@hachej/boring-agent 0.1.94 → 0.1.96

package/dist/server/index.d.ts

@@ -1,25 +1,32 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, R as RuntimeModeAdapter, a as RuntimeModeId, B as BuiltinRuntimeModeId, b as AgentRuntimeHostOperations, c as RuntimeBashStrategy, d as RuntimeFilesystemStrategy, M as ModeContext, e as WorkspaceProvisioningAdapter, f as RuntimeBundle, g as PiHarnessOptions, h as AgentMeteringSink, i as RuntimeFilesystemBinding, j as MeteringErrorLogger, k as ReadyStatusTracker, l as ResolvedAgentRuntimeScope, C as CreateAgentHostOptions, m as CompiledAgentHostAgentSpec, n as AgentRequestLedger, o as AgentEffectAdmission, p as AgentRequestKey, q as CreatedAgentHost, r as AgentFleetCompiler, A as AgentGatewayEffect, s as AgentRequestTarget, t as AgentRequestLedgerRecord, u as AgentRequestFailure, v as AgentHostLegacyRoutePolicy } from '../types-C-Eroi__.js';
-export { w as AgentHostAddressedHttpProjectionOptions, x as AgentHostAgentSpec, y as AgentHostDescription, z as AgentHostHandle, D as AgentHostHttpProjectionOptions, E as AgentHostLegacyHttpProjectionOptions, F as AgentHostLegacyProjectionComposition, G as AgentHostLegacyProjectionLifecycle, H as AgentHostLegacyProjectionRuntime, I as AgentHostLegacyRoutePolicyMountInput, J as ConfiguredAgentHostAgentSpec, L as LegacyDefaultAgentHostSpec, K as MeteringReleaseInput, N as MeteringReleaseReason, O as MeteringReservationResult, Q as MeteringReserveInput, S as MeteringRunKind, T as MeteringRunScope, U as MeteringRunStatus, V as MeteringSettleInput, X as MeteringUsage, Y as MeteringUsageInput, Z as PI_PACKAGE_RESOURCE_FILTERS, _ as PiExtensionFactory, $ as PiPackageSource, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as createResourceSettingsManager, aa as mergePiPackageSources, ab as normalizeMeteringUsage, ac as piPackageSourceKey } from '../types-C-Eroi__.js';
-import { E as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, S as Sandbox } from '../sandbox-DAD8cWQR.js';
-import { R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, b as RemoteWorkerExecRequest } from '../middleware-CzW8n7B7.js';
-export { c as REMOTE_WORKER_PROVIDER, d as REMOTE_WORKER_RUNTIME_CWD, e as RemoteWorkerErrorPayload, f as RemoteWorkerExecResponse, g as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, h as WORKER_REQUEST_ID_HEADER, i as WORKER_WORKSPACE_ID_HEADER, j as createAgentAuthMiddleware } from '../middleware-CzW8n7B7.js';
+import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionFileRef, C as ConfiguredAgentHostAgentSpec, h as AgentHostAgentSpec, i as RuntimeBundle, j as PiHarnessOptions, k as AgentMeteringSink, l as RuntimeFilesystemBinding, m as CreatedAgentHost, n as MeteringErrorLogger, o as ReadyStatusTracker, p as ResolvedAgentRuntimeScope, q as CreateAgentHostOptions, r as CompiledAgentHostAgentSpec, s as AgentRequestLedger, t as AgentEffectAdmission, u as AuthorizedEnvironmentIntent, v as AgentHostEnvironmentScope, w as AgentRequestKey, x as AgentRequestLedgerPrepareResult, y as AgentRequestFailure, z as AgentRequestLedgerRecord, D as AgentFleetCompiler, E as AgentRequestTarget, F as RuntimeFilesystemAccessDecision } from '../types-D_SD-7_l.js';
+export { A as AgentGatewayEffect, G as AgentHostDescription, H as AgentHostDirectProjectionOptions, I as AgentHostDispatcherRunInput, J as AgentHostEnvironmentLease, K as AgentHostHandle, L as LegacyDefaultAgentHostSpec, N as MeteringReleaseInput, O as MeteringReleaseReason, Q as MeteringReservationResult, S as MeteringReserveInput, T as MeteringRunKind, U as MeteringRunScope, V as MeteringRunStatus, X as MeteringSettleInput, Y as MeteringUsage, Z as MeteringUsageInput, _ as PI_PACKAGE_RESOURCE_FILTERS, $ as PiExtensionFactory, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as mergePiPackageSources, aa as normalizeMeteringUsage, ab as piPackageSourceKey } from '../types-D_SD-7_l.js';
+import { E as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, S as Sandbox } from '../sandbox-KQiEdz4W.js';
+export { R as RuntimeFilesystemCapability } from '../sandbox-KQiEdz4W.js';
+import { R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, b as RemoteWorkerExecRequest } from '../middleware-Cq_cYHjJ.js';
+export { c as REMOTE_WORKER_PROVIDER, d as REMOTE_WORKER_RUNTIME_CWD, e as RemoteWorkerErrorPayload, f as RemoteWorkerExecResponse, g as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, h as WORKER_REQUEST_ID_HEADER, i as WORKER_WORKSPACE_ID_HEADER, j as createAgentAuthMiddleware } from '../middleware-Cq_cYHjJ.js';
 import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
-import { S as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, A as AgentDeployment, b as ShareEntryStore, P as PluginRestartWarning, W as WorkspaceAgentDispatcherContext, c as WorkspaceAgentDispatcher, d as ProviderId, e as CredentialFieldId, R as ResolvedCredentialMaterialV1, f as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, g as WorkspaceCredentialAuthorityVerifierV1, h as CredentialConsumerBindingRegistryV1, i as ProviderRegistryV1, j as WorkspaceCredentialResolverV1, k as ProviderCredentialRefV1, l as ResolvedCredentialLeaseV1 } from '../lease-CusB-uLg.js';
-import { s as AgentConfig, b as Agent, d as AgentActor, j as AgentEvent, t as AgentTool, u as AgentHarnessFactory, T as TelemetrySink, A as AgentHarness } from '../harness-Cc48o6uS.js';
-export { v as AgentHarnessFactoryInput } from '../harness-Cc48o6uS.js';
-import { b as PiChatEvent, E as ErrorCode, l as SessionCtx, S as SessionStore, m as SessionListOptions, k as SessionSummary, n as PiChatSnapshot, c as PromptPayload, d as PromptReceipt, F as FollowUpPayload, e as FollowUpReceipt, f as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-BsMp3MSo.js';
-import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, d as AgentSessionSummary, e as AgentSessionStateSnapshot, f as AgentSessionConnection, J as JsonValue, g as AgentGatewayErrorDTO } from '../errors-G6T6S7PQ.js';
+import { S as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, A as AgentDeployment, b as ShareEntryStore, P as ProviderId, c as CredentialFieldId, R as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, W as WorkspaceCredentialAuthorityVerifierV1, e as CredentialConsumerBindingRegistryV1, f as ProviderRegistryV1, g as WorkspaceCredentialResolverV1, h as ProviderCredentialRefV1, i as ResolvedCredentialLeaseV1 } from '../lease-D8WC6pQl.js';
+import { E as ErrorCode, l as SessionCtx, b as PiChatEvent, S as SessionStore, m as SessionListOptions, k as SessionSummary, n as PiChatSnapshot, c as PromptPayload, d as PromptReceipt, F as FollowUpPayload, e as FollowUpReceipt, f as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-B3ehh9V0.js';
+import { J as JsonValue, b as AgentGateway, c as AuthorizedAgentScope, d as AgentSessionRef, e as AgentSessionActivity, V as VerifiedAgentScopeClaim, f as AgentGatewayErrorDTO, g as AgentSessionSummary, h as AgentSessionStateSnapshot, i as AgentSessionConnection } from '../errors-cNC4HMpV.js';
+import { d as AgentActor, j as AgentEvent, T as TelemetrySink, s as AgentTool, t as AgentHarnessFactory, A as AgentHarness } from '../harness-DS8jLKIx.js';
+export { u as AgentConfig, v as AgentHarnessFactoryInput } from '../harness-DS8jLKIx.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { FastifyRequest, FastifyInstance, FastifyPluginAsync } from 'fastify';
-import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult, a as AgentEffectAdmission$1 } from '../piChatSessionService-C0KbcGw9.js';
-import { BoringAgentRuntimePaths } from '@hachej/boring-sandbox/providers/node-workspace';
+import { FastifyRequest, FastifyInstance, FastifyPluginCallback } from 'fastify';
+import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult } from '../piChatSessionService-xnv8rcdh.js';
+import { W as WorkspaceAgentDirectRunInput, a as WorkspaceAgentDirectRunCallback, b as WorkspaceAgentDispatcherContext, c as WorkspaceAgentDispatcher, d as WorkspaceAgentGatewayBinding } from '../file-search-QxnanNjO.js';
+export { L as LeaseBoundWorkspaceAgent } from '../file-search-QxnanNjO.js';
+import { SettingsManager } from '@mariozechner/pi-coding-agent';
 import '@hachej/boring-bash/agent';
-import '@mariozechner/pi-coding-agent';
+import '@hachej/boring-sandbox/providers/node-workspace';
 import 'zod';
 
 declare function provisionWorkspaceRuntime(opts: ProvisionWorkspaceRuntimeOptions): Promise<WorkspaceProvisioningResult>;
 
+declare function createResourceSettingsManager(cwd: string, agentDir: string, piPackages: PiPackageSource[], options?: {
+    includePackage?: (source: PiPackageSource) => boolean;
+}): SettingsManager;
+
 /**
  * uv setup for Python-family runtimes (e.g. Vercel `python3.13`), which already
  * ship `pip` and usually `uv`. Verify-or-install via the on-PATH `uv`.
@@ -190,8 +197,13 @@ declare function createVercelSandboxModeAdapter(options: {
     workspaceRoot: string;
 }): RuntimeModeAdapter;
 
+declare function createBlaxelSandboxModeAdapter(options: {
+    provider: SandboxProviderV1;
+    runtimeHost: AgentRuntimeHostOperations;
+}): RuntimeModeAdapter;
+
 interface ProviderRuntimeModeAdapterOptions {
-    id: 'direct' | 'local' | 'vercel-sandbox';
+    id: BuiltinRuntimeModeId;
     provider: SandboxProviderV1;
     runtimeHost: AgentRuntimeHostOperations;
     workspaceFsCapability: 'strong' | 'best-effort';
@@ -214,39 +226,7 @@ interface SandboxRuntimeModeOptions {
 declare function resolveBuiltinRuntimeLayoutRoot(mode: BuiltinRuntimeModeId, workspaceRoot: string): string;
 declare function createSandboxRuntimeModeAdapter(mode: BuiltinRuntimeModeId, options?: SandboxRuntimeModeOptions): RuntimeModeAdapter;
 
-interface EventStreamReadResult {
-    events: Array<{
-        data: unknown;
-        offset: string;
-    }>;
-    nextOffset: string;
-    upToDate: boolean;
-    closed: boolean;
-}
-interface EventStreamMeta {
-    nextOffset: string;
-    closed: boolean;
-}
-interface EventStreamStore {
-    createStream(path: string): Promise<void>;
-    appendEvent(path: string, event: unknown): Promise<string>;
-    appendEventOnce(path: string, key: string, event: unknown): Promise<string>;
-    appendAgentEvent(sessionId: string, chunk: PiChatEvent, opts?: {
-        idempotencyKey?: string;
-        streamPath?: string;
-    }): Promise<string>;
-    readEvents(path: string, opts?: {
-        offset?: string;
-        limit?: number;
-    }): Promise<EventStreamReadResult>;
-    closeStream(path: string): Promise<void>;
-    getStreamMeta(path: string): Promise<EventStreamMeta | null>;
-    subscribe(path: string, listener: () => void): () => void;
-}
-
-declare function createAgent(config: AgentConfig): Agent;
-
-type AgentDirectoryCompilerErrorCode = 'AGENT_DIRECTORY_NOT_FOUND' | 'AGENT_DIRECTORY_NOT_DIRECTORY' | 'AGENT_MANIFEST_NOT_FOUND' | 'AGENT_MANIFEST_NOT_FILE' | 'AGENT_MANIFEST_INVALID_UTF8' | 'AGENT_MANIFEST_INVALID_JSON' | 'AGENT_ASSET_NOT_FOUND' | 'AGENT_ASSET_NOT_FILE' | 'AGENT_ASSET_INVALID_UTF8' | 'AGENT_PATH_SYMLINK_ESCAPE' | 'AGENT_PATH_CHANGED_DURING_READ' | 'AGENT_DIRECTORY_IO_FAILED';
+type AgentDirectoryCompilerErrorCode = 'AGENT_DIRECTORY_NOT_FOUND' | 'AGENT_DIRECTORY_NOT_DIRECTORY' | 'AGENT_MANIFEST_NOT_FOUND' | 'AGENT_MANIFEST_NOT_FILE' | 'AGENT_MANIFEST_INVALID_UTF8' | 'AGENT_MANIFEST_INVALID_JSON' | 'AGENT_MANIFEST_MISSING_BORING_AGENT' | 'AGENT_ASSET_NOT_FOUND' | 'AGENT_ASSET_NOT_FILE' | 'AGENT_ASSET_INVALID_UTF8' | 'AGENT_PATH_SYMLINK_ESCAPE' | 'AGENT_PATH_CHANGED_DURING_READ' | 'AGENT_DIRECTORY_IO_FAILED';
 type AgentDirectoryCompilerPublicErrorCode = Extract<ErrorCode, 'CONFIG_INVALID' | 'PATH_NOT_FOUND' | 'PATH_SYMLINK_ESCAPE'>;
 declare class AgentDirectoryCompilerError extends Error {
     readonly code: AgentDirectoryCompilerPublicErrorCode;
@@ -261,6 +241,12 @@ declare class AgentDirectoryCompilerError extends Error {
     });
 }
 declare function compileAgentDirectory(directory: string): Promise<CompiledAgentBundle>;
+/**
+ * Compiles a persona authored as a plugin-shaped package: `package.json`'s
+ * `boring.agent` block stands in for `agent.json`, `instructions.md` is
+ * unchanged. Used for `.agents/personas/<seat>` fleet packages.
+ */
+declare function compilePersonaPackageDirectory(directory: string): Promise<CompiledAgentBundle>;
 
 type AuthoredAgentMaterializationErrorCode = Extract<ErrorCode, 'AUTHORED_AGENT_ID_INVALID' | 'AUTHORED_AGENT_TYPE_MISMATCH' | 'AUTHORED_AGENT_REFERENCE_UNSUPPORTED'>;
 type AuthoredAgentSourceV1 = Readonly<{
@@ -270,10 +256,23 @@ type AuthoredAgentSourceV1 = Readonly<{
     label?: string;
     description?: string;
     instructions: string;
+    /**
+     * Computed identity of the compiled definition (instructions + knowledge
+     * bytes). The digest, not the version string, is the definition identity.
+     */
+    definitionDigest?: string;
+    /** Host path of the package's optional `knowledge/` folder, when present. */
+    knowledgeDir?: string;
 }>;
 interface MaterializeAgentDirectoryInput {
     directory: string;
     expectedAgentTypeId?: string;
+    /**
+     * Manifest shape to compile. Defaults to `agent.json` for backward
+     * compatibility. `package.json` reads the `boring.agent` block, used by
+     * plugin-shaped personas (`.agents/personas/<seat>`).
+     */
+    manifest?: 'agent.json' | 'package.json';
 }
 declare class AuthoredAgentMaterializationError extends Error {
     readonly code: AuthoredAgentMaterializationErrorCode;
@@ -290,6 +289,189 @@ declare class AuthoredAgentMaterializationError extends Error {
  */
 declare function materializeAgentDirectory(input: MaterializeAgentDirectoryInput): Promise<AuthoredAgentSourceV1>;
 
+interface TrustedAgentInstructionAppendix {
+    readonly name: string;
+    readonly content: string;
+    readonly digest: Sha256Digest;
+}
+interface TrustedAuthoredAgentPolicy {
+    readonly fallbackLabel?: string;
+    /**
+     * Workspace-relative authored instruction sources for this agent, supplied
+     * by the trusted composer that actually knows where they live.
+     */
+    readonly instructionFiles?: readonly AgentInstructionFileRef[];
+    readonly instructionAppendices?: readonly TrustedAgentInstructionAppendix[];
+    readonly plugins?: readonly {
+        readonly name: string;
+        readonly config?: JsonValue;
+    }[];
+    readonly preferredModel?: string;
+}
+interface CreateConfiguredAgentHostAgentSpecInput {
+    readonly source: AuthoredAgentSourceV1;
+    readonly policy?: TrustedAuthoredAgentPolicy;
+}
+declare class TrustedAgentCompositionError extends Error {
+    readonly code: "CONFIG_INVALID";
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+/**
+ * Maps identity-only authored data into AgentHost configuration. Every behavior
+ * input is supplied separately by trusted host composition.
+ */
+declare function createConfiguredAgentHostAgentSpec(input: CreateConfiguredAgentHostAgentSpecInput): Promise<ConfiguredAgentHostAgentSpec>;
+
+interface ModelTierCandidate {
+    readonly provider: string;
+    readonly id: string;
+    readonly envVar: string;
+}
+interface FleetSkillBinding {
+    readonly name: string;
+    readonly digest: Sha256Digest;
+}
+interface FleetSeatBinding {
+    readonly seat: string;
+    readonly agentTypeId: string;
+    readonly skills: readonly FleetSkillBinding[];
+}
+interface DiscoveredAgentPackageDescriptor {
+    readonly rootDir: string;
+    readonly manifest: {
+        readonly boring: {
+            readonly agent: {
+                readonly definitionId: string;
+                readonly version: string;
+                readonly label?: string;
+                readonly description?: string;
+                readonly instructionsRef: string;
+            };
+        };
+        readonly pi?: {
+            readonly skills?: readonly string[];
+        };
+    };
+    readonly preflight: {
+        readonly ok: boolean;
+        readonly errors?: readonly {
+            readonly code: string;
+            readonly message: string;
+        }[];
+    };
+}
+interface LoadConfiguredAgentFleetOptions {
+    /** Plugin-manager scan descriptors injected by the workspace/CLI boot layer. */
+    readonly discoveredPackages: readonly DiscoveredAgentPackageDescriptor[];
+    /**
+     * Root of the workspace the `user` filesystem serves, or `null` when the
+     * host resolves a DIFFERENT root per request (core, the CLI hub) and so has
+     * no single one at fleet-composition time.
+     *
+     * Required, because published `instructionFiles` are addressed relative to
+     * it and only the caller knows it. It is NOT derivable from the discovered
+     * package roots: a fleet can be composed from packages that live outside
+     * the workspace root, and guessing produced well-formed paths that
+     * resolved to nothing.
+     *
+     * `null` is not a soft option — it makes the host structurally unable to
+     * publish a ref it cannot guarantee, which is the honest answer for
+     * per-workspace roots.
+     */
+    readonly workspaceRoot: string | null;
+    /** Path to `.agents/factory/fleet.yaml`. */
+    readonly fleetConfigPath: string;
+    /** Path to `.agents/factory/policy.yaml` (read for `models.seats` tiers). */
+    readonly policyPath: string;
+    /**
+     * Directory containing `<skill>/SKILL.md` canonical skill sources.
+     * This root is host-owned because shared skill names are not package paths.
+     */
+    readonly skillsRoot: string;
+    /** Overridable for tests; defaults to `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+}
+type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED' | 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
+interface FleetLoaderDiagnostic {
+    readonly seat?: string;
+    readonly agentTypeId: string;
+    readonly code: FleetLoaderDiagnosticCode;
+    readonly message: string;
+}
+interface LoadConfiguredAgentFleetResult {
+    readonly agents: readonly ConfiguredAgentHostAgentSpec[];
+    readonly diagnostics: readonly FleetLoaderDiagnostic[];
+}
+type FleetConfigErrorCode = Extract<ErrorCode, 'AGENT_FLEET_CONFIG_FILE_INVALID'>;
+/** Thrown for whole-fleet configuration failures (not per-seat, fail-closed). */
+declare class FleetConfigError extends Error {
+    readonly code: FleetConfigErrorCode;
+    readonly field: string;
+    constructor(input: {
+        field: string;
+        message: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Loads the config-driven production/CLI agent fleet: `.agents/factory/fleet.yaml`
+ * seat → skill-digest bindings, boot-injected plugin-shaped persona package
+ * descriptors, `.agents/factory/policy.yaml` `models.seats` tiers, and the
+ * priority-ordered `models.tiers` candidates declared in fleet.yaml.
+ *
+ * Fails closed per seat: a persona that fails materialization, digest
+ * verification, or spec composition is excluded with a stable diagnostic —
+ * the remaining valid seats still compose. Whole-fleet config errors (an
+ * unreadable/malformed fleet.yaml or policy.yaml) throw `FleetConfigError`,
+ * since there is no seat set to fail closed against.
+ */
+declare function loadConfiguredAgentFleet(options: LoadConfiguredAgentFleetOptions): Promise<LoadConfiguredAgentFleetResult>;
+
+declare const LEGACY_DEFAULT_AGENT_FLEET: readonly AgentHostAgentSpec[];
+interface ResolveDefaultAgentFleetOptions {
+    /**
+     * Repository root used to resolve `.agents/{factory,skills}` when
+     * `BORING_AGENT_FLEET=1` composes the fleet. Defaults to `process.cwd()`.
+     */
+    readonly repositoryRoot?: string;
+    /** Asset-manager scan results supplied by the workspace/CLI boot layer. */
+    readonly discoveredPackages?: readonly DiscoveredAgentPackageDescriptor[];
+    /**
+     * Root of the workspace the `user` filesystem serves, or `null` when the
+     * host resolves one per request. Explicit rather than defaulted, because it
+     * is a DIFFERENT root from `repositoryRoot` in every multi-workspace host —
+     * the two only coincide in the single-root dogfood/playground case.
+     * Personas outside it are not published as openable instruction refs (see
+     * `loadConfiguredAgentFleet`): a well-formed path the workbench cannot open
+     * is worse than no link.
+     */
+    readonly workspaceRoot: string | null;
+    /** Overridable for tests; defaults to `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * `BORING_AGENT_FLEET=1` composes the config-driven production fleet
+ * from boot-injected plugin scan descriptors plus `.agents/factory` under `repositoryRoot`
+ * alongside the default agent; flag absent preserves the legacy
+ * single-default-agent boot byte-identically. Shared by
+ * `createWorkspaceAgentServer`, `createCoreWorkspaceAgentServer`, and the CLI
+ * hub — one composition path for every production/CLI entry point.
+ *
+ * Fails closed at two levels:
+ *  - Per seat: `loadConfiguredAgentFleet` excludes an individual invalid
+ *    persona/skill with a stable diagnostic; the remaining seats still boot
+ *    (see its own docstring).
+ *  - Whole fleet: a missing/malformed `fleet.yaml` or `policy.yaml` would
+ *    otherwise throw `FleetConfigError` out of the boot path. That throw is
+ *    preserved for direct/programmatic callers of `loadConfiguredAgentFleet`
+ *    (e.g. the playground, tests), but this boot-seam wrapper catches it and
+ *    degrades to the legacy default-agent-only fleet plus a logged
+ *    diagnostic — a container with the flag on and no `.agents/` tree must
+ *    still boot.
+ */
+declare function resolveDefaultAgentFleet(options: ResolveDefaultAgentFleetOptions): Promise<readonly AgentHostAgentSpec[]>;
+
 interface ResolvedAgentDigestInput {
     readonly workspaceId: string;
     readonly defaultDeploymentId: string;
@@ -412,7 +594,7 @@ interface ManagedAgentCollectArtifactsInput {
 }
 interface ManagedAgentMcpDelegateOptions {
     gateway?: AgentGateway;
-    agentTypeId?: string;
+    agentTypeId: string;
     resolveGatewayScope?(input: {
         brief: string;
         ctx: SessionCtx;
@@ -527,23 +709,6 @@ declare function shareResourceUri(id: string): string;
  */
 declare function registerShareEntryResources(server: McpServer, options: ShareEntryMcpResourceOptions): void;
 
-interface ReloadHookDiagnostic {
-    source: string;
-    message: string;
-    pluginId?: string;
-}
-interface ReloadHookResult {
-    /**
-     * One per plugin that loaded successfully but whose server-side
-     * surfaces (routes, agentTools) still hold pre-reload code. The
-     * /api/v1/agent/reload response surfaces these so the chat UI can
-     * render a "restart needed" banner without subscribing to SSE.
-     */
-    restart_warnings?: ReadonlyArray<PluginRestartWarning>;
-    /** Non-fatal plugin reload diagnostics to surface to the caller/UI. */
-    diagnostics?: ReadonlyArray<ReloadHookDiagnostic>;
-}
-
 interface RuntimeEnvContributionContext {
     workspaceId: string;
     workspaceRoot: string;
@@ -554,6 +719,17 @@ interface RuntimeEnvContribution {
     id: string;
     getEnv(ctx: RuntimeEnvContributionContext): Record<string, string> | Promise<Record<string, string>>;
 }
+declare function withRuntimeEnvContributions(runtimeBundle: RuntimeBundle, baseContext: RuntimeEnvContributionContext, contributions: RuntimeEnvContribution[], telemetry?: TelemetrySink): RuntimeBundle;
+
+interface AuthorizedSessionRunDetails {
+    runId: string;
+    terminalEntryId: string;
+    state: 'success' | 'error' | 'aborted' | 'interrupted';
+    createdAt?: string;
+    details: readonly unknown[];
+}
+/** Redact a session snapshot to terminal run identity and allowlisted structured details. */
+declare function projectAuthorizedSessionRunDetails(messages: readonly unknown[], detailKinds: readonly string[]): AuthorizedSessionRunDetails[];
 
 interface WorkspaceAgentDispatcherResolveOptions {
     request?: FastifyRequest;
@@ -593,47 +769,48 @@ interface WorkspaceAgentDispatcherBinding {
     }): Promise<BoundPiSession>;
 }
 interface WorkspaceAgentDispatcherResolver {
+    /** Callback-scoped canonical Host operation; no dispatcher or Workspace escapes. */
+    runWithWorkspaceAgent(input: WorkspaceAgentDirectRunInput & {
+        request?: FastifyRequest;
+    }, run: WorkspaceAgentDirectRunCallback): Promise<void>;
     resolve(ctx: WorkspaceAgentDispatcherContext, options?: WorkspaceAgentDispatcherResolveOptions): Promise<WorkspaceAgentDispatcher>;
     resolveWithWorkspace?(ctx: WorkspaceAgentDispatcherContext, options?: WorkspaceAgentDispatcherResolveOptions): Promise<WorkspaceAgentDispatcherBinding>;
+    /** Authorize one exact addressed native session without exposing transcript data. */
+    authorizeSession?(ctx: WorkspaceAgentDispatcherContext, ref: AgentSessionRef, options?: WorkspaceAgentDispatcherResolveOptions): Promise<void>;
+    /** Authorized transcript-redacted projection of allowlisted structured run details. */
+    readSessionRunDetails?(ctx: WorkspaceAgentDispatcherContext, ref: AgentSessionRef, detailKinds: readonly string[], options?: WorkspaceAgentDispatcherResolveOptions): Promise<readonly AuthorizedSessionRunDetails[]>;
 }
+/**
+ * Bind the compatibility dispatcher surface to one addressed AgentGateway
+ * capability. The gateway, scope, and agent type are supplied only by the
+ * trusted composition root.
+ */
+declare function createBoundWorkspaceAgentDispatcher(binding: WorkspaceAgentGatewayBinding, ctx: WorkspaceAgentDispatcherContext): WorkspaceAgentDispatcher;
 
-interface CreateAgentAppOptions {
+interface CreateStandaloneAgentHostAppOptions {
     workspaceRoot?: string;
     sessionId?: string;
     templatePath?: string;
     mode?: RuntimeModeId;
-    /** Supply a custom runtime adapter to plug in non-built-in sandbox/workspace modes. */
     runtimeModeAdapter?: RuntimeModeAdapter;
-    /** Provider/runtime values supplied by the embedding host. */
     runtimeHost?: AgentRuntimeHostOperations;
     authToken?: string;
     version?: string;
     logger?: boolean;
+    /** Standalone defaults to a warm runtime; readiness smokes may keep binding lazy. */
+    initializeRuntime?: boolean;
     extraTools?: AgentTool[];
-    /** When true, omit the six filesystem tools (read/write/edit/find/grep/ls). */
     disableDefaultFileTools?: boolean;
-    /**
-     * Append-only addendum to the underlying agent's system prompt. Cannot
-     * replace the base prompt — host apps EXTEND it (e.g. document app-
-     * specific tools, panes, data conventions). Plumbed to pi-coding-agent
-     * via DefaultResourceLoader's `appendSystemPromptSource`.
-     */
     systemPromptAppend?: string;
-    /** Override the default pi-backed harness with a custom agent runtime. */
     harnessFactory?: AgentHarnessFactory;
-    /** Optional pi adapter/runtime knobs used by the default harness. */
     pi?: PiHarnessOptions;
-    /** Optional runtime provisioning result used to wire generated PATH/env/skills into tools and Pi. */
+    /** Additional host roots allowed to contribute local Pi resource bytes. */
+    piResourceAuthorizedRoots?: string[];
     runtimeProvisioning?: WorkspaceProvisioningResult;
-    /** Optional dynamic runtime provisioning source used after /reload refreshes generated env/PATH. */
     getRuntimeProvisioning?: () => WorkspaceProvisioningResult | undefined;
-    /** Optional stable namespace for file-backed session storage. */
     sessionNamespace?: string;
-    /** Optional best-effort telemetry sink supplied by an embedding host. */
     telemetry?: TelemetrySink;
-    /** Optional billing sink for native Pi usage (see AgentMeteringSink). */
     metering?: AgentMeteringSink;
-    /** Generic filesystem binding seam for standalone embeddings. */
     getFilesystemBindings?: (ctx: {
         request?: FastifyRequest;
         sessionId?: string;
@@ -644,47 +821,40 @@ interface CreateAgentAppOptions {
         userEmailVerified?: boolean;
         requestId?: string;
     }) => RuntimeFilesystemBinding[] | undefined | Promise<RuntimeFilesystemBinding[] | undefined>;
-    /**
-     * Trusted host seam for resolving Pi HTTP session scope. The default keeps
-     * unauthenticated requests workspace-only and authenticated requests user-scoped.
-     */
     resolvePiSessionRequestContext?: (request: FastifyRequest, defaultContext: PiSessionRequestContext) => PiSessionRequestContext | Promise<PiSessionRequestContext>;
-    /** Generic runtime env contributors. Agent stays workspace-neutral; hosts decide env names/values. */
     runtimeEnvContributions?: RuntimeEnvContribution[];
-    /** Runtime-aware provisioning hook. Runs after Workspace/Sandbox creation and before tools/harness. */
     runtimeProvisioner?: (ctx: {
         workspaceRoot: string;
         runtimeMode: RuntimeModeId;
         runtimeBundle: RuntimeBundle;
     }) => Promise<void>;
-    /** Optional explicit file-backed session directory. Mostly for tests/hosts. */
     sessionDir?: string;
-    /** Optional explicit root for file-backed session directories. */
     sessionRoot?: string;
-    /**
-     * Enable user/global Pi extension auto-discovery from .pi/ and ~/.pi.
-     * App/internal plugins should be passed through extraTools/pi instead.
-     * Defaults to true for standalone agent compatibility.
-     */
     externalPlugins?: boolean;
-    /**
-     * Called BEFORE the harness reloads its session. May return a
-     * `ReloadHookResult` (with `restart_warnings` and/or diagnostics) —
-     * surfaced verbatim on the /api/v1/agent/reload response. `void` /
-     * undefined return = no warnings (backwards compatible).
-     */
-    beforeReload?: () => void | ReloadHookResult | undefined | Promise<void | ReloadHookResult | undefined>;
-    /**
-     * Optional dynamic system-prompt source forwarded to the harness. The
-     * harness calls it whenever it builds or rebuilds a session prompt. Used by
-     * the workspace plugin layer.
-     */
+    beforeReload?: () => void | {
+        readonly diagnostics?: ReadonlyArray<{
+            source: string;
+            message: string;
+            pluginId?: string;
+        }>;
+        readonly restart_warnings?: ReadonlyArray<{
+            id: string;
+            surfaces: readonly string[];
+            message: string;
+        }>;
+    } | undefined | Promise<void | {
+        readonly diagnostics?: ReadonlyArray<{
+            source: string;
+            message: string;
+            pluginId?: string;
+        }>;
+        readonly restart_warnings?: ReadonlyArray<{
+            id: string;
+            surfaces: readonly string[];
+            message: string;
+        }>;
+    } | undefined>;
     systemPromptDynamic?: () => string | undefined | Promise<string | undefined>;
-    /**
-     * Optional host callback returning current plugin/skill load diagnostics
-     * for this workspace. Surfaced by the `plugin_diagnostics` agent tool so the
-     * model can iterate on plugin/skill load errors after a /reload.
-     */
     getPluginDiagnostics?: (args: {
         workspaceId: string;
         workspaceRoot: string;
@@ -693,13 +863,52 @@ interface CreateAgentAppOptions {
         message: string;
         pluginId?: string;
     }>>;
-    /**
-     * Trusted in-process host composition seam. The resolver trusts caller-supplied
-     * workspace/user context; callers must authorize that context before resolving.
-     */
     onWorkspaceAgentDispatcher?: (resolver: WorkspaceAgentDispatcherResolver) => void;
 }
-declare function createAgentApp(opts?: CreateAgentAppOptions): Promise<FastifyInstance>;
+/** Thin standalone HTTP shell over one directly composed CreatedAgentHost. */
+declare function createStandaloneAgentHostApp(options?: CreateStandaloneAgentHostAppOptions): Promise<FastifyInstance>;
+
+interface AgentHostEnvironmentHttpProjectionOptions {
+    readonly created: CreatedAgentHost;
+    readonly authorizeAgentRequest: (request: FastifyRequest) => Promise<AuthorizedAgentScope>;
+    readonly runtimeHost?: AgentRuntimeHostOperations;
+    readonly getWorkspaceHostRoot?: (request: FastifyRequest) => string | undefined | Promise<string | undefined>;
+}
+/**
+ * Mount application-owned filesystem routes over finite Host Environment leases.
+ * The FS event stream explicitly retains its lease until the transport closes.
+ */
+declare function registerAgentHostEnvironmentRoutes(app: FastifyInstance, options: AgentHostEnvironmentHttpProjectionOptions): Promise<void>;
+
+interface EventStreamReadResult {
+    events: Array<{
+        data: unknown;
+        offset: string;
+    }>;
+    nextOffset: string;
+    upToDate: boolean;
+    closed: boolean;
+}
+interface EventStreamMeta {
+    nextOffset: string;
+    closed: boolean;
+}
+interface EventStreamStore {
+    createStream(path: string): Promise<void>;
+    appendEvent(path: string, event: unknown): Promise<string>;
+    appendEventOnce(path: string, key: string, event: unknown): Promise<string>;
+    appendAgentEvent(sessionId: string, chunk: PiChatEvent, opts?: {
+        idempotencyKey?: string;
+        streamPath?: string;
+    }): Promise<string>;
+    readEvents(path: string, opts?: {
+        offset?: string;
+        limit?: number;
+    }): Promise<EventStreamReadResult>;
+    closeStream(path: string): Promise<void>;
+    getStreamMeta(path: string): Promise<EventStreamMeta | null>;
+    subscribe(path: string, listener: () => void): () => void;
+}
 
 interface HarnessPiChatServiceOptions {
     harness: AgentHarness;
@@ -718,6 +927,15 @@ interface HarnessPiChatServiceOptions {
     onEvent?: (sessionId: string, event: PiChatEvent) => void;
     /** Receives non-fatal metering pipeline failures (default: console.warn). */
     meteringLogger?: MeteringErrorLogger;
+    /** Canonical HTTP projection for lazily loaded persisted attachment bytes. */
+    attachmentUrl?: (input: {
+        readonly sessionId: string;
+        readonly messageId: string;
+        readonly index: number;
+        readonly data?: string;
+        readonly mediaType?: string;
+        readonly filename?: string;
+    }) => string;
 }
 declare class HarnessPiChatService implements PiChatSessionService {
     private readonly harness;
@@ -726,12 +944,15 @@ declare class HarnessPiChatService implements PiChatSessionService {
     private readonly workspace?;
     private readonly eventStore?;
     private readonly onEvent?;
+    private readonly attachmentUrl?;
     private readonly channels;
     private readonly channelCreations;
+    private readonly sessionGenerations;
     private readonly messageMetadata;
     private readonly activePromptRuns;
     private readonly syntheticPromptFailures;
     private readonly activeSyntheticPromptErrors;
+    private readonly liveAttachments;
     private readonly lifecycle;
     private readonly metering?;
     private disposePromise?;
@@ -745,13 +966,25 @@ declare class HarnessPiChatService implements PiChatSessionService {
     deleteSession(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
     private deleteSessionBeforeDispose;
     readAttachment(ctx: PiSessionRequestContext, sessionId: string, messageId: string, index: number): Promise<{
-        data: Uint8Array;
-        mediaType: string;
-        filename?: string;
+        readonly data: Uint8Array;
+        readonly mediaType: string;
+        readonly filename?: string;
     }>;
     readState(ctx: PiSessionRequestContext, sessionId: string): Promise<PiChatSnapshot>;
     private readStateBeforeDispose;
+    /**
+     * The persisted transcript can lag the live adapter: transcript writes are
+     * asynchronous, and some harnesses never persist transcripts at all. A
+     * persisted refresh whose seq fences the live replay buffer while its
+     * messages are missing would permanently hide those turns from a hydrating
+     * client (it starts "caught up" at that seq with an empty timeline), so
+     * refresh from persisted state only when it carries at least as much
+     * rendered history as the live adapter.
+     */
+    private persistedStateDropsLiveMessages;
+    private canRefreshFromPersistedState;
     private harnessMayHaveLiveSession;
+    private attachmentUrlFor;
     private readPersistedState;
     subscribe(ctx: PiSessionRequestContext, sessionId: string, cursor: number, subscriber: PiChatEventSubscriber): Promise<PiChatEventStreamResult>;
     private subscribeBeforeDispose;
@@ -787,8 +1020,23 @@ declare class HarnessPiChatService implements PiChatSessionService {
     private ensureChannel;
     /** Coalesce concurrent cold callers so only one adapter subscription wins. */
     private createChannelOnce;
+    private generationOf;
+    private assertSessionIncarnation;
     private buildChannel;
+    /** Cheap cold-snapshot seq lookup (no buffer hydration) — see {@link hydrateDurableReplayBuffer} for the live-channel path. */
     private readDurableLatestPiChatSeq;
+    /**
+     * On cold channel construction, rehydrate a fresh {@link PiChatReplayBuffer}
+     * from the durable event store (when present) so resuming clients replay
+     * genuinely — not merely resume seq counting from a high-water-mark with an
+     * empty buffer, which forces every behind-the-tip cursor into
+     * `PI_CHAT_REPLAY_GAP`. Reads at most the buffer's own retention window
+     * (`DEFAULT_REPLAY_BUFFER_MAX_EVENTS`) worth of trailing entries — older
+     * history is already outside what the in-memory buffer would retain even
+     * across a live process, so this preserves prior semantics for very long
+     * streams while fixing the common "just restarted" resume case.
+     */
+    private hydrateDurableReplayBuffer;
     /**
      * Validate the persisted session identity and instantiate its lazily-created
      * Pi adapter under the same full cache key. This is intentionally a narrow
@@ -814,7 +1062,6 @@ interface EnvironmentLease {
 }
 
 interface BuiltAgentComposition {
-    readonly agent: Agent;
     readonly harness: AgentHarness;
     readonly sessionStore: SessionStore;
     readonly service: HarnessPiChatService;
@@ -830,17 +1077,27 @@ interface AgentSessionRuntimeAuthority {
     /** Absent only for a pre-AH0 transcript created before runtime pins existed. */
     readonly runtimeScopeIdentity?: string;
 }
+interface AgentSessionActivityUpdate {
+    readonly ref: AgentSessionRef;
+    readonly status: AgentSessionActivity;
+}
 /** Process-lifetime live-turn projection. Reads never create activity rows. */
 declare class AgentSessionActivityIndex {
     private readonly activity;
+    private readonly subscribers;
     get(workspaceScopeId: string, ref: AgentSessionRef): AgentSessionActivity;
-    set(workspaceScopeId: string, ref: AgentSessionRef, activity: AgentSessionActivity): void;
+    set(workspaceScopeId: string, ref: AgentSessionRef, status: AgentSessionActivity): void;
+    snapshot(workspaceScopeId: string): AgentSessionActivityUpdate[];
+    subscribe(workspaceScopeId: string, subscriber: (update: AgentSessionActivityUpdate) => void): () => void;
     delete(workspaceScopeId: string, ref: AgentSessionRef): void;
     observe(workspaceScopeId: string, ref: AgentSessionRef, event: PiChatEvent): void;
 }
 
 interface RuntimeBinding {
     readonly key: string;
+    readonly agentTypeId: string;
+    readonly workspaceScopeId: string;
+    readonly generation: number;
     readonly scope: ResolvedAgentRuntimeScope;
     readonly environmentLease: EnvironmentLease;
     readonly composition: BuiltAgentComposition;
@@ -852,21 +1109,45 @@ interface AgentHostRuntime {
     readonly ledger: AgentRequestLedger;
     readonly effectAdmission: AgentEffectAdmission;
     readonly activity: AgentSessionActivityIndex;
+    readonly shutdownGraceMs: number;
     listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim): Promise<readonly SessionSummary[]>;
     isDraining(): boolean;
     assertOpen(): void;
     verify(scope: AuthorizedAgentScope): Promise<VerifiedAgentScopeClaim>;
+    resolveEnvironmentScope(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<AgentHostEnvironmentScope>;
+    acquireEnvironment(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<EnvironmentLease>;
+    acquireResolvedEnvironment(workspaceScopeId: string, environment: AgentHostEnvironmentScope): Promise<EnvironmentLease>;
     resolveSessionRuntime(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, sessionId: string): Promise<AgentSessionRuntimeAuthority | undefined>;
-    resolveBinding(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, resolvedRuntimeScope?: ResolvedAgentRuntimeScope): Promise<RuntimeBinding>;
+    resolveAgentRuntimeScope(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: 'new-binding' | 'existing-session' | 'reload', requestId: string, sessionId?: string): Promise<ResolvedAgentRuntimeScope>;
+    resolveBinding(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, resolvedRuntimeScope?: ResolvedAgentRuntimeScope, purpose?: 'current' | 'pinned'): Promise<RuntimeBinding>;
+    findPublishedBinding(agentTypeId: string, workspaceScopeId: string, runtimeScopeIdentity?: string, physicalBindingIdentity?: string, provisioningFingerprint?: string): RuntimeBinding | undefined;
+    findPublishedCurrentBinding(agentTypeId: string, workspaceScopeId: string, physicalBindingIdentity: string, runtimeScopeIdentity?: string, provisioningFingerprint?: string): RuntimeBinding | undefined;
     startDrain(): void;
     drainRuntime(): Promise<void>;
     registerSubscription(close: () => void | Promise<void>): () => void;
-    trackEffect<T>(effect: Promise<T>, key: AgentRequestKey): Promise<T>;
-    retireCompatibilityComposition(composition: BuiltAgentComposition): Promise<void>;
+    startPreparedEffect<T>(key: AgentRequestKey, effect: () => Promise<T>): Promise<T>;
+    runBindingOperation<T>(bindingKey: string, operation: () => Promise<T>): Promise<T>;
     closeRuntime(): Promise<void>;
 }
 declare function createAgentHost(options: CreateAgentHostOptions): Promise<CreatedAgentHost>;
 
+/** SQLite-backed atomic ownership/CAS ledger for direct and production projections. */
+declare class SqliteAgentRequestLedger implements AgentRequestLedger {
+    readonly durability: "durable-transactional";
+    private readonly database;
+    constructor(path: string);
+    prepare(key: AgentRequestKey, digest: string): Promise<AgentRequestLedgerPrepareResult>;
+    acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
+    beginEffect(key: AgentRequestKey): Promise<void>;
+    reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
+    complete(key: AgentRequestKey, receipt: JsonValue): Promise<void>;
+    markOutcomeUnknown(key: AgentRequestKey, error: AgentGatewayErrorDTO): Promise<void>;
+    read(key: AgentRequestKey): Promise<AgentRequestLedgerRecord | undefined>;
+    close(): void;
+    private readSync;
+    private transition;
+}
+
 declare const AgentFleetCompilationErrorCode: {
     readonly AGENT_FLEET_PLUGIN_UNKNOWN: "AGENT_FLEET_PLUGIN_UNKNOWN";
     readonly AGENT_FLEET_CONFIG_BINDING_UNKNOWN: "AGENT_FLEET_CONFIG_BINDING_UNKNOWN";
@@ -897,20 +1178,44 @@ interface CreateValidatingAgentFleetCompilerOptions {
  */
 declare function createValidatingAgentFleetCompiler(options: CreateValidatingAgentFleetCompilerOptions): AgentFleetCompiler;
 
-type RetryableSessionGuard = () => Promise<AgentGatewayErrorDTO | undefined>;
 declare class EmbeddedAgentGateway implements AgentGateway {
     private readonly runtime;
     private readonly cursorSecret;
     private readonly connections;
-    private readonly effects;
     private readonly pins;
+    private readonly unpinnedSessionFallbackPins;
     private readonly writerTails;
     private sessionRuntimeResolutionObserver?;
     private closed;
     constructor(runtime: AgentHostRuntime);
+    /** Host-owned addressed runtime-capability effect seam. */
+    runHostEffect(input: {
+        readonly scope: AuthorizedAgentScope;
+        readonly operation: 'agent.reload' | 'session.command.execute';
+        readonly target: AgentRequestTarget;
+        readonly requestId: string;
+        readonly payload: JsonValue;
+        readonly action: () => Promise<JsonValue>;
+        readonly classify?: () => Promise<{
+            readonly kind: 'execute';
+        } | {
+            readonly kind: 'reject';
+            readonly error: AgentGatewayErrorDTO;
+        }>;
+    }): Promise<JsonValue>;
+    /** Host-internal resolver shared by every session-bearing capability route. */
+    resolveHostSessionBinding(scope: AuthorizedAgentScope, ref: AgentSessionRef): Promise<{
+        claim: VerifiedAgentScopeClaim;
+        binding: RuntimeBinding;
+    }>;
+    /** Side-effect-free reload lookup: validates persisted existence/pin and requires an already-published binding. */
+    inspectPublishedSessionBinding(scope: AuthorizedAgentScope, ref: AgentSessionRef): Promise<{
+        claim: VerifiedAgentScopeClaim;
+        binding: RuntimeBinding;
+    }>;
     /** Server-only test observer for distinguishing runtime pin resolution paths. */
     setSessionRuntimeResolutionObserverForTesting(observer: (input: {
-        readonly source: 'pre-ah0-compatibility-fallback' | 'persisted-runtime-pin';
+        readonly source: 'unpinned-session-fallback' | 'persisted-runtime-pin';
         readonly runtimeScopeIdentity: string;
     }) => void): void;
     /** Test-only activity seam used by the shared implementation conformance. */
@@ -924,6 +1229,7 @@ declare class EmbeddedAgentGateway implements AgentGateway {
             version: string;
             digest: string;
         } | undefined;
+        pluginIds?: string[] | undefined;
         agentTypeId: string;
         label: string;
     }[]>;
@@ -941,20 +1247,12 @@ declare class EmbeddedAgentGateway implements AgentGateway {
     private bindingForSession;
     private loadSummary;
     private sessionEffect;
-    /** Internal legacy-alias seam; never exposed through the public Gateway contract. */
-    runLegacyCompatibilityEffect(input: {
-        readonly scope: AuthorizedAgentScope;
-        readonly operation: AgentGatewayEffect;
-        readonly target: AgentRequestTarget;
-        readonly requestId: string;
-        readonly payload: JsonValue;
-        readonly action: () => Promise<unknown>;
-        readonly retryableGuard?: RetryableSessionGuard;
-    }): Promise<unknown>;
     private effect;
+    private applyClassification;
     private replayReceipt;
     private failure;
     private promptAdmission;
+    private queueClearAdmission;
     private withWriter;
     private encodeCursor;
     private decodeCursor;
@@ -962,8 +1260,9 @@ declare class EmbeddedAgentGateway implements AgentGateway {
 
 /** Process-lifetime Level-B ledger with the exact published state machine. */
 declare class InMemoryAgentRequestLedger implements AgentRequestLedger {
+    readonly durability: "in-memory";
     private readonly records;
-    prepare(key: AgentRequestKey, digest: string): Promise<AgentRequestLedgerRecord>;
+    prepare(key: AgentRequestKey, digest: string): Promise<AgentRequestLedgerPrepareResult>;
     acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
     beginEffect(key: AgentRequestKey): Promise<void>;
     reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
@@ -980,10 +1279,12 @@ interface RuntimeScopeIdentityInput {
     }[];
     readonly validatedConfig: JsonValue;
     readonly grants: readonly string[];
-    readonly placementIdentity: string;
+    /** Stable semantic placement class; never an absolute root or lease key. */
+    readonly placementClassIdentity: string;
     readonly isolationMode: string;
     readonly toolContractDigests: readonly string[];
-    readonly provisioningGeneration: string;
+    /** Stable semantic provisioning contract. */
+    readonly provisioningIdentity: string;
     readonly bindingInputs?: JsonValue;
 }
 interface EnvironmentProvisioningIdentityInput {
@@ -1013,247 +1314,146 @@ declare function applyCspHeaders(response: HeaderLike, opts?: {
     dev?: boolean;
 }): void;
 
-interface AgentModelSelection {
-    provider: string;
-    id: string;
+interface DeepLinkRoutesOptions {
+    /** Workspace-agnostic store: entries carry their own `workspaceId`. */
+    store: ShareEntryStore;
+    workspace?: Workspace;
+    /**
+     * Resolves the `Workspace` already authorized for the request's scoped
+     * workspace (the same `getWorkspace` shape used by fileRoutes/treeRoutes —
+     * membership for this workspace is enforced upstream, before this route's
+     * handler runs, by the host's existing `onRequest` seam).
+     */
+    getWorkspace?: (request: FastifyRequest) => Workspace | Promise<Workspace>;
+}
+declare const deepLinkRoutes: FastifyPluginCallback<DeepLinkRoutesOptions>;
+
+interface SkillMetadataFrontmatter {
+    readonly name?: string;
+    readonly description?: string;
 }
+declare function parseSkillMetadataFrontmatter(content: string): SkillMetadataFrontmatter;
+
+interface PiResourceDigestLimits {
+    readonly maxDepth: number;
+    readonly maxFiles: number;
+    readonly maxFileBytes: number;
+    readonly maxTotalBytes: number;
+}
+declare const DEFAULT_PI_RESOURCE_DIGEST_LIMITS: PiResourceDigestLimits;
+interface PiResourceDigestInput {
+    /** Cwd passed to Pi. Explicit skills/extensions resolve from here. */
+    readonly piCwd: string;
+    /** Pi user agent directory. User settings/package sources resolve from here. */
+    readonly piAgentDir: string;
+    /** User home Pi uses for ~/.agents skill discovery. */
+    readonly piUserHome: string;
+    /** Mirrors Pi's noSkills resource-loader option. */
+    readonly noSkills: boolean;
+    readonly promptParts?: readonly (string | undefined)[];
+    readonly additionalSkillPaths?: readonly string[];
+    readonly packages?: readonly PiPackageSource[];
+    readonly extensionPaths?: readonly string[];
+    /** Lexical roots explicitly authorized by the embedding Workspace/CLI. */
+    readonly authorizedRoots: readonly string[];
+    readonly limits?: Partial<PiResourceDigestLimits>;
+}
+interface PiResourceSet {
+    readonly promptParts?: readonly (string | undefined)[];
+    readonly additionalSkillPaths?: readonly string[];
+    readonly packages?: readonly PiPackageSource[];
+    readonly extensionPaths?: readonly string[];
+}
+/** Canonical normalization shared by Workspace and CLI resource resolvers. */
+declare function createPiResourceDigestInput(input: {
+    readonly piCwd: string;
+    readonly piAgentDir?: string;
+    readonly piUserHome?: string;
+    readonly noSkills?: boolean;
+    readonly resourceSets: readonly PiResourceSet[];
+    readonly authorizedRoots: readonly string[];
+    readonly limits?: Partial<PiResourceDigestLimits>;
+}): PiResourceDigestInput;
+/** Bounded asynchronous content identity for the exact Pi resources considered by a reload candidate. */
+declare function digestPiResourceInputs(input: PiResourceDigestInput): Promise<string>;
+/** Immutable digest plus the reload fences that defend that exact snapshot. */
+declare function createPiResourceDigestFence(resolveInput: () => PiResourceDigestInput | Promise<PiResourceDigestInput>): Promise<{
+    readonly resourceInputDigest: string;
+    readonly revalidateResourceInputs: () => Promise<void>;
+}>;
 
 /**
- * GET /api/v1/agent/models
+ * `plugin_diagnostics` built-in agent tool.
  *
- * Returns the list of models pi-coding-agent has auth for (i.e. where
- * the corresponding provider API key is present in the environment or
- * `~/.pi/agent/auth.json`). Consumers — including the shadcn example
- * ChatPanel — fetch this endpoint to populate the model-selector dropdown
- * instead of hardcoding a short alias list.
+ * Surfaces current plugin/skill loading errors to the agent so it can iterate
+ * on them without the failures being silently swallowed. It merges three
+ * sources:
  *
- * Shape:
- *   {
- *     models: [
- *       { provider: "anthropic", id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6", available: true },
- *       ...
- *     ]
- *   }
+ *  - `lastReloadDiagnostics`: diagnostics captured by the most recent
+ *    /api/v1/agents/:agentTypeId/reload (hook + harness resource diagnostics).
+ *  - `resourceDiagnostics`: live Pi skill/extension load diagnostics for the
+ *    current session, read straight from the harness.
+ *  - `pluginErrors`: host-provided plugin load/preflight errors for the
+ *    workspace (wired by the embedding host).
  *
- * Safe to call unauthenticated — we only report {provider, id, label,
- * available}, never any key material.
+ * The tool is informational: it returns the diagnostics as data and never
+ * reports `isError`, even when diagnostics exist.
  */
 
-interface ModelSummary {
-    provider: string;
-    id: string;
-    label: string;
-    available: boolean;
-}
-interface ModelFilterContext {
-    request: FastifyRequest;
-    workspaceId?: string;
+interface PluginDiagnostic {
+    source: string;
+    message: string;
+    pluginId?: string;
 }
-type ModelFilterResult = {
-    models: readonly ModelSummary[];
-    defaultModel?: AgentModelSelection;
-};
-interface ModelsRoutesOptions {
-    filterModels?: (ctx: ModelFilterContext, models: readonly ModelSummary[], defaultModel: AgentModelSelection | undefined) => ModelFilterResult | Promise<ModelFilterResult>;
+interface PluginDiagnosticsToolDeps {
+    /** Diagnostics stashed by the last /reload. Read via a thunk because the
+     * runtime binding is assigned after the tool catalog is built. */
+    getLastReloadDiagnostics: () => ReadonlyArray<PluginDiagnostic>;
+    /** Live harness, used to read per-session resource diagnostics. */
+    getHarness: () => AgentHarness | undefined;
+    /** Optional host callback returning workspace plugin load/preflight errors. */
+    getPluginErrors?: () => Promise<ReadonlyArray<PluginDiagnostic>>;
 }
+declare function createPluginDiagnosticsTool(deps: PluginDiagnosticsToolDeps): AgentTool;
 
-type PiSessionRequestContextResolver = (request: FastifyRequest, defaultContext: PiSessionRequestContext) => PiSessionRequestContext | Promise<PiSessionRequestContext>;
-
-interface PrebuiltAgentHostRoutePolicy {
-    /** The sole Host instance constructed by the embedding composition root. */
-    readonly created: CreatedAgentHost;
-    /** Default Agent used by the legacy unaddressed route family. */
-    readonly defaultAgentTypeId: string;
-    /**
-     * App-owned capability issuer. The app may replace workspaceScopeId with its
-     * canonical workspace/storage partition while retaining the normalized
-     * runtime scope as private issuer context.
-     */
-    issueScope(input: {
-        readonly claim: VerifiedAgentScopeClaim;
-        readonly runtimeScope: ResolvedAgentRuntimeScope;
-    }): AuthorizedAgentScope;
+declare const RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE: "RUNTIME_FILESYSTEM_BINDING_DUPLICATE";
+declare class RuntimeFilesystemBindingConfigurationError extends Error {
+    readonly code: "RUNTIME_FILESYSTEM_BINDING_DUPLICATE";
+    readonly filesystem: string;
+    constructor(filesystem: string);
 }
-interface RegisterAgentRoutesOptions {
-    /**
-     * Reuse a Host created by the embedding composition root. Omission preserves
-     * the historical wrapper behavior and constructs one legacy default Host.
-     */
-    agentHost?: PrebuiltAgentHostRoutePolicy;
-    workspaceRoot?: string;
-    sessionId?: string;
-    templatePath?: string;
-    getTemplatePath?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        request?: FastifyRequest;
-    }) => string | undefined | Promise<string | undefined>;
-    mode?: RuntimeModeId;
-    /** Supply a custom runtime adapter to plug in non-built-in sandbox/workspace modes. */
-    runtimeModeAdapter?: RuntimeModeAdapter;
-    /** Provider/runtime values supplied by the embedding host. */
-    runtimeHost?: AgentRuntimeHostOperations;
-    version?: string;
-    extraTools?: AgentTool[];
-    /** When true, omit the six filesystem tools (read/write/edit/find/grep/ls). */
-    disableDefaultFileTools?: boolean;
-    getExtraTools?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        runtimeMode: RuntimeModeId;
-        workspaceFsCapability?: Workspace['fsCapability'];
-        authSubject?: string;
-    }) => AgentTool[] | Promise<AgentTool[]>;
-    systemPromptAppend?: string;
-    /** Optional dynamic system-prompt source forwarded to the harness. */
-    systemPromptDynamic?: () => string | undefined | Promise<string | undefined>;
-    getSystemPromptDynamic?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-    }) => string | undefined | Promise<string | undefined>;
-    /** Immutable host contribution captured once in the runtime binding scope. */
-    getRuntimeScopeContribution?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        request?: FastifyRequest;
-    }) => Readonly<{
-        identity: string;
-        loadSystemPromptAppend?: () => Promise<string | undefined>;
-    }> | Promise<Readonly<{
-        identity: string;
-        loadSystemPromptAppend?: () => Promise<string | undefined>;
-    }>>;
-    /** Override the default pi-backed harness with a custom agent runtime. */
-    harnessFactory?: AgentHarnessFactory;
-    /** Optional pi adapter/runtime knobs used by the default harness. */
-    pi?: PiHarnessOptions;
-    getPi?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        request?: FastifyRequest;
-    }) => PiHarnessOptions | undefined | Promise<PiHarnessOptions | undefined>;
-    sessionNamespace?: string;
-    /** Optional explicit root for file-backed Pi chat transcript storage. */
-    sessionRoot?: string;
-    /** Trusted host seam for resolving Pi HTTP session scope. */
-    resolvePiSessionRequestContext?: PiSessionRequestContextResolver;
-    /** Optional best-effort telemetry sink supplied by an embedding host. */
-    telemetry?: TelemetrySink;
-    /** Optional host admission called immediately before each agent effect. */
-    admitEffect?: AgentEffectAdmission$1;
-    /** Generic request-aware model filtering seam. Hosts may filter per user/workspace. */
-    filterModels?: ModelsRoutesOptions['filterModels'];
-    /** Generic per-request/per-run filesystem binding seam. Hosts may return user/session-filtered bindings. */
-    getFilesystemBindings?: (ctx: {
-        request?: FastifyRequest;
-        workspaceId: string;
-        workspaceRoot: string;
-        sessionId?: string;
-        userId?: string;
-        userEmail?: string;
-        userEmailVerified?: boolean;
-        requestId?: string;
-    }) => RuntimeFilesystemBinding[] | undefined | Promise<RuntimeFilesystemBinding[] | undefined>;
-    /**
-     * Optional billing sink for native Pi usage. Reserve happens before
-     * accepted prompt/follow-up execution (fail closed), usage is recorded from
-     * native assistant message_end events, and runs settle/release from native
-     * terminal lifecycle. See AgentMeteringSink.
-     */
-    metering?: AgentMeteringSink;
-    /**
-     * Enable user/global Pi extension auto-discovery from .pi/ and ~/.pi.
-     * App/internal plugins should be passed through extraTools/pi instead.
-     * Defaults to true for standalone agent compatibility.
-     */
-    externalPlugins?: boolean;
-    getSessionNamespace?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        request?: FastifyRequest;
-        /** Verified actor id for trusted requestless dispatcher resolution. */
-        userId?: string;
-    }) => string | undefined | Promise<string | undefined>;
-    registerHealthRoute?: boolean;
-    /**
-     * Optional Lane W share-entry store (AR1-002/AR1-003, same-workspace
-     * shareable links, `docs/issues/391/runtime-refactor/work/
-     * AR1-shareable-artifacts/AR1-001-SPEC.md` §3). When supplied, mounts the
-     * membership-gated `GET /a/:id` deep-link route. Omit to leave Lane W
-     * entirely unmounted (no widening for hosts that don't use it yet).
-     */
-    shareEntryStore?: ShareEntryStore;
-    getWorkspaceId?: (request: FastifyRequest) => string | Promise<string>;
-    getWorkspaceRoot?: (workspaceId: string, request: FastifyRequest) => string | Promise<string>;
-    getTrustedWorkspaceRoot?: (ctx: WorkspaceAgentDispatcherContext) => string | Promise<string>;
-    /** Generic runtime env contributors. Agent stays workspace-neutral; hosts decide env names/values. */
-    runtimeEnvContributions?: RuntimeEnvContribution[];
-    /**
-     * Optional runtime reconciliation hook. Callers own plugin discovery and may
-     * call provisionWorkspaceRuntime() with the normalized structural inputs.
-     * registerAgentRoutes only consumes the returned env/PATH/skill paths.
-     */
-    provisionRuntime?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        runtimeMode: RuntimeModeId;
-        runtimeLayout: BoringAgentRuntimePaths;
-        provisioningAdapter?: WorkspaceProvisioningAdapter;
-        /** Already-created paired Workspace/Sandbox runtime for this binding. */
-        runtimeBundle: RuntimeBundle;
-        request?: FastifyRequest;
-        /** Aborted when this binding retires; retirement still drains the task before provider disposal. */
-        signal: AbortSignal;
-    }) => WorkspaceProvisioningResult | undefined | Promise<WorkspaceProvisioningResult | undefined>;
-    provisionWorkspace?: boolean;
-    /** Optional hook called before /api/v1/agent/reload reloads the harness. */
-    beforeReload?: (ctx: {
-        workspaceId: string;
-        workspaceRoot: string;
-        request: FastifyRequest;
-    }) => void | ReloadHookResult | undefined | Promise<void | ReloadHookResult | undefined>;
-    /**
-     * Optional host callback returning current plugin/skill load diagnostics
-     * for a workspace. Surfaced by the `plugin_diagnostics` agent tool so the
-     * model can iterate on plugin/skill load errors after a /reload.
-     */
-    getPluginDiagnostics?: (args: {
-        workspaceId: string;
-        workspaceRoot: string;
-    }) => Promise<Array<{
-        source: string;
-        message: string;
-        pluginId?: string;
-    }>>;
-    /**
-     * Trusted in-process host composition seam. The resolver trusts caller-supplied
-     * workspace/user context; callers must authorize that context before resolving.
-     */
-    onWorkspaceAgentDispatcher?: (resolver: WorkspaceAgentDispatcherResolver) => void;
-}
-interface AgentHostLegacyRouteScopePolicy {
-    /** App-owned capability issuer for the already-created Host. */
-    issueScope(input: {
-        readonly claim: VerifiedAgentScopeClaim;
-        readonly runtimeScope: ResolvedAgentRuntimeScope;
-    }): AuthorizedAgentScope;
-    /** True only for the legacy wrapper whose Host admission calls admitEffect. */
-    readonly gatewayUsesLegacyAdmission?: boolean;
-}
-type AgentHostLegacyRoutePolicyOptions = Omit<RegisterAgentRoutesOptions, 'agentHost' | 'runtimeModeAdapter'> & {
-    readonly runtimeModeAdapter: RuntimeModeAdapter;
-};
-
-/** Normalize legacy options into the nested Host projection seam. */
-declare function createAgentHostLegacyRoutePolicy(options: AgentHostLegacyRoutePolicyOptions, scopePolicy: AgentHostLegacyRouteScopePolicy): AgentHostLegacyRoutePolicy;
+/**
+ * Canonical final merge seam for runtime-owned and request-scoped bindings.
+ * Duplicates *within* either list stay configuration errors; a host/request
+ * collision on the same id composes as an intersection of both capabilities.
+ */
+declare function mergeRuntimeFilesystemBindings<T extends RuntimeFilesystemBinding>(runtimeBindings: readonly T[] | undefined, requestBindings: readonly T[] | undefined): readonly RuntimeFilesystemBinding[] | undefined;
 
+declare const RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE: "RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID";
+declare class RuntimeReadonlyFilesystemPolicyError extends Error {
+    readonly code: "RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID";
+    constructor();
+}
 /**
- * Compatibility wrapper for legacy embedding callers.
- *
- * It normalizes legacy construction inputs, creates or reuses exactly one Host,
- * and delegates the complete route profile through CreatedAgentHost.registerRoutes().
+ * Default protected prefixes applied when a host does not configure its own.
+ * `.agents` holds agent governance/skill definitions: agents may read them but
+ * must never rewrite the rules they run under. Hosts opt out with an explicit
+ * empty array.
  */
-declare const registerAgentRoutes: FastifyPluginAsync<RegisterAgentRoutesOptions>;
+declare const DEFAULT_READONLY_WORKSPACE_PATHS: readonly string[];
+interface RuntimeReadonlyFilesystemPolicy {
+    readonly readonlyPaths: readonly string[];
+    readonly revision: string;
+}
+declare function normalizeRuntimeReadonlyFilesystemPolicy(paths: readonly string[]): RuntimeReadonlyFilesystemPolicy;
+/** Resolve policy after the Workspace adapter has normalized/confined the path. */
+declare function resolveRuntimeReadonlyFilesystemAccess(policy: RuntimeReadonlyFilesystemPolicy, descriptor: {
+    readonly filesystem: string;
+    readonly normalizedPath: string;
+}): RuntimeFilesystemAccessDecision;
+
+/** Primary-user Operations adapter shared by HTTP and Pi filesystem tools. */
+declare function createUserFilesystemBinding(workspace: Workspace, policy: RuntimeReadonlyFilesystemPolicy, resolvePolicyPath: (path: string) => Promise<string>): RuntimeFilesystemBinding;
 
 interface CredentialStoreBackendV1 {
     read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[]): Promise<ResolvedCredentialMaterialV1 & {
@@ -1286,4 +1486,4 @@ declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCre
 
 declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
 
-export { AgentConfig, AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentGatewayEffect, AgentHarnessFactory, AgentHostLegacyRoutePolicy, type AgentHostLegacyRoutePolicyOptions, type AgentHostLegacyRouteScopePolicy, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, type CreateAgentAppOptions, CreateAgentHostOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, MeteringErrorLogger, ModeContext, PiHarnessOptions, type PrebuiltAgentHostRoutePolicy, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, type RegisterAgentRoutesOptions, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemBinding, RuntimeModeAdapter, RuntimeModeId, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, constantTimeTokenEqual, createAgent, createAgentApp, createAgentHost, createAgentHostLegacyRoutePolicy, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createSandboxRuntimeModeAdapter, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, encodeBytesForWorker, hasBwrap, materializeAgentDirectory, prepareDeploymentSnapshot, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveBuiltinRuntimeLayoutRoot, resolveMode, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential };
+export { AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, LEGACY_DEFAULT_AGENT_FLEET, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, MeteringErrorLogger, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };