@fungi.computer/truffle 0.4.0 → 0.6.0

package/dist/local-board-shipping.js

@@ -0,0 +1,325 @@
+import { execFile } from "node:child_process";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as SchemaIssue from "effect/SchemaIssue";
+/** What happened to a piece of work: it landed, shipped out, or is on its way. */
+export const ShipKind = Schema.Literals([
+    "landed",
+    "released",
+    "queued",
+    "gating",
+    "dropped",
+]);
+const text = Schema.String.check(Schema.isMaxLength(200));
+/** One thing a shipping source saw since local midnight. */
+export const ShipItem = Schema.Struct({
+    /** Stable within its source. */
+    id: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)),
+    /** What happened to it. */
+    kind: ShipKind,
+    /** A one-line title, such as a commit subject or a released version. */
+    title: text,
+    /** The branch, tag or package it belongs to. */
+    ref: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256))),
+    /** When it happened. */
+    at: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+    /** A short note the source adds. */
+    detail: Schema.optionalKey(text),
+});
+/** The most shipping sources one board reads. */
+export const maximumShippingSources = 6;
+const reference = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+/** Commits first-parent on `ref` since midnight; a protected branch's merges are its landings. */
+const gitSourceConfig = Schema.Struct({
+    /** Reads a Git history. */
+    kind: Schema.Literal("git"),
+    /** The branch, tag or `HEAD` whose first-parent history is read. */
+    ref: reference,
+    /** Whether those commits landed work or released it. */
+    shows: Schema.Literals(["landed", "released"]),
+});
+/** Versions of these packages published today. */
+const npmSourceConfig = Schema.Struct({
+    /** Reads a package registry. */
+    kind: Schema.Literal("npm"),
+    /** Package names, as `npm view` takes them. */
+    packages: Schema.Array(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(214))).check(Schema.isMinLength(1), Schema.isMaxLength(8)),
+});
+/** One configured shipping source; an unknown kind or key is refused. */
+export const ShippingSourceConfig = Schema.Union([
+    gitSourceConfig,
+    npmSourceConfig,
+]);
+/** The `board` key of a `.fungi/settings.json`; excess keys are refused. */
+export const BoardSettings = Schema.Struct({
+    /** The sources the Board reads for what shipped today. */
+    shipping: Schema.optionalKey(Schema.Array(ShippingSourceConfig).check(Schema.isMaxLength(maximumShippingSources))),
+});
+const isKey = Schema.is(Schema.Union([Schema.String, Schema.Finite]));
+/** The sources a settings `board` value names, or each refusal with its settings path. */
+export function decodeBoardSettings(board) {
+    const decoded = Schema.decodeUnknownResult(BoardSettings, {
+        onExcessProperty: "error",
+        errors: "all",
+    })(board);
+    if (Result.isSuccess(decoded))
+        return Result.succeed(decoded.success.shipping ?? []);
+    const format = SchemaIssue.makeFormatterStandardSchemaV1();
+    return Result.fail(format(decoded.failure.issue).issues.map(({ path, message }) => (path ?? []).reduce((where, part) => {
+        // Settings are JSON, so every path segment is a name or an index.
+        const key = isKey(part) ? String(part) : "?";
+        return /^\d+$/u.test(key) ? `${where}[${key}]` : `${where}.${key}`;
+    }, "board") + `: ${message}`));
+}
+/** A settings file larger than this is not read. */
+const maximumSettingsBytes = 64 * 1024;
+/** Git history is read at most this many commits deep; the board lists far fewer. */
+const maximumCommits = 200;
+const gitRefreshMs = 60_000;
+const npmRefreshMs = 5 * 60_000;
+/** How long the answer to "is this a work tree, and on which branch" is kept. */
+const defaultBranchMs = 60_000;
+/** The first line a program said, so a refusal reads as a reason and not as a command line. */
+function reason(file, stderr, cause) {
+    const line = stderr.split("\n").find((text) => text.trim() !== "");
+    if ("code" in cause && cause.code === "ENOENT")
+        return `${file} is not installed`;
+    return `${file} failed${line === undefined ? "" : `: ${line.trim()}`}`;
+}
+/**
+ * The tool's ordinary interface: its own argv, no shell, a bounded environment.
+ * A program that is missing or refuses is an error with a short reason.
+ */
+export const execShipping = (file, args, { cwd, signal }) => new Promise((resolve, reject) => {
+    execFile(file, [...args], {
+        cwd,
+        signal,
+        maxBuffer: 4 * 1024 * 1024,
+        env: {
+            ...process.env,
+            GIT_TERMINAL_PROMPT: "0",
+            GIT_OPTIONAL_LOCKS: "0",
+            LC_ALL: "C",
+            npm_config_update_notifier: "false",
+            npm_config_fund: "false",
+            npm_config_audit: "false",
+        },
+    }, (error, stdout, stderr) => {
+        if (error === null)
+            resolve(stdout);
+        else
+            reject(new Error(reason(file, stderr, error)));
+    });
+});
+const decodeItems = Schema.decodeUnknownSync(Schema.Array(ShipItem));
+/**
+ * Commits first-parent on `ref` since local midnight, from `git log`. A merge
+ * shows the subject of the tip it merged, and any other commit its own, so a
+ * merge queue's "Merge branch ..." lines read as the work that landed.
+ */
+export function gitSource(config, options) {
+    const { ref, shows } = config;
+    return {
+        id: `git:${ref}:${shows}`,
+        label: options.label ?? ref,
+        refreshMs: gitRefreshMs,
+        read: async (sinceMs, signal) => {
+            const run = (args) => options.exec("git", args, { cwd: options.cwd, signal });
+            const log = await run([
+                "log",
+                "--first-parent",
+                `--since=${new Date(sinceMs).toISOString()}`,
+                `--max-count=${String(maximumCommits)}`,
+                "--format=%H%x1f%ct%x1f%s%x1f%P%x1e",
+                ref,
+                "--",
+            ]);
+            const commits = records(log, 4).map(([hash, time, subject, parents]) => ({
+                hash: hash ?? "",
+                time: Number(time),
+                subject: subject ?? "",
+                merged: (parents ?? "").split(" ").filter((parent) => parent !== "")[1],
+            }));
+            const tips = [
+                ...new Set(commits.flatMap(({ merged }) => merged === undefined ? [] : [merged])),
+            ];
+            const tipSubjects = new Map();
+            if (tips.length > 0) {
+                const shown = await run([
+                    "log",
+                    "--no-walk=unsorted",
+                    "--format=%H%x1f%s%x1e",
+                    ...tips,
+                    "--",
+                ]);
+                for (const [hash, subject] of records(shown, 2))
+                    if (hash !== undefined)
+                        tipSubjects.set(hash, subject ?? "");
+            }
+            const items = decodeItems(commits.map(({ hash, time, subject, merged }) => ({
+                id: hash.slice(0, 12),
+                kind: shows,
+                title: (merged === undefined
+                    ? subject
+                    : (tipSubjects.get(merged) ?? subject)).slice(0, 200),
+                ref,
+                at: time * 1000,
+            })));
+            return { state: "ok", items: items.filter((item) => item.at >= sinceMs) };
+        },
+    };
+}
+/** Split a program's `%x1e`-terminated, `%x1f`-separated records into fields. */
+function records(output, fields) {
+    return output
+        .split("\x1e")
+        .map((record) => record.replace(/^\n+/u, ""))
+        .filter((record) => record !== "")
+        .map((record) => record.split("\x1f", fields));
+}
+const publishTimes = Schema.Record(Schema.String, Schema.String);
+const decodePublishTimes = Schema.decodeUnknownSync(publishTimes);
+/** Keys of `npm view time` that are not versions. */
+const notVersions = new Set(["created", "modified"]);
+/** Versions of each package published since local midnight, from `npm view <package> time --json`. */
+export function npmSource(config, options) {
+    const { packages } = config;
+    return {
+        id: `npm:${packages.join(",")}`,
+        label: `npm: ${packages.join(", ")}`,
+        refreshMs: npmRefreshMs,
+        read: async (sinceMs, signal) => {
+            const found = [];
+            for (const name of packages) {
+                const times = decodePublishTimes(JSON.parse(await options.exec("npm", ["view", name, "time", "--json"], {
+                    cwd: options.cwd,
+                    signal,
+                })));
+                for (const [version, published] of Object.entries(times)) {
+                    const at = Date.parse(published);
+                    if (!notVersions.has(version) && at >= sinceMs)
+                        found.push({
+                            id: `${name}@${version}`,
+                            kind: "released",
+                            title: `${name} ${version}`,
+                            ref: name,
+                            at,
+                        });
+                }
+            }
+            return {
+                state: "ok",
+                items: decodeItems(found.sort((left, right) => right.at - left.at)),
+            };
+        },
+    };
+}
+/** A source that only says why the settings could not be used. */
+function settingsProblem(file, message) {
+    return {
+        id: `settings:${file}`,
+        label: "Board settings",
+        refreshMs: gitRefreshMs,
+        read: () => Promise.reject(new Error(`${file}: ${message}`)),
+    };
+}
+/** Read one settings file's `board` key; a missing file or key says nothing. */
+async function readSettings(path) {
+    let text;
+    try {
+        const handle = await open(path, "r");
+        try {
+            const bytes = Buffer.alloc(maximumSettingsBytes + 1);
+            const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+            if (bytesRead > maximumSettingsBytes)
+                return {
+                    kind: "refused",
+                    problems: ["the file is larger than 64 KiB"],
+                };
+            text = bytes.subarray(0, bytesRead).toString("utf8");
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (cause) {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return { kind: "none" };
+        return {
+            kind: "refused",
+            problems: [cause instanceof Error ? cause.message : "could not be read"],
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { kind: "refused", problems: ["settings are not valid JSON"] };
+    }
+    const board = Schema.decodeUnknownOption(Schema.Struct({ board: Schema.optionalKey(Schema.Unknown) }))(parsed);
+    if (board._tag === "None" || board.value.board === undefined)
+        return { kind: "none" };
+    const decoded = decodeBoardSettings(board.value.board);
+    return decoded._tag === "Success"
+        ? { kind: "sources", sources: decoded.success }
+        : { kind: "refused", problems: decoded.failure };
+}
+/**
+ * The Board's shipping sources for this folder: `board.shipping` in the
+ * folder's `.fungi/settings.json`, then the person's, read afresh each cycle so
+ * an edit applies. A refused file is one failed source line naming its
+ * path, never a silent default. With nothing configured, a Git work tree
+ * shows its current branch as landed work, and a folder that is not one shows
+ * no shipping at all.
+ */
+export function createLocalShippingSources(options) {
+    const exec = options.exec ?? execShipping;
+    const now = options.now ?? Date.now;
+    let branch;
+    /** The current branch when this folder is a Git work tree; asked at most once a minute. */
+    async function currentBranch(signal) {
+        if (branch !== undefined && now() - branch.at < defaultBranchMs)
+            return branch.name;
+        let name;
+        try {
+            name = (await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+                cwd: options.cwd,
+                signal,
+            })).trim();
+        }
+        catch {
+            // Not a work tree, or no Git: there is nothing to default to.
+            name = null;
+        }
+        branch = { at: now(), name: name === "" ? null : name };
+        return branch.name;
+    }
+    return async (signal) => {
+        const files = [
+            join(options.cwd, ".fungi/settings.json"),
+            join(options.home, ".fungi/settings.json"),
+        ];
+        const configs = [];
+        const problems = [];
+        for (const file of files) {
+            const read = await readSettings(file);
+            if (read.kind === "sources")
+                configs.push(...read.sources);
+            else if (read.kind === "refused")
+                problems.push(settingsProblem(file, read.problems.join("; ")));
+        }
+        const context = { cwd: options.cwd, exec };
+        const sources = configs.map((config) => config.kind === "git"
+            ? gitSource(config, context)
+            : npmSource(config, context));
+        if (sources.length === 0 && problems.length === 0) {
+            const name = await currentBranch(signal);
+            if (name !== null)
+                sources.push(gitSource({ kind: "git", ref: "HEAD", shows: "landed" }, { ...context, label: name }));
+        }
+        return [...sources, ...problems];
+    };
+}

package/dist/local-extensions.d.ts

@@ -41,6 +41,8 @@ export type LocalExtensionTerminal = Readonly<{
     terminalId: string;
     name: string;
     description: string;
+    /** A shell key that opens this program beside the focused pane. */
+    binding?: string;
     /** Absolute executable followed by its arguments. */
     command: readonly string[];
     cwd: string;
@@ -76,7 +78,7 @@ export declare function localExtensions(options: LocalExtensionsOptions): {
      * is pinned to the commit Bun's lockfile resolved; updating is another
      * explicit `add`. Missing declared artifacts are a refusal.
      */
-    add(source: string): Promise<LocalInstalledExtension>;
+    add(source: string, cwd: string): Promise<LocalInstalledExtension>;
     /** Remove the package and every activation that references it. */
     remove(id: string): Promise<boolean>;
     list(): Promise<readonly LocalExtensionSummary[]>;
@@ -99,7 +101,7 @@ export declare function localExtensions(options: LocalExtensionsOptions): {
         agentStoreDirectory: string;
     }>): Promise<{
         revision: string;
-        capabilities: ("state" | "attention" | "settled" | "send" | "timers" | "commands" | "projection" | "run_tools" | "files" | "prompt" | "compaction_handoff")[];
+        capabilities: ("state" | "prompt" | "attention" | "settled" | "send" | "timers" | "commands" | "projection" | "run_tools" | "files" | "compaction_handoff")[];
         skills: boolean;
     }>;
     /**

package/dist/local-extensions.js

@@ -6,6 +6,7 @@ import { Mycelium } from "@fungi.computer/mycelium";
 import { defineExtension, ExtensionId, } from "@fungi.computer/shiitake/extensions";
 import * as Predicate from "effect/Predicate";
 import * as Schema from "effect/Schema";
+import npa from "npm-package-arg";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import { describeExtensionSkills, } from "./local-skill-source.js";
@@ -37,6 +38,11 @@ const manifestSchema = z.strictObject({
         id: identifier.max(64),
         name: z.string().trim().min(1).max(64),
         description: z.string().max(200).default(""),
+        /** A shell key that opens this program beside the focused pane. */
+        binding: z
+            .string()
+            .regex(/^<leader>[a-z]$/u)
+            .optional(),
         /** Package-relative executable and its arguments. */
         command: z
             .array(z.string().min(1).max(1_024))
@@ -60,6 +66,7 @@ const terminalRecord = z.strictObject({
     id: z.string(),
     name: z.string(),
     description: z.string(),
+    binding: z.string().optional(),
     command: z.array(z.string()),
 });
 const revisionRecord = z.strictObject({
@@ -331,29 +338,52 @@ export function localExtensions(options) {
          * is pinned to the commit Bun's lockfile resolved; updating is another
          * explicit `add`. Missing declared artifacts are a refusal.
          */
-        async add(source) {
+        async add(source, cwd) {
+            if (source.length === 0)
+                throw new LocalExtensionError("install", "An extension source is required");
+            // Bun installs in private staging, not the caller's project. Let the
+            // maintained package-spec parser resolve only local sources there first;
+            // leave Git and registry specifications to Bun unchanged.
+            const parsed = npa(source, cwd);
+            const installSource = parsed.type === "directory" || parsed.type === "file"
+                ? z.string().parse(parsed.fetchSpec)
+                : source;
             await mkdir(join(root, "staging"), { recursive: true, mode: 0o700 });
             const staging = await mkdtemp(join(root, "staging", "install-"));
             try {
+                const runBun = async (args, directory) => {
+                    const child = Bun.spawn([process.execPath, ...args], {
+                        cwd: directory,
+                        // A private cache resolves the named ref afresh instead of a
+                        // cached checkout of an earlier commit.
+                        env: {
+                            ...process.env,
+                            BUN_BE_BUN: "1",
+                            BUN_INSTALL_CACHE_DIR: join(staging, ".install-cache"),
+                        },
+                        stdout: "ignore",
+                        stderr: "pipe",
+                    });
+                    const [status, stderr] = await Promise.all([
+                        child.exited,
+                        new Response(child.stderr).text(),
+                    ]);
+                    if (status !== 0)
+                        throw new LocalExtensionError("install", `Could not install ${source}: ${stderr.trim().slice(0, 2_000)}`);
+                };
+                // Bun links a directory dependency's files back to its source, even
+                // with --backend=copyfile. Its ordinary pack operation supplies an
+                // isolated package snapshot and the install lock supplies its integrity.
+                // Both operations keep lifecycle scripts disabled.
+                const archive = join(staging, "source.tgz");
+                if (parsed.type === "directory")
+                    await runBun(["pm", "pack", "--ignore-scripts", "--filename", archive], installSource);
                 await writeFile(join(staging, "package.json"), `${JSON.stringify({ private: true })}\n`);
-                const child = Bun.spawn([process.execPath, "add", "--ignore-scripts", source], {
-                    cwd: staging,
-                    // A private cache resolves the named ref afresh instead of a
-                    // cached checkout of an earlier commit.
-                    env: {
-                        ...process.env,
-                        BUN_BE_BUN: "1",
-                        BUN_INSTALL_CACHE_DIR: join(staging, ".install-cache"),
-                    },
-                    stdout: "pipe",
-                    stderr: "pipe",
-                });
-                const [status, stderr] = await Promise.all([
-                    child.exited,
-                    new Response(child.stderr).text(),
-                ]);
-                if (status !== 0)
-                    throw new LocalExtensionError("install", `Could not install ${source}: ${stderr.trim().slice(0, 2_000)}`);
+                await runBun([
+                    "add",
+                    "--ignore-scripts",
+                    parsed.type === "directory" ? archive : installSource,
+                ], staging);
                 const lock = lockSchema.parse(Bun.JSONC.parse(await readFile(join(staging, "bun.lock"), "utf8")));
                 const dependencies = Object.keys(z
                     .looseObject({ dependencies: z.record(z.string(), z.string()) })
@@ -614,8 +644,8 @@ export function localExtensions(options) {
                 if (record.client !== null)
                     clients.push(record.client);
                 const runtime = await runtimeDirectory(project, id);
-                for (const terminal of record.terminals)
-                    terminals.push({
+                for (const terminal of record.terminals) {
+                    const launcher = {
                         extensionId: id,
                         terminalId: terminal.id,
                         name: terminal.name,
@@ -630,7 +660,11 @@ export function localExtensions(options) {
                             FUNGI_PROJECT_ROOT: project,
                             FUNGI_EXTENSION_RUNTIME_DIR: runtime,
                         },
-                    });
+                    };
+                    terminals.push(terminal.binding === undefined
+                        ? launcher
+                        : { ...launcher, binding: terminal.binding });
+                }
             }
             return { clients, terminals, diagnostics };
         },

package/dist/local-login.js

@@ -1,3 +1,4 @@
+import { interactionTitleLimit } from "@fungi.computer/whistle/wire";
 /** Display order for popular model providers; labels remain owned by Pi. */
 export const localPopularProviderIds = Object.freeze([
     "fungi",
@@ -54,13 +55,32 @@ function notice(event) {
             return { type: "progress", message: event.message };
     }
 }
+/**
+ * Pi's prompt text is provider wording, not a modal title: Whistle titles are
+ * at most `interactionTitleLimit` characters, and Pi 1.3's Anthropic paste
+ * prompt is longer. A message that fits stays the title; a longer one keeps
+ * every word as the summary under Fungi's fixed title for that prompt kind,
+ * so a provider sentence can never make the dialog refuse to open.
+ */
+function modalText(message, fallbackTitle, hint) {
+    const fits = message.trim() !== "" && message.length <= interactionTitleLimit;
+    const lines = [
+        ...(fits ? [] : [message]),
+        ...(hint === undefined ? [] : [hint]),
+    ];
+    const title = fits ? message : fallbackTitle;
+    return lines.length === 0
+        ? { message: title }
+        : { message: title, summary: lines.join(" ") };
+}
+const placeholderOf = (placeholder) => placeholder === undefined ? {} : { placeholder };
 async function ask(interaction, prompt) {
     const options = prompt.signal === undefined ? {} : { signal: prompt.signal };
     switch (prompt.type) {
         case "select":
             return interaction.prompt({
                 type: "choice",
-                message: prompt.message,
+                ...modalText(prompt.message, "Choose a sign-in option"),
                 options: prompt.options.map((option) => option.description === undefined
                     ? { value: option.id, label: option.label }
                     : {
@@ -69,36 +89,24 @@ async function ask(interaction, prompt) {
                         description: option.description,
                     }),
             }, options);
-        case "manual_code": {
+        case "manual_code":
             // Generic across every provider that falls back to a pasted code or
             // redirect URL (OpenAI, Anthropic): the provider's own
             // message explains what to paste; this adds the SSH hint once, here,
             // instead of baking it into one provider's registry label.
-            const summary = "Connecting over SSH? Paste the URL here instead of opening a browser.";
-            const { message } = prompt;
-            return interaction.prompt(prompt.placeholder === undefined
-                ? { type: "text", message, summary }
-                : {
-                    type: "text",
-                    message,
-                    summary,
-                    placeholder: prompt.placeholder,
-                }, options);
-        }
+            return interaction.prompt({
+                type: "text",
+                ...modalText(prompt.message, "Paste the sign-in code or redirect URL", "Connecting over SSH? Paste the URL here instead of opening a browser."),
+                ...placeholderOf(prompt.placeholder),
+            }, options);
         case "secret":
         case "text":
-            return interaction.prompt(prompt.placeholder === undefined
-                ? {
-                    type: "text",
-                    message: prompt.message,
-                    secret: prompt.type === "secret",
-                }
-                : {
-                    type: "text",
-                    message: prompt.message,
-                    placeholder: prompt.placeholder,
-                    secret: prompt.type === "secret",
-                }, options);
+            return interaction.prompt({
+                type: "text",
+                ...modalText(prompt.message, prompt.type === "secret" ? "Enter your key" : "Enter a value"),
+                ...placeholderOf(prompt.placeholder),
+                secret: prompt.type === "secret",
+            }, options);
     }
 }
 const methodNotOffered = "The provider did not offer that sign-in method";

package/dist/private-fungi-mcp-connection.js

@@ -2,6 +2,7 @@ import { FungiSignInRequiredError } from "./private-fungi-auth-error.js";
 import { createRequire } from "node:module";
 import { Client, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
 import { Mycelium } from "@fungi.computer/mycelium";
+import { forageDiscoveryInstructions } from "@fungi.computer/mycelium/effect";
 import { z } from "zod";
 import { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
 import { registerMcpFormElicitation, McpFormApprovalError, } from "./private-mcp-form-elicitation.js";
@@ -83,7 +84,11 @@ export function createPrivateFungiMcpConnection(options) {
                                 operations: {
                                     execute: Mycelium.operation({
                                         replay: "unsafe",
-                                        description: "Execute JavaScript on the connected Fungi MCP server. Discover permitted Team Computer operations with await forage.search({query: 'read'}) and await forage.describe({path: 'files.read'}). Explicitly return the result. Returns the original MCP content and isError; it does not run on the local machine.",
+                                        description: [
+                                            "This operation sends its code to the connected Fungi MCP server's execute tool. The following discovery instructions apply inside that remote call, not the outer Local call.",
+                                            forageDiscoveryInstructions,
+                                            "Explicitly return the result. Returns the original MCP content and isError; it does not run on the local machine.",
+                                        ].join(" "),
                                         input: z.strictObject({ code: z.string() }),
                                         execute: async (input, context) => {
                                             try {

package/dist/private-invocation-computer.d.ts

@@ -21,6 +21,7 @@ declare const execInput: z.ZodUnion<readonly [z.ZodObject<{
         justification: z.ZodString;
     }, z.core.$strict>>;
     cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     timeoutMs: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>, z.ZodObject<{
     executable: z.ZodString;
@@ -31,6 +32,7 @@ declare const execInput: z.ZodUnion<readonly [z.ZodObject<{
         justification: z.ZodString;
     }, z.core.$strict>>;
     cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     timeoutMs: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>]>;
 declare const completedOutput: z.ZodObject<{
@@ -247,7 +249,9 @@ export type LocalExecPolicyRun = (input: Parameters<LocalExecEscapeStage>[0]) =>
 /** Run the recorded command through the normal bounded process door, without a sandbox.
  * The host supplies the captured PATH and canonical cwd; the record supplies the
  * exact original request. No model invocation can call this door directly. */
-export declare function dispatchApprovedLocalExec(input: unknown, cwd: string, executionPath: string, home: string, processes: PrivateLocalProcessScope, mode: LocalPermissionMode): Promise<ExecOutput | z.output<typeof backgroundExecOutput>>;
+export declare function dispatchApprovedLocalExec(input: unknown, cwd: string, executionPath: string, home: string, processes: PrivateLocalProcessScope, mode: LocalPermissionMode, 
+/** Only inline rule matches have a live execute sink; ledger dispatch does not. */
+sink?: InvocationContext["output"]): Promise<ExecOutput | z.output<typeof backgroundExecOutput>>;
 export type ExecOutput = z.output<typeof execOutput>;
 export type ProcessOutput = z.output<typeof completedOutput> | z.output<typeof deadlineOutput>;
 /**
@@ -262,7 +266,7 @@ export declare function runPrivateInvocationProcess(processCommand: ChildProcess
     requestedMs?: number;
     /** The real command text, for the timeout message; omitted when not meaningful (e.g. a native helper). */
     describeCommand?: () => string;
-}>): Promise<ProcessOutput>;
+}>, output?: InvocationContext["output"]): Promise<ProcessOutput>;
 /**
  * Construct one private invocation-root Computer: bounded shell exec, plus the
  * background-process operations of `processes` when the host supplies a scope.