@hachej/boring-agent 0.1.109 → 0.1.111

package/dist/core/index.d.ts

@@ -1,8 +1,8 @@
-import { A as AgentHarness, a as AgentReadiness, b as Agent } from '../harness-Ct0e4RWc.js';
-export { c as AGENT_NOT_IMPLEMENTED_UNTIL_T1, d as AgentActor, e as AgentCoreHarness, f as AgentCoreHarnessFactory, g as AgentCorePromptInput, h as AgentCoreSessionAdapter, i as AgentCoreSessionSnapshot, j as AgentEvent, k as AgentMessageContent, l as AgentMessagePart, m as AgentNotImplementedError, n as AgentReadinessStatus, o as AgentResolveInputResponse, p as AgentSendInput, q as AgentStartReceipt, r as AgentStreamOptions } from '../harness-Ct0e4RWc.js';
-import { S as SessionStore } from '../piChatEvent-BUWIzw5l.js';
-import { A as AgentCoreSessionService, a as AgentEffectAdmission } from '../piChatSessionService-nvroRAVk.js';
-export { b as AGENT_EFFECT_METHODS, c as AgentEffectAdmissionError, P as PiChatEventStreamResult, d as PiChatEventStreamSubscription, e as PiChatEventSubscriber, f as PiChatReplayRangeError, g as PiChatSessionService, h as PiSessionCreateInit, i as PiSessionRequestContext, w as withAgentEffectAdmission } from '../piChatSessionService-nvroRAVk.js';
+import { A as AgentHarness, a as AgentReadiness, b as Agent } from '../harness-qHlMJhZo.js';
+export { c as AGENT_NOT_IMPLEMENTED_UNTIL_T1, d as AgentActor, e as AgentCoreHarness, f as AgentCoreHarnessFactory, g as AgentCorePromptInput, h as AgentCoreSessionAdapter, i as AgentCoreSessionSnapshot, j as AgentEvent, k as AgentMessageContent, l as AgentMessagePart, m as AgentNotImplementedError, n as AgentReadinessStatus, o as AgentResolveInputResponse, p as AgentSendInput, q as AgentStartReceipt, r as AgentStreamOptions } from '../harness-qHlMJhZo.js';
+import { S as SessionStore } from '../piChatEvent-DpE0lIb9.js';
+import { A as AgentCoreSessionService, a as AgentEffectAdmission } from '../piChatSessionService-CBct-hmz.js';
+export { b as AGENT_EFFECT_METHODS, c as AgentEffectAdmissionError, P as PiChatEventStreamResult, d as PiChatEventStreamSubscription, e as PiChatEventSubscriber, f as PiChatReplayRangeError, g as PiChatSessionService, h as PiSessionCreateInit, i as PiSessionRequestContext, w as withAgentEffectAdmission } from '../piChatSessionService-CBct-hmz.js';
 import '@mariozechner/pi-coding-agent';
 import 'zod';
 

package/dist/core/index.js

@@ -4,7 +4,7 @@ import {
 } from "../chunk-YTUZFKB3.js";
 import {
   ErrorCode
-} from "../chunk-3JFPS2O6.js";
+} from "../chunk-KJIEMSQP.js";
 
 // src/core/piChatSessionService.ts
 var AgentEffectAdmissionError = class extends Error {
@@ -40,6 +40,7 @@ var AGENT_EFFECT_METHODS = {
 };
 function withAgentEffectAdmission(service, admit) {
   return {
+    ...service.resolveSessionStreamPath ? { resolveSessionStreamPath: (ctx, sessionId) => service.resolveSessionStreamPath(ctx, sessionId) } : {},
     ...service.ensurePiSessionBound ? { ensurePiSessionBound: (ctx, sessionId) => service.ensurePiSessionBound(ctx, sessionId) } : {},
     ...service.listSessions ? { listSessions: (ctx, options) => service.listSessions(ctx, options) } : {},
     async createSession(ctx, init) {

package/dist/{createHarness-AHWSC36D.js → createHarness-DOLOHA62.js}

@@ -5,9 +5,9 @@ import {
   mergePiPackageSources,
   projectSkillResourceLocations,
   withPiHarnessDefaults
-} from "./chunk-GS4ADE34.js";
+} from "./chunk-42D6KAQV.js";
 import "./chunk-7XAOVFSN.js";
-import "./chunk-3JFPS2O6.js";
+import "./chunk-KJIEMSQP.js";
 export {
   createPiCodingAgentHarness,
   createResourceSettingsManager,

package/dist/file-search-BUgMSKZE.d.ts

@@ -0,0 +1,289 @@
+import { o as InterruptReceipt, j as StopReceipt } from './piChatEvent-DpE0lIb9.js';
+import { p as AgentSendInput, j as AgentEvent } from './harness-qHlMJhZo.js';
+import { b as Workspace } from './sandbox-BMhut3kh.js';
+import { b as AgentSessionRef, d as AgentSendReceipt, A as AgentGateway, a as AuthorizedAgentScope } from './admin-DORVQfLn.js';
+
+/**
+ * Opaque, in-process Core capability. The brand symbol and constructor are not
+ * exported; Core records issued object identity in a private WeakMap.
+ */
+declare const authorizedWorkspaceCredentialScopeBrand: unique symbol;
+interface AuthorizedWorkspaceCredentialScopeV1 {
+    readonly contractVersion: "boring.authorized-workspace-credential-scope.v1";
+    readonly [authorizedWorkspaceCredentialScopeBrand]: true;
+}
+type VerifiedWorkspaceCredentialPrincipalV1 = Readonly<{
+    kind: "user";
+    userId: string;
+    membershipRole: "owner" | "editor" | "viewer";
+}> | Readonly<{
+    kind: "system";
+    principalId: string;
+    workspaceGrantId: string;
+}>;
+interface VerifiedWorkspaceCredentialAuthorityV1 {
+    readonly workspaceId: string;
+    readonly appId: string;
+    readonly principal: VerifiedWorkspaceCredentialPrincipalV1;
+    readonly authorizationReceiptId: string;
+    readonly expiresAt: string;
+}
+/** Core-owned verifier; a TypeScript cast or copied object is never authority. */
+interface WorkspaceCredentialAuthorityVerifierV1 {
+    readonly contractVersion: "boring.workspace-credential-authority-verifier.v1";
+    verifyCurrent(scope: AuthorizedWorkspaceCredentialScopeV1): Promise<VerifiedWorkspaceCredentialAuthorityV1>;
+}
+
+type ProviderId = string & {
+    readonly __providerId: unique symbol;
+};
+type CredentialFieldId = string & {
+    readonly __credentialFieldId: unique symbol;
+};
+type CredentialConsumerBindingId = string & {
+    readonly __credentialConsumerBindingId: unique symbol;
+};
+type ProviderCategoryV1 = "llm" | "search" | "transcription" | "mcp" | "other";
+interface CredentialFieldDefinitionV1 {
+    readonly id: CredentialFieldId;
+    readonly label: string;
+    readonly required: boolean;
+    readonly sensitivity: "secret" | "public";
+    readonly minBytes?: number;
+    readonly maxBytes: number;
+}
+interface ExternalManagedAccountReferenceDefinitionV1 {
+    readonly label: string;
+    readonly maxBytes: number;
+    readonly persistence: "server-only-metadata";
+}
+type ProviderCredentialDefinitionV1 = Readonly<{
+    type: "api-key";
+    fields: readonly CredentialFieldDefinitionV1[];
+}> | Readonly<{
+    type: "oauth2-authorization-code";
+    tokenCustody: "local-vault";
+    clientRegistrationRef: string;
+    authorizationEndpoint: `https://${string}`;
+    tokenEndpoint: `https://${string}`;
+    revocationEndpoint?: `https://${string}`;
+    scopes: readonly string[];
+    usePkce: true;
+    refreshTokenField: CredentialFieldDefinitionV1;
+    resolvedAccessTokenField: CredentialFieldDefinitionV1;
+    accessTokenPersistence: "memory-only";
+}> | Readonly<{
+    type: "oauth2-authorization-code";
+    tokenCustody: "external-managed";
+    custodianAdapterId: string;
+    connectUrlOrigins: readonly `https://${string}`[];
+    scopes: readonly string[];
+    accountReference: ExternalManagedAccountReferenceDefinitionV1;
+    delivery: "host-session-adapter-only";
+}> | Readonly<{
+    type: "none";
+}>;
+interface ProviderDefinitionV1 {
+    readonly contractVersion: "boring.provider.v1";
+    readonly id: ProviderId;
+    readonly displayName: string;
+    readonly category: ProviderCategoryV1;
+    readonly credential: ProviderCredentialDefinitionV1;
+    readonly consumerBindingIds: readonly CredentialConsumerBindingId[];
+    readonly sandboxEgressOrigins: readonly `https://${string}`[];
+    readonly mcp?: Readonly<{
+        transport: "streamable-http";
+        endpoint?: `https://${string}`;
+        toolkitId?: string;
+        allowedTools: readonly string[];
+        deniedTools: readonly string[];
+    }>;
+}
+interface ProviderRegistryV1 {
+    readonly contractVersion: "boring.provider-registry.v1";
+    list(): readonly ProviderDefinitionV1[];
+    require(providerId: ProviderId): ProviderDefinitionV1;
+}
+declare function createProviderRegistryV1(defs: readonly ProviderDefinitionV1[]): ProviderRegistryV1;
+
+/**
+ * Ratified `KmsBackend` abstraction (docs/issues/820/byok-secret-vault-plan.md,
+ * "KmsBackend interface (pluggable KEK provider)", amendment A).
+ *
+ * This module is intentionally backend-agnostic: OVH KMS, Scaleway Key Manager,
+ * Exoscale KMS, self-run Vault/OpenBao Transit and the local-KEK envelope are
+ * all implementations of `WorkspaceKekProviderV1`. Only the KEK-holder call
+ * differs; the per-workspace DEK and the AAD-bound AES-256-GCM field crypto are
+ * identical across every backend.
+ *
+ * Shared code stays `Uint8Array`-only: no `node:*` import and no Node byte-array
+ * type may appear here. Backend-specific crypto lives under `src/server/**`.
+ */
+declare const WORKSPACE_KEK_PROVIDER_VERSION: "boring.workspace-kek-provider.v1";
+declare const CREDENTIAL_ENVELOPE_VERSION: "boring.credential-envelope.v1";
+/** Canonical AAD encoding version; changing it is a migration, not a tweak. */
+declare const CREDENTIAL_AAD_ENCODING_VERSION: "boring.credential-aad.v1";
+/** AES-256-GCM parameters. Fixed by the ratified design; never widened. */
+declare const CREDENTIAL_DEK_BYTE_LENGTH_V1 = 32;
+declare const CREDENTIAL_KEK_BYTE_LENGTH_V1 = 32;
+declare const CREDENTIAL_NONCE_BYTE_LENGTH_V1 = 12;
+declare const CREDENTIAL_AUTH_TAG_BYTE_LENGTH_V1 = 16;
+interface WorkspaceKekContextV1 {
+    readonly workspaceId: string;
+    readonly dekGeneration: number;
+    readonly requestId: string;
+}
+type WrappedWorkspaceDekPayloadV1 = Readonly<{
+    /** Reserved for a future self-run Vault/OpenBao Transit backend. */
+    format: "vault-transit-ciphertext.v1";
+    ciphertext: Uint8Array;
+}> | Readonly<{
+    format: "local-aes-256-gcm.v1";
+    ciphertext: Uint8Array;
+    nonce: Uint8Array;
+    authTag: Uint8Array;
+    aadContext: Uint8Array;
+}> | Readonly<{
+    /** Reserved. A future backend must define and conformance-test this. */
+    format: "external-kms-opaque.v1";
+    payloadFormatId: string;
+    opaqueAuthenticatedPayload: Uint8Array;
+}>;
+interface WrappedWorkspaceDekV1 {
+    readonly providerId: string;
+    readonly keyRef: string;
+    readonly keyVersion: number;
+    readonly payload: WrappedWorkspaceDekPayloadV1;
+}
+interface GeneratedWorkspaceDekV1 {
+    /** Transient plaintext; the caller overwrites and drops it in `finally`. */
+    readonly plaintextDek: Uint8Array;
+    readonly wrappedDek: WrappedWorkspaceDekV1;
+}
+interface WorkspaceKekProviderReadinessV1 {
+    readonly ready: boolean;
+    readonly reasonCode?: string;
+}
+/**
+ * `readiness()` returning `ready: false`, or any backend/KEK error, denies the
+ * credential operation (fail closed). An implementation never falls back to
+ * another backend or to plaintext.
+ */
+interface WorkspaceKekProviderV1 {
+    readonly contractVersion: typeof WORKSPACE_KEK_PROVIDER_VERSION;
+    readonly providerId: string;
+    generateDataKey(context: WorkspaceKekContextV1): Promise<GeneratedWorkspaceDekV1>;
+    unwrapDataKey(context: WorkspaceKekContextV1, wrapped: WrappedWorkspaceDekV1): Promise<Uint8Array>;
+    rewrapDataKey?(context: WorkspaceKekContextV1, wrapped: WrappedWorkspaceDekV1): Promise<WrappedWorkspaceDekV1>;
+    readiness(): Promise<WorkspaceKekProviderReadinessV1>;
+    close?(): Promise<void>;
+}
+/**
+ * The identity a field envelope is cryptographically bound to. Every component
+ * is part of the AAD, so moving a row between workspaces, providers, fields,
+ * credential versions or DEK generations fails authentication.
+ */
+interface CredentialFieldAadContextV1 {
+    readonly workspaceId: string;
+    readonly credentialId: string;
+    readonly providerId: string;
+    readonly fieldId: string;
+    readonly credentialVersion: number;
+    readonly dekGeneration: number;
+}
+/** Logical encrypted field envelope; the DB may normalize `wrappedDek` away. */
+interface CredentialEnvelopeV1 {
+    readonly envelopeVersion: typeof CREDENTIAL_ENVELOPE_VERSION;
+    readonly ciphertext: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly aadContext: Uint8Array;
+}
+
+interface WorkspaceAgentDispatcherContext {
+    workspaceId: string;
+    userId: string;
+}
+type WorkspaceAgentDispatcherSendInput = Omit<AgentSendInput, 'ctx'>;
+interface WorkspaceAgentDispatcherDispatchInput extends WorkspaceAgentDispatcherSendInput {
+    /** Optional user-visible presentation when content carries hidden instructions. */
+    displayMessage?: string;
+    /** Optional title for a newly created addressed session. */
+    title?: string;
+    /** Durable caller-owned idempotency key. */
+    requestId: string;
+    /** Defaults to requestId. */
+    clientNonce?: string;
+    /** Defaults to prompt; follow-up requires a non-negative clientSeq. */
+    kind?: 'prompt' | 'followup';
+    /** Server-only atomic admission for durable background prompt delivery. */
+    requireIdle?: true;
+    clientSeq?: number;
+}
+interface WorkspaceAgentDispatch {
+    ref: AgentSessionRef;
+    receipt: AgentSendReceipt;
+    events: AsyncIterable<AgentEvent>;
+}
+/**
+ * Callback-scoped direct Agent capability. The Workspace and operations are
+ * lease guarded by the Host and must not be retained after the callback.
+ */
+interface LeaseBoundWorkspaceAgent {
+    readonly workspace: Workspace;
+    readonly signal: AbortSignal;
+    dispatch(input: WorkspaceAgentDispatcherDispatchInput, onEvent: (event: AgentEvent) => void | Promise<void>, onAccepted?: (accepted: {
+        readonly ref: AgentSessionRef;
+        readonly receipt: AgentSendReceipt;
+    }) => void | Promise<void>): Promise<{
+        readonly ref: AgentSessionRef;
+        readonly receipt: AgentSendReceipt;
+    }>;
+    interrupt(sessionId: string, requestId: string): Promise<InterruptReceipt>;
+    stop(sessionId: string, requestId: string): Promise<StopReceipt>;
+}
+type AgentInvocationFundingPolicyV1 = 'personal-subscription' | 'api-key-only';
+interface WorkspaceAgentDirectRunInput {
+    readonly agentTypeId: string;
+    readonly context: WorkspaceAgentDispatcherContext;
+    readonly requestId: string;
+    /** Dispatcher invocations are unattended by contract and can never opt into personal OAuth. */
+    readonly fundingPolicy: 'api-key-only';
+}
+type WorkspaceAgentDirectRunCallback = (binding: LeaseBoundWorkspaceAgent) => Promise<void>;
+/** Addressed gateway binding minted by the trusted composition root. */
+interface WorkspaceAgentGatewayBinding {
+    gateway: AgentGateway;
+    scope: AuthorizedAgentScope;
+    agentTypeId: string;
+}
+/**
+ * Compatibility-facing delegation surface. New durable callers use dispatch so
+ * the addressed ref and accepted Gateway receipt can be persisted before they
+ * consume events. send remains for callers that only need the legacy stream.
+ */
+interface WorkspaceAgentDispatcher {
+    /** Optional only for source compatibility with pre-Gateway injected resolvers. */
+    dispatch?(input: WorkspaceAgentDispatcherDispatchInput): Promise<WorkspaceAgentDispatch>;
+    send(input: WorkspaceAgentDispatcherSendInput): AsyncIterable<AgentEvent>;
+    interrupt(sessionId: string): Promise<InterruptReceipt>;
+    stop(sessionId: string): Promise<StopReceipt>;
+}
+
+declare const AGENT_RESOURCES_FILESYSTEM_ID: "agent_resources";
+/**
+ * Agent-scoped readonly filesystem carrying the knowledge/ folder shipped
+ * inside an agent definition package (gh-1107 slice 2). Generic id only —
+ * never tenant-named. The binding exists only for the owning agent.
+ */
+declare const AGENT_KNOWLEDGE_FILESYSTEM_ID: "agent_knowledge";
+interface AgentSkillResource {
+    readonly filesystem: 'user' | typeof AGENT_RESOURCES_FILESYSTEM_ID | (string & {});
+    readonly path: string;
+}
+
+interface FileSearch {
+    search(glob: string, limit?: number): Promise<string[]>;
+}
+
+export { type AuthorizedWorkspaceCredentialScopeV1 as A, type WorkspaceCredentialAuthorityVerifierV1 as B, type CredentialConsumerBindingId as C, type WorkspaceKekContextV1 as D, type ExternalManagedAccountReferenceDefinitionV1 as E, type FileSearch as F, type GeneratedWorkspaceDekV1 as G, type WorkspaceKekProviderReadinessV1 as H, type WorkspaceKekProviderV1 as I, type WrappedWorkspaceDekPayloadV1 as J, type WrappedWorkspaceDekV1 as K, type LeaseBoundWorkspaceAgent as L, createProviderRegistryV1 as M, type AgentInvocationFundingPolicyV1 as N, type ProviderId as P, type VerifiedWorkspaceCredentialAuthorityV1 as V, WORKSPACE_KEK_PROVIDER_VERSION as W, type CredentialFieldId as a, type ProviderRegistryV1 as b, type ProviderDefinitionV1 as c, type CredentialFieldDefinitionV1 as d, AGENT_KNOWLEDGE_FILESYSTEM_ID as e, AGENT_RESOURCES_FILESYSTEM_ID as f, type AgentSkillResource as g, CREDENTIAL_AAD_ENCODING_VERSION as h, CREDENTIAL_AUTH_TAG_BYTE_LENGTH_V1 as i, CREDENTIAL_DEK_BYTE_LENGTH_V1 as j, CREDENTIAL_ENVELOPE_VERSION as k, CREDENTIAL_KEK_BYTE_LENGTH_V1 as l, CREDENTIAL_NONCE_BYTE_LENGTH_V1 as m, type CredentialEnvelopeV1 as n, type CredentialFieldAadContextV1 as o, type ProviderCategoryV1 as p, type ProviderCredentialDefinitionV1 as q, type VerifiedWorkspaceCredentialPrincipalV1 as r, type WorkspaceAgentDirectRunCallback as s, type WorkspaceAgentDirectRunInput as t, type WorkspaceAgentDispatch as u, type WorkspaceAgentDispatcher as v, type WorkspaceAgentDispatcherContext as w, type WorkspaceAgentDispatcherDispatchInput as x, type WorkspaceAgentDispatcherSendInput as y, type WorkspaceAgentGatewayBinding as z };

package/dist/front/index.d.ts

@@ -1,8 +1,8 @@
-import { q as ToolUiMetadata, B as BoringChatPart, w as BoringChatMessage, J as PiChatStatus, c as PiChatSnapshot, n as QueuedUserMessage, x as ChatError, d as PiChatEvent, P as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, b as SessionSummary, z as ErrorCode } from '../piChatEvent-BUWIzw5l.js';
+import { q as ToolUiMetadata, B as BoringChatPart, w as BoringChatMessage, M as PiChatStatus, c as PiChatSnapshot, n as QueuedUserMessage, D as ChatError, d as PiChatEvent, P as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, b as SessionSummary, H as ErrorCode } from '../piChatEvent-DpE0lIb9.js';
 import * as react from 'react';
 import { ComponentProps, HTMLAttributes, FormEvent, ReactNode, ComponentType } from 'react';
 import { FileUIPart, ChatStatus, UIMessage } from 'ai';
-import { s as AgentSummary, j as AgentGatewayErrorCode, B as JsonValue } from '../errors-CEU4iujR.js';
+import { s as AgentSummary, j as AgentGatewayErrorCode, P as JsonValue, E as CredentialMetadataV1 } from '../admin-DORVQfLn.js';
 export { Artifact, ArtifactAction, ArtifactActions, ArtifactDescription, ArtifactHeader, ArtifactOpenProvider, ArtifactTitle, OpenArtifactHandler, useOpenArtifact } from './artifacts.js';
 import { InputGroupAddon, InputGroupButton, InputGroupTextarea, Button, Collapsible, CollapsibleContent, CollapsibleTrigger } from '@hachej/boring-ui-kit';
 import { Streamdown } from 'streamdown';
@@ -663,6 +663,17 @@ interface ComposerBlocker {
     target?: unknown;
 }
 
+/**
+ * How much of a turn the transcript shows.
+ *
+ * - `full` (default): everything — text, reasoning, tool calls, tool groups.
+ * - `messages-only`: just the conversation. Reasoning and tool activity are
+ *   suppressed and a streaming turn shows one quiet status line instead. For
+ *   hosts whose user is not a developer and for whom "ran bash" is noise, not
+ *   progress.
+ */
+type ChatRenderMode = 'full' | 'messages-only';
+
 type ChatSubmitSource = 'composer' | 'suggestion' | 'auto-submit';
 interface ChatSubmitContext {
     files: PromptInputFilePart[];
@@ -696,6 +707,26 @@ interface PiChatPanelProps<TComposerBlocker extends ComposerBlocker = ComposerBl
     fetch?: typeof globalThis.fetch;
     className?: string;
     chrome?: boolean;
+    /**
+     * How much of a turn the transcript shows. `messages-only` renders user and
+     * assistant text only — no reasoning, no tool calls, one quiet working line
+     * while a turn streams. Defaults to `full`, so existing hosts are unchanged.
+     */
+    renderMode?: ChatRenderMode;
+    /**
+     * Tool names that stay visible under `renderMode="messages-only"`. Empty by
+     * default. Pair each with a renderer in `toolRenderers`: the host opts a tool
+     * back in when the call is itself something the user must see and act on.
+     */
+    messagesOnlyVisibleTools?: readonly string[];
+    /** Hide per-message copy actions in `messages-only` mode. Defaults to false. */
+    messagesOnlyHideCopyActions?: boolean;
+    /**
+     * User-message prefixes omitted from the transcript in `messages-only` mode.
+     * The messages remain in agent context; this only lets a host hide its own
+     * machine-authored control prompts from the person using the chat.
+     */
+    messagesOnlyHiddenUserPrefixes?: readonly string[];
     debug?: boolean;
     showSessions?: boolean;
     hotReloadEnabled?: boolean;
@@ -703,6 +734,8 @@ interface PiChatPanelProps<TComposerBlocker extends ComposerBlocker = ComposerBl
     emptyState?: ChatPanelEmptyState;
     emptyPlacement?: 'default' | 'hero';
     composerPlaceholder?: string;
+    /** Replaces the composer's default streaming pill when supplied. Pass `null` to hide it. */
+    composerActivity?: ReactNode;
     initialDraft?: string;
     autoSubmitInitialDraft?: boolean;
     onDraftRestored?: () => void;
@@ -757,7 +790,7 @@ interface PiChatPanelProps<TComposerBlocker extends ComposerBlocker = ComposerBl
      * knowing what the code means or what the action does. */
     renderNoticeAction?: (notice: PiChatRuntimeNotice) => ReactNode;
 }
-declare function PiChatPanel<TComposerBlocker extends ComposerBlocker = ComposerBlocker>({ sessionId, agentTypeId, extraCommands, apiBaseUrl, workspaceId, storageScope, requestHeaders, storage, fetch, className, chrome, debug, showSessions, hotReloadEnabled, suggestions, emptyState, emptyPlacement, composerPlaceholder, initialDraft, autoSubmitInitialDraft, onDraftRestored, onAutoSubmitInitialDraftAccepted, onAutoSubmitInitialDraftSettled, model, defaultModel, availableModels, hideDefaultModelOption, hideComposerSettings, suppressPreSubmitCancelledWarning, thinkingLevel, thinkingControl, serverResourcesEnabled, mentionedFiles, commands, excludeBuiltinCommands, toolRenderers, createRemoteSession, remoteSessionOptions, hydrateMessages, allowPromptDuringInitialHydration, workspaceWarmupStatus, onSessionReset, spillLargePrompts, largePromptThresholdChars, onBeforeSubmit, onReloadAgentPlugins, onCommandResult, onComposerWarning, onMentionedFilesConsumed, onPromptSubmitStarted, onData, onOpenArtifact, composerBlockers, onComposerStop, onComposerBlockerAction, onTurnComplete, renderNoticeAction, }: PiChatPanelProps<TComposerBlocker>): react.JSX.Element;
+declare function PiChatPanel<TComposerBlocker extends ComposerBlocker = ComposerBlocker>({ sessionId, agentTypeId, extraCommands, apiBaseUrl, workspaceId, storageScope, requestHeaders, storage, fetch, className, chrome, renderMode, messagesOnlyVisibleTools, messagesOnlyHideCopyActions, messagesOnlyHiddenUserPrefixes, debug, showSessions, hotReloadEnabled, suggestions, emptyState, emptyPlacement, composerPlaceholder, composerActivity, initialDraft, autoSubmitInitialDraft, onDraftRestored, onAutoSubmitInitialDraftAccepted, onAutoSubmitInitialDraftSettled, model, defaultModel, availableModels, hideDefaultModelOption, hideComposerSettings, suppressPreSubmitCancelledWarning, thinkingLevel, thinkingControl, serverResourcesEnabled, mentionedFiles, commands, excludeBuiltinCommands, toolRenderers, createRemoteSession, remoteSessionOptions, hydrateMessages, allowPromptDuringInitialHydration, workspaceWarmupStatus, onSessionReset, spillLargePrompts, largePromptThresholdChars, onBeforeSubmit, onReloadAgentPlugins, onCommandResult, onComposerWarning, onMentionedFilesConsumed, onPromptSubmitStarted, onData, onOpenArtifact, composerBlockers, onComposerStop, onComposerBlockerAction, onTurnComplete, renderNoticeAction, }: PiChatPanelProps<TComposerBlocker>): react.JSX.Element;
 
 type AddressedAgentOption = Pick<AgentSummary, 'agentTypeId' | 'label' | 'description' | 'pluginIds'>;
 interface UseAddressedAgentSelectionOptions {
@@ -805,6 +838,58 @@ interface DebugDrawerProps {
 }
 declare function DebugDrawer({ agentTypeId, apiBaseUrl, fetch, sessionId, messages, requestHeaders, storageScope, width, onWidthChange }: DebugDrawerProps): react.JSX.Element;
 
+type CredentialFundingMethod = 'api-key' | 'openai-codex';
+type CredentialOAuthEvent = {
+    readonly type: 'auth_url';
+    readonly url: string;
+} | {
+    readonly type: 'device_code';
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly expiresInSeconds?: number;
+} | {
+    readonly type: 'progress';
+};
+interface CredentialOAuthPrompt {
+    readonly type: string;
+    readonly options?: readonly {
+        readonly id: string;
+        readonly label: string;
+    }[];
+}
+interface CredentialOAuthFlow {
+    readonly flowId: string;
+    readonly providerId: 'openai-codex';
+    readonly status: 'pending' | 'succeeded' | 'failed' | 'cancelled';
+    readonly events: readonly CredentialOAuthEvent[];
+    readonly prompt?: CredentialOAuthPrompt;
+}
+interface CredentialSettingsClient {
+    list(): Promise<readonly CredentialMetadataV1[]>;
+    putApiKey(providerId: string, apiKey: string): Promise<CredentialMetadataV1>;
+    disable(providerId: string): Promise<CredentialMetadataV1>;
+    revoke(providerId: string): Promise<CredentialMetadataV1>;
+    delete(providerId: string): Promise<CredentialMetadataV1>;
+    startCodexLogin(): Promise<CredentialOAuthFlow>;
+    getCodexLogin(flowId: string): Promise<CredentialOAuthFlow>;
+    respondToCodexLogin(flowId: string, value: string): Promise<CredentialOAuthFlow>;
+    cancelCodexLogin(flowId: string): Promise<void>;
+}
+declare function createCredentialSettingsClient(apiBaseUrl?: string, fetchImpl?: typeof fetch, requestHeaders?: Readonly<Record<string, string>>): CredentialSettingsClient;
+
+interface CredentialSettingsSurfaceProps {
+    /** The host must derive this from its authenticated workspace membership. */
+    isWorkspaceOwner: boolean;
+    /** Active workspace scope sent to the authenticated credential routes. */
+    workspaceId?: string;
+    apiBaseUrl?: string;
+    /** Test/host transport seam. It must preserve the metadata-only contract. */
+    client?: CredentialSettingsClient;
+}
+/** Workspace identity is also the state boundary: switching workspaces remounts
+ * the inner surface so metadata and pending OAuth/lifecycle state cannot cross. */
+declare function CredentialSettingsSurface(props: CredentialSettingsSurfaceProps): react.JSX.Element;
+
 type SelectorTrigger = 'button' | 'slash';
 declare const ModelSelectTrigger: react.ForwardRefExoticComponent<Omit<Omit<react.DetailedHTMLProps<react.ButtonHTMLAttributes<HTMLButtonElement>, HTMLButtonElement>, "ref">, "value"> & {
     value: ModelSelection | null;
@@ -994,4 +1079,4 @@ declare const ToolContent: ({ className, ...props }: ToolContentProps) => react.
 
 declare function cn(...inputs: ClassValue[]): string;
 
-export { type AddressedAgentOption, type AgentCommandContribution, type AgentCommandOptions, type AgentPluginReloadResult, type AvailableModel, BoringChatMessage, type ChatBeforeSubmitResult, ChatEmptyState, type ChatEmptyStateProps, type ChatMessageContribution, type ChatMessageContributionProps, ChatMessageContributionProvider, PiChatPanel as ChatPanel, type PiChatPanelProps as ChatPanelProps, type ChatSubmitContext, type ChatSuggestion, CodeBlock, type CommandRegistry, type ComposerActionContributionProps, type ComposerBlocker, type ComposerBlockerAction, type ComposerContribution, ComposerContributionProvider, type ComposerDraftUpdate, Conversation, ConversationContent, ConversationScrollButton, DebugDrawer, GatewayResponseError, type GatewayResponseErrorCode, type GroupedToolEntry, Message, MessageAction, MessageActions, MessageContent, MessageResponse, ModelPickerMenu, ModelSelect, ModelSelectTrigger, type ModelSelection, type ParsedCommand, PiChatPanel, type PiChatPanelProps, SessionBrowser as PiSessionBrowser, type PiSessionCreateInit, SessionList as PiSessionList, type PiSessionSearchItem, type PiSessionSearchOptions, type PiSessionSearchSortMode, PromptInput, PromptInputFooter, PromptInputSubmit, PromptInputTextarea, Reasoning, ReasoningContent, ReasoningTrigger, type SessionListProps, type SlashCommand, type SlashCommandContext, type ThinkingLevel, ThinkingSelect, Tool, ToolCallGroup, ToolContent, ToolHeader, type ToolPart$1 as ToolPart, type ToolRenderer, type ToolRendererOverrides, type UploadFileOptions, type UploadFileResult, type UseAddressedAgentSelectionOptions, type UseAddressedAgentSelectionResult, type UsePiSessionsOptions, type UsePiSessionsResult, activeSessionStorageKey, builtinCommands, cn, createCommandRegistry, defaultChatSuggestions, defaultToolRenderers, errorResponseCode, gatewayResponseError, gatewayResponseErrorFromBody, getAgentCommands, matchPiSessionSearch, mergeShadcnToolRenderers, mergeToolRenderers, parsePiSessionSearchQuery, parseSlashCommand, readActiveSessionId, resolveToolRenderer, searchPiSessions, uploadFile, useAddressedAgentSelection, usePiSessions, writeActiveSessionId };
+export { type AddressedAgentOption, type AgentCommandContribution, type AgentCommandOptions, type AgentPluginReloadResult, type AvailableModel, BoringChatMessage, type ChatBeforeSubmitResult, ChatEmptyState, type ChatEmptyStateProps, type ChatMessageContribution, type ChatMessageContributionProps, ChatMessageContributionProvider, PiChatPanel as ChatPanel, type PiChatPanelProps as ChatPanelProps, type ChatRenderMode, type ChatSubmitContext, type ChatSuggestion, CodeBlock, type CommandRegistry, type ComposerActionContributionProps, type ComposerBlocker, type ComposerBlockerAction, type ComposerContribution, ComposerContributionProvider, type ComposerDraftUpdate, Conversation, ConversationContent, ConversationScrollButton, type CredentialFundingMethod, type CredentialOAuthEvent, type CredentialOAuthFlow, type CredentialOAuthPrompt, type CredentialSettingsClient, CredentialSettingsSurface, type CredentialSettingsSurfaceProps, DebugDrawer, GatewayResponseError, type GatewayResponseErrorCode, type GroupedToolEntry, Message, MessageAction, MessageActions, MessageContent, MessageResponse, ModelPickerMenu, ModelSelect, ModelSelectTrigger, type ModelSelection, type ParsedCommand, PiChatPanel, type PiChatPanelProps, SessionBrowser as PiSessionBrowser, type PiSessionCreateInit, SessionList as PiSessionList, type PiSessionSearchItem, type PiSessionSearchOptions, type PiSessionSearchSortMode, PromptInput, PromptInputFooter, PromptInputSubmit, PromptInputTextarea, Reasoning, ReasoningContent, ReasoningTrigger, type SessionListProps, type SlashCommand, type SlashCommandContext, type ThinkingLevel, ThinkingSelect, Tool, ToolCallGroup, ToolContent, ToolHeader, type ToolPart$1 as ToolPart, type ToolRenderer, type ToolRendererOverrides, type UploadFileOptions, type UploadFileResult, type UseAddressedAgentSelectionOptions, type UseAddressedAgentSelectionResult, type UsePiSessionsOptions, type UsePiSessionsResult, activeSessionStorageKey, builtinCommands, cn, createCommandRegistry, createCredentialSettingsClient, defaultChatSuggestions, defaultToolRenderers, errorResponseCode, gatewayResponseError, gatewayResponseErrorFromBody, getAgentCommands, matchPiSessionSearch, mergeShadcnToolRenderers, mergeToolRenderers, parsePiSessionSearchQuery, parseSlashCommand, readActiveSessionId, resolveToolRenderer, searchPiSessions, uploadFile, useAddressedAgentSelection, usePiSessions, writeActiveSessionId };