@hachej/boring-agent 0.1.104 → 0.1.107

package/dist/server/index.d.ts

@@ -1,22 +1,23 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionFileRef, C as ConfiguredAgentHostAgentSpec, h as AgentHostAgentSpec, i as RuntimeBundle, j as PiHarnessOptions, k as AgentMeteringSink, l as RuntimeFilesystemBinding, m as CreatedAgentHost, n as MeteringErrorLogger, o as ReadyStatusTracker, p as CreateAgentHostOptions, q as CompiledAgentHostAgentSpec, r as AgentRequestLedger, s as AgentEffectAdmission, t as AuthorizedEnvironmentIntent, u as AgentHostEnvironmentScope, v as ResolvedAgentRuntimeScope, w as AgentRequestKey, x as AgentRequestLedgerPrepareResult, y as AgentRequestFailure, z as AgentRequestLedgerRecord, D as AgentFleetCompiler, E as AgentRequestTarget, F as RuntimeFilesystemAccessDecision } from '../types-B1xDlBSo.js';
-export { A as AgentGatewayEffect, G as AgentHostDescription, H as AgentHostDirectProjectionOptions, I as AgentHostDispatcherRunInput, J as AgentHostEnvironmentLease, K as AgentHostHandle, L as LegacyDefaultAgentHostSpec, N as MeteringReleaseInput, O as MeteringReleaseReason, Q as MeteringReservationResult, S as MeteringReserveInput, T as MeteringRunKind, U as MeteringRunScope, V as MeteringRunStatus, X as MeteringSettleInput, Y as MeteringUsage, Z as MeteringUsageInput, _ as PI_PACKAGE_RESOURCE_FILTERS, $ as PiExtensionFactory, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as mergePiPackageSources, aa as normalizeMeteringUsage, ab as piPackageSourceKey } from '../types-B1xDlBSo.js';
+import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionSource, C as ConfiguredAgentHostAgentSpec, h as AgentInstructionFileRef, i as AgentHostAgentSpec, j as RuntimeBundle, k as PiHarnessOptions, l as AgentMeteringSink, m as RuntimeFilesystemBinding, n as CreatedAgentHost, o as ResolvedPiHarnessOptions, p as ReadyStatusTracker, q as CreateAgentHostOptions, r as CompiledAgentHostAgentSpec, s as AgentRequestLedger, t as AgentEffectAdmission, u as AuthorizedEnvironmentIntent, v as AgentHostEnvironmentScope, w as ResolvedAgentRuntimeScope, x as AgentRequestKey, y as AgentRequestLedgerPrepareResult, z as AgentRequestFailure, D as AgentRequestLedgerRecord, E as AgentFleetCompiler, F as AgentRequestTarget, G as RuntimeFilesystemAccessDecision } from '../types-B7-PN5jV.js';
+export { A as AgentGatewayEffect, H as AgentHostDescription, I as AgentHostDirectProjectionOptions, J as AgentHostDispatcherRunInput, K as AgentHostEnvironmentLease, L as AgentHostHandle, N as DEFAULT_AGENT_TYPE_ID, O as MeteringErrorLogger, Q as MeteringReleaseInput, S as MeteringReleaseReason, T as MeteringReservationResult, U as MeteringReserveInput, V as MeteringRunKind, X as MeteringRunScope, Y as MeteringRunStatus, Z as MeteringSettleInput, _ as MeteringUsage, $ as MeteringUsageInput, a0 as PI_PACKAGE_RESOURCE_FILTERS, a1 as PiExtensionFactory, a2 as PluginSkillSource, a3 as ResolvedEnvironmentScope, a4 as RuntimeFilesystemBindingOperations, a5 as RuntimeNodePackageSpec, a6 as RuntimeProvisioningContribution, a7 as RuntimePythonSpec, a8 as RuntimeTemplateContribution, a9 as WorkspaceProvisioningExecResult, aa as compactPiPackages, ab as mergePiPackageSources, ac as normalizeMeteringUsage, ad as piPackageSourceKey } from '../types-B7-PN5jV.js';
 import { d as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, c as Sandbox } from '../sandbox-BMhut3kh.js';
 export { h as RuntimeFilesystemCapability } from '../sandbox-BMhut3kh.js';
 import { b as RemoteWorkerHealthResponse, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, c as RemoteWorkerExecRequest } from '../middleware-CaAEXpi5.js';
 export { d as REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY, e as REMOTE_WORKER_PROVIDER, f as REMOTE_WORKER_RUNTIME_CWD, g as RemoteWorkerErrorPayload, h as RemoteWorkerExecResponse, i as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, j as WORKER_REQUEST_ID_HEADER, k as WORKER_WORKSPACE_ID_HEADER, l as createAgentAuthMiddleware } from '../middleware-CaAEXpi5.js';
 import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
 import { BwrapSandboxProviderOptions } from '@hachej/boring-sandbox/providers/bwrap';
-import { F as SandboxHandleStore, k as CompiledAgentBundle, a as Sha256Digest, i as AgentDeployment, M as ShareEntryStore, y as ProviderId, c as CredentialFieldId, B as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, X as WorkspaceCredentialAuthorityVerifierV1, n as CredentialConsumerBindingRegistryV1, z as ProviderRegistryV1, Y as WorkspaceCredentialResolverV1, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../lease-DffrPrQn.js';
-import { y as ErrorCode, n as SessionCtx, c as PiChatEvent, S as SessionStore, a as SessionListOptions, b as SessionSummary, P as PiChatSnapshot, d as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-iNSXiFQq.js';
-import { x as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, i as AgentGatewayErrorDTO, p as AgentSessionSummary, o as AgentSessionStateSnapshot, l as AgentSessionConnection } from '../errors-DH7C01Pm.js';
-import { d as AgentActor, j as AgentEvent, v as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-Dcd08yKr.js';
-export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-Dcd08yKr.js';
+import { F as SandboxHandleStore, k as CompiledAgentBundle, a as Sha256Digest, i as AgentDeployment, M as ShareEntryStore, y as ProviderId, c as CredentialFieldId, B as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, X as WorkspaceCredentialAuthorityVerifierV1, n as CredentialConsumerBindingRegistryV1, z as ProviderRegistryV1, Y as WorkspaceCredentialResolverV1, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../lease-nASWv2tU.js';
+import { z as ErrorCode, o as SessionCtx, a as SessionListOptions, b as SessionSummary, c as PiChatSnapshot, d as PiChatEvent, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, S as SessionStore } from '../piChatEvent-BUWIzw5l.js';
+import { B as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, g as AgentAccessOperation, f as AgentAccessDecision, k as AgentGatewayErrorDTO, r as AgentSessionSummary, q as AgentSessionStateSnapshot, n as AgentSessionConnection } from '../errors-CEU4iujR.js';
+export { F as ResolveAgentAccess, G as ResolveAgentAccessInput } from '../errors-CEU4iujR.js';
+import { d as AgentActor, j as AgentEvent, w as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-Ct0e4RWc.js';
+export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-Ct0e4RWc.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { FastifyRequest, FastifyInstance, FastifyPluginCallback } from 'fastify';
-import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult } from '../piChatSessionService-DQSQ_kWZ.js';
-import { c as WorkspaceAgentDirectRunInput, W as WorkspaceAgentDirectRunCallback, f as WorkspaceAgentDispatcherContext, e as WorkspaceAgentDispatcher, i as WorkspaceAgentGatewayBinding } from '../file-search-qcD5zItr.js';
-export { L as LeaseBoundWorkspaceAgent } from '../file-search-qcD5zItr.js';
+import { i as PiSessionRequestContext, j as AgentPromptPayload, k as PiChatAttachmentResult } from '../piChatSessionService-nvroRAVk.js';
+import { c as WorkspaceAgentDirectRunInput, W as WorkspaceAgentDirectRunCallback, f as WorkspaceAgentDispatcherContext, e as WorkspaceAgentDispatcher, i as WorkspaceAgentGatewayBinding } from '../file-search-BGUHnW9o.js';
+export { L as LeaseBoundWorkspaceAgent } from '../file-search-BGUHnW9o.js';
 import { SettingsManager } from '@mariozechner/pi-coding-agent';
 import '@hachej/boring-bash/agent';
 import '@hachej/boring-sandbox/providers/node-workspace';
@@ -204,7 +205,7 @@ declare function createBlaxelSandboxModeAdapter(options: {
 }): RuntimeModeAdapter;
 
 interface ProviderRuntimeModeAdapterOptions {
-    id: BuiltinRuntimeModeId;
+    id: RuntimeModeId;
     provider: SandboxProviderV1;
     runtimeHost: AgentRuntimeHostOperations;
     workspaceFsCapability: 'strong' | 'best-effort';
@@ -226,7 +227,7 @@ interface SandboxRuntimeModeOptions {
 }
 /** Built-in runtime layout root without exposing provider package constants to consumers. */
 declare function resolveBuiltinRuntimeLayoutRoot(mode: BuiltinRuntimeModeId, workspaceRoot: string): string;
-declare function createSandboxRuntimeModeAdapter(mode: BuiltinRuntimeModeId, options?: SandboxRuntimeModeOptions): RuntimeModeAdapter;
+declare function createSandboxRuntimeModeAdapter(mode: RuntimeModeId, options?: SandboxRuntimeModeOptions): RuntimeModeAdapter;
 
 type AgentDirectoryCompilerErrorCode = 'AGENT_DIRECTORY_NOT_FOUND' | 'AGENT_DIRECTORY_NOT_DIRECTORY' | 'AGENT_MANIFEST_NOT_FOUND' | 'AGENT_MANIFEST_NOT_FILE' | 'AGENT_MANIFEST_INVALID_UTF8' | 'AGENT_MANIFEST_INVALID_JSON' | 'AGENT_MANIFEST_MISSING_BORING_AGENT' | 'AGENT_ASSET_NOT_FOUND' | 'AGENT_ASSET_NOT_FILE' | 'AGENT_ASSET_INVALID_UTF8' | 'AGENT_PATH_SYMLINK_ESCAPE' | 'AGENT_PATH_CHANGED_DURING_READ' | 'AGENT_DIRECTORY_IO_FAILED';
 type AgentDirectoryCompilerPublicErrorCode = Extract<ErrorCode, 'CONFIG_INVALID' | 'PATH_NOT_FOUND' | 'PATH_SYMLINK_ESCAPE'>;
@@ -299,10 +300,11 @@ interface TrustedAgentInstructionAppendix {
 interface TrustedAuthoredAgentPolicy {
     readonly fallbackLabel?: string;
     /**
-     * Workspace-relative authored instruction sources for this agent, supplied
-     * by the trusted composer that actually knows where they live.
+     * Authored instruction sources for this agent as host absolute paths,
+     * supplied by the trusted composer that actually knows where they live.
+     * Addressing them against a served workspace root is a per-request concern.
      */
-    readonly instructionFiles?: readonly AgentInstructionFileRef[];
+    readonly instructionSources?: readonly AgentInstructionSource[];
     readonly instructionAppendices?: readonly TrustedAgentInstructionAppendix[];
     readonly plugins?: readonly {
         readonly name: string;
@@ -366,22 +368,6 @@ interface DiscoveredAgentPackageDescriptor {
 interface LoadConfiguredAgentFleetOptions {
     /** Plugin-manager scan descriptors injected by the workspace/CLI boot layer. */
     readonly discoveredPackages: readonly DiscoveredAgentPackageDescriptor[];
-    /**
-     * Root of the workspace the `user` filesystem serves, or `null` when the
-     * host resolves a DIFFERENT root per request (core, the CLI hub) and so has
-     * no single one at fleet-composition time.
-     *
-     * Required, because published `instructionFiles` are addressed relative to
-     * it and only the caller knows it. It is NOT derivable from the discovered
-     * package roots: a fleet can be composed from packages that live outside
-     * the workspace root, and guessing produced well-formed paths that
-     * resolved to nothing.
-     *
-     * `null` is not a soft option — it makes the host structurally unable to
-     * publish a ref it cannot guarantee, which is the honest answer for
-     * per-workspace roots.
-     */
-    readonly workspaceRoot: string | null;
     /** Path to `.agents/factory/fleet.yaml`. */
     readonly fleetConfigPath: string;
     /** Path to `.agents/factory/policy.yaml` (read for `models.seats` tiers). */
@@ -394,7 +380,7 @@ interface LoadConfiguredAgentFleetOptions {
     /** Overridable for tests; defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
 }
-type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED' | 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
+type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED'>;
 interface FleetLoaderDiagnostic {
     readonly seat?: string;
     readonly agentTypeId: string;
@@ -422,55 +408,68 @@ declare class FleetConfigError extends Error {
  * descriptors, `.agents/factory/policy.yaml` `models.seats` tiers, and the
  * priority-ordered `models.tiers` candidates declared in fleet.yaml.
  *
- * Fails closed per seat: a persona that fails materialization, digest
- * verification, or spec composition is excluded with a stable diagnostic —
- * the remaining valid seats still compose. Whole-fleet config errors (an
- * unreadable/malformed fleet.yaml or policy.yaml) throw `FleetConfigError`,
- * since there is no seat set to fail closed against.
+ * Fails startup when any configured seat cannot materialize or verify. Only
+ * genuinely unseated discovered packages remain nonfatal diagnostics. Whole-
+ * fleet config errors (including unreadable/malformed fleet or policy YAML)
+ * throw `FleetConfigError`.
  */
 declare function loadConfiguredAgentFleet(options: LoadConfiguredAgentFleetOptions): Promise<LoadConfiguredAgentFleetResult>;
 
-declare const LEGACY_DEFAULT_AGENT_FLEET: readonly AgentHostAgentSpec[];
+type InstructionRefWithholdingCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
+interface WithheldInstructionRef {
+    readonly code: InstructionRefWithholdingCode;
+    /** Host absolute path of the authored source that could not be addressed. */
+    readonly absolutePath: string;
+    readonly message: string;
+}
+interface ResolvedInstructionFileRefs {
+    readonly refs: readonly AgentInstructionFileRef[];
+    readonly withheld: readonly WithheldInstructionRef[];
+}
+/**
+ * Addresses authored instruction sources against the workspace root a SINGLE
+ * request is served from, which is the only moment a multi-workspace host
+ * (the CLI hub, core) knows one — composition time sees a fleet shared by
+ * every workspace (gh-1189).
+ *
+ * Publication is deterministic and fails closed: a ref is emitted only when
+ * the source canonically resolves inside the served root AND composes a path
+ * the client-side openable-resource guard accepts. Anything else is withheld
+ * with the stable `AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE` code, so
+ * the invariant from #1176 holds: a rendered link always resolves.
+ *
+ * Canonicalization (not lexical containment) on BOTH sides is the point:
+ * dotfile managers make a symlinked `.agents` ordinary, and a lexical check
+ * would call `~/project/.agents -> ~/dotfiles/agents` "inside the workspace"
+ * and publish a link the `user` filesystem cannot open.
+ */
+declare function resolveAgentInstructionFileRefs(input: {
+    readonly sources: readonly AgentInstructionSource[] | undefined;
+    /** Root the `user` filesystem serves for THIS request, when the host resolved one. */
+    readonly workspaceRoot: string | null | undefined;
+}): Promise<ResolvedInstructionFileRefs>;
+
+/**
+ * A real, regular Agent used by hosts that do not opt into authored fleet
+ * discovery. Platform host adapters preserve the established `default` ID's
+ * plugin, skill, and transcript behavior without a separate pseudo-Agent type.
+ */
+declare const DEFAULT_AGENT_FLEET: readonly AgentHostAgentSpec[];
 interface ResolveDefaultAgentFleetOptions {
-    /**
-     * Repository root used to resolve `.agents/{factory,skills}` when
-     * `BORING_AGENT_FLEET=1` composes the fleet. Defaults to `process.cwd()`.
-     */
+    /** Repository root used to resolve `.agents/{factory,skills}`. Defaults to `process.cwd()`. */
     readonly repositoryRoot?: string;
     /** Asset-manager scan results supplied by the workspace/CLI boot layer. */
     readonly discoveredPackages?: readonly DiscoveredAgentPackageDescriptor[];
-    /**
-     * Root of the workspace the `user` filesystem serves, or `null` when the
-     * host resolves one per request. Explicit rather than defaulted, because it
-     * is a DIFFERENT root from `repositoryRoot` in every multi-workspace host —
-     * the two only coincide in the single-root dogfood/playground case.
-     * Personas outside it are not published as openable instruction refs (see
-     * `loadConfiguredAgentFleet`): a well-formed path the workbench cannot open
-     * is worse than no link.
-     */
-    readonly workspaceRoot: string | null;
     /** Overridable for tests; defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
 }
 /**
- * `BORING_AGENT_FLEET=1` composes the config-driven production fleet
- * from boot-injected plugin scan descriptors plus `.agents/factory` under `repositoryRoot`
- * alongside the default agent; flag absent preserves the legacy
- * single-default-agent boot byte-identically. Shared by
- * `createWorkspaceAgentServer`, `createCoreWorkspaceAgentServer`, and the CLI
- * hub — one composition path for every production/CLI entry point.
+ * Resolves one deployment-static fleet for Core, Workspace, and CLI hosts.
  *
- * Fails closed at two levels:
- *  - Per seat: `loadConfiguredAgentFleet` excludes an individual invalid
- *    persona/skill with a stable diagnostic; the remaining seats still boot
- *    (see its own docstring).
- *  - Whole fleet: a missing/malformed `fleet.yaml` or `policy.yaml` would
- *    otherwise throw `FleetConfigError` out of the boot path. That throw is
- *    preserved for direct/programmatic callers of `loadConfiguredAgentFleet`
- *    (e.g. the playground, tests), but this boot-seam wrapper catches it and
- *    degrades to the legacy default-agent-only fleet plus a logged
- *    diagnostic — a container with the flag on and no `.agents/` tree must
- *    still boot.
+ * The built-in default is a regular configured Agent. When authored fleet
+ * discovery is enabled it remains available alongside discovered seats so old
+ * `default` session references stay routable. Invalid enabled fleet
+ * composition fails boot; it never degrades to a pseudo-Agent.
  */
 declare function resolveDefaultAgentFleet(options: ResolveDefaultAgentFleetOptions): Promise<readonly AgentHostAgentSpec[]>;
 
@@ -832,6 +831,12 @@ interface CreateStandaloneAgentHostAppOptions {
     }) => Promise<void>;
     sessionDir?: string;
     sessionRoot?: string;
+    /**
+     * Durable request ledger file. Host application state, not workspace content:
+     * point it at host-owned storage. Defaults per
+     * {@link resolveRequestLedgerPath}.
+     */
+    requestLedgerPath?: string;
     externalPlugins?: boolean;
     beforeReload?: () => void | {
         readonly diagnostics?: ReadonlyArray<{
@@ -882,173 +887,6 @@ interface AgentHostEnvironmentHttpProjectionOptions {
  */
 declare function registerAgentHostEnvironmentRoutes(app: FastifyInstance, options: AgentHostEnvironmentHttpProjectionOptions): Promise<void>;
 
-interface EventStreamReadResult {
-    events: Array<{
-        data: unknown;
-        offset: string;
-    }>;
-    nextOffset: string;
-    upToDate: boolean;
-    closed: boolean;
-}
-interface EventStreamMeta {
-    nextOffset: string;
-    closed: boolean;
-}
-interface EventStreamStore {
-    createStream(path: string): Promise<void>;
-    appendEvent(path: string, event: unknown): Promise<string>;
-    appendEventOnce(path: string, key: string, event: unknown): Promise<string>;
-    appendAgentEvent(sessionId: string, chunk: PiChatEvent, opts?: {
-        idempotencyKey?: string;
-        streamPath?: string;
-    }): Promise<string>;
-    readEvents(path: string, opts?: {
-        offset?: string;
-        limit?: number;
-    }): Promise<EventStreamReadResult>;
-    closeStream(path: string): Promise<void>;
-    getStreamMeta(path: string): Promise<EventStreamMeta | null>;
-    subscribe(path: string, listener: () => void): () => void;
-}
-
-interface HarnessPiChatServiceOptions {
-    harness: AgentHarness;
-    sessionStore: SessionStore;
-    workdir: string;
-    workspace?: Workspace;
-    eventStore?: EventStreamStore;
-    /**
-     * Optional host billing sink. When set, accepted prompts/follow-ups reserve
-     * before execution (a rejecting sink blocks the request), native assistant
-     * usage is recorded per message, and every run settles or releases from
-     * native terminal lifecycle.
-     */
-    metering?: AgentMeteringSink;
-    /** Host-owned process-lifetime projection of live session activity. */
-    onEvent?: (sessionId: string, event: PiChatEvent) => void;
-    /** Receives non-fatal metering pipeline failures (default: console.warn). */
-    meteringLogger?: MeteringErrorLogger;
-    /** Canonical HTTP projection for lazily loaded persisted attachment bytes. */
-    attachmentUrl?: (input: {
-        readonly sessionId: string;
-        readonly messageId: string;
-        readonly index: number;
-        readonly data?: string;
-        readonly mediaType?: string;
-        readonly filename?: string;
-    }) => string;
-}
-declare class HarnessPiChatService implements PiChatSessionService {
-    private readonly harness;
-    private readonly sessionStore;
-    private readonly workdir;
-    private readonly workspace?;
-    private readonly eventStore?;
-    private readonly onEvent?;
-    private readonly attachmentUrl?;
-    private readonly channels;
-    private readonly channelCreations;
-    private readonly sessionGenerations;
-    private readonly messageMetadata;
-    private readonly activePromptRuns;
-    private readonly syntheticPromptFailures;
-    private readonly activeSyntheticPromptErrors;
-    private readonly liveAttachments;
-    private readonly lifecycle;
-    private readonly metering?;
-    private disposePromise?;
-    constructor(options: HarnessPiChatServiceOptions);
-    /** Test/diagnostic hook: resolves once queued metering sink calls settle. */
-    flushMetering(): Promise<void>;
-    dispose(): Promise<void>;
-    private disposeService;
-    listSessions(ctx: PiSessionRequestContext, options?: SessionListOptions): Promise<SessionSummary[]>;
-    createSession(ctx: PiSessionRequestContext, init?: PiSessionCreateInit): Promise<SessionSummary>;
-    deleteSession(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
-    private deleteSessionBeforeDispose;
-    readAttachment(ctx: PiSessionRequestContext, sessionId: string, messageId: string, index: number): Promise<{
-        readonly data: Uint8Array;
-        readonly mediaType: string;
-        readonly filename?: string;
-    }>;
-    readState(ctx: PiSessionRequestContext, sessionId: string): Promise<PiChatSnapshot>;
-    private readStateBeforeDispose;
-    /**
-     * The persisted transcript can lag the live adapter: transcript writes are
-     * asynchronous, and some harnesses never persist transcripts at all. A
-     * persisted refresh whose seq fences the live replay buffer while its
-     * messages are missing would permanently hide those turns from a hydrating
-     * client (it starts "caught up" at that seq with an empty timeline), so
-     * refresh from persisted state only when it carries at least as much
-     * rendered history as the live adapter.
-     */
-    private persistedStateDropsLiveMessages;
-    private canRefreshFromPersistedState;
-    private harnessMayHaveLiveSession;
-    private attachmentUrlFor;
-    private readPersistedState;
-    subscribe(ctx: PiSessionRequestContext, sessionId: string, cursor: number, subscriber: PiChatEventSubscriber): Promise<PiChatEventStreamResult>;
-    private subscribeBeforeDispose;
-    prompt(ctx: PiSessionRequestContext, sessionId: string, payload: PromptPayload): Promise<PromptReceipt>;
-    private promptBeforeDispose;
-    followUp(ctx: PiSessionRequestContext, sessionId: string, payload: FollowUpPayload): Promise<FollowUpReceipt>;
-    private followUpBeforeDispose;
-    clearQueue(ctx: PiSessionRequestContext, sessionId: string, payload: QueueClearPayload): Promise<QueueClearReceipt>;
-    private clearQueueBeforeDispose;
-    interrupt(ctx: PiSessionRequestContext, sessionId: string, _payload: InterruptPayload): Promise<{
-        accepted: true;
-        cursor: number;
-    }>;
-    private interruptBeforeDispose;
-    stop(ctx: PiSessionRequestContext, sessionId: string, _payload: StopPayload): Promise<StopReceipt>;
-    private stopBeforeDispose;
-    private clearAllFollowUps;
-    private nextFollowUpForInterrupt;
-    private autoPostInterruptedFollowUp;
-    private runPrompt;
-    private trackActiveRun;
-    private clearAutoPostedFollowUpForFallback;
-    private canClearAutoPostedFollowUpForFallback;
-    private enrichSyntheticPromptFailures;
-    private publishAutoPostedFollowUpRunError;
-    private publishChannelEvents;
-    private publishChannelEventSync;
-    private publishPromptRunError;
-    private runAndDrainPublishQueue;
-    private drainPublishQueue;
-    private getAdapter;
-    private getChannel;
-    private ensureChannel;
-    /** Coalesce concurrent cold callers so only one adapter subscription wins. */
-    private createChannelOnce;
-    private generationOf;
-    private assertSessionIncarnation;
-    private buildChannel;
-    /** Cheap cold-snapshot seq lookup (no buffer hydration) — see {@link hydrateDurableReplayBuffer} for the live-channel path. */
-    private readDurableLatestPiChatSeq;
-    /**
-     * On cold channel construction, rehydrate a fresh {@link PiChatReplayBuffer}
-     * from the durable event store (when present) so resuming clients replay
-     * genuinely — not merely resume seq counting from a high-water-mark with an
-     * empty buffer, which forces every behind-the-tip cursor into
-     * `PI_CHAT_REPLAY_GAP`. Reads at most the buffer's own retention window
-     * (`DEFAULT_REPLAY_BUFFER_MAX_EVENTS`) worth of trailing entries — older
-     * history is already outside what the in-memory buffer would retain even
-     * across a live process, so this preserves prior semantics for very long
-     * streams while fixing the common "just restarted" resume case.
-     */
-    private hydrateDurableReplayBuffer;
-    /**
-     * Validate the persisted session identity and instantiate its lazily-created
-     * Pi adapter under the same full cache key. This is intentionally a narrow
-     * trusted-host seam rather than another browser route.
-     */
-    ensurePiSessionBound(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
-    private assertCanAccessSession;
-    private sessionKey;
-}
-
 interface EnvironmentProvisioningSnapshot {
     readonly changed: boolean;
     readonly env: Readonly<Record<string, string>>;
@@ -1063,13 +901,64 @@ interface EnvironmentLease {
     retire(): Promise<void>;
 }
 
+/** Workspace-scoped addressing. Pi-native identities remain adapter-private. */
+interface HarnessSessionAddress {
+    readonly workspaceScopeId: string;
+    readonly ref: AgentSessionRef;
+}
+interface HarnessAgentScope {
+    readonly workspaceScopeId: string;
+    readonly agentTypeId: string;
+}
+/** Attribution only: authSubjectId is never session-storage ownership. */
+interface HarnessRequestContext {
+    readonly requestId: string;
+    readonly authSubjectId: string;
+}
+type HarnessWatchResult = {
+    readonly type: 'ok';
+    unsubscribe(): void;
+    readonly closed?: Promise<void>;
+} | {
+    readonly type: 'replay_gap' | 'cursor_ahead';
+    readonly latestSeq: number;
+    readonly minReplaySeq: number;
+};
+/**
+ * Private D29 runtime seam. The Gateway ledger is the sole idempotency
+ * authority; callers may retry only after ledger admission.
+ */
+interface AgentHarnessBackend {
+    listSessions(scope: HarnessAgentScope, ctx: HarnessRequestContext, options?: SessionListOptions): Promise<SessionSummary[]>;
+    createSession(scope: HarnessAgentScope, ctx: HarnessRequestContext, init?: {
+        title?: string;
+    }): Promise<SessionSummary>;
+    readSnapshot(address: HarnessSessionAddress, ctx: HarnessRequestContext): Promise<PiChatSnapshot>;
+    watchEvents(address: HarnessSessionAddress, ctx: HarnessRequestContext, cursor: number, subscriber: (event: PiChatEvent) => void): Promise<HarnessWatchResult>;
+    submitPrompt(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: AgentPromptPayload): Promise<PromptReceipt>;
+    submitFollowUp(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: FollowUpPayload): Promise<FollowUpReceipt>;
+    clearQueue(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: QueueClearPayload): Promise<QueueClearReceipt>;
+    interrupt(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: InterruptPayload): Promise<CommandReceipt>;
+    stop(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: StopPayload): Promise<StopReceipt>;
+    renameSession(address: HarnessSessionAddress, ctx: HarnessRequestContext, title: string): Promise<SessionSummary>;
+    deleteSession(address: HarnessSessionAddress, ctx: HarnessRequestContext): Promise<void>;
+    readAttachment(address: HarnessSessionAddress, ctx: HarnessRequestContext, messageId: string, index: number): Promise<PiChatAttachmentResult>;
+    close(): Promise<void>;
+}
+
 interface BuiltAgentComposition {
     readonly harness: AgentHarness;
     readonly sessionStore: SessionStore;
-    readonly service: HarnessPiChatService;
+    readonly backend: AgentHarnessBackend;
     readonly tools: readonly AgentTool[];
+    readonly pi: ResolvedPiHarnessOptions;
     readonly runtimeBundle: RuntimeBundle;
     readonly readyTracker: ReadyStatusTracker;
+    readonly getFilesystemBindings?: (ctx: {
+        sessionId?: string;
+        userId?: string;
+        requestId?: string;
+    }) => Promise<readonly RuntimeFilesystemBinding[]>;
     dispose(): Promise<void>;
 }
 
@@ -1106,10 +995,13 @@ interface AgentHostRuntime {
     readonly effectAdmission: AgentEffectAdmission;
     readonly activity: AgentSessionActivityIndex;
     readonly shutdownGraceMs: number;
-    listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim): Promise<readonly SessionSummary[]>;
+    listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, options?: SessionListOptions): Promise<readonly SessionSummary[]>;
+    setSessionArchived?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, sessionId: string, archived: boolean): Promise<SessionSummary>;
     isDraining(): boolean;
     assertOpen(): void;
     verify(scope: AuthorizedAgentScope): Promise<VerifiedAgentScopeClaim>;
+    resolveAgentAccess?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: AgentAccessOperation): Promise<AgentAccessDecision>;
+    assertAgentAccess?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: AgentAccessOperation): Promise<void>;
     resolveEnvironmentScope(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<AgentHostEnvironmentScope>;
     acquireEnvironment(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<EnvironmentLease>;
     acquireResolvedEnvironment(workspaceScopeId: string, environment: AgentHostEnvironmentScope): Promise<EnvironmentLease>;
@@ -1143,6 +1035,65 @@ declare class SqliteAgentRequestLedger implements AgentRequestLedger {
     private transition;
 }
 
+/**
+ * Compatibility location a host falls back to when it has neither an explicit
+ * ledger path nor a host-owned session root.
+ *
+ * Hosts historically disagreed on this tail, so it is the *only* part of the
+ * chain that is parameterized. Everything before it is identical for every
+ * host and is owned solely by {@link resolveRequestLedgerPath}.
+ */
+type LegacyRequestLedgerLocation = 
+/** `<workspaceRoot>/.boring/agent-request-ledger.sqlite` (standalone + workspace hosts). */
+{
+    readonly layout: 'workspace-boring-dir';
+    readonly workspaceRoot: string;
+}
+/** `<workspaceRoot>/.agent-request-ledger.sqlite` (core workspace host). */
+ | {
+    readonly layout: 'workspace-host-file';
+    readonly workspaceRoot: string;
+};
+interface ResolveRequestLedgerPathInput {
+    /** Explicit host-configured ledger file. Wins over every fallback. */
+    readonly requestLedgerPath?: string;
+    /** Host-owned session root supplied by the caller, if any. */
+    readonly sessionRoot?: string;
+    /**
+     * Also accept `BORING_AGENT_SESSION_ROOT` as a host-owned root when the
+     * caller supplied no `sessionRoot`. Hosts that already fold that env var
+     * into their own session-root chain omit this.
+     */
+    readonly acceptSessionRootEnv?: boolean;
+    /**
+     * Last-resort compatibility location. Omit for hosts that must fail closed
+     * instead of inventing an in-workspace ledger; they get `undefined`.
+     */
+    readonly legacy?: LegacyRequestLedgerLocation;
+}
+/**
+  * Resolve the durable request ledger file for an agent host.
+ *
+ * **Ledger cutover note:** adopting BORING_AGENT_SESSION_ROOT (or an
+ * explicit requestLedgerPath) after running with the legacy in-workspace
+ * location RELOCATES the sqlite ledger. Effect-idempotency keys recorded
+ * at the legacy path are stranded there; retries that span the upgrade
+ * may be re-admitted once against the new ledger. Copy or drain the
+ * legacy file as part of the cutover if exactly-once effects must
+ * survive it.
+ *
+ * The request ledger is host application state, not workspace content, so the
+ * chain prefers host-owned storage: explicit option, then the caller's
+ * `sessionRoot` (optionally `BORING_AGENT_SESSION_ROOT`), and only then the
+ * host's legacy in-workspace location.
+ *
+ * This is the sole owner of that chain: no host may re-encode any part of it.
+ */
+declare function resolveRequestLedgerPath(input: ResolveRequestLedgerPathInput & {
+    readonly legacy: LegacyRequestLedgerLocation;
+}): string;
+declare function resolveRequestLedgerPath(input: ResolveRequestLedgerPathInput): string | undefined;
+
 declare const AgentFleetCompilationErrorCode: {
     readonly AGENT_FLEET_PLUGIN_UNKNOWN: "AGENT_FLEET_PLUGIN_UNKNOWN";
     readonly AGENT_FLEET_CONFIG_BINDING_UNKNOWN: "AGENT_FLEET_CONFIG_BINDING_UNKNOWN";
@@ -1175,7 +1126,7 @@ declare function createValidatingAgentFleetCompiler(options: CreateValidatingAge
 
 declare class EmbeddedAgentGateway implements AgentGateway {
     private readonly runtime;
-    private readonly cursorSecret;
+    private readonly sessionInventoryPager;
     private readonly connections;
     private readonly writerTails;
     private readonly knownSessions;
@@ -1210,6 +1161,14 @@ declare class EmbeddedAgentGateway implements AgentGateway {
     setActivityForTesting(workspaceScopeId: string, ref: AgentSessionRef, activity: AgentSessionActivity): void;
     private assertOpen;
     private verify;
+    private resolveAgentAccess;
+    private throwForAgentAccessDecision;
+    private assertAgentAccess;
+    authorizeAgentAccess(input: {
+        readonly scope: AuthorizedAgentScope;
+        readonly agentTypeId: string;
+        readonly operation: AgentAccessOperation;
+    }): Promise<void>;
     listAgents(input: {
         readonly scope: AuthorizedAgentScope;
     }): Promise<{
@@ -1222,15 +1181,22 @@ declare class EmbeddedAgentGateway implements AgentGateway {
         label: string;
     }[]>;
     listSessions(input: Parameters<AgentGateway['listSessions']>[0]): Promise<{
-        nextCursor?: string | undefined;
         sessions: AgentSessionSummary[];
+        nextCursor?: string;
     }>;
     createSession(input: Parameters<AgentGateway['createSession']>[0]): Promise<AgentSessionRef>;
     readSessionState(input: Parameters<AgentGateway['readSessionState']>[0]): Promise<AgentSessionStateSnapshot>;
     connectSession(input: Parameters<AgentGateway['connectSession']>[0]): Promise<AgentSessionConnection>;
     private send;
     renameSession(input: Parameters<AgentGateway['renameSession']>[0]): Promise<AgentSessionSummary>;
+    /**
+     * Visibility only. This never reaches the delete path: the session
+     * repository records the flag beside the transcript and hands back the same
+     * summary, so `archived: false` restores the row untouched.
+     */
+    setSessionArchived(input: Parameters<AgentGateway['setSessionArchived']>[0]): Promise<AgentSessionSummary>;
     deleteSession(input: Parameters<AgentGateway['deleteSession']>[0]): Promise<void>;
+    private authorizedEvents;
     close(): Promise<void>;
     private bindingForSession;
     private loadSummary;
@@ -1242,8 +1208,6 @@ declare class EmbeddedAgentGateway implements AgentGateway {
     private promptAdmission;
     private queueClearAdmission;
     private withWriter;
-    private encodeCursor;
-    private decodeCursor;
 }
 
 /** Process-lifetime Level-B ledger with the exact published state machine. */
@@ -1477,4 +1441,4 @@ declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCre
 
 declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
 
-export { AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, LEGACY_DEFAULT_AGENT_FLEET, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, MeteringErrorLogger, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };
+export { AgentAccessDecision, AgentAccessOperation, AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentInstructionSource, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_AGENT_FLEET, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, type LegacyRequestLedgerLocation, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolveRequestLedgerPathInput, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, type ResolvedInstructionFileRefs, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WithheldInstructionRef, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveAgentInstructionFileRefs, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRequestLedgerPath, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };