@autopilot-agent/core 0.1.0 → 0.2.0

package/dist/runtime/application/job-service.d.ts

@@ -1,9 +1,11 @@
 import { type ChildProcess } from "node:child_process";
 import type { Job, JobListView, JobOutputView, JobPollResult, JobReadView, JobView, PollJobInput, StartJobInput } from "../domain";
+import { type ManagedExecutionControl } from "../domain/sandbox-policy";
 import { type JobOwnerProbe, type JobStore, type ProjectStore, type SandboxPort, type SessionStore } from "../ports";
 import { AgentRuntimeError as RuntimeError } from "../protocol";
 import { BoundedOutputBuffer } from "../../internal/tools/process-utils";
 import { JobOutputProjector } from "./job-output-projection";
+import { type JobServiceOwnershipProbe } from "./job-service-ownership";
 export interface JobService {
     start(input: StartJobInput): Promise<Job>;
     poll(input: PollJobInput): Promise<JobPollResult>;
@@ -42,6 +44,10 @@ export interface SessionJobService {
         jobId: string;
         source: "agent" | "host";
     }): Promise<JobView>;
+    verifyServiceOwnership(input: {
+        jobId: string;
+        serviceUrl: string;
+    }): Promise<"owned" | "unowned" | "unverifiable">;
 }
 export interface InternalJobService extends JobService {
     withSessionLock<T>(sessionId: string, operation: () => Promise<T>): Promise<T>;
@@ -54,6 +60,7 @@ export interface CreateJobServiceOptions {
     runtimeInstanceId?: string;
     hostProcessId?: number;
     now?: () => number;
+    serviceProbe?: JobServiceOwnershipProbe;
 }
 interface ActiveJob {
     child: ChildProcess;
@@ -68,6 +75,7 @@ interface ActiveJob {
     transitionTail: Promise<void>;
     closeResult?: {
         exitCode: number | null;
+        signal?: NodeJS.Signals | null;
     };
     initialized: boolean;
     projectorFlushed: boolean;
@@ -78,6 +86,7 @@ interface ActiveJob {
     sandboxExecution?: {
         port: SandboxPort;
         executionId: string;
+        control?: ManagedExecutionControl;
     };
 }
 export declare class ProcessManager {

package/dist/runtime/application/turn/turn-conversation-builder.d.ts

@@ -5,9 +5,9 @@ import type { RuntimePorts } from "../../ports";
 export interface TurnConversationBuilder {
     buildInitialMessages(input: StartTurnInput): AgentMessage[];
     refreshContext(capabilities: RunConfig, content: string | undefined): Promise<void>;
-    getLatestCompletedTurn(sessionId: string): Promise<Turn | undefined>;
-    buildCanonicalSessionMessages(latestCompleted: Turn | undefined, initial: AgentMessage[]): Promise<AgentMessage[]>;
-    inheritPreviousUsageAnchor(sessionId: string, latestCompleted: Turn | undefined, canonical: AgentMessage[], initial: AgentMessage[]): Promise<AgentCheckpoint["usageAnchor"]>;
+    getConversationBaselineTurn(sessionId: string): Promise<Turn | undefined>;
+    buildCanonicalSessionMessages(baseline: Turn | undefined, initial: AgentMessage[]): Promise<AgentMessage[]>;
+    inheritPreviousUsageAnchor(sessionId: string, baseline: Turn | undefined, canonical: AgentMessage[], initial: AgentMessage[]): Promise<AgentCheckpoint["usageAnchor"]>;
     injectTodoSnapshot(sessionId: string, todoChainId: string, messages: AgentMessage[]): Promise<AgentMessage[]>;
 }
 export declare function createTurnConversationBuilder(ports: RuntimePorts): TurnConversationBuilder;

package/dist/runtime/application/turn/turn-runtime-config-resolver.d.ts

@@ -2,7 +2,7 @@ import type { AgentOptions } from "../../../internal/agent-runtime";
 import type { ModelSampler } from "../../../internal/kernel/model-sampler";
 import type { ResolvedCredential, FrozenRunConfig } from "../../domain";
 import type { RuntimePorts } from "../../ports";
-import type { ApprovalService } from "../approval-service";
+import type { ApprovalService, InternalApprovalService } from "../approval-service";
 import type { InputInboxService } from "../input-inbox-service";
 import type { JobService } from "../job-service";
 import type { RunConfig } from "../../protocol";
@@ -11,7 +11,7 @@ import type { UserQuestionService } from "../user-question-service";
 export interface TurnRuntimeConfigResolverDependencies {
     ports: RuntimePorts;
     defaultRunConfig: RunConfig;
-    approvalService?: ApprovalService;
+    approvalService?: ApprovalService & Partial<InternalApprovalService>;
     inputInboxService?: InputInboxService;
     jobService?: JobService;
     userQuestionService?: UserQuestionService;

package/dist/runtime/application/undo-service.d.ts

@@ -1,5 +1,9 @@
 import type { FileMutation } from "../domain";
 import type { RuntimePorts } from "../ports";
+export declare function resolveFileMutationTarget(workspaceRoot: string, mutationPath: string): Promise<{
+    absolutePath: string;
+    exists: boolean;
+}>;
 export interface UndoPreview {
     status: "available" | "unavailable";
     turnId?: string;

package/dist/runtime/bootstrap/runtime-bootstrap-service.d.ts

@@ -1,7 +1,7 @@
 import type { AgentRuntime } from "../public";
 import type { RuntimePorts } from "../ports";
 import type { WorkspaceAdapter } from "../ports/workspace-adapter";
-import type { RunConfig, McpCapability, WebCapability } from "../protocol";
+import type { RunConfig, McpCapability, WebCapability, WorkPreviewCapability } from "../protocol";
 import type { AgentContextSnapshot } from "../../internal/agent-context";
 import type { AgentSkillsCapability } from "../../internal/tools/builtins/skill-tool";
 import type { AgentInputInboxCapability } from "../../internal/agent-runtime";
@@ -17,6 +17,7 @@ export interface CapabilityLoader {
     loadSkills?(workspaceRoot: string): Promise<AgentSkillsCapability | undefined> | AgentSkillsCapability | undefined;
     loadContext?(workspaceRoot: string, query?: string): Promise<AgentContextSnapshot> | AgentContextSnapshot;
     loadInputInbox?(workspaceRoot: string): Promise<AgentInputInboxCapability> | AgentInputInboxCapability;
+    loadWorkPreview?(workspaceRoot: string): Promise<WorkPreviewCapability | undefined> | WorkPreviewCapability | undefined;
 }
 export interface BootstrapEvent {
     phase: "safe" | "trust" | "runtime" | "ready" | "error";

package/dist/runtime/config/autopilot-settings.d.ts

@@ -43,7 +43,14 @@ export interface ResolvedSandboxSettings {
     deniedRead: readonly string[];
     deniedWrite: readonly string[];
 }
+export interface ResolvedExternalPermissionSettings {
+    allow: readonly string[];
+    deny: readonly string[];
+    ask: readonly string[];
+    readonly restricted?: boolean;
+}
 export interface ResolvedAutopilotSettings {
+    maxTurns?: number;
     modelRef?: ModelRef;
     visionModelRef?: ModelRef | false;
     modelSource?: "environment" | "settings";
@@ -58,7 +65,9 @@ export interface ResolvedAutopilotSettings {
     webSearchDisabled?: boolean;
     rag: ResolvedRagSettings;
     sandbox: ResolvedSandboxSettings;
+    permissions: ResolvedExternalPermissionSettings;
     diagnostics: readonly SettingsDiagnostic[];
 }
 export declare function normalizeProviderBaseUrl(value: unknown): string | undefined;
+export declare function isExternalPermissionDiagnostic(diagnostic: SettingsDiagnostic): boolean;
 export declare function resolveAutopilotSettings(sources: readonly AutopilotSettingsSource[]): ResolvedAutopilotSettings;

package/dist/runtime/config/runtime-limits.d.ts

@@ -1,6 +1,6 @@
 export interface LimitConfig {
     defaultValue?: number;
-    hardLimit: number;
+    hardLimit?: number;
     requestOverride?: number;
 }
 export interface ResolvedAgentRuntimeLimits {
@@ -8,11 +8,10 @@ export interface ResolvedAgentRuntimeLimits {
     maxToolRetries: number;
 }
 export interface AgentRuntimeSafetyLimits {
-    maxDurationMs: number;
+    maxDurationMs?: number;
     maxTotalTokens?: number;
 }
 export interface AgentRuntimeSafetyHardLimits {
-    maxDurationMs: number;
     maxTotalTokens: number;
 }
 export declare function resolveLimitConfig(config: LimitConfig & {
@@ -24,7 +23,6 @@ export declare const AGENT_RUNTIME_LIMIT_DEFAULTS: {
     readonly maxToolRetries: number;
 };
 export declare const AGENT_RUNTIME_LIMIT_HARD_LIMITS: {
-    readonly maxSteps: 100;
     readonly maxToolRetries: 10;
 };
 export declare const AGENT_RUNTIME_SAFETY_DEFAULTS: AgentRuntimeSafetyLimits;

package/dist/runtime/domain/approval.d.ts

@@ -1,4 +1,5 @@
 import type { ToolApprovalDecision, ToolRisk } from "../../internal/tools/types";
+import type { ExternalExecutionTarget } from "./external-execution";
 export interface ApprovalDecision {
     approvalId: string;
     turnId: string;
@@ -6,9 +7,21 @@ export interface ApprovalDecision {
     callId: string;
     toolName: string;
     normalizedInputHash: string;
+    constraint?: string;
+    expiresAt?: string;
     decision: ToolApprovalDecision;
+    projection?: "synced" | "pending";
     createdAt: string;
 }
+export interface TaskFileTarget {
+    path: string;
+    operation: "create" | "edit";
+}
+export declare const TASK_FILE_SET_CONSTRAINT = "task-files:v1";
+export declare const TASK_EXTERNAL_FILE_SET_CONSTRAINT = "task-ext-files:v1";
+export declare function isTaskFileSetConstraint(constraint: string | undefined): boolean;
+export declare function isExternalTaskFileSetConstraint(constraint: string | undefined): boolean;
+export declare function isTaskFileSetDeclarationConstraint(constraint: string | undefined): boolean;
 export interface PersistentGrant {
     scope: "allow_session" | "allow_workspace";
     workspaceRoot?: string;
@@ -16,6 +29,11 @@ export interface PersistentGrant {
     toolName: string;
     constraint: string;
     risk?: ToolRisk;
+    externalRule?: string;
+    executionTarget?: ExternalExecutionTarget;
+    projection?: "synced" | "pending";
+    turnId?: string;
+    taskFiles?: TaskFileTarget[];
     createdAt: string;
 }
 export interface SubmitApprovalInput {

package/dist/runtime/domain/external-execution.d.ts

@@ -0,0 +1,42 @@
+export declare const EXTERNAL_EXECUTION_CONSTRAINT_PREFIX = "ext-exec-file:v1:";
+export interface ExternalExecutionTarget {
+    schemaVersion: 1;
+    canonicalTarget: string;
+    canonicalWorkspace: string;
+    scope: "file";
+    operation: "write";
+    commandDigest: string;
+}
+export interface ExternalExecutionApproval {
+    recordType: "external_execution_request";
+    sessionId: string;
+    turnId: string;
+    approvalId: string;
+    callId: string;
+    toolName: string;
+    normalizedInputHash: string;
+    constraint: string;
+    expiresAt: string;
+    target: ExternalExecutionTarget;
+}
+export interface ExternalExecutionAuthorization {
+    lifetime: "allow_once" | "allow_session" | "allow_workspace";
+    sessionId: string;
+    canonicalWorkspace: string;
+    approvalId?: string;
+    expiresAt?: string;
+}
+export interface ExternalWriteCapability extends ExternalExecutionAuthorization {
+    schemaVersion: 1;
+    target: ExternalExecutionTarget;
+    toolName: string;
+    callId: string;
+    normalizedInputHash: string;
+    executionId: string;
+    constraint: string;
+    capabilityDigest: string;
+}
+export declare function comparablePath(value: string): string;
+export declare function computeExternalExecutionConstraint(toolName: string, target: ExternalExecutionTarget): string;
+export declare function isExternalExecutionConstraint(value: string | undefined): boolean;
+export declare function matchesExternalExecutionTarget(toolName: string, constraint: string, target: ExternalExecutionTarget | undefined): boolean;

package/dist/runtime/domain/external-permissions.d.ts

@@ -0,0 +1,32 @@
+export declare const EXTERNAL_FILE_CONSTRAINT_PREFIX = "ext-file:";
+export type ExternalFileOperation = "Read" | "Write" | "Edit";
+export interface ParsedExternalPermissionRule {
+    operation: ExternalFileOperation;
+    target: string;
+    recursive: boolean;
+}
+export declare function isExternalFileConstraint(constraint: string | undefined): boolean;
+export declare function externalFileConstraintTarget(constraint: string | undefined): string | undefined;
+export declare function formatExternalFileRule(toolName: string, constraint: string): string;
+export interface ExternalFileApproval {
+    recordType: "external_file_request";
+    sessionId: string;
+    turnId: string;
+    approvalId: string;
+    callId: string;
+    toolName: string;
+    normalizedInputHash: string;
+    constraint: string;
+    expiresAt: string;
+}
+export declare function normalizeComparablePath(target: string): string;
+export declare function parseExternalPermissionRule(rule: string): ParsedExternalPermissionRule | null;
+export declare function isValidExternalPermissionRule(rule: string): boolean;
+export declare function externalRuleCoversRule(denyRule: string, grantRule: string): boolean;
+export interface ExternalRestrictionSnapshot {
+    allow: readonly string[];
+    deny: readonly string[];
+    ask?: readonly string[];
+    restricted?: boolean;
+}
+export declare function classifyExternalRestriction(snapshot: ExternalRestrictionSnapshot, toolName: string, constraint: string): "allow" | "ask" | "deny";

package/dist/runtime/domain/frozen-run-config.d.ts

@@ -10,6 +10,7 @@ export interface FrozenRunConfig {
     workContextVersion?: 1;
     capabilityCeiling?: import("./product-mode").CapabilityCeiling;
     chatAttachmentGrants?: readonly import("../protocol/chat-capability").ChatAttachmentGrant[];
+    workPreviewEnabled?: boolean;
     modelRef?: ModelRef;
     reasoningProfile?: ReasoningProfile;
     credentialRef?: CredentialRef;
@@ -29,4 +30,5 @@ export interface FrozenRunConfig {
     sandboxTempRoot?: string;
     sandboxPolicyDigest?: string;
     sandboxPolicyVersion?: 1;
+    processExecution?: "sandbox" | "host";
 }

package/dist/runtime/domain/index.d.ts

@@ -3,13 +3,17 @@ export type { ModelRef, ReasoningEffort } from "./model-ref";
 export type { ReasoningProfile } from "./reasoning-profile";
 export type { SessionRunConfig } from "./session-run-config";
 export type { FrozenRunConfig } from "./frozen-run-config";
-export type { SandboxMode, SandboxEnforcement, SandboxPolicy, SandboxCapabilityReport, SandboxExecutionRequest, SandboxPreparedCommand, SandboxErrorCode } from "./sandbox-policy";
+export type { SandboxMode, SandboxEnforcement, SandboxPolicy, SandboxCapabilityReport, SandboxExecutionRequest, SandboxPreparedCommand, SandboxErrorCode, ManagedExecutionControl, ManagedExecutionChannel } from "./sandbox-policy";
+export type { ExternalExecutionTarget, ExternalExecutionApproval, ExternalExecutionAuthorization, ExternalWriteCapability } from "./external-execution";
 export { SANDBOX_ERROR_CODES, SANDBOX_POLICY_VERSION, isSandboxPolicyDenialCode, isSandboxAvailabilityFailureCode, resolveSandboxMode, computeSandboxPolicyDigest } from "./sandbox-policy";
 export type { Turn, TurnStatus } from "./turn";
 export { JOB_RECORD_VERSION } from "./job";
-export type { Job, JobStatus, JobOwner, JobOwnerLiveness, JobControlState, JobLastControl, JobView, JobListView, JobReadView, JobOutputSnapshot, JobSafeOutputSnapshot, JobSafeOutputStreamSnapshot, JobSafeOutputStreamView, JobOutputView, JobSandboxSummary, StartJobInput, PollJobInput, JobPollResult } from "./job";
+export { normalizeJobServiceUrl, jobServicePort, sameServiceOrigin } from "./job-service-url";
+export type { Job, JobStatus, JobOwner, JobOwnerLiveness, JobControlState, JobExecutionFacts, JobLastControl, JobView, JobListView, JobReadView, JobOutputSnapshot, JobSafeOutputSnapshot, JobSafeOutputStreamSnapshot, JobSafeOutputStreamView, JobOutputView, JobSandboxSummary, StartJobInput, PollJobInput, JobPollResult } from "./job";
 export type { FileMutation, FileMutationOperation, FileMutationStatus, PrepareFileMutationInput, UndoTransaction } from "./file-mutation";
 export type { Project, CreateProjectInput } from "./project";
+export { EXTERNAL_FILE_CONSTRAINT_PREFIX, isExternalFileConstraint, externalFileConstraintTarget, formatExternalFileRule, parseExternalPermissionRule, isValidExternalPermissionRule, externalRuleCoversRule } from "./external-permissions";
+export type { ExternalFileOperation, ParsedExternalPermissionRule, ExternalFileApproval } from "./external-permissions";
 export type { ApprovalDecision, PersistentGrant, SubmitApprovalInput, FindPersistentGrantInput, } from "./approval";
 export type { UserQuestionOption, UserQuestionItem, UserQuestionAnswerItem, UserQuestionRequest, UserQuestionAnswer, StoredUserQuestion, } from "./user-question";
 export type { TodoStatus, TodoItem, TodoCounts, TodoSnapshot, TodoWriteResult, } from "./todo";

package/dist/runtime/domain/job-service-url.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeJobServiceUrl(value: string): string | undefined;
+export declare function jobServicePort(serviceUrl: string): number | undefined;
+export declare function sameServiceOrigin(left: string, right: string): boolean;

package/dist/runtime/domain/job.d.ts

@@ -32,6 +32,12 @@ export interface JobOutputView {
     stderr: JobSafeOutputStreamView;
 }
 export type JobControlState = "owned" | "foreign_owner" | "owner_unknown" | "terminal";
+export interface JobExecutionFacts {
+    phase: "wrapper_spawn_failed" | "wrapper_running" | "wrapper_exit" | "target_spawn_error_reported" | "host_spawn_failed" | "host_running";
+    targetState: "unknown" | "not_started";
+    signal?: string;
+    win32Code?: string;
+}
 export interface JobLastControl {
     action: "stop";
     source: "agent" | "host" | "legacy_api";
@@ -47,11 +53,13 @@ export interface JobView {
     updatedAt: number;
     finishedAt?: number;
     exitCode?: number;
+    execution?: JobExecutionFacts;
     failureCode?: Job["failureCode"];
     stdoutBytes: number;
     stderrBytes: number;
     outputTruncated: boolean;
     lastControl?: JobLastControl;
+    serviceUrl?: string;
 }
 export interface JobListView {
     jobs: JobView[];
@@ -80,6 +88,7 @@ export interface JobSandboxSummary {
     mode: SandboxMode;
     policyDigest: string;
     policyVersion: number;
+    execution?: "host";
 }
 export interface Job {
     jobRecordVersion?: typeof JOB_RECORD_VERSION;
@@ -97,13 +106,17 @@ export interface Job {
     updatedAt: number;
     finishedAt?: number;
     exitCode?: number;
+    execution?: JobExecutionFacts;
     failureCode?: "JOB_SPAWN_FAILED" | "JOB_STOP_FAILED" | "JOB_STOP_TIMEOUT" | "JOB_STORAGE_FAILED";
     lastControl?: JobLastControl;
     output: JobOutputSnapshot;
     safeOutput?: JobSafeOutputSnapshot;
     sandbox?: JobSandboxSummary;
+    serviceUrl?: string;
 }
 export interface StartJobInput {
+    externalWriteTarget?: string;
+    toolCallId?: string;
     signal?: AbortSignal;
     workspaceId: string;
     workspaceRoot: string;
@@ -112,9 +125,14 @@ export interface StartJobInput {
     program: string;
     args: string[];
     cwd: string;
+    serviceUrl?: string;
     sandbox: {
+        execution?: "sandboxed";
         port: SandboxPort;
         policy: SandboxPolicy;
+    } | {
+        execution: "host";
+        policy: SandboxPolicy;
     };
 }
 export interface PollJobInput {

package/dist/runtime/domain/sandbox-policy.d.ts

@@ -1,3 +1,4 @@
+import type { ExternalWriteCapability } from "./external-execution";
 export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
 export type SandboxEnforcement = "full" | "partial" | "unavailable";
 export interface SandboxPolicy {
@@ -7,6 +8,7 @@ export interface SandboxPolicy {
     allowedDomains: readonly string[];
     deniedRead: readonly string[];
     deniedWrite: readonly string[];
+    externalWriteCapability?: ExternalWriteCapability;
 }
 export interface SandboxCapabilityReport {
     platform: "macos" | "windows" | "linux" | "unknown";
@@ -23,6 +25,19 @@ export interface SandboxExecutionRequest {
     args: readonly string[];
     cwd: string;
     policy: SandboxPolicy;
+    managed?: boolean;
+}
+export interface ManagedExecutionChannel {
+    incoming: AsyncIterable<Uint8Array>;
+    send(bytes: Uint8Array): void;
+    close(): void;
+}
+export interface ManagedExecutionControl {
+    protocolVersion: 1;
+    bind(channel: ManagedExecutionChannel): void;
+    stop(): Promise<{
+        evidence: "container_empty";
+    }>;
 }
 export interface SandboxPreparedCommand {
     executionId: string;
@@ -30,6 +45,7 @@ export interface SandboxPreparedCommand {
     args: readonly string[];
     env: Record<string, string>;
     enforcement: SandboxEnforcement;
+    control?: ManagedExecutionControl;
 }
 export declare const SANDBOX_ERROR_CODES: {
     readonly UNAVAILABLE: "SANDBOX_UNAVAILABLE";
@@ -43,9 +59,23 @@ export type SandboxErrorCode = (typeof SANDBOX_ERROR_CODES)[keyof typeof SANDBOX
 export declare function isSandboxPolicyDenialCode(code: string): boolean;
 export declare function isSandboxAvailabilityFailureCode(code: string): boolean;
 export declare const SANDBOX_POLICY_VERSION = 1;
+export declare const NO_SANDBOX_EXEC_CONSTRAINT = "no-sandbox-exec:v1";
+export declare function isNoSandboxExecConstraint(constraint: string | undefined): boolean;
+export interface SandboxDegradeApproval {
+    recordType: "sandbox_degrade_request";
+    sessionId: string;
+    turnId: string;
+    approvalId: string;
+    callId: string;
+    toolName: string;
+    normalizedInputHash: string;
+    constraint: string;
+    expiresAt: string;
+}
 export declare function resolveSandboxMode(value: unknown): SandboxMode;
 export declare function computeSandboxPolicyDigest(input: {
     mode: SandboxMode;
     workspaceRoot?: string;
     tempRoot?: string;
+    externalWriteCapability?: ExternalWriteCapability;
 }): string;

package/dist/runtime/domain/todo.d.ts

@@ -17,4 +17,8 @@ export interface TodoSnapshot {
 export interface TodoWriteResult {
     todos: TodoItem[];
     counts: TodoCounts;
+    fileTargets?: Array<{
+        path: string;
+        operation: "create" | "edit";
+    }>;
 }

package/dist/runtime/ports/approval-store.d.ts

@@ -1,5 +1,8 @@
 import type { ToolRisk } from "../../internal/tools/types";
-import type { ApprovalDecision, PersistentGrant } from "../domain/approval";
+import type { ApprovalDecision, PersistentGrant, TaskFileTarget } from "../domain/approval";
+import type { ExternalExecutionApproval, ExternalExecutionTarget } from "../domain/external-execution";
+import type { ExternalFileApproval } from "../domain/external-permissions";
+import type { SandboxDegradeApproval } from "../domain/sandbox-policy";
 export interface GetApprovalDecisionInput {
     sessionId: string;
     turnId: string;
@@ -18,8 +21,36 @@ export interface SavePersistentGrantInput {
     toolName: string;
     constraint: string;
     risk?: ToolRisk;
+    externalRule?: string;
+    executionTarget?: ExternalExecutionTarget;
+    turnId?: string;
+    taskFiles?: TaskFileTarget[];
+    projection?: "synced" | "pending";
 }
 export interface ApprovalStore {
+    saveExecutionApproval?(request: ExternalExecutionApproval): Promise<boolean>;
+    getExecutionApproval?(input: GetApprovalDecisionInput): Promise<ExternalExecutionApproval | null>;
+    consumeExecutionApproval?(input: GetApprovalDecisionInput & {
+        constraint: string;
+        callId: string;
+        normalizedInputHash: string;
+        now: string;
+    }): Promise<boolean>;
+    saveFileApproval?(request: ExternalFileApproval): Promise<boolean>;
+    getFileApproval?(input: GetApprovalDecisionInput): Promise<ExternalFileApproval | null>;
+    consumeFileApproval?(input: GetApprovalDecisionInput & {
+        constraint: string;
+        callId: string;
+        normalizedInputHash: string;
+        now: string;
+    }): Promise<boolean>;
+    saveDegradeApproval?(request: SandboxDegradeApproval): Promise<boolean>;
+    consumeDegradeApproval?(input: GetApprovalDecisionInput & {
+        constraint: string;
+        callId: string;
+        normalizedInputHash: string;
+        now: string;
+    }): Promise<boolean>;
     getDecision(input: GetApprovalDecisionInput): Promise<ApprovalDecision | null>;
     saveDecision(decision: ApprovalDecision): Promise<boolean>;
     getPersistentGrant(input: GetPersistentGrantInput): Promise<PersistentGrant | null>;
@@ -28,4 +59,11 @@ export interface ApprovalStore {
     }): Promise<PersistentGrant>;
     deletePersistentGrant(input: GetPersistentGrantInput): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<void>;
+    listPersistentGrants(input: {
+        workspaceRoot?: string;
+        sessionId?: string;
+    }): Promise<PersistentGrant[]>;
+    setGrantProjection(input: GetPersistentGrantInput & {
+        projection: "synced" | "pending";
+    }): Promise<PersistentGrant | null>;
 }

package/dist/runtime/ports/external-permission-projector.d.ts

@@ -0,0 +1,14 @@
+export interface ExternalPermissionSnapshot {
+    allow: readonly string[];
+    deny: readonly string[];
+    ask?: readonly string[];
+    restricted?: boolean;
+}
+export interface ExternalPermissionProjector {
+    project(input: {
+        workspaceRoot: string;
+        rule: string;
+        action: "add" | "remove";
+    }): Promise<void>;
+    read(workspaceRoot: string): Promise<ExternalPermissionSnapshot>;
+}

package/dist/runtime/ports/file-mutation-store.d.ts

@@ -7,5 +7,5 @@ export interface FileMutationStore {
     saveUndoTransaction(transaction: UndoTransaction): Promise<void>;
     listUndoTransactions(sessionId: string): Promise<UndoTransaction[]>;
     deleteBySession(sessionId: string): Promise<void>;
-    withWorkspaceLock<T>(workspaceRoot: string, operation: () => Promise<T>): Promise<T>;
+    withWorkspaceLock<T>(workspaceRoot: string, operation: () => Promise<T>, canonicalTargets?: readonly string[]): Promise<T>;
 }

package/dist/runtime/ports/host-mutation-protection.d.ts

@@ -0,0 +1,7 @@
+export interface ProtectedMutationTarget {
+    path: string;
+    scope: "file" | "directory";
+}
+export interface HostMutationProtection {
+    getProtectedTargets(workspaceRoot: string): Promise<readonly ProtectedMutationTarget[]>;
+}

package/dist/runtime/ports/index.d.ts

@@ -16,12 +16,17 @@ import type { FileMutationStore } from "./file-mutation-store";
 import type { SessionResourceStore } from "./session-resource-store";
 import type { UserQuestionStore } from "./user-question-store";
 import type { SandboxPort } from "./sandbox-port";
-export type { SessionStore, CheckpointStore, TranscriptStore, CredentialStore, ProjectStore, EventSink, Clock, WorkspaceAdapter, WorkspaceInfo, TurnStore, ApprovalStore, InputInbox, LeaseStore, JobStore, JobOwnerProbe, FileMutationStore, SessionResourceStore, UserQuestionStore };
+import type { ExternalPermissionProjector } from "./external-permission-projector";
+import type { HostMutationProtection } from "./host-mutation-protection";
+export type { HostMutationProtection, ProtectedMutationTarget } from "./host-mutation-protection";
+export type { SessionStore, CheckpointStore, TranscriptStore, CredentialStore, ProjectStore, EventSink, Clock, WorkspaceAdapter, WorkspaceInfo, TurnStore, ApprovalStore, InputInbox, LeaseStore, JobStore, JobOwnerProbe, FileMutationStore, SessionResourceStore, UserQuestionStore, ExternalPermissionProjector };
+export type { ExternalPermissionSnapshot } from "./external-permission-projector";
 export type { JobStoreWriteCondition } from "./job-store";
 export type { GetUserQuestionInput, SaveUserQuestionAnswerInput, SaveUserQuestionAnswerResult } from "./user-question-store";
 export type { SandboxPort } from "./sandbox-port";
 export { SandboxPortError, createUnavailableSandboxPort } from "./sandbox-port";
 export interface RuntimePorts {
+    hostMutationProtection?: HostMutationProtection;
     sessionStore: SessionStore;
     checkpointStore: CheckpointStore;
     transcriptStore: TranscriptStore;
@@ -40,4 +45,5 @@ export interface RuntimePorts {
     sessionResourceStore: SessionResourceStore;
     userQuestionStore: UserQuestionStore;
     sandboxPort: SandboxPort;
+    externalPermissionProjector?: ExternalPermissionProjector;
 }

package/dist/runtime/ports/sandbox-port.d.ts

@@ -4,6 +4,7 @@ export declare class SandboxPortError extends Error {
     constructor(code: string, message: string);
 }
 export interface SandboxPort {
+    readonly execution?: "host";
     status(): Promise<SandboxCapabilityReport>;
     setup(): Promise<SandboxCapabilityReport>;
     prepare(request: SandboxExecutionRequest): Promise<SandboxPreparedCommand>;

package/dist/runtime/protocol/index.d.ts

@@ -13,6 +13,7 @@ export type { McpCapability, McpServerConfig } from "./mcp-capability";
 export { parseMcpConfig, getMcpServerConfigHash, getMcpServerGrantConstraint } from "./mcp-capability";
 export { WebFetchCapabilityError, WebSearchCapabilityError } from "./web-capability";
 export type { WebCapability, WebFetchCapability, WebFetchCapabilityErrorCode, WebFetchResult, WebSearchCapability, WebSearchCapabilityErrorCode, WebSearchResult, WebSearchSource } from "./web-capability";
+export type { WorkPreviewCapability, WorkPreviewPrepareRequest, WorkPreviewPrepareResult, WorkPreviewOpenWhen } from "./work-preview-capability";
 export type { CompactTurnInput, CompactTurnResult } from "./compact-turn-input";
 export type { AgentTerminationBudget, AgentTerminationReason, AgentTerminationView, RecoverableTurnStatus, RecoverableApprovalView, RecoverableTurnView } from "./recoverable-turn-view";
 export { sanitizeAgentTerminationView } from "./recoverable-turn-view";

package/dist/runtime/protocol/recoverable-turn-view.d.ts

@@ -1,5 +1,5 @@
 export type RecoverableTurnStatus = "running" | "awaiting_approval" | "awaiting_user_input" | "interrupted_recoverable" | "limit_reached" | "completed" | "failed";
-export type AgentTerminationReason = "runtime_budget" | "token_budget" | "repeated_tool_calls" | "stale_lease" | "turn_limit_reached";
+export type AgentTerminationReason = "runtime_budget" | "token_budget" | "repeated_tool_calls" | "write_verification" | "stale_lease" | "turn_limit_reached";
 export interface AgentTerminationBudget {
     used: number;
     limit: number;

package/dist/runtime/protocol/run-config.d.ts

@@ -7,6 +7,7 @@ import type { ModelSampler } from "../../internal/kernel/model-sampler";
 import type { ModelSamplerFactory } from "../provider/model-sampler-factory";
 import type { McpCapability } from "./mcp-capability";
 import type { WebCapability } from "./web-capability";
+import type { WorkPreviewCapability } from "./work-preview-capability";
 import type { SessionRunConfig } from "../domain/session-run-config";
 import type { FrozenRunConfig } from "../domain/frozen-run-config";
 import type { ModelRef } from "../domain/model-ref";
@@ -48,6 +49,8 @@ export interface RunConfig {
     rag?: RagCapability;
     web?: WebCapability;
     webLoader?: () => Promise<WebCapability | undefined>;
+    workPreview?: WorkPreviewCapability;
+    workPreviewLoader?: () => Promise<WorkPreviewCapability | undefined>;
     databaseSearch?: DatabaseSearchCapability;
     databaseSearchPolicy?: DatabaseSearchPolicy;
     ragSourcePolicy?: RagSourcePolicy;

package/dist/runtime/protocol/work-preview-capability.d.ts

@@ -0,0 +1,23 @@
+export type WorkPreviewOpenWhen = "now" | "after_turn";
+export interface WorkPreviewPrepareRequest {
+    url: string;
+    jobId?: string;
+    openWhen: WorkPreviewOpenWhen;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    callId: string;
+    signal?: AbortSignal;
+}
+export interface WorkPreviewPrepareResult {
+    previewId: string;
+    hostLabel: string;
+    copyUrl: string;
+    openWhen: WorkPreviewOpenWhen;
+    state: "prepared";
+    jobId?: string;
+    autoOpen?: boolean;
+}
+export interface WorkPreviewCapability {
+    preparePreview(request: WorkPreviewPrepareRequest): Promise<WorkPreviewPrepareResult>;
+}