@fungi.computer/truffle 0.0.0-stage → 0.1.1

package/dist/private-local-delegation.js

@@ -0,0 +1,78 @@
+import { deterministicReplayKey } from "@fungi.computer/cairn";
+import { createFleetDelegation, delegationProvenance, delegationReplyMeta, delegationSendMeta, } from "@fungi.computer/shiitake/fleet";
+/** How long one Local delegation grant stays valid while it is admitted. */
+const grantLifetimeMs = 60_000;
+/**
+ * One Local Agent's side of delegation, over the same fleet contract as the
+ * Hub: a `followUp` send freezes BirdDog mail in this Agent's store, and an
+ * arriving reply is admitted only after `fleet.authenticateReply` checks it
+ * against that frozen mail. The replying child authors the reply line.
+ */
+export function createPrivateLocalDelegation(input) {
+    const fleet = createFleetDelegation({
+        storage: input.storage,
+        deliver: input.routing.deliver,
+        readSettlement: input.routing.readSettlement,
+        open: (agentId) => input.directory.open(agentId, new AbortController().signal),
+    });
+    async function members(signal) {
+        return (await input.directory.list(signal)).map(({ agentId, name }) => ({
+            agentId,
+            name,
+        }));
+    }
+    /** Delegate follow-up work; its reply returns to the invoking Session. */
+    async function send(task, sourceSessionId, signal, invocation) {
+        if (invocation === undefined)
+            throw new Error("Delegation requires a tool invocation");
+        const agents = await members(signal);
+        if (!agents.some(({ agentId }) => agentId === task.agentId))
+            throw new Error("Agent is outside this Local project");
+        const meta = delegationSendMeta({ id: input.agentId, name: input.agentId }, invocation.meta);
+        const provenance = await delegationProvenance({ agentId: input.agentId, sessionId: sourceSessionId }, invocation.toolCallCode);
+        const requestId = await deterministicReplayKey("local-agent-delegation", [
+            input.agentId,
+            sourceSessionId,
+            invocation.commandId ?? "",
+            invocation.toolCallId,
+            String(invocation.sendIndex),
+        ]);
+        signal.throwIfAborted();
+        return fleet.start({
+            agents: agents.map(({ agentId }) => agentId),
+            actions: ["delegate"],
+            expiresAt: Date.now() + grantLifetimeMs,
+            provenance,
+            meta,
+        }, { ...task, requestId });
+    }
+    /**
+     * Admit one mail addressed to this Agent. New work must name its sender as
+     * its only reply destination; a reply-less mail is admitted only as an
+     * authenticated reply. Everything else is refused.
+     */
+    async function receive(mail) {
+        if (mail.to.agentId !== input.agentId)
+            throw new Error("Local addressed mail recipient is not authorized");
+        const agents = await members(new AbortController().signal);
+        if (!agents.some(({ agentId }) => agentId === mail.from.agentId))
+            throw new Error("Local mail sender is outside this project");
+        if (mail.replyTo.length > 0) {
+            const [destination] = mail.replyTo;
+            if (mail.replyTo.length !== 1 ||
+                destination?.agentId !== mail.from.agentId ||
+                destination.sessionId !== mail.from.sessionId)
+                throw new Error("Local delegated work must reply to its sender");
+            return input.accept(mail, mail.meta);
+        }
+        const delegation = fleet.authenticateReply(mail);
+        if (delegation === undefined)
+            throw new Error("Local reply does not match work this Agent sent");
+        const replier = agents.find(({ agentId }) => agentId === delegation.reply.agentId);
+        if (replier === undefined)
+            throw new Error("Local reply sender is outside this project");
+        const meta = delegationReplyMeta(delegation, replier.name);
+        return input.accept({ ...mail, meta }, meta, delegation.reply);
+    }
+    return { send, receive };
+}

package/dist/private-local-effective-model.d.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+/** Secret-free model status published by the Local owner for one Session. */
+export declare const privateLocalEffectiveModelSchema: z.ZodObject<{
+    agentName: z.ZodLiteral<"Shiitake">;
+    providerId: z.ZodString;
+    providerName: z.ZodString;
+    modelId: z.ZodString;
+    modelName: z.ZodString;
+    credential: z.ZodObject<{
+        kind: z.ZodEnum<{
+            api_key: "api_key";
+            oauth: "oauth";
+            missing: "missing";
+        }>;
+        source: z.ZodString;
+    }, z.core.$strict>;
+    label: z.ZodString;
+}, z.core.$strict>;
+export type PrivateLocalEffectiveModel = z.output<typeof privateLocalEffectiveModelSchema>;

package/dist/private-local-effective-model.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+/** Secret-free model status published by the Local owner for one Session. */
+export const privateLocalEffectiveModelSchema = z.strictObject({
+    agentName: z.literal("Shiitake"),
+    providerId: z.string().min(1).max(160),
+    providerName: z.string().min(1).max(256),
+    modelId: z.string().min(1).max(160),
+    modelName: z.string().min(1).max(256),
+    credential: z.strictObject({
+        kind: z.enum(["oauth", "api_key", "missing"]),
+        source: z.string().min(1).max(160),
+    }),
+    label: z.string().min(1).max(640),
+});

package/dist/private-local-exec-launch.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+/**
+ * One exec launch's own text ceiling: 16384, shared by the shell form's
+ * `command` and the direct form's combined `executable`+`args`, so neither
+ * gets a materially larger budget. This is exec's own bound, not borrowed
+ * from any other owner's limit.
+ *
+ * The two forms count against it in different units, which the name
+ * deliberately leaves open rather than mis-claiming one: `command` is
+ * bounded by `z.string().max()`, zod's native UTF-16 code-unit count, the
+ * same as the field already was before the direct form existed. The direct
+ * form's `combinedArgvBytes` below counts real UTF-8 bytes, because argv is
+ * a byte protocol with no code-unit concept. For multi-byte text the two
+ * measures diverge; both stay well inside this ceiling for any launch a
+ * model would actually send.
+ */
+export declare const maximumLaunchTextLength: number;
+/**
+ * One exec launch's own stdin bound. A launch's stdin is a finite payload
+ * held fully in memory and written to the child once, then closed; it is
+ * never streamed, paginated or interactive. 128 KiB keeps that one-shot
+ * payload bounded while still fitting an ordinary small script or data blob.
+ * This is exec's own bound, not borrowed from any other owner's limit (in
+ * particular, not Files' write bound, which governs a different resource:
+ * durable file content, read and written in pages).
+ */
+export declare const maximumLaunchStdinBytes: number;
+/**
+ * Finite UTF-8 text delivered to a launched child once, then closed; never
+ * an interactive protocol. A lone surrogate is refused rather than silently
+ * becoming U+FFFD, so byte-identity is a real guarantee, not a best effort.
+ */
+export declare const launchStdinSchema: z.ZodString;
+/** Combined UTF-8 bytes of a direct form's executable and its args. */
+export declare function combinedArgvBytes(executable: string, args: readonly string[]): number;
+/**
+ * One launch's requested `cwd`: absolute, bounded, no NUL. The caller still
+ * resolves and contains it under the invocation root; this schema only
+ * shapes the raw string.
+ */
+export declare const launchCwdSchema: z.ZodString;

package/dist/private-local-exec-launch.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+/**
+ * One exec launch's own text ceiling: 16384, shared by the shell form's
+ * `command` and the direct form's combined `executable`+`args`, so neither
+ * gets a materially larger budget. This is exec's own bound, not borrowed
+ * from any other owner's limit.
+ *
+ * The two forms count against it in different units, which the name
+ * deliberately leaves open rather than mis-claiming one: `command` is
+ * bounded by `z.string().max()`, zod's native UTF-16 code-unit count, the
+ * same as the field already was before the direct form existed. The direct
+ * form's `combinedArgvBytes` below counts real UTF-8 bytes, because argv is
+ * a byte protocol with no code-unit concept. For multi-byte text the two
+ * measures diverge; both stay well inside this ceiling for any launch a
+ * model would actually send.
+ */
+export const maximumLaunchTextLength = 16 * 1_024;
+/**
+ * One exec launch's own stdin bound. A launch's stdin is a finite payload
+ * held fully in memory and written to the child once, then closed; it is
+ * never streamed, paginated or interactive. 128 KiB keeps that one-shot
+ * payload bounded while still fitting an ordinary small script or data blob.
+ * This is exec's own bound, not borrowed from any other owner's limit (in
+ * particular, not Files' write bound, which governs a different resource:
+ * durable file content, read and written in pages).
+ */
+export const maximumLaunchStdinBytes = 128 * 1_024;
+/**
+ * Finite UTF-8 text delivered to a launched child once, then closed; never
+ * an interactive protocol. A lone surrogate is refused rather than silently
+ * becoming U+FFFD, so byte-identity is a real guarantee, not a best effort.
+ */
+export const launchStdinSchema = z
+    .string()
+    .refine((value) => value.isWellFormed(), "Computer exec stdin must be well-formed UTF-16 text (no lone surrogates)")
+    .refine((value) => Buffer.byteLength(value, "utf8") <= maximumLaunchStdinBytes, `Computer exec stdin exceeds the ${String(maximumLaunchStdinBytes)}-byte bound`);
+/** Combined UTF-8 bytes of a direct form's executable and its args. */
+export function combinedArgvBytes(executable, args) {
+    return [executable, ...args].reduce((total, value) => total + Buffer.byteLength(value, "utf8"), 0);
+}
+/**
+ * One launch's requested `cwd`: absolute, bounded, no NUL. The caller still
+ * resolves and contains it under the invocation root; this schema only
+ * shapes the raw string.
+ */
+export const launchCwdSchema = z
+    .string()
+    .min(1)
+    .max(4_096)
+    .startsWith("/")
+    .refine((path) => !path.includes("\0"), "Path cannot contain null bytes");

package/dist/private-local-exec-path.d.ts

@@ -0,0 +1,6 @@
+import { z } from "zod";
+/** Only the invoking client's bounded PATH crosses the local service boundary. */
+export declare const privateLocalExecPathSchema: z.ZodString;
+export declare function parsePrivateLocalExecPath(value: string): string;
+/** Resolve shell-relative client entries before the absolute-only RPC boundary. */
+export declare function capturePrivateLocalExecPath(value: string, clientDirectory: string): string;

package/dist/private-local-exec-path.js

@@ -0,0 +1,40 @@
+import { isAbsolute, resolve } from "node:path";
+import { z } from "zod";
+const maximumPathCharacters = 8_192;
+const maximumPathDirectories = 64;
+/** Only the invoking client's bounded PATH crosses the local service boundary. */
+export const privateLocalExecPathSchema = z
+    .string()
+    .min(1)
+    .max(maximumPathCharacters)
+    .superRefine((path, context) => {
+    const directories = path.split(":");
+    if (directories.length > maximumPathDirectories)
+        context.addIssue({
+            code: "custom",
+            message: "PATH has too many directories",
+        });
+    for (const directory of directories) {
+        if (directory === "" ||
+            !isAbsolute(directory) ||
+            /[\p{Cc}\p{Cf}]/u.test(directory)) {
+            context.addIssue({
+                code: "custom",
+                message: "PATH must contain only nonempty absolute directories",
+            });
+            break;
+        }
+    }
+});
+export function parsePrivateLocalExecPath(value) {
+    return privateLocalExecPathSchema.parse(value);
+}
+/** Resolve shell-relative client entries before the absolute-only RPC boundary. */
+export function capturePrivateLocalExecPath(value, clientDirectory) {
+    const absolute = value
+        .split(":")
+        .map((directory) => directory === "" || isAbsolute(directory)
+        ? directory
+        : resolve(clientDirectory, directory));
+    return parsePrivateLocalExecPath(absolute.join(":"));
+}

package/dist/private-local-git-exclude.d.ts

@@ -0,0 +1,2 @@
+/** Keep generated project state out of Git without changing tracked ignore rules. */
+export declare function ensurePrivateLocalGitExclude(projectRoot: string): Promise<void>;

package/dist/private-local-git-exclude.js

@@ -0,0 +1,33 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCallback);
+const excludeEntry = ".fungi/";
+/** Keep generated project state out of Git without changing tracked ignore rules. */
+export async function ensurePrivateLocalGitExclude(projectRoot) {
+    let common;
+    try {
+        const result = await execFile("git", ["rev-parse", "--git-common-dir"], {
+            cwd: projectRoot,
+        });
+        common = resolve(projectRoot, result.stdout.trim());
+    }
+    catch (cause) {
+        // A non-Git project still keeps its local Fungi store.
+        if (cause instanceof Error && "code" in cause && cause.code === 128)
+            return;
+        throw cause;
+    }
+    const info = join(common, "info");
+    await mkdir(info, { recursive: true });
+    const exclude = join(info, "exclude");
+    const current = await readFile(exclude, "utf8").catch((cause) => {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return "";
+        throw cause;
+    });
+    if (current.split(/\r?\n/u).some((line) => line.trim() === excludeEntry))
+        return;
+    await appendFile(exclude, `${current !== "" && !current.endsWith("\n") ? "\n" : ""}${excludeEntry}\n`);
+}

package/dist/private-local-http-dispatch.d.ts

@@ -0,0 +1,5 @@
+export type RequestIdleClock = {
+    timeout: (request: Request, seconds: number) => void;
+};
+/** Bun's socket clock must stay off while a command or quiet SSE is pending. */
+export declare function dispatchPrivateLocalRequest(request: Request, clock: RequestIdleClock, fetch: (request: Request) => Response | Promise<Response>): Promise<Response>;

package/dist/private-local-http-dispatch.js

@@ -0,0 +1,14 @@
+/** Bun's socket clock must stay off while a command or quiet SSE is pending. */
+export async function dispatchPrivateLocalRequest(request, clock, fetch) {
+    clock.timeout(request, 0);
+    try {
+        const response = await fetch(request);
+        if (!response.headers.get("content-type")?.startsWith("text/event-stream"))
+            clock.timeout(request, 10);
+        return response;
+    }
+    catch (cause) {
+        clock.timeout(request, 10);
+        throw cause;
+    }
+}

package/dist/private-local-mail.d.ts

@@ -0,0 +1,11 @@
+import type { BirdDogMail } from "@fungi.computer/bird-dog";
+import { type BirdDogEffect } from "@fungi.computer/bird-dog/effect";
+import type { DatabaseSync } from "node:sqlite";
+import type { Accepted } from "@fungi.computer/shiitake";
+export type PrivateLocalMailOptions = Readonly<{
+    /** Admit one reply at its addressed Agent; a rejection retries later. */
+    deliver: (mail: BirdDogMail) => Promise<Accepted>;
+    scheduleWake?: (at: number) => void;
+    now?: () => number;
+}>;
+export declare function createPrivateLocalMailRoom(database: DatabaseSync, options: PrivateLocalMailOptions): BirdDogEffect;

package/dist/private-local-mail.js

@@ -0,0 +1,69 @@
+import { BirdDogError, make as makeBirdDog, } from "@fungi.computer/bird-dog/effect";
+import * as Effect from "effect/Effect";
+import { messageAuthor } from "@fungi.computer/agar/agents";
+import { z } from "zod";
+const outboxValue = z.object({ value: z.string() });
+const outboxRows = z.array(z.object({ key: z.string(), value: z.string() }).readonly());
+function storeFailure(cause) {
+    return new BirdDogError("local mail store is unavailable", { cause });
+}
+export function createPrivateLocalMailRoom(database, options) {
+    database.exec("CREATE TABLE IF NOT EXISTS local_birddog_outbox (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL)");
+    const room = Effect.runSync(makeBirdDog({
+        outbox: {
+            read: (key) => Effect.try({
+                try: () => {
+                    const statement = database.prepare("SELECT value FROM local_birddog_outbox WHERE key = ?");
+                    const row = outboxValue.safeParse(statement.get(key));
+                    return row.success ? row.data.value : undefined;
+                },
+                catch: storeFailure,
+            }),
+            put: (key, value) => Effect.try({
+                try: () => {
+                    database
+                        .prepare("INSERT INTO local_birddog_outbox (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+                        .run(key, value);
+                },
+                catch: storeFailure,
+            }),
+            list: (limit, afterKey) => Effect.try({
+                try: () => outboxRows.parse(database
+                    .prepare("SELECT key, value FROM local_birddog_outbox WHERE (? IS NULL OR key > ?) ORDER BY key LIMIT ?")
+                    .all(afterKey ?? null, afterKey ?? null, limit)),
+                catch: storeFailure,
+            }),
+            delete: (key) => Effect.try({
+                try: () => {
+                    database
+                        .prepare("DELETE FROM local_birddog_outbox WHERE key = ?")
+                        .run(key);
+                },
+                catch: storeFailure,
+            }),
+        },
+        post: (mail) => Effect.tryPromise({
+            try: async () => {
+                await options.deliver(mail);
+                return true;
+            },
+            catch: (cause) => new BirdDogError("local recipient rejected mail", { cause }),
+        }).pipe(Effect.catch((cause) => Effect.logError("Local mail recipient rejected delivery", cause).pipe(Effect.as(false)))),
+        scheduleWake: (at) => Effect.sync(() => options.scheduleWake?.(at)),
+        now: options.now ?? (() => Date.now()),
+    }));
+    return {
+        ...room,
+        fanOut: (settlement) => {
+            if (settlement.job.outcome !== "cancelled")
+                return room.fanOut(settlement);
+            const author = messageAuthor(settlement.meta);
+            return room.fanOut({
+                ...settlement,
+                content: author === undefined
+                    ? "Work cancelled."
+                    : `Work cancelled by ${author.name}.`,
+            });
+        },
+    };
+}

package/dist/private-local-model-settings.d.ts

@@ -0,0 +1,5 @@
+import { type ModelPreference } from "@fungi.computer/shiitake/model-preference";
+/** Reads Local's per-person remembered model; a Session switch never writes it. */
+export declare function createLocalModelSettings(path?: string): {
+    read: () => Promise<ModelPreference | null>;
+};

package/dist/private-local-model-settings.js

@@ -0,0 +1,31 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import * as Schema from "effect/Schema";
+import { ModelPreferenceSchema, } from "@fungi.computer/shiitake/model-preference";
+const settingsSchema = Schema.Struct({
+    lastManualModel: ModelPreferenceSchema,
+});
+const decodeSettings = Schema.decodeUnknownSync(Schema.fromJsonString(settingsSchema), { onExcessProperty: "error" });
+/** Reads Local's per-person remembered model; a Session switch never writes it. */
+export function createLocalModelSettings(path = join(homedir(), ".config", "fungi", "shiitake.json")) {
+    return {
+        read: async () => {
+            try {
+                const text = await readFile(path, "utf8");
+                if (text.length > 4096)
+                    throw new Error("Local model settings exceed their bound");
+                return decodeSettings(text).lastManualModel;
+            }
+            catch (cause) {
+                if (cause instanceof Error &&
+                    "code" in cause &&
+                    cause.code === "ENOENT")
+                    return null;
+                throw new Error("Local model settings are invalid or unreadable", {
+                    cause,
+                });
+            }
+        },
+    };
+}

package/dist/private-local-runtime-host.d.ts

@@ -0,0 +1,141 @@
+import { DatabaseSync } from "node:sqlite";
+import { type Models, type ThinkingLevel } from "@earendil-works/pi-ai";
+import type { CapabilitySource } from "@fungi.computer/mycelium";
+import type { BirdDogMail } from "@fungi.computer/bird-dog";
+import type { Accepted, CommandSettlement } from "@fungi.computer/shiitake";
+import { type ModelPreference } from "@fungi.computer/shiitake/model-preference";
+import { type AgentControlDirectory } from "@fungi.computer/shiitake/agent-control";
+import type { ExtensionRosterV0 } from "@fungi.computer/shiitake/extensions";
+import { type InstructionSource, type ModelSource, type RuntimeHost, type ShiitakeAgent, type ShiitakeSession, type ShiitakeOptions } from "@fungi.computer/shiitake";
+import { type PrivateLocalEffectiveModel } from "./private-local-effective-model.js";
+import { type PrivateLocalComputerProcesses } from "./private-local-computer-processes.js";
+import { type NodeRuntimeHost, type NodeStoreLease } from "@fungi.computer/shiitake/node";
+import { createPrivateInvocationFilesPort } from "./private-invocation-files.js";
+import { type PrivateFungiMcpConnectionOptions } from "./private-fungi-mcp-connection.js";
+import { type PrivateLocalMailRouting } from "./private-local-delegation.js";
+import { type SubagentSource } from "@fungi.computer/shiitake-extensions/subagents/host";
+declare const localHostIds: Readonly<{
+    readonly store: import("@fungi.computer/cairn").IdCodec<"local-host", "store", 1>;
+    readonly "session-create-request": import("@fungi.computer/cairn").IdCodec<"local-host", "session-create-request", 1>;
+}>;
+export type LocalStoreId = ReturnType<typeof localHostIds.store.generate>;
+export type LocalResources = Readonly<{
+    agent?: Pick<ShiitakeAgent, "close"> | undefined;
+    processes?: Pick<PrivateLocalComputerProcesses, "close"> | undefined;
+    runtime: Omit<NodeRuntimeHost, "scheduleWake">;
+    database?: Pick<DatabaseSync, "close"> | undefined;
+    lease?: NodeStoreLease | undefined;
+    providerCacheKey?: string | undefined;
+}>;
+export type PrivateLocalTools = Readonly<{
+    port: Awaited<ReturnType<typeof createPrivateInvocationFilesPort>>;
+    tools: NonNullable<ShiitakeOptions["tools"]>;
+    extensions: ExtensionRosterV0;
+    /** Background Computer processes, scoped per Session; the host closes them. */
+    processes: PrivateLocalComputerProcesses;
+}>;
+/** Inputs for the one private local Agent opener. */
+export type PrivateLocalRuntimeHostOptions = Readonly<{
+    /** Invocation root captured before selecting a fresh local database. */
+    invocationRoot: string;
+    /** Existing Agent database to reopen instead of creating a fresh local store. */
+    databasePath?: string | undefined;
+    /** Stable Local store identity for replaying one Agent create request. */
+    createRequestId?: string | undefined;
+    /** Explicit Agent model; otherwise inherit manual choice and available login. */
+    providerId?: string | undefined;
+    modelId?: string | undefined;
+    reasoning?: ThinkingLevel | undefined;
+    /** Local settings location; credentials remain in their separate owner. */
+    modelSettingsPath?: string | undefined;
+    /**
+     * Service-owned project mail routing. With `agentControl`, it gives this
+     * Agent follow-up delegation with authenticated replies and settles its own
+     * addressed work back to the sender.
+     */
+    mail?: PrivateLocalMailRouting | undefined;
+    /** Service-owned directory scoped to the captured project. */
+    agentControl?: AgentControlDirectory | undefined;
+    /** Explicit hosted capability connection; local tools and the Agent store stay local. */
+    fungiMcp?: PrivateFungiMcpConnectionOptions | undefined;
+}>;
+/** Typed Session and awaited resource owner supplied directly to the local TUI. */
+export type PrivateLocalRuntimeHost = Readonly<{
+    /** Stable Local directory identity of this authorized Agent. */
+    agentId: string;
+    /** Canonical file path to pass explicitly to a later --db launch. */
+    databasePath: string;
+    session: ShiitakeSession;
+    /** Address a Session through this same Agent and resource owner. */
+    getSession: (sessionId: string) => ShiitakeSession;
+    /** A selected Session keeps one client's command PATH while this host is live. */
+    bindSessionPath: (sessionId: string, path: string) => boolean;
+    /** Resolve this Session's effective model and nonsecret credential source. */
+    effectiveModel: (sessionId: string, signal: AbortSignal) => Promise<PrivateLocalEffectiveModel>;
+    /** Set the persistent Agent default without changing Session overrides. */
+    setModel: (model: ModelPreference, signal: AbortSignal) => Promise<void>;
+    /** Refuse unrunnable creation or send before claiming acceptance. */
+    assertModelReady: (sessionId: string, signal: AbortSignal) => Promise<void>;
+    listSessions: ShiitakeAgent["listSessions"];
+    createSession: ShiitakeAgent["createSession"];
+    deleteSession: ShiitakeAgent["deleteSession"];
+    /** List, resume and call this Agent's rostered extensions. */
+    extensions: ShiitakeAgent["extensions"];
+    /**
+     * Admit mail addressed to this Agent: new work that replies to its sender,
+     * or a reply authenticated against work this Agent sent. Anything else is
+     * refused.
+     */
+    acceptMail: (mail: BirdDogMail) => Promise<Accepted>;
+    /** Exact settled command facts for a delegating sender. */
+    readSettlement: (sessionId: string, commandId: string) => Promise<CommandSettlement | undefined>;
+    close: () => Promise<void>;
+}>;
+/** Local-owned id for a new Session creation request. */
+export declare function createPrivateLocalSessionRequestId(): import("@fungi.computer/cairn").CairnId<"local-host", "session-create-request", 1>;
+export type PrivateLocalCreateStore = Readonly<{
+    agentId: LocalStoreId;
+    databasePath: string;
+}>;
+/** Resolve an Agent create request through its durable Local receipt. */
+export declare function resolvePrivateLocalCreateStore(root: string, requestId: string): Promise<PrivateLocalCreateStore>;
+/** Build the fixed source read by Shiitake once for each local run. */
+export declare function createPrivateLocalInstructionSource(port: Awaited<ReturnType<typeof createPrivateInvocationFilesPort>>): InstructionSource;
+export declare function createPrivateLocalModelSource(models: Models, providerId: string | undefined, modelId: string | undefined, providerCacheKey: string, selectedOwnerReasoning?: ThinkingLevel, defaults?: Readonly<{
+    agent?: () => ModelPreference | null;
+    manual: () => Promise<ModelPreference | null>;
+}>): ModelSource & Readonly<{
+    /** The secret-free effective selection the footer and /model show. */
+    effective: (preference: ModelPreference | null, signal: AbortSignal) => Promise<PrivateLocalEffectiveModel>;
+    assertReady: (preference: ModelPreference | null, signal: AbortSignal) => Promise<void>;
+}>;
+/** Assemble the existing Files, Computer, and workerd owners once per host. */
+export declare function createPrivateLocalTools(invocationRoot: string, fungiMcp?: PrivateFungiMcpConnectionOptions, agentControl?: AgentControlDirectory, sessionPath?: (sessionId: string) => string | undefined, 
+/** This Agent's store; its owner-enabled installed extensions join the roster. */
+storeDirectory?: string, 
+/**
+ * This Agent's sub-agent record: its Session-bound Agent-control tools and
+ * the view's facts. Present when it can direct other Agents.
+ */
+subagents?: Readonly<{
+    control: CapabilitySource;
+    source: SubagentSource;
+}>): Promise<PrivateLocalTools>;
+/** Event-loop adaptation for the one local Shiitake owner; it has no queue policy. */
+export declare function createPrivateLocalRuntimeHost(): RuntimeHost;
+/**
+ * Close the fixed local owner in dependency order without surrendering its
+ * sidecar before runtime drain and main-database close have succeeded.
+ *
+ * This source-local seam is intentionally not re-exported by the package; the
+ * focused tests use it to falsify injected failure ordering.
+ */
+export declare function closePrivateLocalResources(resources: LocalResources, initiatingFailure?: Error): Promise<void>;
+/**
+ * Open one private file-backed local Shiitake host and its fixed Session.
+ *
+ * The returned close owns agent, main database, and sidecar release in that
+ * order. It is the only lifecycle the current terminal caller needs to learn.
+ */
+export declare function openPrivateLocalRuntimeHost(input: PrivateLocalRuntimeHostOptions, models?: Models): Promise<PrivateLocalRuntimeHost>;
+export {};