@claudexor/cli 3.6.0 → 3.8.1

package/dist/control-services.d.ts

@@ -80,6 +80,9 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 remediation: string | null;
                 requiresFullAccess: boolean;
             };
+            setupLogin: {
+                mode: "external_terminal" | "in_app";
+            } | null;
             readiness: {
                 id: string;
                 kind: "auth" | "binary" | "model" | "probe" | "smoke";
@@ -133,7 +136,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                     plan_label: string | null;
                     subject_id: string | null;
                 };
-                reason: "auth_revoked" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+                reason: "auth_revoked" | "credential_profile_ambiguous" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
                 detail: string | null;
                 observed_at: string;
             }[];
@@ -172,6 +175,8 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
             verification_source: "local_store" | "vendor";
+            stale?: boolean | undefined;
+            stale_age_ms?: number | undefined;
             detail?: string | undefined;
             last_verified_at: string | null;
         };
@@ -189,6 +194,11 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
         };
         removed: boolean;
         credentialCleanup: "config_dir_removed" | "none" | "secret_deleted";
+        vendorCredentialDisposition?: {
+            owner: "vendor";
+            state: "left_unchanged";
+            scope: "os_user" | "profile";
+        } | undefined;
     }>;
     quota: () => Promise<{
         snapshots: {
@@ -229,7 +239,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 plan_label: string | null;
                 subject_id: string | null;
             };
-            reason: "auth_revoked" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+            reason: "auth_revoked" | "credential_profile_ambiguous" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
             detail: string | null;
             observed_at: string;
         }[];
@@ -274,631 +284,34 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 plan_label: string | null;
                 subject_id: string | null;
             };
-            reason: "auth_revoked" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+            reason: "auth_revoked" | "credential_profile_ambiguous" | "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
             detail: string | null;
             observed_at: string;
         }[];
         refreshed_at: string | null;
     }>;
-    listDirectory?: (path?: string) => Promise<import("@claudexor/schema").ControlDirectoryListing>;
-    fetchProjectFile?: (projectId: string, path: string) => Promise<import("./remote-filesystem.js").ScopedProjectFile>;
-    threadDetail: (id: string) => Promise<{
-        thread: unknown;
-        sessions: unknown[];
-        turns: unknown[];
-    }>;
-    createThreadTurn: (id: string, prompt: string, options: {
-        kind?: unknown;
-        parentRunId?: string | null;
-        answersPlanRunId?: string | null;
-        planRunId?: string | null;
-        planHash?: string | null;
-        planOverridden?: boolean;
-        attachments?: ResourceAttachmentRef[];
-        idempotency?: {
-            key: string;
-            client: string;
-            request: unknown;
-        };
-    }) => Promise<{
-        id: string;
-        thread_id: string;
-        run_id: string | null;
-        parent_run_id: string | null;
-        answers_plan_run_id: string | null;
-        plan_run_id: string | null;
-        plan_hash: string | null;
-        plan_readiness_overridden: boolean;
-        kind: "decision" | "followup" | "initial";
-        prompt: string;
-        attachments: {
-            resource_id: string;
-            kind: "file" | "image";
-            mime: string;
-            name: string;
-            sha256: string;
-            size_bytes: number;
-            path: string;
-        }[];
-        enqueue_error: {
-            message: string;
-            code: string | null;
-            retryable: boolean;
-            required_actions: string[];
-            context: Record<string, unknown>;
-            failed_at: string;
-        } | null;
-        continuity: {
-            kind: "fresh" | "native_resume" | "packet";
-            packet_turns: number;
-            summarized: boolean;
-            lane_switched_from: {
-                harness_id: string;
-                profile_id: string | null;
-            } | null;
-        } | null;
-        created_at: string;
-    }>;
-    findThreadTurnByIdempotency: (id: string, idempotency: {
-        key: string;
-        client: string;
+    createSetupJob: (input: {
         request: unknown;
+        idempotencyKey: string;
+        clientId: string;
     }) => Promise<{
-        id: string;
-        thread_id: string;
-        run_id: string | null;
-        parent_run_id: string | null;
-        answers_plan_run_id: string | null;
-        plan_run_id: string | null;
-        plan_hash: string | null;
-        plan_readiness_overridden: boolean;
-        kind: "decision" | "followup" | "initial";
-        prompt: string;
-        attachments: {
-            resource_id: string;
-            kind: "file" | "image";
-            mime: string;
-            name: string;
-            sha256: string;
-            size_bytes: number;
-            path: string;
-        }[];
-        enqueue_error: {
-            message: string;
-            code: string | null;
-            retryable: boolean;
-            required_actions: string[];
-            context: Record<string, unknown>;
-            failed_at: string;
-        } | null;
-        continuity: {
-            kind: "fresh" | "native_resume" | "packet";
-            packet_turns: number;
-            summarized: boolean;
-            lane_switched_from: {
-                harness_id: string;
-                profile_id: string | null;
-            } | null;
-        } | null;
-        created_at: string;
-    } | null>;
-    setTurnEnqueueError: (turnId: string, problem: import("@claudexor/schema").TurnEnqueueProblem) => void;
-    preflightRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
-    preflightThreadRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
-    createUpload: (input: unknown, idempotencyKey: string) => Promise<{
-        uploadId: string;
-        state: "cancelled" | "open" | "uploaded" | "uploading";
-        receivedBytes: number;
-        expectedBytes: number;
-    }>;
-    writeUpload: (uploadId: string, chunks: AsyncIterable<Uint8Array>) => Promise<{
-        uploadId: string;
-        state: "cancelled" | "open" | "uploaded" | "uploading";
-        receivedBytes: number;
-        expectedBytes: number;
-    }>;
-    uploadStatus: (uploadId: string) => Promise<{
-        uploadId: string;
-        state: "cancelled" | "open" | "uploaded" | "uploading";
-        receivedBytes: number;
-        expectedBytes: number;
-    }>;
-    cancelUpload: (uploadId: string) => Promise<{
-        uploadId: string;
-        state: "cancelled" | "open" | "uploaded" | "uploading";
-        receivedBytes: number;
-        expectedBytes: number;
-    }>;
-    finalizeUpload: (uploadId: string, expectedSha256: string | undefined, idempotencyKey: string) => Promise<{
-        resourceId: string;
-        kind: "file" | "image";
-        mime: string;
-        name: string;
-        sha256: string;
-        sizeBytes: number;
-        createdAt: string;
-        deduplicated: boolean;
-    }>;
-    validateResources: (refs: ResourceAttachmentRef[]) => Promise<void>;
-    runRetention: import("./retention-service.js").RetentionRunner;
-    listProjects: () => Promise<{
-        projects: unknown[];
-    }>;
-    registerProject: (input: Parameters<ProjectStore["register"]>[0]) => Promise<{
-        schema_version: 2;
-        id: string;
-        root: string;
-        created_at: string;
-        updated_at: string;
-        nesting: {
-            relation: "inside" | "contains";
-            root: string;
-            projectId: string;
-        }[];
-    }>;
-    relinkProject: (id: string, root: string) => Promise<{
-        schema_version: 2;
-        id: string;
-        root: string;
-        created_at: string;
-        updated_at: string;
-        nesting: {
-            relation: "inside" | "contains";
-            root: string;
-            projectId: string;
-        }[];
-    }>;
-    removeProject: (id: string) => Promise<{
-        projectId: string;
-        root: string;
-        registryRemoved: true;
-        journalPartitionArchived: boolean;
-        archivedPartitionPath: string | null;
-        artifactsRetained: true;
-        activeRunCheck: "snapshot";
-    }>;
-    createThread: (input: unknown) => Promise<{
-        schema_version: 2;
-        id: string;
-        created_at: string;
-        updated_at: string;
-        repo: {
-            root: string;
-            base_ref: string;
-        } | null;
-        title: string | null;
-        mode: "agent" | "ask" | "plan";
-        auth_preference: "api_key" | "auto" | "subscription";
-        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
-        credential_profile_id: string | null;
-        primary_harness: string | null;
-        eligible_harnesses: string[];
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        run_ids: string[];
-        head_run_id: string | null;
-        state: "active" | "closed" | "purged" | "trashed";
-        trashed_at: string | null;
-        purge_after: string | null;
-        pre_trash_state: "active" | "closed" | null;
-    }>;
-    listThreads: () => Promise<{
-        threads: unknown[];
-        problems: unknown[];
-    }>;
-    updateThread: (id: string, patch: {
-        title?: string;
-        state?: string;
-        primaryHarness?: string | null;
-        credentialProfileId?: string | null;
-        eligibleHarnesses?: string[];
-        access?: string | null;
-    }) => Promise<{
-        schema_version: 2;
-        id: string;
-        created_at: string;
-        updated_at: string;
-        repo: {
-            root: string;
-            base_ref: string;
-        } | null;
-        title: string | null;
-        mode: "agent" | "ask" | "plan";
-        auth_preference: "api_key" | "auto" | "subscription";
-        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
-        credential_profile_id: string | null;
-        primary_harness: string | null;
-        eligible_harnesses: string[];
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        run_ids: string[];
-        head_run_id: string | null;
-        state: "active" | "closed" | "purged" | "trashed";
-        trashed_at: string | null;
-        purge_after: string | null;
-        pre_trash_state: "active" | "closed" | null;
-    }>;
-    trashThread: (id: string) => Promise<{
-        schema_version: 2;
-        id: string;
-        created_at: string;
-        updated_at: string;
-        repo: {
-            root: string;
-            base_ref: string;
-        } | null;
-        title: string | null;
-        mode: "agent" | "ask" | "plan";
-        auth_preference: "api_key" | "auto" | "subscription";
-        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
-        credential_profile_id: string | null;
-        primary_harness: string | null;
-        eligible_harnesses: string[];
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        run_ids: string[];
-        head_run_id: string | null;
-        state: "active" | "closed" | "purged" | "trashed";
-        trashed_at: string | null;
-        purge_after: string | null;
-        pre_trash_state: "active" | "closed" | null;
-    }>;
-    restoreThread: (id: string) => Promise<{
-        schema_version: 2;
-        id: string;
-        created_at: string;
-        updated_at: string;
-        repo: {
-            root: string;
-            base_ref: string;
-        } | null;
-        title: string | null;
-        mode: "agent" | "ask" | "plan";
-        auth_preference: "api_key" | "auto" | "subscription";
-        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
-        credential_profile_id: string | null;
-        primary_harness: string | null;
-        eligible_harnesses: string[];
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        run_ids: string[];
-        head_run_id: string | null;
-        state: "active" | "closed" | "purged" | "trashed";
-        trashed_at: string | null;
-        purge_after: string | null;
-        pre_trash_state: "active" | "closed" | null;
-    }>;
-    purgeThread: (id: string) => Promise<{
-        schema_version: 2;
-        id: string;
-        created_at: string;
-        updated_at: string;
-        repo: {
-            root: string;
-            base_ref: string;
-        } | null;
-        title: string | null;
-        mode: "agent" | "ask" | "plan";
-        auth_preference: "api_key" | "auto" | "subscription";
-        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
-        credential_profile_id: string | null;
-        primary_harness: string | null;
-        eligible_harnesses: string[];
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        run_ids: string[];
-        head_run_id: string | null;
-        state: "active" | "closed" | "purged" | "trashed";
-        trashed_at: string | null;
-        purge_after: string | null;
-        pre_trash_state: "active" | "closed" | null;
-    }>;
-    applyThread: (id: string, opts: ThreadApplyOptions) => Promise<{
-        applied: boolean;
-        status: string;
-        headMoved: boolean;
-        detail: string | null;
-        delivery: import("@claudexor/schema").ControlDeliveryResponse | null;
-    }>;
-    listTrust: typeof listTrustService;
-    updateTrust: typeof updateTrustService;
-    pendingInteractions: (runId: string) => {
-        interactionId: string;
-        runId: string;
-        attemptId: string | null;
-        harnessId: string | null;
-        sourceTool: string | null;
-        questions: {
-            id: string;
-            question: string;
-            header: string | null;
-            options: {
-                label: string;
-                description: string | null;
-            }[];
-            multi_select: boolean;
-        }[];
-        requestedAt: string;
-        timeoutAt: string | null;
-    }[];
-    answerInteraction: (runId: string, interactionId: string, answers: unknown) => {
-        status: import("@claudexor/daemon").InteractionAnswerStatus;
-        message?: string;
-    };
-    operatorDecision: (runId: string, params: unknown) => OperatorDecisionRecord | null;
-    findOperatorDecisionByIdempotency: (runId: string, params: unknown, idempotency: {
-        key: string;
-        client: string;
-        request: unknown;
-    }) => OperatorDecisionRecord | null;
-    recordOperatorDecision: (runId: string, params: unknown, decision: Omit<OperatorDecisionRecord, "runId">, idempotency?: {
-        key: string;
-        client: string;
-        request: unknown;
-    }) => import("@claudexor/daemon").RecordedOperatorDecision;
-    beginDelivery: (params: unknown, input: {
-        key: string;
-        client: string;
-        operation: string;
-        request: unknown;
-    }) => Promise<{
-        id: string;
-        state: "cancelled" | "failed" | "interrupted" | "queued" | "running" | "succeeded";
-        params: unknown;
-        result?: unknown;
-        error?: string;
-        errorCode?: string;
-        errorStatus?: number;
-        errorRetryable?: boolean;
-        errorRequiredActions?: string[];
-        errorContext?: Record<string, unknown>;
-        createdAt: string;
-        runId?: string;
-        taskId?: string;
-        runDir?: string;
-        startedAt?: string;
-        finishedAt?: string;
-        reused: boolean;
-    }>;
-    completeDelivery: (id: string, result: unknown) => Promise<void>;
-    failDelivery: (id: string, error: unknown) => Promise<void>;
-    harnesses: (input?: HarnessListInput) => Promise<{
-        git: {
-            status: "available" | "developer_tools_stub" | "failed" | "missing";
-            version: string | null;
-            detail: string | null;
-            remediation: string | null;
-        };
-        harnesses: {
-            id: string;
-            available: boolean;
-            status: "ok" | "degraded" | "unavailable";
-            manifest: import("@claudexor/schema").HarnessManifest | null;
-            enabledIntents: import("@claudexor/schema").Intent[];
-            routableIntents: import("@claudexor/schema").Intent[];
-            disabledIntents: import("@claudexor/schema").Intent[];
-            checks: import("@claudexor/schema").ConformanceCheck[];
-            reasons: string[];
-            authSources: import("@claudexor/schema").AuthSourceReadiness[];
-            configuredModel: string | null;
-            configuredModelCheck: {
-                status: "ok" | "rejected";
-                message?: string | null;
-            } | null;
-            delegation: {
-                available: boolean;
-                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
-                remediation: string | null;
-                requiresFullAccess: boolean;
-            };
-            readiness: {
-                id: string;
-                kind: "auth" | "binary" | "model" | "probe" | "smoke";
-                title: string;
-                status: "fail" | "pass" | "skip";
-                detail: string | null;
-            }[];
-        }[];
-    }>;
-    harnessModels: (input: {
-        harnessId: string;
-        route?: "local_session" | "api_key";
-    }) => Promise<{
-        harnessId: string;
-        models: {
-            id: string;
-            label: string | null;
-            context_window: number | null;
-            routes: ("api_key" | "local_session")[] | null;
-        }[];
-        source: "api" | "manifest" | "none";
-        verifiedAgainst: string | null;
-    }>;
-    authReadiness: (input: {
-        harnessId: string;
-        request: unknown;
-    }) => Promise<{
-        harnessId: string;
-        authRequest: "api_key" | "auto" | "subscription";
-        requestedSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-        observedAt: string;
-        readiness: {
-            source: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-            availability: "available" | "unavailable" | "unknown";
-            verification: "failed" | "not_run" | "passed";
-            detail?: string | undefined;
-        };
-    }>;
-    agentCapabilities: () => Promise<{
-        ok: true;
-        version: string;
-        generatedAt: string;
-        git: {
-            status: "available" | "developer_tools_stub" | "failed" | "missing";
-            version: string | null;
-            detail: string | null;
-            remediation: string | null;
-        };
-        harnesses: {
-            id: string;
-            enabled: boolean;
-            displayName: string;
-            status: "degraded" | "ok" | "unavailable";
-            providerFamily: "anthropic" | "cursor" | "google" | "local" | "openai" | "opencode" | "unknown" | "xai";
-            enabledIntents: string[];
-            disabledIntents: string[];
-            reasons: string[];
-            configuredModel: string | null;
-            configuredModelValid: boolean | null;
-            models: {
-                source: "api" | "manifest" | "none";
-                count: number;
-                verifiedAgainst: string | null;
-            };
-            webPolicy: "native" | "none" | "tools" | "uncontrolled";
-            attachmentInputs: {
-                kind: "file" | "image";
-                mime_types: string[];
-                max_bytes: number;
-                max_count: number;
-                transport: "base64_inline" | "base64_stream" | "file_path" | "text_inline";
-            }[];
-            effortLevels: string[];
-            accessProfilesSupported: ("external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write")[];
-            readonlyMechanism: "fs_sandbox" | "none" | "permission_deny" | "tool_allowlist";
-            delegation: {
-                available: boolean;
-                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
-                remediation: string | null;
-                requiresFullAccess: boolean;
-            };
-        }[];
-        availableHarnesses: string[];
-        modes: ("agent" | "ask" | "plan")[];
-        runControlKeys: string[];
-        outputSchemaDialects: {
-            dialect: "draft-07" | "draft-2020-12";
-            uri: string;
-            defaultWhenOmitted: boolean;
-        }[];
-        mutability: {
-            readOnlyModes: ("agent" | "ask" | "plan")[];
-            writeModes: ("agent" | "ask" | "plan")[];
-            isolationKinds: ("envelope" | "live")[];
-            workspaceModes: ("in_place" | "isolated")[];
-            accessProfiles: ("external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write")[];
-            applyModes: ("apply" | "branch" | "commit" | "pr")[];
-        };
-        cliCommands: {
-            id: string;
-            mutability: "delivery" | "ops" | "read" | "write";
-            stability: "experimental" | "stable";
-            recovery: boolean;
-        }[];
-        mcpTools: string[];
-        runApplyStates: string[];
-    }>;
-    runApplicability: (input: {
-        repoRoot: string;
-    }) => Promise<{
-        repoRoot: string;
-        git: {
-            status: "available" | "developer_tools_stub" | "failed" | "missing";
-            version: string | null;
-            detail: string | null;
-            remediation: string | null;
-        };
-        matrix: {
-            in_place: {
-                read_only: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-                agent_convergence: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-                agent_other: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-            };
-            isolated: {
-                read_only: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-                agent_convergence: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-                agent_other: {
-                    applicable: boolean;
-                    requiresGit: boolean;
-                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
-                    reason: string | null;
-                    remediation: string | null;
-                };
-            };
-        };
-    }>;
-    createSetupJob: (input: {
-        request: unknown;
-        idempotencyKey: string;
-        clientId: string;
-    }) => Promise<{
-        jobId: string;
-        harness: "agy" | "claude" | "codex" | "cursor";
-        action: "login";
-        transport: "client_pty" | "daemon";
-        profileId: string | null;
-        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
-        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
-        deadlineAt?: string | undefined;
-        deadlineFixed?: boolean | undefined;
-        outcome?: {
-            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
-            exitCode?: number | null | undefined;
-            signal?: string | null | undefined;
-        } | undefined;
-        command: string | null;
-        guideUrl: string | null;
-        message: string;
+        jobId: string;
+        harness: "agy" | "claude" | "codex" | "cursor";
+        action: "login";
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
+        deadlineFixed?: boolean | undefined;
+        outcome?: {
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
         createdAt: string;
         startedAt: string | null;
         finishedAt: string | null;
@@ -1056,7 +469,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             commandStarted: boolean;
             exitCode: number | null;
             signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
             finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
@@ -1240,7 +653,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -1424,7 +837,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             commandStarted: boolean;
             exitCode: number | null;
             signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
             finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
@@ -1609,7 +1022,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -1795,7 +1208,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -1996,7 +1409,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -2188,7 +1601,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -2377,7 +1790,190 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             commandStarted: boolean;
             exitCode: number | null;
             signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
+            finishedAt: string;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    setupJobInput: (input: unknown) => Promise<{
+        jobId: string;
+        harness: "agy" | "claude" | "codex" | "cursor";
+        action: "login";
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
+        deadlineFixed?: boolean | undefined;
+        outcome?: {
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+            startedAt: string;
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            startedAt: string;
+            completedAt: string;
+            receipt: {
+                receiptId: string;
+                attemptId: string;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                    aborted: boolean;
+                };
+                evidenceRefs: string[];
+            };
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            startedAt: string;
+            interruptedAt: string;
+        } | undefined;
+        execution?: {
+            executionId: string;
+            commandDigest: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux" | "win32";
+                    source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
+            executable: {
+                realpath: string;
+                sha256: string;
+                size: number;
+                mode: number;
+                device: string;
+                inode: string;
+            };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
+        } | undefined;
+        nativeCommand?: {
+            executionId: string;
+            commandDigest: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
             finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
@@ -2385,7 +1981,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             observedAt: string;
         } | undefined;
     }>;
-    setupJobInput: (input: unknown) => Promise<{
+    reconcileSetupJob: (input: unknown) => Promise<{
         jobId: string;
         harness: "agy" | "claude" | "codex" | "cursor";
         action: "login";
@@ -2560,7 +2156,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             commandStarted: boolean;
             exitCode: number | null;
             signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
             finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
@@ -2568,7 +2164,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             observedAt: string;
         } | undefined;
     }>;
-    reconcileSetupJob: (input: unknown) => Promise<{
+    extendSetupJob: (input: unknown) => Promise<{
         jobId: string;
         harness: "agy" | "claude" | "codex" | "cursor";
         action: "login";
@@ -2743,7 +2339,7 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             commandStarted: boolean;
             exitCode: number | null;
             signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
             finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
@@ -2751,188 +2347,608 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             observedAt: string;
         } | undefined;
     }>;
-    extendSetupJob: (input: unknown) => Promise<{
-        jobId: string;
-        harness: "agy" | "claude" | "codex" | "cursor";
-        action: "login";
-        transport: "client_pty" | "daemon";
-        profileId: string | null;
-        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
-        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
-        deadlineAt?: string | undefined;
-        deadlineFixed?: boolean | undefined;
-        outcome?: {
-            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
-            exitCode?: number | null | undefined;
-            signal?: string | null | undefined;
-        } | undefined;
-        command: string | null;
-        guideUrl: string | null;
-        message: string;
+    listDirectory?: (path?: string) => Promise<import("@claudexor/schema").ControlDirectoryListing>;
+    fetchProjectFile?: (projectId: string, path: string) => Promise<import("./remote-filesystem.js").ScopedProjectFile>;
+    threadDetail: (id: string) => Promise<{
+        thread: unknown;
+        sessions: unknown[];
+        turns: unknown[];
+    }>;
+    createThreadTurn: (id: string, prompt: string, options: {
+        kind?: unknown;
+        parentRunId?: string | null;
+        answersPlanRunId?: string | null;
+        planRunId?: string | null;
+        planHash?: string | null;
+        planOverridden?: boolean;
+        attachments?: ResourceAttachmentRef[];
+        idempotency?: {
+            key: string;
+            client: string;
+            request: unknown;
+        };
+    }) => Promise<{
+        id: string;
+        thread_id: string;
+        run_id: string | null;
+        parent_run_id: string | null;
+        answers_plan_run_id: string | null;
+        plan_run_id: string | null;
+        plan_hash: string | null;
+        plan_readiness_overridden: boolean;
+        kind: "decision" | "followup" | "initial";
+        prompt: string;
+        attachments: {
+            resource_id: string;
+            kind: "file" | "image";
+            mime: string;
+            name: string;
+            sha256: string;
+            size_bytes: number;
+            path: string;
+        }[];
+        enqueue_error: {
+            message: string;
+            code: string | null;
+            retryable: boolean;
+            required_actions: string[];
+            context: Record<string, unknown>;
+            failed_at: string;
+        } | null;
+        continuity: {
+            kind: "fresh" | "native_resume" | "packet";
+            packet_turns: number;
+            summarized: boolean;
+            lane_switched_from: {
+                harness_id: string;
+                profile_id: string | null;
+            } | null;
+        } | null;
+        created_at: string;
+    }>;
+    findThreadTurnByIdempotency: (id: string, idempotency: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => Promise<{
+        id: string;
+        thread_id: string;
+        run_id: string | null;
+        parent_run_id: string | null;
+        answers_plan_run_id: string | null;
+        plan_run_id: string | null;
+        plan_hash: string | null;
+        plan_readiness_overridden: boolean;
+        kind: "decision" | "followup" | "initial";
+        prompt: string;
+        attachments: {
+            resource_id: string;
+            kind: "file" | "image";
+            mime: string;
+            name: string;
+            sha256: string;
+            size_bytes: number;
+            path: string;
+        }[];
+        enqueue_error: {
+            message: string;
+            code: string | null;
+            retryable: boolean;
+            required_actions: string[];
+            context: Record<string, unknown>;
+            failed_at: string;
+        } | null;
+        continuity: {
+            kind: "fresh" | "native_resume" | "packet";
+            packet_turns: number;
+            summarized: boolean;
+            lane_switched_from: {
+                harness_id: string;
+                profile_id: string | null;
+            } | null;
+        } | null;
+        created_at: string;
+    } | null>;
+    setTurnEnqueueError: (turnId: string, problem: import("@claudexor/schema").TurnEnqueueProblem) => void;
+    preflightRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
+    preflightThreadRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
+    createUpload: (input: unknown, idempotencyKey: string) => Promise<{
+        uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    writeUpload: (uploadId: string, chunks: AsyncIterable<Uint8Array>) => Promise<{
+        uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    uploadStatus: (uploadId: string) => Promise<{
+        uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    cancelUpload: (uploadId: string) => Promise<{
+        uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    finalizeUpload: (uploadId: string, expectedSha256: string | undefined, idempotencyKey: string) => Promise<{
+        resourceId: string;
+        kind: "file" | "image";
+        mime: string;
+        name: string;
+        sha256: string;
+        sizeBytes: number;
+        createdAt: string;
+        deduplicated: boolean;
+    }>;
+    validateResources: (refs: ResourceAttachmentRef[]) => Promise<void>;
+    runRetention: import("./retention-service.js").RetentionRunner;
+    listProjects: () => Promise<{
+        projects: unknown[];
+    }>;
+    registerProject: (input: Parameters<ProjectStore["register"]>[0]) => Promise<{
+        schema_version: 2;
+        id: string;
+        root: string;
+        created_at: string;
+        updated_at: string;
+        nesting: {
+            relation: "inside" | "contains";
+            root: string;
+            projectId: string;
+        }[];
+    }>;
+    relinkProject: (id: string, root: string) => Promise<{
+        schema_version: 2;
+        id: string;
+        root: string;
+        created_at: string;
+        updated_at: string;
+        nesting: {
+            relation: "inside" | "contains";
+            root: string;
+            projectId: string;
+        }[];
+    }>;
+    removeProject: (id: string) => Promise<{
+        projectId: string;
+        root: string;
+        registryRemoved: true;
+        journalPartitionArchived: boolean;
+        archivedPartitionPath: string | null;
+        artifactsRetained: true;
+        activeRunCheck: "snapshot";
+    }>;
+    createThread: (input: unknown) => Promise<{
+        schema_version: 2;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        run_ids: string[];
+        head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    listThreads: () => Promise<{
+        threads: unknown[];
+        problems: unknown[];
+    }>;
+    updateThread: (id: string, patch: {
+        title?: string;
+        state?: string;
+        primaryHarness?: string | null;
+        credentialProfileId?: string | null;
+        eligibleHarnesses?: string[];
+        access?: string | null;
+    }) => Promise<{
+        schema_version: 2;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        run_ids: string[];
+        head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    trashThread: (id: string) => Promise<{
+        schema_version: 2;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        run_ids: string[];
+        head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    restoreThread: (id: string) => Promise<{
+        schema_version: 2;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        run_ids: string[];
+        head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    purgeThread: (id: string) => Promise<{
+        schema_version: 2;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        run_ids: string[];
+        head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    applyThread: (id: string, opts: ThreadApplyOptions) => Promise<{
+        applied: boolean;
+        status: string;
+        headMoved: boolean;
+        detail: string | null;
+        delivery: import("@claudexor/schema").ControlDeliveryResponse | null;
+    }>;
+    listTrust: typeof listTrustService;
+    updateTrust: typeof updateTrustService;
+    pendingInteractions: (runId: string) => {
+        interactionId: string;
+        runId: string;
+        attemptId: string | null;
+        harnessId: string | null;
+        sourceTool: string | null;
+        questions: {
+            id: string;
+            question: string;
+            header: string | null;
+            options: {
+                label: string;
+                description: string | null;
+            }[];
+            multi_select: boolean;
+        }[];
+        requestedAt: string;
+        timeoutAt: string | null;
+    }[];
+    answerInteraction: (runId: string, interactionId: string, answers: unknown) => {
+        status: import("@claudexor/daemon").InteractionAnswerStatus;
+        message?: string;
+    };
+    operatorDecision: (runId: string, params: unknown) => OperatorDecisionRecord | null;
+    findOperatorDecisionByIdempotency: (runId: string, params: unknown, idempotency: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => OperatorDecisionRecord | null;
+    recordOperatorDecision: (runId: string, params: unknown, decision: Omit<OperatorDecisionRecord, "runId">, idempotency?: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => import("@claudexor/daemon").RecordedOperatorDecision;
+    beginDelivery: (params: unknown, input: {
+        key: string;
+        client: string;
+        operation: string;
+        request: unknown;
+    }) => Promise<{
+        id: string;
+        state: "cancelled" | "failed" | "interrupted" | "queued" | "running" | "succeeded";
+        params: unknown;
+        result?: unknown;
+        error?: string;
+        errorCode?: string;
+        errorStatus?: number;
+        errorRetryable?: boolean;
+        errorRequiredActions?: string[];
+        errorContext?: Record<string, unknown>;
         createdAt: string;
-        startedAt: string | null;
-        finishedAt: string | null;
-        authCapability?: {
-            attemptId: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "api_key" | "auto" | "subscription";
-                requiredRoute: "local" | "managed_api_key" | "vendor_native";
-                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
-                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
+        runId?: string;
+        taskId?: string;
+        runDir?: string;
+        startedAt?: string;
+        finishedAt?: string;
+        reused: boolean;
+    }>;
+    completeDelivery: (id: string, result: unknown) => Promise<void>;
+    failDelivery: (id: string, error: unknown) => Promise<void>;
+    harnesses: (input?: HarnessListInput) => Promise<{
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
+        harnesses: {
+            id: string;
+            available: boolean;
+            status: "ok" | "degraded" | "unavailable";
+            manifest: import("@claudexor/schema").HarnessManifest | null;
+            enabledIntents: import("@claudexor/schema").Intent[];
+            routableIntents: import("@claudexor/schema").Intent[];
+            disabledIntents: import("@claudexor/schema").Intent[];
+            checks: import("@claudexor/schema").ConformanceCheck[];
+            reasons: string[];
+            authSources: import("@claudexor/schema").AuthSourceReadiness[];
+            configuredModel: string | null;
+            configuredModelCheck: {
+                status: "ok" | "rejected";
+                message?: string | null;
+            } | null;
+            delegation: {
+                available: boolean;
+                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
+                remediation: string | null;
+                requiresFullAccess: boolean;
             };
-            state: "disclosed";
-        } | {
-            attemptId: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "api_key" | "auto" | "subscription";
-                requiredRoute: "local" | "managed_api_key" | "vendor_native";
-                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
-                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
+            setupLogin: {
+                mode: "external_terminal" | "in_app";
+            } | null;
+            readiness: {
+                id: string;
+                kind: "auth" | "binary" | "model" | "probe" | "smoke";
+                title: string;
+                status: "fail" | "pass" | "skip";
+                detail: string | null;
+            }[];
+        }[];
+    }>;
+    harnessModels: (input: {
+        harnessId: string;
+        route?: "local_session" | "api_key";
+    }) => Promise<{
+        harnessId: string;
+        models: {
+            id: string;
+            label: string | null;
+            context_window: number | null;
+            routes: ("api_key" | "local_session")[] | null;
+        }[];
+        source: "api" | "manifest" | "none";
+        verifiedAgainst: string | null;
+    }>;
+    authReadiness: (input: {
+        harnessId: string;
+        request: unknown;
+    }) => Promise<{
+        harnessId: string;
+        authRequest: "api_key" | "auto" | "subscription";
+        requestedSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+        observedAt: string;
+        readiness: {
+            source: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            detail?: string | undefined;
+        };
+    }>;
+    agentCapabilities: () => Promise<{
+        ok: true;
+        version: string;
+        generatedAt: string;
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
+        harnesses: {
+            id: string;
+            enabled: boolean;
+            displayName: string;
+            status: "degraded" | "ok" | "unavailable";
+            providerFamily: "anthropic" | "cursor" | "google" | "local" | "openai" | "opencode" | "unknown" | "xai";
+            enabledIntents: string[];
+            disabledIntents: string[];
+            reasons: string[];
+            configuredModel: string | null;
+            configuredModelValid: boolean | null;
+            models: {
+                source: "api" | "manifest" | "none";
+                count: number;
+                verifiedAgainst: string | null;
             };
-            state: "running";
-            startedAt: string;
-        } | {
-            attemptId: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "api_key" | "auto" | "subscription";
-                requiredRoute: "local" | "managed_api_key" | "vendor_native";
-                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
-                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
+            webPolicy: "native" | "none" | "tools" | "uncontrolled";
+            attachmentInputs: {
+                kind: "file" | "image";
+                mime_types: string[];
+                max_bytes: number;
+                max_count: number;
+                transport: "base64_inline" | "base64_stream" | "file_path" | "text_inline";
+            }[];
+            effortLevels: string[];
+            accessProfilesSupported: ("full" | "inherit_native" | "readonly" | "workspace_write")[];
+            readonlyMechanism: "fs_sandbox" | "none" | "permission_deny" | "tool_allowlist";
+            delegation: {
+                available: boolean;
+                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
+                remediation: string | null;
+                requiresFullAccess: boolean;
             };
-            state: "completed";
-            startedAt: string;
-            completedAt: string;
-            receipt: {
-                receiptId: string;
-                attemptId: string;
-                harness: string;
-                requested: "api_key" | "auto" | "subscription";
-                requiredRoute: "local" | "managed_api_key" | "vendor_native";
-                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-                effective: "local" | "managed_api_key" | "vendor_native" | null;
-                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
-                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
-                availability: "available" | "unavailable" | "unknown";
-                verification: "failed" | "not_run" | "passed";
-                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
-                costKnowledge: "estimated" | "exact" | "unknown";
-                costUsd?: number | undefined;
-                startedAt: string;
-                completedAt: string;
-                challengeDigest: string;
-                requestDigest: string;
-                responseDigest: string;
-                streamDigest: string;
-                scratchBeforeDigest: string;
-                scratchAfterDigest: string;
-                stream: {
-                    startedEvents: number;
-                    completedEvents: number;
-                    errorEvents: number;
-                    unexpectedToolEvents: number;
-                    interactionEvents: number;
-                    sessionMismatchEvents: number;
-                    eventsAfterCompleted: number;
-                    aborted: boolean;
+            setupLogin?: {
+                mode: "external_terminal" | "in_app";
+            } | null | undefined;
+        }[];
+        availableHarnesses: string[];
+        modes: ("agent" | "ask" | "plan")[];
+        runControlKeys: string[];
+        outputSchemaDialects: {
+            dialect: "draft-07" | "draft-2020-12";
+            uri: string;
+            defaultWhenOmitted: boolean;
+        }[];
+        mutability: {
+            readOnlyModes: ("agent" | "ask" | "plan")[];
+            writeModes: ("agent" | "ask" | "plan")[];
+            isolationKinds: ("envelope" | "live")[];
+            workspaceModes: ("in_place" | "isolated")[];
+            accessProfiles: ("full" | "inherit_native" | "readonly" | "workspace_write")[];
+            applyModes: ("apply" | "branch" | "commit" | "pr")[];
+        };
+        cliCommands: {
+            id: string;
+            mutability: "delivery" | "ops" | "read" | "write";
+            stability: "experimental" | "stable";
+            recovery: boolean;
+        }[];
+        mcpTools: string[];
+        runApplyStates: string[];
+    }>;
+    runApplicability: (input: {
+        repoRoot: string;
+    }) => Promise<{
+        repoRoot: string;
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
+        matrix: {
+            in_place: {
+                read_only: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
                 };
-                evidenceRefs: string[];
-            };
-        } | {
-            attemptId: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "api_key" | "auto" | "subscription";
-                requiredRoute: "local" | "managed_api_key" | "vendor_native";
-                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
-                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
-            };
-            state: "interrupted_unknown";
-            startedAt: string;
-            interruptedAt: string;
-        } | undefined;
-        execution?: {
-            executionId: string;
-            commandDigest: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    pid: number;
-                    platform: "darwin" | "linux" | "win32";
-                    source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
-                    startToken: string;
-                    processGroupId: number;
+                agent_convergence: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_other: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
                 };
             };
-            observedAt: string;
-            permitIssuedAt?: string | undefined;
-        } | undefined;
-        authorization?: {
-            executionId: string;
-            executable: {
-                realpath: string;
-                sha256: string;
-                size: number;
-                mode: number;
-                device: string;
-                inode: string;
+            isolated: {
+                read_only: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_convergence: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_other: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
             };
-            args: string[];
-            commandDigest: string;
-            manifestDigest: string;
-        } | undefined;
-        nativeCommand?: {
-            executionId: string;
-            commandDigest: string;
-            manifestDigest: string;
-            permitIssuedAt: string | null;
-            commandStarted: boolean;
-            exitCode: number | null;
-            signal: string | null;
-            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
-            finishedAt: string;
-        } | undefined;
-        terminationReconciliation?: {
-            status: "empty";
-            observedAt: string;
-        } | undefined;
+        };
     }>;
     journalEvents: (partition: string, afterCursor?: string) => Promise<{
         schemaVersion: 1;
@@ -3086,6 +3102,8 @@ resources: () => ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs:
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
             verification_source: "local_store" | "vendor";
+            stale?: boolean | undefined;
+            stale_age_ms?: number | undefined;
             detail?: string | undefined;
             last_verified_at: string | null;
         };