentinelHandle;
+    status?: SentinelStatus;
+}
+type SentinelUpdatePatch = Partial<Pick<Sentinel, "spec" | "provider" | "handle" | "status" | "lastEventTs" | "eventCount" | "lastError" | "terminalSubjects" | "closedSubjects">>;
+/** A `webhook` target's secret sidecar row — the material `signWebhook` and
+ *  challenge verification need, keyed by the `secretRef` the at-rest target
+ *  carries. The material NEVER sits inside the `Sentinel` record or any
+ *  sentinel view (plan §4 W-B task 4); keys are never logged. */
+interface SentinelWebhookSecret {
+    /** Current signing secret (`whsec_…`, standard-base64 wire format). */
+    secret: string;
+    /** Previous secret — kept while a rotation window is open (10 min from
+     *  `rotatedAt`) so delivery signs with BOTH during renewal. */
+    prevSecret?: string;
+    /** Wall-clock ms at which `prevSecret` was superseded by `secret`; the
+     *  dual-sign window is `now - rotatedAt < 10 minutes`. */
+    rotatedAt?: number;
+}
+/** What {@link SentinelStore.putSentinelSecret} hands back — the only thing
+ *  sidecar writes return; never the material. */
+interface SentinelSecretWriteResult {
+    ref: string;
+    hasPrevSecret: boolean;
+    rotatedAt?: number;
+}
+interface SentinelStore {
+    get(id: string): Sentinel | undefined;
+    list(): Sentinel[];
+    create(input: SentinelCreateInput): Sentinel;
+    update(id: string, patch: SentinelUpdatePatch): Sentinel | undefined;
+    remove(id: string): boolean;
+    /** true = first time this event id has been seen for this sentinel
+     *  (persisted dedup, bounded). Returns true (treat-as-unseen) for an
+     *  unknown sentinel id — never blocks a caller who already validated the
+     *  sentinel exists moments earlier.
+     *
+     *  Callers that need at-least-once delivery MUST check {@link isSeen}
+     *  BEFORE attempting delivery and only call `markSeen` AFTER delivery is
+     *  handled (delivered or parked) — calling this before delivery and
+     *  bailing out on a thrown error would dedupe the event out of every
+     *  future redelivery attempt, silently losing it. */
+    markSeen(id: string, eventId: string): boolean;
+    /** Read-only check: true = this event id is already in the persisted
+     *  `seen` window for this sentinel. Never mutates — use this to decide
+     *  whether an event needs (re)delivery, and only call `markSeen` once
+     *  delivery has actually been handled. Returns false for an unknown
+     *  sentinel id (nothing recorded, so nothing has been "seen"). */
+    isSeen(id: string, eventId: string): boolean;
+    /** Write a webhook secret sidecar row (secret material at rest, 0600
+     *  sidecar file, keys never logged). When the row's existing `secret`
+     *  DIFFERS, the old one is kept as `prevSecret` and `rotatedAt` is
+     *  stamped now — the dual-sign window arithmetic lives on the delivery
+     *  side. Returns only non-secret metadata; never the secret. */
+    putSentinelSecret(ref: string, row: SentinelWebhookSecret): SentinelSecretWriteResult | undefined;
+    /** Read a secret sidecar row (delivery path only — never a listing path). */
+    getSentinelSecret(ref: string): SentinelWebhookSecret | undefined;
+    /** Read-only expiry consultation for `until: {kind:"at"}` — false for
+     *  every other `until` kind and for an unknown id. Sweeping the status
+     *  flip belongs to the runtime; this never mutates. */
+    isExpired(id: string): boolean;
+    /** Solve the `secretRef` for a webhook target: a target still carrying
+     *  raw `secret` has it moved into the sidecar (fresh ref returned); a
+     *  target already carrying `secretRef` (at-rest shape) is left as-is and
+     *  its ref returned. undefined = not a webhook target, or neither
+     *  secret nor ref present. */
+    materializeWebhookTargetRef(target: SentinelTarget): string | undefined;
+    /** Synchronous flush for shutdown paths. */
+    flushSync(): void;
+}
 
 /**
  * LlmEndpointRegistry — supervised-sidecar manager for the
@@ -2201,6 +2415,12 @@ interface SpawnAgentSessionDeps {
      *  tool and HTTP route each have their own "not enabled" response
      *  shape for the missing-resolver case). */
     resolveAgentAdapter: AgentAdapterResolver;
+    /** Installed-adapter lister — ONLY used to enumerate the valid slugs in
+     *  the generic `adapter_not_found` error, so a genuinely unknown adapter
+     *  name names what IS installed instead of just saying "install it".
+     *  Omitted ⇒ the error keeps its previous wording. Mirrors
+     *  `CronAdapterCheckDeps.listAgentAdapters` (cron's create-time check). */
+    listAgentAdapters?: AgentAdapterLister;
     /** Optional orchestrator-injection builder (WP3). See
      *  `RegisterAgentToolsOptions.buildOrchestratorMcp` for the full
      *  contract. Omitted → `orchestrator` is rejected with
@@ -3819,6 +4039,10 @@ type GhRunner$1 = (args: readonly string[], cwd: string) => Promise<{
  *   B. BRANCH — resolve the OPEN PR for the session cwd's current branch
  *      (via the injected {@link OpenPrResolver} port), the fallback for
  *      adapters whose tool calls aren't recorded.
+ *   C. TEXTUAL — pull-request urls mentioned in the session's own assistant
+ *      output (bounded transcript-tail scan); records on `openedPrs`
+ *      (adapter "output-scan") but never stamps a footer — a mention is
+ *      not proof of creation.
  *
  * Turn-end/exit are only poll checkpoints, never an assertion the PR is
  * ready: the real predicate is "did this session create a PR / does an open
@@ -3855,6 +4079,10 @@ interface ReconcilerSession extends FooterSession {
         url: string;
         number?: number;
     }[];
+    /** Ephemeral transcript path the live registry stamps on every read
+     *  (see `SessionDescriptor.eventsPath`); lane C's bounded tail read
+     *  needs it. Absent from test fakes without a transcript on disk. */
+    eventsPath?: string;
 }
 /** The registry slice the reconciler needs — structurally satisfied by the full
  *  `SessionsRegistry`, and by a trivial fake in tests. It is also a valid
@@ -5689,6 +5917,211 @@ interface SandboxReconcileResult {
  */
 declare function reconcileSandboxLedger(deps: SandboxReconcileDeps): Promise<SandboxReconcileResult>;
 
+/**
+ * Per-session structured event capture — one append-only JSONL file per
+ * agent-cli session, written at the same tap point where `projectEvent`
+ * (sessions.ts) flattens `StreamEvent`s into the ANSI ring buffer, but
+ * BEFORE that flattening happens. Gives agentproto the Claude-Code
+ * property: a daemon-owned structured transcript that survives a daemon
+ * restart (the ring buffer doesn't) and that any frontend can render,
+ * not just the two adapters `transcript-export.ts` knows how to re-read
+ * from their own native stores.
+ *
+ * File layout: `~/.agentproto/sessions/<sessionId>/events.jsonl` (the
+ * root is overridable via the daemon config's `sessions.eventsDir` — see
+ * `setDefaultSessionsBaseDir`), one JSON object per line: `{seq, ts, kind, ...fields}`.
+ *
+ * PTY (`terminal`) and `command` sessions never call into this writer —
+ * they have no structured event source (see report-transcript-
+ * architecture.md finding C.17), so this module is only ever driven from
+ * `agent-cli` sessions' `runAgentTurn`.
+ */
+
+/** Point the no-`baseDir` path resolution at `dir`. Called once at daemon
+ *  boot from the loaded config (`sessions.eventsDir`); `undefined` restores
+ *  the hardcoded `~/.agentproto/sessions` default. Relative paths are
+ *  resolved against the home directory. */
+declare function setDefaultSessionsBaseDir(dir: string | undefined): void;
+/** The effective default base dir — the configured one, or the hardcoded
+ *  `~/.agentproto/sessions`. */
+declare function defaultTranscriptBaseDir(): string;
+declare function sessionTranscriptDir(sessionId: string, baseDir?: string): string;
+declare function sessionEventsPath(sessionId: string, baseDir?: string): string;
+
+/**
+ * Per-session index sidecar — a compact `<sessionsDir>/<id>/index.json`
+ * projection of every session dir under the sessions store, maintained
+ * best-effort on every write-path event (create/rename/turn-end/exit) and
+ * backfilled at daemon startup for sessions that predate the sidecar.
+ *
+ * WHY: recovering a session by its user-visible label (or its cwd, or an id
+ * prefix) used to require `grep -r` across the whole sessions store and a
+ * hand-rolled parse of a multi-thousand-line `events.jsonl`. Everything was
+ * in the jsonl, but answering "which session was that?" meant loading every
+ * file whole. The sidecar turns that into one small JSON read per session
+ * (`sessions find`) and a single bounded tail read for the "where did we
+ * stop" recap (`sessions recap`).
+ *
+ * INVARIANTS:
+ *   - additive: `events.jsonl`'s format is never touched; this is a sidecar.
+ *   - best-effort: a failed index write must never fail a session write.
+ *   - bounded: reads seek from the end and cap the window ({@link INDEX_TAIL_BYTES});
+ *     a whole-file read of `events.jsonl` is never performed here.
+ *   - throttled: the registry schedules index writes rather than doing one
+ *     per streaming frame (see `scheduleIndexWrite` in sessions.ts).
+ *
+ * Pure by construction apart from the explicit read/write helpers; the
+ * registry owns the scheduling, this module owns the shape and the disk.
+ */
+
+/** Hard cap on `lastUserPrompt.text`, in characters. */
+declare const INDEX_MAX_PROMPT = 500;
+/** Hard cap on `lastOutputText`, in characters. */
+declare const INDEX_MAX_OUTPUT = 300;
+/** How many bytes of `events.jsonl` a tail read may pull back from the end.
+ *  Bounded so a multi-MB transcript never turns a find/recap into a scan. */
+declare const INDEX_TAIL_BYTES: number;
+/** Default page size for `sessions find` / `session_search`. */
+declare const INDEX_DEFAULT_LIMIT = 20;
+/** The compact sidecar shape. Every field is optional except `id`/`kind`/
+ *  `status`/`alive`/`startedAt`, so a recovered-from-jsonl entry can be
+ *  partial without lying about what it knows. */
+interface SessionIndexEntry {
+    id: string;
+    label?: string;
+    title?: string;
+    renamedByUser?: boolean;
+    kind: string;
+    status: string;
+    alive: boolean;
+    adapter?: string;
+    model?: string;
+    cwd?: string;
+    workspaceSlug?: string;
+    origin?: string;
+    depth?: number;
+    parentSessionId?: string;
+    startedAt: string;
+    lastActivityAt?: string;
+    lastTurnReason?: string;
+    lastUserPrompt?: {
+        ts: string;
+        text: string;
+    };
+    lastOutputText?: string;
+    turnsCompleted?: number;
+    costUsd?: number;
+}
+/** One user prompt recovered from a transcript tail. */
+interface TranscriptPrompt {
+    ts: string;
+    text: string;
+}
+/** The bounded tail-read result: parsed prompts, the last assistant run, and
+ *  how many bytes were actually read (exposed so a test can prove the read
+ *  stayed within {@link INDEX_TAIL_BYTES}). */
+interface TranscriptTail {
+    prompts: TranscriptPrompt[];
+    lastOutputText?: string;
+    bytesRead: number;
+    /** `ts` of the first parseable record in the window, when it carries one. */
+    firstTs?: string;
+}
+/** Absolute path of one session's index sidecar. */
+declare function sessionIndexPath(sessionId: string, baseDir?: string): string;
+/** Build the sidecar entry from a live/persisted descriptor, filling the
+ *  transcript-derived fields (`lastUserPrompt`/`lastOutputText`) from the
+ *  caller when it has them. */
+declare function indexEntryFromDescriptor(desc: SessionDescriptor, extra?: {
+    lastUserPrompt?: TranscriptPrompt;
+    lastOutputText?: string;
+}): SessionIndexEntry;
+/** Read one session's sidecar. Returns undefined on ENOENT, malformed JSON,
+ *  or a shape missing its id — never throws. */
+declare function readSessionIndex(sessionId: string, baseDir?: string): SessionIndexEntry | undefined;
+/** Atomically write one session's sidecar (tmp + rename). Best-effort:
+ *  swallows every error — a failed index write must never fail a session
+ *  write. */
+declare function writeSessionIndex(entry: SessionIndexEntry, baseDir?: string): void;
+/**
+ * Read the final `maxBytes` of `eventsPath` and extract, in one forward pass,
+ * every `user-prompt` (with its `ts`) and the last non-empty assistant text
+ * run. The window's first line is usually torn; JSON.parse rejects it and it
+ * is skipped. Never reads the whole file.
+ */
+declare function readTranscriptTail(eventsPath: string, maxBytes?: number): TranscriptTail;
+/** Recover a partial sidecar entry for a session from its `events.jsonl`
+ *  alone — the backfill path for a missing/corrupt index. Returns undefined
+ *  when the session dir has no transcript. */
+declare function deriveIndexFromTranscript(sessionId: string, baseDir?: string): SessionIndexEntry | undefined;
+/** Every sidecar under `baseDir`, newest activity first. Dirs with a missing
+ *  or corrupt index are recovered in memory from their transcript tail so a
+ *  find still sees them; this never writes. Best-effort: a readdir failure
+ *  returns `[]`. */
+declare function readAllSessionIndexes(baseDir?: string): SessionIndexEntry[];
+/** Case-insensitive query match: `id` by prefix, every other searchable field
+ *  by substring. An empty query matches everything. */
+declare function matchesSessionQuery(entry: Pick<SessionIndexEntry, "id" | "label" | "title" | "cwd" | "workspaceSlug">, query: string): boolean;
+/** Filter + order + cap a set of index entries. `limit` defaults to
+ *  {@link INDEX_DEFAULT_LIMIT}. */
+declare function searchSessionIndexes(entries: readonly SessionIndexEntry[], query: string, opts?: {
+    status?: string;
+    limit?: number;
+}): SessionIndexEntry[];
+/** The one-glance "where did we stop" recap — the output an agent needs to
+ *  resume. Built from the sidecar plus a bounded tail read of the transcript. */
+interface SessionRecap {
+    id: string;
+    status: string;
+    alive: boolean;
+    label?: string;
+    title?: string;
+    adapter?: string;
+    model?: string;
+    cwd?: string;
+    workspaceSlug?: string;
+    parentSessionId?: string;
+    children: string[];
+    startedAt: string;
+    lastActivityAt?: string;
+    turnsCompleted?: number;
+    costUsd?: number;
+    lastTurnReason?: string;
+    /** Last K user prompts, oldest → newest. */
+    prompts: TranscriptPrompt[];
+    /** Final assistant text/thought of the last turn (trimmed). */
+    lastOutputText?: string;
+    queuedPrompts?: number;
+}
+/**
+ * Compose a recap from an index entry + a bounded transcript tail read.
+ * `eventsPath` is read from the end only (≤{@link INDEX_TAIL_BYTES});
+ * `children`/`queuedPrompts` come from the caller (the daemon has them live,
+ * the CLI derives children from the index set).
+ */
+declare function buildSessionRecap(input: {
+    entry: SessionIndexEntry;
+    eventsPath: string;
+    last?: number;
+    children?: readonly string[];
+    queuedPrompts?: number;
+}): SessionRecap;
+/**
+ * Daemon-startup pass: create the sidecar for every session dir that lacks a
+ * valid one, recovering `lastUserPrompt`/`lastOutputText` from the transcript
+ * tail (never a whole-file parse). When `descriptors` are supplied (the live
+ * registry), their authoritative meta fills the entry. Best-effort and
+ * synchronous — a store with thousands of sessions does one readdir plus one
+ * bounded read per missing index, nothing more.
+ */
+declare function backfillSessionIndexes(baseDir?: string, opts?: {
+    descriptors?: Iterable<SessionDescriptor>;
+}): {
+    scanned: number;
+    created: number;
+    skipped: number;
+};
+
 /**
  * Host-level load report - answers "why is this machine on its knees" without
  * a hand-run `top` / `vm_stat` / `iostat` / `ps` / `lsof` session.
@@ -6052,9 +6485,15 @@ declare function runIdleReapPass(opts: {
  * `status:"running"` until the next prompt's RPC fails. A parked session
  * with no next prompt never gets that chance; the crash is silent forever.
  *
- * This pass sweeps the registry, finds agent-cli sessions whose OS process
- * is provably gone (`processAlive === false`, a fresh `process.kill(pid,0)`
- * probe), and MARKS them crashed (`registry.markCrashed`): flips the row to
+ * The same is true one layer up, for a reason a pid probe can never catch:
+ * an ACP wrapper's PROCESS can outlive its own JSON-RPC stream. The stream
+ * ends, `process.kill(pid, 0)` keeps succeeding, and the row reports
+ * `running`/`alive: true` while every prompt rejects "ACP connection
+ * closed". So this pass probes BOTH axes — process liveness AND transport
+ * liveness (`adapterConnected`, from the live session's `isConnected()`).
+ *
+ * This pass sweeps the registry, finds agent-cli sessions provably dead on
+ * either axis, and MARKS them crashed (`registry.markCrashed`): flips the row to
  * `error`/`endedReason:"crashed"`, records a short `lastError`, and clears
  * the dead binding so the row stays lazy-resumable — same shape as
  * idle-reaper's `reapIdle`, except this pass is DISCOVERING a death that
@@ -6097,7 +6536,7 @@ interface CrashReaperRegistry {
     list(opts?: {
         includeArchived?: boolean;
     }): readonly SessionDescriptor[];
-    markCrashed(id: string): boolean;
+    markCrashed(id: string, reason?: SessionCrashReason): boolean;
 }
 /**
  * Run one crash-detect sweep. Pure over the registry's own freshly-probed
@@ -6497,54 +6936,6 @@ interface SentinelView {
     lastError?: string;
 }
 
-/**
- * Standard Webhooks `whsec_` signing for webhook egress (W-A of
- * `.plans/sentinel-mcp-events/PLAN.md`).
- *
- * Contract (frozen §3):
- *   - HMAC-SHA256 over `msgId.timestamp.body` (raw bytes; `.update` chained so
- *     the body is never re-encoded — payload arrives as `Uint8Array`, I2).
- *   - Signature print = standard base64 (NOT base64url): `v1,<b64>`.
- *   - HMAC key = the base64 payload DECODED after the `whsec_` prefix.
- *   - Multi-secret: space-separated `v1,<sig>` segments (rotation window).
- *   - Returns ONLY headers — the caller owns the bytes and signs them again
- *     with a fresh timestamp on retry; signing never re-serializes.
- */
-interface WebhookSignInput {
-    /** Stable event id (`evt_…` / verification `msg_verification_…`) — same across retries. */
-    msgId: string;
-    /** Seconds, Unix epoch (Standard Webhooks wire format). */
-    timestamp: number;
-    /** Exact bytes — signed once (I2). Caller passes the serialization; signing never re-serializes. */
-    payload: Uint8Array;
-    /** One or, during a rotation window, two secrets (`whsec_…`). */
-    secrets: readonly string[];
-}
-type WebhookSignatureHeaders = {
-    "webhook-id": string;
-    "webhook-timestamp": string;
-    "webhook-signature": string;
-};
-/**
- * Encode raw secret bytes into the `whsec_<base64>` wire format.
- * Inverse of {@link decodeWhsecSecret}.
- */
-declare function encodeWhsecSecret(raw: Uint8Array): string;
-/**
- * Decode a `whsec_…` secret to its raw HMAC key: standard-base64 payload
- * after the prefix, which must decode to 24..64 bytes. Returns `null` on any
- * violation (bad prefix, not base64, length out of range). The canonical
- * validator for W-C: a submit failing this is `-32602` upstream; egress
- * surfaces it as a categorized challenge failure.
- */
-declare function decodeWhsecSecret(secret: string): Buffer | null;
-/**
- * Sign exactly the bytes given. Throws `Error` when any secret fails
- * {@link decodeWhsecSecret} (callers must have validated upstream; a bad
- * secret at this point is a programmer error, never silently signed).
- */
-declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
-
 /**
  * SSRF-guarded outbound HTTPS POST for webhook egress (W-A of
  * `.plans/sentinel-mcp-events/PLAN.md`).
@@ -6753,6 +7144,316 @@ declare function envelopeClampedBytes(event: McpEventEnvelope): {
 };
 declare function deliverEventEnvelope(replay: DeliveryReplay, event: McpEventEnvelope, deps?: DeliverEventDeps): Promise<DeliveryOutcome>;
 
+/**
+ * MCP Events registry (W-C of `.plans/sentinel-mcp-events/PLAN.md`, §2/§3).
+ *
+ * One object per provider scheme. Every registration carries the WIRE
+ * `EventDefinition` (name / description / `delivery:["webhook"]` /
+ * `inputSchema` / `payloadSchema` — official doc verbatim, no extra fields)
+ * PLUS the internal `InternalEventMeta`. Two fields on the meta are
+ * MANDATORY by type: `argumentsToMatch` (the missing link between
+ * `document_id`-style subscription args and `SentinelSpec.match`) and
+ * `authorize`. A registration that omits either does not compile.
+ *
+ * `replayable` is INTERNAL only (it drives `cursor:null` for v1) and must
+ * never appear on the wire — the §3 `EventDefinition` has no such field.
+ *
+ * Day-1 scheme: `github`. The definitions are derived from the ACTUAL event
+ * types the providers declare/emit in `sentinel-providers/` (verified with
+ * `rg 'github\.' packages/runtime/src/sentinel-providers`) — NOT from the
+ * illustrative names in the plan's task text. See `GITHUB_SCHEME` below.
+ */
+
+declare const PRINCIPAL_BRAND: unique symbol;
+/**
+ * The authenticated caller of a native MCP `events/*` call. REALITY (plan
+ * §1): the root `/mcp` transport authenticates with ONE daemon bearer (or
+ * trusted loopback) and exposes only an optional `callerSessionId` — there is
+ * no per-caller auth-profile principal yet. So v1 has exactly two
+ * constructors; a future W-F multi-tenant widening touches this one file.
+ */
+type Principal = string & {
+    readonly [PRINCIPAL_BRAND]: true;
+};
+declare function daemonBearerPrincipal(): Principal;
+declare function sessionPrincipal(sessionId: string): Principal;
+interface EventDefinition {
+    name: string;
+    description: string;
+    delivery: ["webhook"];
+    inputSchema: object;
+    payloadSchema: object;
+}
+/** What `argumentsToMatch` produces: explicit Sentinel match clauses plus the
+ *  provider slug that can emit the event. `ok:false` becomes `-32602` with a
+ *  definition-specific reason. */
+type ArgumentsResult = {
+    ok: true;
+    matchClauses: SentinelMatchClause[];
+    providerSlug: string;
+} | {
+    ok: false;
+    reason: string;
+};
+interface InternalEventMeta {
+    /** INTERNAL: drives `cursor:null` vs a provider cursor. v1 is all-false. */
+    replayable: boolean;
+    /** Map `inputSchema`-validated args to explicit match clauses (pure). */
+    argumentsToMatch: (args: Record<string, unknown>) => ArgumentsResult;
+    /** Authorization gate for the given principal. */
+    authorize: (args: Record<string, unknown>, principal: Principal) => boolean;
+}
+interface EventRegistration {
+    definition: EventDefinition;
+    meta: InternalEventMeta;
+}
+interface SchemeRegistry {
+    scheme: string;
+    events: EventRegistration[];
+}
+/** Validate subscription args against a definition's `inputSchema`. */
+declare function validateAgainstInputSchema(schema: object, args: unknown): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The day-1 github scheme. Types are the ACTUAL `github.*` strings emitted by
+ * `sentinel-providers/local-gh.ts` (the zero-infra provider the plan names):
+ *   - github.pull_request.closed
+ *   - github.pull_request.synchronize
+ *   - github.pull_request_review.submitted
+ *   - github.check_suite.completed
+ *
+ * The plan's illustrative `github.pull_request.opened` and
+ * `github.build.failed` do NOT exist in `sentinel-providers/` (opened is only
+ * producible by the push `webhook` provider's normalizer; build.failed exists
+ * nowhere — the closest real signal is `github.check_suite.completed` with
+ * `data.conclusion === "failure"`). Per the plan's own instruction to surface
+ * actual declared values, only real types ship — no fabricated definition.
+ *
+ * `local-gh`'s `defaultTypes()` also lists `github.workflow_run.completed` and
+ * `github.issue_comment.created`, but its poll implementation does not emit
+ * them (documented in `local-gh.ts`); shipping them here would advertise
+ * subscriptions that can never fire, so they are intentionally omitted.
+ */
+declare const GITHUB_SCHEME: SchemeRegistry;
+/** Every registered scheme. Adding a scheme = one object + one test row. */
+declare const EVENT_REGISTRY: readonly SchemeRegistry[];
+/** The schemes a principal may discover/subscribe to. v1: single tenant, all. */
+declare function tenantScope(_principal: Principal): readonly SchemeRegistry[];
+/** Look up a registration by official wire name (all schemes). */
+declare function findEventDefinition(name: string): EventRegistration | undefined;
+
+/**
+ * MCP Events adapter (W-C of `.plans/sentinel-mcp-events/PLAN.md`, §2/§3).
+ *
+ * Three methods over the existing Sentinel core — `events/list`,
+ * `events/subscribe`, `events/unsubscribe`. This module owns the subscription
+ * lifecycle; the transport (native JSON-RPC methods + `events:{}` in
+ * `server/discover`) lives in `@agentproto/mcp-server` and is wired in
+ * `runtime/index.ts`.
+ *
+ * INVARIANTS v1 (plan §2, code-verified):
+ *   - every event is NON-REPLAYABLE → `cursor` is always `null`, `truncated`
+ *     is never set;
+ *   - no `read` tool, no separate package, no batching.
+ *
+ * Subscription ids are deterministic (`subscription-id.ts`): subscribe upserts
+ * on identity, unsubscribe RECOMPUTES the id (never an id-lookup). The store
+ * has no CAS and `create()` silently overwrites, so every mutation is
+ * serialized behind an in-process async mutex.
+ */
+
+declare const DEFAULT_TTL_MS: number;
+declare const MAX_TTL_MS: number;
+/** Store minimum lifetime — prevents churn-refresh for a tiny requested TTL. */
+declare const MIN_TTL_MS: number;
+/**
+ * `refreshBefore` is the GRANTED EXPIRATION itself (`until.ms` as ISO-8601),
+ * per the official doc — never a pre-expiry hint. `until:{kind:"never"}`
+ * (only granted for `ttlMs: null`) yields `null`.
+ */
+declare function computeRefreshBefore(until: SentinelUntil): string | null;
+/**
+ * `ttlMs` mapping (§2):
+ *   omitted → default 7d;
+ *   number  → grant `min(requested, 30d)`, floored at 60s;
+ *   null    → `until:{kind:"never"}` (no expiration).
+ */
+declare function untilForTtl(ttlMs: number | null | undefined, now: number): SentinelUntil;
+/**
+ * An error the native-method transport surfaces verbatim as a JSON-RPC error:
+ * the SDK's request path copies `code` and `data` straight onto the error
+ * response, so no transport-side catch is needed.
+ */
+declare class McpEventsError extends Error {
+    readonly code: number;
+    readonly data?: Record<string, unknown>;
+    constructor(code: number, message: string, data?: Record<string, unknown>);
+}
+interface EventsListRequest {
+    cursor?: string;
+    pageSize?: number;
+}
+interface EventsListContext {
+    principal: Principal;
+}
+interface EventsListResult {
+    events: EventDefinition[];
+    nextCursor: string | null;
+}
+interface EventsSubscribeInput {
+    name: string;
+    arguments: Record<string, unknown>;
+    delivery: {
+        mode: "webhook";
+        url: string;
+        secret: string;
+    };
+    ttlMs?: number | null;
+    /** Refresh/replay handle (null on first subscribe). v1 ignores it: all
+     *  events are non-replayable, so it never changes the returned cursor. */
+    cursor?: string | null;
+}
+interface EventsSubscribeContext {
+    principal: Principal;
+    store: SentinelStore;
+    resolveProvider: (slug: string) => Promise<SentinelProviderHandle | null>;
+    nowMs?: () => number;
+    /** DI seam (tests): replaces `verifyCallback`'s POST boundary. */
+    verify?: typeof verifyCallback;
+    activeIntervalMs?: number;
+}
+interface EventsSubscribeResult {
+    id: `sub_${string}`;
+    refreshBefore: string | null;
+    cursor: string | null;
+    truncated?: boolean;
+}
+interface EventsUnsubscribeInput {
+    name: string;
+    arguments: Record<string, unknown>;
+    delivery: {
+        mode: "webhook";
+        url: string;
+    };
+}
+interface EventsUnsubscribeContext {
+    principal: Principal;
+    store: SentinelStore;
+    resolveProvider: (slug: string) => Promise<SentinelProviderHandle | null>;
+}
+declare function eventsList(r: EventsListRequest, ctx: EventsListContext): Promise<EventsListResult>;
+declare function eventsSubscribe(input: EventsSubscribeInput, ctx: EventsSubscribeContext): Promise<EventsSubscribeResult>;
+declare function eventsUnsubscribe(input: EventsUnsubscribeInput, ctx: EventsUnsubscribeContext): Promise<{}>;
+/**
+ * CloudEvents `SentinelEvent` → the MCP Events wire envelope (official doc
+ * verbatim): `id→eventId`, `type→name`, `time→timestamp`, `data→data` (plus
+ * the `subject`/`summary` projection so the 256 KiB clamp's `{summary,
+ * subject}` replacement never goes blind), and `cursor: null` (v1
+ * non-replayable). No top-level `type` — that field is reserved for protocol
+ * control notifications we never send.
+ */
+declare function toMcpEvent(event: SentinelEvent): McpEventEnvelope;
+
+/**
+ * Deterministic MCP Events subscription ids (W-C of
+ * `.plans/sentinel-mcp-events/PLAN.md`, §3 frozen).
+ *
+ * The id is a pure function of the subscription IDENTITY — authenticated
+ * principal + normalized callback URL + event name + subscription arguments —
+ * so the SAME logical subscription always lands on the SAME id. That is what
+ * makes `events/subscribe` idempotent (upsert, never duplicate) and lets
+ * `events/unsubscribe` recompute the id instead of trusting a caller-supplied
+ * one.
+ *
+ * Hashing input is RFC 8785 (JCS) canonical JSON: recursive key sort by
+ * UTF-16 code units, ECMAScript number serialization, Unicode minimization
+ * (literal non-ASCII, control chars escaped). The `args` payload is trustless
+ * input and nested objects are legal, so a plain `JSON.stringify` (key order
+ * dependent) would let `{a:1,b:2}` and `{b:2,a:1}` mint two different
+ * subscriptions for one logical watch — exactly the duplicate the doc warns
+ * against. The canonical form is a single source of truth shared by subscribe
+ * and unsubscribe.
+ */
+interface SubscriptionIdentity {
+    /** Authenticated principal (`daemon-bearer` or `session:<id>`). */
+    principal: string;
+    /** Callback URL exactly as submitted (identity component; no normalization
+     *  beyond what the caller already applied — challenge caching normalizes
+     *  separately). */
+    callbackUrl: string;
+    /** Official wire event name, e.g. `github.pull_request.closed`. */
+    eventName: string;
+    /** Subscription arguments (JSON, nested objects legal). */
+    args: Record<string, unknown>;
+}
+/**
+ * RFC 8785 (JCS) canonical JSON over a JSON-legal value. Throws on values
+ * JSON cannot carry (`undefined`, functions, non-finite numbers) rather than
+ * silently coercing them — a trustless `args` payload must fail loudly, not
+ * hash to a phantom identity.
+ *
+ * `JSON.stringify` already implements the JCS string and number rules for
+ * well-formed JSON: ECMAScript shortest-round-trip number printing (`-0` →
+ * `"0"`), control-char escaping, literal non-ASCII (Unicode minimization),
+ * and `\uXXXX` for lone surrogates (ES2019 well-formed stringify). Only the
+ * recursive object-key sort is added here.
+ */
+declare function canonicalizeJcs(value: unknown): string;
+/** `sub_<hex32>` — sha256 over the JCS canonical identity, first 128 bits. */
+declare function subscriptionId(identity: SubscriptionIdentity): `sub_${string}`;
+
+/**
+ * Standard Webhooks `whsec_` signing for webhook egress (W-A of
+ * `.plans/sentinel-mcp-events/PLAN.md`).
+ *
+ * Contract (frozen §3):
+ *   - HMAC-SHA256 over `msgId.timestamp.body` (raw bytes; `.update` chained so
+ *     the body is never re-encoded — payload arrives as `Uint8Array`, I2).
+ *   - Signature print = standard base64 (NOT base64url): `v1,<b64>`.
+ *   - HMAC key = the base64 payload DECODED after the `whsec_` prefix.
+ *   - Multi-secret: space-separated `v1,<sig>` segments (rotation window).
+ *   - Returns ONLY headers — the caller owns the bytes and signs them again
+ *     with a fresh timestamp on retry; signing never re-serializes.
+ */
+interface WebhookSignInput {
+    /** Stable event id (`evt_…` / verification `msg_verification_…`) — same across retries. */
+    msgId: string;
+    /** Seconds, Unix epoch (Standard Webhooks wire format). */
+    timestamp: number;
+    /** Exact bytes — signed once (I2). Caller passes the serialization; signing never re-serializes. */
+    payload: Uint8Array;
+    /** One or, during a rotation window, two secrets (`whsec_…`). */
+    secrets: readonly string[];
+}
+type WebhookSignatureHeaders = {
+    "webhook-id": string;
+    "webhook-timestamp": string;
+    "webhook-signature": string;
+};
+/**
+ * Encode raw secret bytes into the `whsec_<base64>` wire format.
+ * Inverse of {@link decodeWhsecSecret}.
+ */
+declare function encodeWhsecSecret(raw: Uint8Array): string;
+/**
+ * Decode a `whsec_…` secret to its raw HMAC key: standard-base64 payload
+ * after the prefix, which must decode to 24..64 bytes. Returns `null` on any
+ * violation (bad prefix, not base64, length out of range). The canonical
+ * validator for W-C: a submit failing this is `-32602` upstream; egress
+ * surfaces it as a categorized challenge failure.
+ */
+declare function decodeWhsecSecret(secret: string): Buffer | null;
+/**
+ * Sign exactly the bytes given. Throws `Error` when any secret fails
+ * {@link decodeWhsecSecret} (callers must have validated upstream; a bad
+ * secret at this point is a programmer error, never silently signed).
+ */
+declare function signWebhook(input: WebhookSignInput): WebhookSignatureHeaders;
+
 /**
  * SentinelWebhookOutbox — the PERSISTED outbox for `webhook`-target sentinel
  * events (W-B of `.plans/sentinel-mcp-events/PLAN.md`, §4 task 3).
@@ -6873,11 +7574,12 @@ interface SentinelWebhookOutboxOptions {
 }
 /** `sub_<hex32>` — deterministic over (sentinelId, eventId). */
 declare function webhookRequestId(sentinelId: string, eventId: string): `sub_${string}`;
-/** The CloudEvents → MCP-Events-envelope fusion this WP owns (W-C's adapter
- *  becomes the canonical owner of the same mapping; this shape is the frozen
- *  §3 wire envelope — insertion order stable, so its serialization is
- *  byte-stable across restarts). `data` gains `subject`/`summary` so the
- *  256 KiB clamp's `{summary, subject}` replacement never goes blind. */
+/** The CloudEvents → MCP-Events-envelope fusion. W-C's `mcp-events/adapter.ts`
+ *  is now the canonical owner of this mapping (`toMcpEvent`); this alias keeps
+ *  the W-B call sites/tests working. The shape is the frozen §3 wire envelope —
+ *  insertion order stable, so its serialization is byte-stable across
+ *  restarts. `data` gains `subject`/`summary` so the 256 KiB clamp's
+ *  `{summary, subject}` replacement never goes blind. */
 declare function toWebhookEnvelope(event: SentinelEvent): McpEventEnvelope;
 declare function createSentinelWebhookOutbox(opts: SentinelWebhookOutboxOptions): SentinelWebhookOutbox;
 
@@ -8639,6 +9341,19 @@ interface GatewayHandle {
     continueInterruptedOnBoot(opts?: {
         isServed?: (desc: SessionDescriptor) => boolean;
     }): Promise<ContinueOnBootSummary>;
+    /** Daemon-startup backfill for the per-session index sidecars
+     *  (`session-index.ts`): create a compact `index.json` for every session dir
+     *  that lacks one, recovering the last prompt/output from the transcript
+     *  tail (never a whole-file parse). Synchronous and best-effort — a store
+     *  with thousands of sessions pays one readdir plus one bounded read per
+     *  missing index. serve.ts calls this once at boot so `agentproto sessions
+     *  find`/`recap` answer instantly even for sessions that predate the
+     *  sidecar. */
+    backfillSessionIndexes(): {
+        scanned: number;
+        created: number;
+        skipped: number;
+    };
     stop(): Promise<void>;
 }
 /**
@@ -8655,4 +9370,4 @@ interface GatewayHandle {
  */
 declare function createGateway(opts: CreateGatewayOptions): Promise<GatewayHandle>;
 
-export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type FetchHostTurnsResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MCP_APP_BRIDGE_SCRIPT, type McpCredentialDeps, type McpEventEnvelope, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, SessionMessage, type SessionMessageSentRecord, type SessionObserver, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, injectMcpAppBridge, isAgentCliAuthConfigured, isNoSessionPromptFailure, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, seedWalkForTranscript, serializeEnvelope, setDefaultPreset, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, withPr, withPrStatus, writeDaemonRegistryEntry };
+export { ActivityListFilter, type ActivityPolicyLister, type ActivityProjector, type ActivityProjectorRegistry, type ActivityProjectorSession, ActivityRecord, type ActivityWorkflowLister, AdapterAuthDescriptor, type AdapterCapabilitiesLister, type AdapterInstallResult, type AdapterListEntry, type AgentAdapterInstaller, type AgentAdapterLister, type AgentAdapterResolver, AgentSessionLike, AgentStreamEvent, type ArgumentsResult, type AttachSandboxOpts, type AttachSandboxResult, BUCKETS_ROOT, type BranchGcClass, type BranchGcCoverageView, type BranchGcHoldReason, type BranchGcKind, type BranchGcOutcomeView, type BranchGcPlanEntryView, type BranchGcPlanView, type BranchGcReclaimReason, type BranchGcResult, type BranchGcRunInput, type BranchGcRunner, type BranchGcStatus, type BranchGcSummaryView, type BranchGcTriageVerdict, type BranchGcVerdictInput, type BranchGcVerdictLookupInput, type BranchGcVerdictReader, type BranchGcVerdictRecordView, type BranchGcVerdictRecorder, type BrowserAdapterHandle, type BrowserAdapterInfo, type BrowserAdapterLister, type BrowserAdapterResolver, BuildHeartbeatAgent, CLAMP_LIMIT_BYTES, CONTINUE_PROMPT_SOURCE, CanonicalPosture, type CapabilitiesInventory, type CapabilitiesInventoryMcp, type CapabilitiesInventorySkills, type CatalogModelsLister, CatalogModelsQuery, CatalogModelsResponse, type CatalogProviderModel, type CatalogProviderModelsQuery, type CatalogProviderModelsResponse, type CatalogProviderPricing, type ChallengeFailureReason, type ChallengeOutcome, type ClaudeNativeRef, CompletionPolicySupervisor, type ComposeCandidate, ContextProfile, type ContinueInterruptedMode, type ContinueInterruptedOutcome, type ContinueInterruptedResult, type ContinueInterruptedSkipReason, type ContinueOnBootSummary, type ConversationIndexRecord, type ConversationNativeRef, type CostBudgetDecision, type CrashDetectSummary, type CrashReaperRegistry, type CreateGatewayOptions, type CreateJoinTokenInput, type CreateReviewRunnerOptions, type CreatedJoinToken, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_HOST_LOAD_BUDGET_MS, DEFAULT_HOST_LOAD_THRESHOLDS, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_TTL_MS, DEVICE_PROMPT_PATH_PREFIX, type DaemonReviewerHostDeps, DeclaredAdapterOption, type DeclaredAdapterPreset, DefaultsAdapterAuthConfig, type DeliveryOutcome, type DeliveryReplay, type DeliveryState, type Device, type DeviceKind, type DeviceMirrorSyncResult, type DeviceMirrorTarget, type DevicePromptSessionsLike, type DeviceRegistry, type DeviceRole, type DiskLoad, EVENT_REGISTRY, type EagerResumeSummary, type EgressDispatcher, type EnableInput, type EnableResult, type EventDefinition, type EventRegistration, type EventsListContext, type EventsListRequest, type EventsListResult, type EventsSubscribeContext, type EventsSubscribeInput, type EventsSubscribeResult, type EventsUnsubscribeContext, type EventsUnsubscribeInput, type FetchHostTurnsResult, type FindComposeCandidateInput, type ForwardHttpRequest, type ForwardHttpResponse, GC_REAPABLE_STATES, GITHUB_SCHEME, type GatewayHandle, type GhRunner, HOSTS_VERSION, HOST_HANDSHAKE_REMEDIATION_HINT, HOST_SCOPE_HEADER, type HarnessPreset, type HarnessPresetValidationDeps, HarnessPresetValidationError, type HarnessPresetsFile, type HermesNativeRef, type HostEventRecord, type HostJoinMeta, type HostLoadCpu, type HostLoadDetail, type HostLoadMemory, type HostLoadReport, type HostLoadService, type HostLoadSwap, type HostLoadThresholds, type HostProbes, type HostProcess, type HostProcessOwner, type HostRecord, type HostRegistry, type HostRegistryDeps, type HostSessionRollup, type HostWarning, type HostWarningKind, INBOUND_PROVIDERS, INDEX_DEFAULT_LIMIT, INDEX_MAX_OUTPUT, INDEX_MAX_PROMPT, INDEX_TAIL_BYTES, type IdleReapSummary, type IdleReaperRegistry, type InboundEndpoint, type InboundEndpointStore, type InboundEndpointStoreOptions, type InboundEnqueuePrompt, type InboundIsSessionAlive, type InboundMessage, type InboundProvider, type InboundRestartSession, type InboundRouteMode, type InboundRouterDeps, type InboundRouterLog, type InboundSpawnForContact, type InboundWatcher, type InternalEventMeta, JOIN_TOKENS_VERSION, type JoinTokenRecord, type JoinTokenRegistry, type JoinTokenRegistryDeps, LEGACY_SESSIONS_FILE, type LedgerAnnotations, type LedgerEntry, type LedgerHostMeta, type LlmEndpointDescriptor, type LlmEndpointStatus, type LlmEndpointStatusReport, type LocatedConversation, type LocatedConversationByPath, MAX_ATTEMPTS, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_TTL_MS, MCP_APP_BRIDGE_SCRIPT, MIN_TTL_MS, type McpCredentialDeps, type McpEventEnvelope, McpEventsError, type MeasurableTool, type MeasuredToolEntry, MessageKind, MessageUrgency, type MigrationMarker, type ModelRolesInput, type ModelRolesOutput, type NormalizeInboundResult, type OpenPrResolver, type OrchestratorGatewayDeps, type OrchestratorInjection, type OrchestratorInjector, type OrchestratorInjectorDeps, type OrchestratorMcpServerFactory, type OrchestratorScope, type OrphanReaperRegistry, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, type PersistedOutboxRow, PolicyRunState, Posture, type PostureResolution, PrLookupError, type PrLookupErrorCode, PrResolvedState, type PrStateResolver, type PrStatusSnapshot, type PresetInfo, type Principal, type ProjectBrowserToolsOptions, type ProjectedBrowserTool, type ProjectedBrowserTools, type ProjectedProvider, type ProjectedToolResult, type PromptHostSessionInput, type PromptHostSessionResult, ProvisionInFlight, QuotaReadableProfile, type RegisterBrainToolsOptions, type RegisterDeviceToolsOptions, type RegisterPairingToolsOptions, type RegisterReviewToolsOptions, type RegisterWebSearchToolsOptions, RemainingQuotaReader, type RemoteStatus, type ResolveNativeLinkInput, ResolvedAuthSpec, ResolvedModelRole, type ReuseResolution, type ReviewComposeContext, type ReviewLedger, type ReviewLedgerFilter, type ReviewRun, type ReviewRunInput, type ReviewRunStatus, type ReviewRunner, type ReviewSignature, type ReviewSigningKey, type ReviewerRunResult, type ReviewerSessionHost, type RouteAwareLaunchConfig, type RouteAwareLaunchConfigInput, RouteSpec, type RuntimeMeta, SIGN_NAMESPACE, type SandboxAdapterInfo, type SandboxConnectionDescriptor, type SandboxGcCandidate, type SandboxGcProviderHandle, type SandboxGcReapDeps, type SandboxGcReapResult, type SandboxLedgerEntry, type SandboxLedgerState, type SandboxProviderCapabilities, type SandboxProviderHandle, type SandboxProviderLister, type SandboxProviderResolver, type SandboxReconcileDeps, type SandboxReconcileProviderHandle, type SandboxReconcileResult, type SandboxReconcileRow, type SandboxReconcileVerdict, type SchemeRegistry, type ScopeTokenRegistry, type SentinelMatchClause, type SentinelSpec, type SentinelStatus, type SentinelTarget, type SentinelUntil, type SentinelView, type SentinelWebhookOutbox, type SentinelWebhookOutboxOptions, type SentinelWebhookOutboxRow, type SentinelWebhookOutboxStatus, SessionDescriptor, SessionEndReason, type SessionIndexEntry, SessionMessage, type SessionMessageSentRecord, type SessionObserver, type SessionRecap, SessionUsage, type SessionUsageWithSubtree, type SessionWaitEvent, type SessionWaitResult, SessionsRegistry, type SkillPackInventoryEntry, type SkillsByHarnessEntry, SpawnDefaultsConfig, SsrfFetchError, type SsrfFetchInit, type SsrfFetchReason, type SsrfFetchResult, type StallWatchdogRegistry, type StallWatchdogSummary, type SubscriptionIdentity, type SubtreeChildUsage, type SubtreeUsageTotals, TaskLedger, type ToolListMeasurement, type TranscriptPrompt, type TranscriptTail, type TransmitterBinding, type TransmitterBindingStore, type TunnelDescriptor, type TunnelProvider, type TunnelStatus, UsageReadContext, UsageReadResult, UsageRollup, UsageSnapshotRecord, UserPreset, type VerifyCallbackInput, type VerifySignedAttestationResult, type WatcherDescriptor, type WatcherStartInput, type WebSearchInput, type WebSearchOutput, type WebSearchResult, type WebhookSignInput, type WebhookSignatureHeaders, type WorkspaceBrainSubscriber, type WorkspaceBrainSubscriberOptions, type WorkspaceBrains, WorkspaceFs, WorktreeAutoReclaimer, WorktreeField, type WorktreeGcClass, type WorktreeGcOutcomeView, type WorktreeGcPlanEntryView, type WorktreeGcReclaimReason, type WorktreeGcResult, type WorktreeGcRunInput, type WorktreeGcRunner, WorktreeIsolationMode, WorktreeProvisioner, type WorktreeStatusLister, type WorktreeStatusView, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, backfillSessionIndexes, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogProviderModels, buildHostLoadReport, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, buildSessionRecap, canonicalForModeId, canonicalizeJcs, challengeCacheSize, challengeReasonForSsrf, claudeProjectSlug, collectGcCandidates, collectHostSample, composeSessionObservers, composedFromRangeSha, computeHostWarnings, computeRefreshBefore, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDefaultHostProbes, createDeviceRegistry, createFileStepCache, createGateway, createHostLoadService, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPrProvenanceReconciler, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSentinelWebhookOutbox, createWorkspaceBrainSubscriber, createWorkspaceBrains, daemonBearerPrincipal, daemonRegistryDir, declaredPresetToProviderPreset, decodeWhsecSecret, defaultBrowserAdapterIds, defaultBrowserAdapterResolution, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defaultTranscriptBaseDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deliverEventEnvelope, deliveryBackoffDelay, deriveIndexFromTranscript, describeOwner, encodeWhsecSecret, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, envelopeClampedBytes, evaluateCostBudget, eventsList, eventsSubscribe, eventsUnsubscribe, execGh, extractHelpSection, fetchHostTurns, fetchPrStatus, fileExists, findComposeCandidate, findConversationRecord, findEventDefinition, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getHostLoadService, getMcpCredentialDeps, getToolHelp, githubRepoOf, harnessPresetsPath, hostPlaceholders, hostRecordToMirrorRecord, indexEntryFromDescriptor, injectMcpAppBridge, isAgentCliAuthConfigured, isNoSessionPromptFailure, isPubliclyRoutable, isSafeBucketSlug, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, loadHarnessPresets, loadWorkspaceModelRoles, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesSessionQuery, measureTool, measureToolList, migrateLegacySessionsFile, migrationMarkerPath, mirrorCursorForSession, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeCallbackUrl, normalizeInbound, normalizeModeId, normalizeRemote, parsePrUrl, prHeadSha, projectBrowserTools, promptDeviceSession, promptHostSession, readAllSessionIndexes, readConversationIndex, readDaemonRegistry, readHostsSnapshot, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readSessionIndex, readTranscriptTail, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, removeSandboxLedgerEntry, repoSlug, resetChallengeCacheForTests, resolveBucketSlug, resolveDevicePromptMapping, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveReuseFromLedger, resolveReviewerPreset, rollupSessionSubtree, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, searchSessionIndexes, seedWalkForTranscript, serializeEnvelope, sessionEventsPath, sessionIndexPath, sessionPrincipal, sessionTranscriptDir, setDefaultPreset, setDefaultSessionsBaseDir, setEgressDispatcherForTests, setMcpCredentialDeps, signAttestation, signWebhook, ssrfFetch, subscriptionId, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, syncDeviceMirror, tenantScope, toMcpEvent, toWebhookEnvelope, toWorktreeStatusView, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, untilForTtl, updateHarnessPreset, upsertSandboxLedger, validateAgainstInputSchema, verifyCallback, verifyInboundSignature, verifySignedAttestation, webSearchTool, webhookRequestId, withPr, withPrStatus, writeDaemonRegistryEntry, writeSessionIndex };