@jini-ai/daemon 0.3.8 → 0.5.0

package/dist/agent-executor.d.ts

@@ -81,10 +81,10 @@
  * byte-identical to pre-gap-4 behavior — every `'failed'` outcome
  * resumable:false). OD's ~20-vendor-CLI text-matching failure classifier was
  * deliberately never ported (see `run/core/failure-taxonomy.ts`'s own doc and
- * `source-map.md`). The real zero-config classifier lives in `@jini-ai/daemon`'s
+ * `archived provenance ledger`). The real zero-config classifier lives in `@jini-ai/daemon`'s
  * `run/core/retry.ts` (`resumableFromProcessExit`/`classifyProcessExitFailure`)
  * and is wired in by `@jini-ai/server`'s `createLocalNodeDaemon` — see that
- * package's own source-map.md, and `run/core/retry.ts`'s own doc for the
+ * package's own archived provenance ledger, and `run/core/retry.ts`'s own doc for the
  * classification policy and its 2026-07-22 merge-time reconciliation against
  * a second, independently-built (and rejected) classifier that once lived in
  * this module.
@@ -93,7 +93,7 @@ import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
 import type { Principal } from '@jini-ai/core';
 import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
 import { applyAgentLaunchEnv, ensureAgentCapabilities, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, type AcpMcpServerInput, type AcpPermissionHandler, type AgentLaunchResolution, type PreparedAgentLogFile, type PreparedPromptFile, type PromptAugmenter, type RuntimeAgentDef, type RuntimeBuildOptions, type RuntimeContext, type RuntimeLockHold } from '@jini-ai/agent-runtime';
-import { collectProcessTreePids, createCommandInvocation, listProcessSnapshots, stopProcesses, type ProcessSnapshot, type StopProcessesResult } from '@jini-ai/platform';
+import { createCommandInvocation, listProcessSnapshots, type ProcessSnapshot, type StopProcessesResult } from '@jini-ai/platform';
 import type { RunByteJournal } from './continuation/journal.js';
 import { type ImagePromptDelivery } from './image-prompt-delivery.js';
 import type { RunRetrySideEffectState } from './run/core/index.js';
@@ -122,7 +122,11 @@ type ChildDrivenStreamFormat = JsonStreamFormat | 'plain';
  * @complexity O(1) — fixed membership check.
  * @overallScore 100/100
  */
-export declare function isSupportedStreamFormat(value: string): value is SupportedStreamFormat;
+export declare function isSupportedStreamFormat(args: {
+    readonly value: string;
+}): args is {
+    readonly value: SupportedStreamFormat;
+};
 /**
  * Whether `run()` can drive a given def, and — when it can — its `streamFormat` already narrowed for
  * the dispatch logic that follows. The narrowing rides along deliberately: it is what lets `run()`
@@ -157,7 +161,9 @@ export type AgentExecutorCompatibility = {
  * @complexity O(1) — fixed field checks.
  * @overallScore 100/100
  */
-export declare function assessAgentExecutorCompatibility(def: RuntimeAgentDef): AgentExecutorCompatibility;
+export declare function assessAgentExecutorCompatibility({ def }: {
+    readonly def: RuntimeAgentDef;
+}): AgentExecutorCompatibility;
 /**
  * Whether `run()` can actually drive this def — the discovery-time counterpart to the guards inside
  * `run()`, so a consumer never offers a user an agent that fails the moment it is selected.
@@ -168,7 +174,9 @@ export declare function assessAgentExecutorCompatibility(def: RuntimeAgentDef):
  * @complexity O(1).
  * @overallScore 100/100
  */
-export declare function isAgentExecutorSupported(def: RuntimeAgentDef): boolean;
+export declare function isAgentExecutorSupported({ def }: {
+    readonly def: RuntimeAgentDef;
+}): boolean;
 /**
  * Result of translating one parsed stream event into this engine's
  * vocabulary. `'agent'` is the common case (forward as a `RunAgentPayload`
@@ -194,7 +202,7 @@ export declare function isAgentExecutorSupported(def: RuntimeAgentDef): boolean;
  * `tool_use` block in the same assistant message has already been
  * translated (so a caller can decide whether to keep stdin open before
  * closing it), but v1 (pre-gap-3) discarded it and closed stdin
- * unconditionally on any `turn-end` — see `packages/daemon/source-map.md`'s
+ * unconditionally on any `turn-end` — see `packages/daemon/archived provenance ledger`'s
  * "Design decision 2" note. `wireChildLifecycle` now reads it to decide
  * whether `stop_reason: 'tool_use'` means "inject a tool result and keep
  * going" (gap 3, gated — see `ContinuationOptions`) or "close stdin as
@@ -222,14 +230,24 @@ export type AgentRuntimeEventTranslation = {
  * original "omit the whole `usage` field rather than emit an empty object" behavior.
  * @complexity O(1).
  */
-export declare function extractUsageTokens(rawUsage: Record<string, unknown> | undefined): {
+export declare function extractUsageTokens({ rawUsage }: {
+    readonly rawUsage: Record<string, unknown> | undefined;
+}): {
     input_tokens?: number;
     output_tokens?: number;
 } | undefined;
-export declare function translateStatusEvent(rawEvent: Record<string, unknown>): AgentRuntimeEventTranslation;
-export declare function translateToolResultEvent(rawEvent: Record<string, unknown>): AgentRuntimeEventTranslation;
-export declare function translateErrorEvent(rawEvent: Record<string, unknown>): AgentRuntimeEventTranslation;
-export declare function translateTurnEndEvent(rawEvent: Record<string, unknown>): AgentRuntimeEventTranslation;
+export declare function translateStatusEvent({ rawEvent }: {
+    readonly rawEvent: Record<string, unknown>;
+}): AgentRuntimeEventTranslation;
+export declare function translateToolResultEvent({ rawEvent }: {
+    readonly rawEvent: Record<string, unknown>;
+}): AgentRuntimeEventTranslation;
+export declare function translateErrorEvent({ rawEvent }: {
+    readonly rawEvent: Record<string, unknown>;
+}): AgentRuntimeEventTranslation;
+export declare function translateTurnEndEvent({ rawEvent }: {
+    readonly rawEvent: Record<string, unknown>;
+}): AgentRuntimeEventTranslation;
 /**
  * Narrows one parser-emitted `{type, ...}` record into this engine's
  * `RunAgentPayload` union (or the `error`/`turn-end`/`ignored` routing
@@ -252,13 +270,18 @@ export declare function translateTurnEndEvent(rawEvent: Record<string, unknown>)
  * @complexity O(1) — one table lookup, no iteration.
  * @overallScore 100/100
  */
-export declare function translateAgentRuntimeEvent(rawEvent: unknown): AgentRuntimeEventTranslation;
+export declare function translateAgentRuntimeEvent({ rawEvent }: {
+    readonly rawEvent: unknown;
+}): AgentRuntimeEventTranslation;
 /** Machine-readable failure reasons `run()` can reject with — every one is preceded by a `lifecycle.finish({status:'failed'})` call (see module doc's Invariant section). */
-export type AgentExecutorErrorCode = 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
+export type AgentExecutorErrorCode = 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
 /** Thrown by `AgentExecutor.run()` on every failure path — never a bare `Error`, so callers can branch on `.code` instead of parsing `.message`. */
 export declare class AgentExecutorError extends Error {
     readonly code: AgentExecutorErrorCode;
-    constructor(code: AgentExecutorErrorCode, message: string);
+    constructor({ code, message }: {
+        readonly code: AgentExecutorErrorCode;
+        readonly message: string;
+    });
 }
 export interface AgentExecutorRunInput {
     readonly runId: string;
@@ -272,9 +295,10 @@ export interface AgentExecutorRunInput {
     /**
      * Forwarded verbatim to `RuntimeBuildOptions.permissionMode` (see `@jini-ai/agent-runtime`'s
      * `types.ts`). Every def that has an auto-approve flag (`bypassPermissions` / `--yolo` /
-     * `--dangerously-skip-permissions`) uses it by default when this is omitted — unchanged
-     * behavior, since there is no TTY on a spawned subprocess to answer an interactive prompt.
-     * A host that wants a run to NOT auto-approve every action passes `'restricted'` here.
+     * `--dangerously-skip-permissions`) historically enabled it when omitted because a spawned
+     * subprocess has no TTY for interactive approval. That rationale explains the old behavior;
+     * the daemon now fails closed with 'restricted'. A host must explicitly select 'bypass' to
+     * delegate auto-approval, and any unknown mode is rejected before launching a process.
      */
     readonly permissionMode?: 'bypass' | 'restricted';
     /**
@@ -351,12 +375,20 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see module doc's Invariant).
      */
-    run(input: AgentExecutorRunInput): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
 }
+/** Process discovery is a getter; process collection and stopping accept explicit host inputs. */
+export type CollectProcessTreePidsPort = (args: {
+    readonly processes: ProcessSnapshot[];
+    readonly rootPids: Array<number | null | undefined>;
+}) => number[];
+export type StopProcessesPort = (args: {
+    readonly pids: Array<number | null | undefined>;
+}) => Promise<StopProcessesResult>;
 interface TerminateChildTreeDeps {
     readonly listProcessSnapshots: () => Promise<ProcessSnapshot[]>;
-    readonly collectProcessTreePids: typeof collectProcessTreePids;
-    readonly stopProcesses: (pids: Array<number | null | undefined>) => Promise<StopProcessesResult>;
+    readonly collectProcessTreePids: CollectProcessTreePidsPort;
+    readonly stopProcesses: StopProcessesPort;
 }
 /**
  * Which step reported a contained failure through `onCleanupFailure` (SEC-007).
@@ -434,6 +466,14 @@ export interface McpJsonInjectionOptions {
     readonly command: string;
     /** Extra argv for `command`. @default [] */
     readonly args?: readonly string[];
+    /**
+     * Extra env for the bridge child, for hosts whose `command` is not a plain Node binary. An Electron
+     * host passes `{ ELECTRON_RUN_AS_NODE: '1' }`: its `process.execPath` is the app itself, which boots
+     * as a GUI app without that flag and never speaks MCP. `buildAgentEnv`'s allowlist strips the
+     * host's own copy from the CLI, so it can only reach the bridge through here. `JINI_*` keys are
+     * ignored: the run id, callback URL and token are this driver's to set. @default {}
+     */
+    readonly env?: Readonly<Record<string, string>>;
     /** The daemon's own loopback base URL the spawned `jini-mcp` process calls back into via `JINI_DAEMON_URL` (see `packages/mcp/src/bin/serve.ts`'s `DAEMON_URL_ENV_VAR`). */
     readonly daemonUrl: string;
     /**
@@ -459,11 +499,18 @@ export interface McpJsonInjectionOptions {
      * @throws Anything the host's own minting throws. `run()` turns a rejection into a pre-spawn
      * `AGENT_SPAWN_FAILED` failure rather than spawning a child that cannot authenticate.
      */
-    readonly credential?: (runId: string) => string | Promise<string>;
+    readonly credential?: ({ runId }: {
+        readonly runId: string;
+    }) => string | Promise<string>;
     /** Reads the project's own `cwd/.mcp.json` so this driver merges its servers in rather than dropping them. Rejecting (ENOENT or otherwise) is treated as "no existing file" — see `writeMcpJsonForRun`. This file is only ever *read*. @default the real `fs.promises.readFile` (utf8) */
-    readonly readFile?: (path: string) => Promise<string>;
+    readonly readFile?: ({ path }: {
+        readonly path: string;
+    }) => Promise<string>;
     /** Writes the merged content to this run's own config path (see {@link mcpJsonPathForRun}), never to the project's `.mcp.json`. @default the real `fs.promises.writeFile` (utf8) */
-    readonly writeFile?: (path: string, content: string) => Promise<void>;
+    readonly writeFile?: ({ path, content }: {
+        readonly path: string;
+        readonly content: string;
+    }) => Promise<void>;
     /**
      * Removes this run's config file once the run is over — it holds a live per-run bearer token, so
      * leaving it behind is the same class of confidentiality gap as a leaked prompt file (see
@@ -471,7 +518,9 @@ export interface McpJsonInjectionOptions {
      * pre-spawn/spawn-failure path, and a rejection is reported rather than allowed to strand the run.
      * @default `fs.promises.rm(path, { force: true })` — already-gone is success, not an error.
      */
-    readonly removeFile?: (path: string) => Promise<void>;
+    readonly removeFile?: ({ path }: {
+        readonly path: string;
+    }) => Promise<void>;
     /**
      * `'codex-toml'` only. Creates a fresh, randomly-named directory `prepareCodexHomeForRun` stages
      * as a run's scratch `CODEX_HOME`. **Must be non-deterministic (a real `mkdtemp`, not a
@@ -486,20 +535,39 @@ export interface McpJsonInjectionOptions {
      * template; the real suffix mkdtemp appends is what makes the path unpredictable.
      * @default `fs.mkdtemp(path.join(os.tmpdir(), prefix))`
      */
-    readonly mkdtemp?: (prefix: string) => Promise<string>;
+    readonly mkdtemp?: ({ prefix }: {
+        readonly prefix: string;
+    }) => Promise<string>;
     /**
      * `'codex-toml'` only. Recursively removes the scratch `CODEX_HOME` directory `mkdtemp` above
      * created — the directory-level analogue of `removeFile`, needed because this mechanism stages a
      * whole directory (`config.toml` plus a copied `auth.json`), not one file.
      * @default `fs.rm(path, { recursive: true, force: true })` — already-gone is success, not an error.
      */
-    readonly removeDir?: (path: string) => Promise<void>;
+    readonly removeDir?: ({ path }: {
+        readonly path: string;
+    }) => Promise<void>;
 }
+/** The run-error code a run gets when its CLI reports the injected `jini` bridge as anything but connected. */
+export declare const MCP_BRIDGE_UNAVAILABLE = "MCP_BRIDGE_UNAVAILABLE";
+/**
+ * Judges a CLI's startup report of the injected bridge. Returns the bridge's status (`'missing'`
+ * when the list omits it) when it is not `'connected'`, and `undefined` when it is connected or
+ * when `rawEvent` is not an init status carrying an MCP server list (nothing to judge).
+ *
+ * `'pending'` counts as a failure on purpose: the CLI decides which MCP tools a session has at
+ * startup, so a bridge that is not connected by then never joins this run.
+ * @param rawEvent - One parsed stream event, as `@jini-ai/agent-runtime`'s parser emits it.
+ * @complexity O(n) in the number of reported servers.
+ */
+export declare function unavailableJiniBridgeStatus({ rawEvent }: {
+    readonly rawEvent: unknown;
+}): string | undefined;
 /** One `.mcp.json` `mcpServers` entry — the shape Claude Code's own config schema expects. */
 interface McpJsonServerEntry {
     readonly command: string;
     readonly args: string[];
-    readonly env: {
+    readonly env: Readonly<Record<string, string>> & {
         readonly JINI_RUN_ID: string;
         readonly JINI_DAEMON_URL: string;
         /** Present only when the host supplied a `credential` resolver — see {@link McpJsonInjectionOptions.credential}. */
@@ -513,13 +581,18 @@ interface McpJsonServerEntry {
  * `writeMcpJsonForRun`'s job, which keeps the effect out of this function.
  *
  * @param runId - The run this entry scopes its child to.
- * @param options - `command`/`args`/`daemonUrl` from the host's injection options.
+ * @param options - `command`/`args`/`daemonUrl`/`env` from the host's injection options.
  * @param credential - The already-resolved bearer token, or `undefined` to omit `JINI_DAEMON_TOKEN`
  * entirely. Omitting produces byte-identical output to before this parameter existed.
  * @complexity O(1).
  * @overallScore 100/100
  */
-export declare function buildMcpJsonServerEntry(runId: string, options: Pick<McpJsonInjectionOptions, 'command' | 'args' | 'daemonUrl'>, credential?: string): McpJsonServerEntry;
+export declare function buildMcpJsonServerEntry({ runId, options }: {
+    readonly runId: string;
+    readonly options: Pick<McpJsonInjectionOptions, 'command' | 'args' | 'daemonUrl' | 'env'>;
+}, { credential }?: {
+    readonly credential?: string;
+}): McpJsonServerEntry;
 /**
  * Merges {@link JINI_MCP_SERVER_KEY} into an existing `.mcp.json`'s `mcpServers` map, preserving
  * every other key and every other registered server untouched. A missing (`existingRaw ===
@@ -531,7 +604,10 @@ export declare function buildMcpJsonServerEntry(runId: string, options: Pick<Mcp
  * @complexity O(1) plus `JSON.parse`/`JSON.stringify`'s own cost on a small config file.
  * @overallScore 100/100
  */
-export declare function mergeMcpJsonContent(existingRaw: string | undefined, serverEntry: McpJsonServerEntry): string;
+export declare function mergeMcpJsonContent({ existingRaw, serverEntry }: {
+    readonly existingRaw: string | undefined;
+    readonly serverEntry: McpJsonServerEntry;
+}): string;
 /**
  * Mechanism 2 of 5 — `'acp-merge'`. Re-shapes the same bridge entry into the `mcpServers` element
  * an ACP `session/new` call carries, for the 9 ACP-native defs declaring this strategy (amr, devin,
@@ -553,7 +629,9 @@ export declare function mergeMcpJsonContent(existingRaw: string | undefined, ser
  * @complexity O(1).
  * @overallScore 100/100
  */
-export declare function buildAcpMcpBridgeServers(entry: McpJsonServerEntry): AcpMcpServerInput[];
+export declare function buildAcpMcpBridgeServers({ entry }: {
+    readonly entry: McpJsonServerEntry;
+}): AcpMcpServerInput[];
 /**
  * Serialises the bridge entry into the OpenCode-schema config JSON that `OPENCODE_CONFIG_CONTENT`
  * / `MIMOCODE_CONFIG_CONTENT` carries, merging into whatever the host already put in that variable
@@ -581,7 +659,10 @@ export declare function buildAcpMcpBridgeServers(entry: McpJsonServerEntry): Acp
  * @complexity O(1) plus `JSON.parse`/`JSON.stringify` over a small config document.
  * @overallScore 100/100
  */
-export declare function mergeEnvContentMcpConfig(existingRaw: string | undefined, entry: McpJsonServerEntry): string;
+export declare function mergeEnvContentMcpConfig({ existingRaw, entry }: {
+    readonly existingRaw: string | undefined;
+    readonly entry: McpJsonServerEntry;
+}): string;
 /**
  * Merges a staged system-prompt overlay file's path into the `instructions` array of the same
  * OpenCode-schema config document {@link mergeEnvContentMcpConfig} writes `mcp` into — for a
@@ -619,7 +700,10 @@ export declare function mergeEnvContentMcpConfig(existingRaw: string | undefined
  * @complexity O(1) plus `JSON.parse`/`JSON.stringify` over a small config document.
  * @overallScore 100/100
  */
-export declare function mergeEnvContentInstructions(existingRaw: string | undefined, instructionsFilePath: string): string;
+export declare function mergeEnvContentInstructions({ existingRaw, instructionsFilePath }: {
+    readonly existingRaw: string | undefined;
+    readonly instructionsFilePath: string;
+}): string;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
@@ -628,13 +712,15 @@ export declare function mergeEnvContentInstructions(existingRaw: string | undefi
  * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
  * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
  * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
- * table, env vars in a nested `.env` table) — see `source-map.md` for the transcript.
+ * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
  * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
  * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export declare function buildCodexMcpServerToml(entry: McpJsonServerEntry): string;
+export declare function buildCodexMcpServerToml({ entry }: {
+    readonly entry: McpJsonServerEntry;
+}): string;
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
  * config, with any pre-existing `[mcp_servers.jini]` table removed (see
@@ -655,7 +741,10 @@ export declare function buildCodexMcpServerToml(entry: McpJsonServerEntry): stri
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export declare function buildCodexHomeConfigToml(existingRaw: string | undefined, entry: McpJsonServerEntry): string;
+export declare function buildCodexHomeConfigToml({ existingRaw, entry }: {
+    readonly existingRaw: string | undefined;
+    readonly entry: McpJsonServerEntry;
+}): string;
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -668,7 +757,9 @@ export declare function buildCodexHomeConfigToml(existingRaw: string | undefined
  * @complexity O(1).
  * @overallScore 100/100
  */
-export declare function resolveSourceCodexHomeDir(hostEnv: NodeJS.ProcessEnv): string;
+export declare function resolveSourceCodexHomeDir({ hostEnv }: {
+    readonly hostEnv: NodeJS.ProcessEnv;
+}): string;
 /**
  * What one run's MCP bridge turns into, discriminated by the delivery mechanism its def declared.
  * Exactly one variant is produced per run, and each variant carries only what its own consumer
@@ -767,10 +858,19 @@ export type PreparedClaudeConfigDir = {
 };
 /** The Claude-config-dir mechanism's injectable filesystem seams, real by default — the directory-staging analogue of {@link CodexHomeSeams}, kept as its own small options bag (see {@link CreateAgentExecutorOptions.claudeConfigDirIsolation}) rather than folded into {@link McpJsonInjectionOptions}: isolating the operator's personal config is an env-hygiene concern independent of whether this host configured MCP federation at all, and must not be gated on that unrelated flag. */
 export interface ClaudeConfigDirSeams {
-    readonly mkdtemp: (prefix: string) => Promise<string>;
-    readonly readFile: (path: string) => Promise<string>;
-    readonly writeFile: (path: string, content: string) => Promise<void>;
-    readonly removeDir: (path: string) => Promise<void>;
+    readonly mkdtemp: ({ prefix }: {
+        readonly prefix: string;
+    }) => Promise<string>;
+    readonly readFile: ({ path }: {
+        readonly path: string;
+    }) => Promise<string>;
+    readonly writeFile: ({ path, content }: {
+        readonly path: string;
+        readonly content: string;
+    }) => Promise<void>;
+    readonly removeDir: ({ path }: {
+        readonly path: string;
+    }) => Promise<void>;
 }
 /**
  * `CreateAgentExecutorOptions.claudeConfigDirIsolation` — every field optional and real-filesystem
@@ -783,13 +883,22 @@ export interface ClaudeConfigDirSeams {
  */
 export interface ClaudeConfigDirIsolationOptions {
     /** @default the real `fs.promises.mkdtemp(path.join(os.tmpdir(), prefix))` */
-    readonly mkdtemp?: (prefix: string) => Promise<string>;
+    readonly mkdtemp?: ({ prefix }: {
+        readonly prefix: string;
+    }) => Promise<string>;
     /** Reads the operator's real `.credentials.json`, if any — see {@link prepareClaudeConfigDirForRun}'s own doc. @default the real `fs.promises.readFile` (utf8) */
-    readonly readFile?: (path: string) => Promise<string>;
+    readonly readFile?: ({ path }: {
+        readonly path: string;
+    }) => Promise<string>;
     /** Writes the copied `.credentials.json` into the scratch directory. @default the real `fs.promises.writeFile` (utf8) */
-    readonly writeFile?: (path: string, content: string) => Promise<void>;
+    readonly writeFile?: ({ path, content }: {
+        readonly path: string;
+        readonly content: string;
+    }) => Promise<void>;
     /** @default `fs.promises.rm(path, { recursive: true, force: true })` — already-gone is success, not an error. */
-    readonly removeDir?: (path: string) => Promise<void>;
+    readonly removeDir?: ({ path }: {
+        readonly path: string;
+    }) => Promise<void>;
 }
 /**
  * Where `claude`'s own config resolution reads the operator's REAL config from, to seed a run's
@@ -803,7 +912,9 @@ export interface ClaudeConfigDirIsolationOptions {
  * default, `~/.claude`.
  * @complexity O(1).
  */
-export declare function resolveSourceClaudeConfigDir(hostEnv: NodeJS.ProcessEnv): string;
+export declare function resolveSourceClaudeConfigDir({ hostEnv }: {
+    readonly hostEnv: NodeJS.ProcessEnv;
+}): string;
 /**
  * Gap 4 of the run/chat orchestration Final Recommendation: what
  * `classifyFailure` (see `CreateAgentExecutorOptions.classifyFailure`) is
@@ -865,7 +976,9 @@ export type ClassifyFailure = (context: FailureClassificationContext) => boolean
 export declare const DEFAULT_BUFFERED_STDOUT_MAX_BYTES: number;
 /** The side-effect signals {@link applyAgentTranslationSideEffects} reports through, one callback per signal so a caller only wires the ones it actually tracks. */
 interface AgentTranslationSideEffectSink {
-    readonly onSessionId: (sessionId: string) => void;
+    readonly onSessionId: (args: {
+        readonly sessionId: string;
+    }) => void;
     readonly onToolCall: () => void;
     readonly onUserVisibleOutput: () => void;
 }
@@ -881,7 +994,11 @@ interface AgentTranslationSideEffectSink {
  * @param sink - The driver-specific effects to apply.
  * @complexity O(1).
  */
-export declare function applyAgentTranslationSideEffects(payload: RunAgentPayload, sessionId: string | undefined, sink: AgentTranslationSideEffectSink): void;
+export declare function applyAgentTranslationSideEffects({ payload, sessionId, sink }: {
+    readonly payload: RunAgentPayload;
+    readonly sessionId: string | undefined;
+    readonly sink: AgentTranslationSideEffectSink;
+}): void;
 export interface CreateAgentExecutorOptions {
     readonly lifecycle: RunLifecycle;
     /** @default the real `@jini-ai/agent-runtime` registry lookup */
@@ -926,9 +1043,9 @@ export interface CreateAgentExecutorOptions {
     /** @default the real `@jini-ai/platform` process-snapshot enumerator */
     readonly listProcessSnapshots?: typeof listProcessSnapshots;
     /** @default the real `@jini-ai/platform` descendant-PID collector */
-    readonly collectProcessTreePids?: typeof collectProcessTreePids;
+    readonly collectProcessTreePids?: CollectProcessTreePidsPort;
     /** @default the real `@jini-ai/platform` SIGTERM→SIGKILL escalator */
-    readonly stopProcesses?: typeof stopProcesses;
+    readonly stopProcesses?: StopProcessesPort;
     /** Host-owned sink for a process-tree cleanup failure (SEC-007) — e.g. EPERM stopping descendants. @default logs a redacted diagnostic via `console.error` */
     readonly onCleanupFailure?: (context: AgentCleanupFailureContext) => void;
     /**
@@ -1036,72 +1153,97 @@ export interface CreateAgentExecutorOptions {
  * @overallScore 100/100
  */
 /** `createAgentExecutor`'s internal `failBeforeSpawn` — a nested closure over `lifecycle`, so every extracted `run()` phase below takes it as an explicit injected collaborator rather than reaching for a module-level one. */
-type FailBeforeSpawn = (runId: string, code: AgentExecutorErrorCode, message: string) => Promise<never>;
+type FailBeforeSpawn = (args: {
+    readonly runId: string;
+    readonly code: AgentExecutorErrorCode;
+    readonly message: string;
+}) => Promise<never>;
 interface ResolvedDefAndFormat {
     readonly def: RuntimeAgentDef;
     readonly streamFormat: SupportedStreamFormat;
 }
 /** Phase 1: registry lookup + `assessAgentExecutorCompatibility` guard. */
-export declare function resolveDefAndStreamFormat(input: Pick<AgentExecutorRunInput, 'runId' | 'agentId'>, deps: {
-    readonly getAgentDef: typeof getAgentDef;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function resolveDefAndStreamFormat({ input, deps }: {
+    readonly input: Pick<AgentExecutorRunInput, 'runId' | 'agentId'>;
+    readonly deps: {
+        readonly getAgentDef: typeof getAgentDef;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<ResolvedDefAndFormat>;
 /** Phase 2: image-prompt-delivery augmentation + argv-budget guard for argv-bound defs. */
-export declare function resolveImageDeliveryAndArgvBudget(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly prompt: string;
-    readonly imagePaths: readonly string[] | undefined;
-    readonly extraAllowedDirs: readonly string[] | undefined;
-}, deps: {
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function resolveImageDeliveryAndArgvBudget({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly prompt: string;
+        readonly imagePaths: readonly string[] | undefined;
+        readonly extraAllowedDirs: readonly string[] | undefined;
+    };
+    readonly deps: {
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<ImagePromptDelivery>;
 /**
  * Phase 3a: the subprocess environment this run's launch resolution and spawn should use — the
  * caller-supplied escape hatch verbatim, or the deny-by-default `BASELINE_AGENT_ENV_KEYS` allowlist.
  * Pure.
  */
-export declare function resolveRunEnv(input: Pick<AgentExecutorRunInput, 'env' | 'credentialEnv'>, hostEnv: NodeJS.ProcessEnv): Record<string, string>;
+export declare function resolveRunEnv({ input, hostEnv }: {
+    readonly input: Pick<AgentExecutorRunInput, 'env' | 'credentialEnv'>;
+    readonly hostEnv: NodeJS.ProcessEnv;
+}): Record<string, string>;
 /** A resolved launch whose `launchPath` is confirmed non-null — see {@link resolveLaunch}. */
 type ConfirmedAgentLaunchResolution = AgentLaunchResolution & {
     readonly launchPath: string;
 };
 /** Phase 3b: launch-path resolution + binary-not-resolved guard. */
-export declare function resolveLaunch(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly resolvedEnv: Record<string, string>;
-}, deps: {
-    readonly resolveAgentLaunch: typeof resolveAgentLaunch;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function resolveLaunch({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly resolvedEnv: Record<string, string>;
+    };
+    readonly deps: {
+        readonly resolveAgentLaunch: typeof resolveAgentLaunch;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<ConfirmedAgentLaunchResolution>;
 /** Phase 4a: stage a `promptViaFile` def's prompt to a temp file (a no-op for every other def). */
-export declare function stagePromptFile(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly prompt: string;
-}, deps: {
-    readonly preparePromptFileForAgent: typeof preparePromptFileForAgent;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function stagePromptFile({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly prompt: string;
+    };
+    readonly deps: {
+        readonly preparePromptFileForAgent: typeof preparePromptFileForAgent;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<PreparedPromptFile | null>;
 /** Phase 4b: stage a `needsAgentLogFile` def's diagnostic-log path (a no-op for every other def). */
-export declare function stageLogFile(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly preparedPromptFile: PreparedPromptFile | null;
-}, deps: {
-    readonly prepareAgentLogFile: typeof prepareAgentLogFile;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function stageLogFile({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly preparedPromptFile: PreparedPromptFile | null;
+    };
+    readonly deps: {
+        readonly prepareAgentLogFile: typeof prepareAgentLogFile;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<PreparedAgentLogFile | null>;
 /** Phase 5: resolves this run's MCP bridge delivery (credential resolution + {@link buildMcpBridgeDelivery}). */
-export declare function resolveMcpBridgeForRun(input: {
-    readonly runId: string;
-    readonly cwd: string;
-    readonly def: RuntimeAgentDef;
-}, deps: {
-    readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
-    readonly cleanupStagedFiles: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function resolveMcpBridgeForRun({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly cwd: string;
+        readonly def: RuntimeAgentDef;
+    };
+    readonly deps: {
+        readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
+        readonly cleanupStagedFiles: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<McpBridgeDelivery | null>;
 /**
  * Phase 6a/10c: the subprocess environment every env-riding mechanism uses — mechanism 3+4
@@ -1124,10 +1266,18 @@ export declare function resolveMcpBridgeForRun(input: {
  * @complexity O(1) plus `mergeEnvContentMcpConfig`'s and `mergeEnvContentInstructions`'s own `JSON.parse`/`JSON.stringify` cost.
  * @overallScore 100/100
  */
-export declare function computeChildEnv(spawnEnv: NodeJS.ProcessEnv, mcpBridge: McpBridgeDelivery | null, codexHomeDir?: string, systemPromptEnvOverrides?: Readonly<Record<string, string>>, stagedInstructionsFile?: {
-    readonly varName: string;
-    readonly path: string;
-}, claudeConfigDir?: string): NodeJS.ProcessEnv;
+export declare function computeChildEnv({ spawnEnv, mcpBridge }: {
+    readonly spawnEnv: NodeJS.ProcessEnv;
+    readonly mcpBridge: McpBridgeDelivery | null;
+}, { codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile, claudeConfigDir }?: {
+    readonly codexHomeDir?: string;
+    readonly systemPromptEnvOverrides?: Readonly<Record<string, string>>;
+    readonly stagedInstructionsFile?: {
+        readonly varName: string;
+        readonly path: string;
+    };
+    readonly claudeConfigDir?: string;
+}): NodeJS.ProcessEnv;
 /**
  * Phase 6b: the `RuntimeContext` `buildArgs` receives — `undefined` unless a file, bridge path, or
  * session id was staged. Pure.
@@ -1139,9 +1289,20 @@ export declare function computeChildEnv(spawnEnv: NodeJS.ProcessEnv, mcpBridge:
  * session id, with no prompt/log file staged and no claude-mcp-json bridge, is exactly the common
  * case for a resumed turn.
  */
-export declare function computeRuntimeContext(preparedPromptFile: PreparedPromptFile | null, preparedLogFile: PreparedAgentLogFile | null, mcpBridge: McpBridgeDelivery | null, resumeSessionId?: string | null, newSessionId?: string): RuntimeContext | undefined;
-/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
-export declare function buildAgentBuildArgsOptions(input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings'>, systemPromptOverlay: string | null | undefined): RuntimeBuildOptions | undefined;
+export declare function computeRuntimeContext({ preparedPromptFile, preparedLogFile, mcpBridge }: {
+    readonly preparedPromptFile: PreparedPromptFile | null;
+    readonly preparedLogFile: PreparedAgentLogFile | null;
+    readonly mcpBridge: McpBridgeDelivery | null;
+}, { resumeSessionId, newSessionId }?: {
+    readonly resumeSessionId?: string | null;
+    readonly newSessionId?: string;
+}): RuntimeContext | undefined;
+/** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
+ * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
+export declare function buildAgentBuildArgsOptions({ input, systemPromptOverlay }: {
+    readonly input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings'>;
+    readonly systemPromptOverlay: string | null | undefined;
+}): RuntimeBuildOptions | undefined;
 /**
  * {@link resolveSystemPromptOverlayDelivery}'s decision, threaded out of that one resolver to every
  * channel that can actually carry the overlay to the CLI.
@@ -1241,32 +1402,38 @@ export declare function resolveSystemPromptOverlayDelivery(input: {
  * therefore only ever reach the 7 defs whose `buildArgs` reads its first argument at all — the
  * other 17 declare it `_prompt` and discard it, which is exactly how the overlay used to go missing.
  */
-export declare function buildRunArgs(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly imageDelivery: ImagePromptDelivery;
-    readonly imagePaths: readonly string[] | undefined;
-    readonly runInput: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode'>;
-    readonly systemPromptOverlay: string | null | undefined;
-    readonly overlayDelivery: SystemPromptOverlayDelivery;
-    readonly runtimeContext: RuntimeContext | undefined;
-}, deps: {
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function buildRunArgs({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly imageDelivery: ImagePromptDelivery;
+        readonly imagePaths: readonly string[] | undefined;
+        readonly runInput: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode'>;
+        readonly systemPromptOverlay: string | null | undefined;
+        readonly overlayDelivery: SystemPromptOverlayDelivery;
+        readonly runtimeContext: RuntimeContext | undefined;
+    };
+    readonly deps: {
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<{
     readonly args: string[];
     readonly envOverrides: Readonly<Record<string, string>>;
 }>;
 /** Phase 10: mechanism 1 of 5's one effect — stages this run's own `.mcp.json`, returning the path `cleanupStagedFiles` should later remove (`undefined` for every other mechanism / unconfigured host). */
-export declare function writeMcpJsonIfNeeded(input: {
-    readonly runId: string;
-    readonly cwd: string;
-    readonly def: RuntimeAgentDef;
-    readonly mcpBridge: McpBridgeDelivery | null;
-}, deps: {
-    readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function writeMcpJsonIfNeeded({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly cwd: string;
+        readonly def: RuntimeAgentDef;
+        readonly mcpBridge: McpBridgeDelivery | null;
+    };
+    readonly deps: {
+        readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<string | undefined>;
 /** {@link prepareSystemPromptOverlayFileIfNeeded}'s result. */
 export type PreparedSystemPromptOverlayFile = {
@@ -1293,13 +1460,16 @@ export type PreparedSystemPromptOverlayFile = {
  * @complexity O(1) plus one directory creation and one file write.
  * @overallScore 100/100
  */
-export declare function prepareSystemPromptOverlayFileIfNeeded(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly overlay: string | null | undefined;
-}, deps: {
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function prepareSystemPromptOverlayFileIfNeeded({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly overlay: string | null | undefined;
+    };
+    readonly deps: {
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<PreparedSystemPromptOverlayFile | null>;
 /**
  * Phase 10b: mechanism 5 of 5's one effect — stages this run's scratch `CODEX_HOME` directory,
@@ -1311,15 +1481,18 @@ export declare function prepareSystemPromptOverlayFileIfNeeded(input: {
  * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
  * @overallScore 100/100
  */
-export declare function prepareCodexHomeIfNeeded(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly mcpBridge: McpBridgeDelivery | null;
-}, deps: {
-    readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
-    readonly hostEnv: NodeJS.ProcessEnv;
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function prepareCodexHomeIfNeeded({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly mcpBridge: McpBridgeDelivery | null;
+    };
+    readonly deps: {
+        readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
+        readonly hostEnv: NodeJS.ProcessEnv;
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<PreparedCodexHome | null>;
 /**
  * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
@@ -1344,25 +1517,31 @@ export declare function prepareCodexHomeIfNeeded(input: {
  * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceClaudeConfigDir} rather than read from a module-level `process.env`, matching {@link prepareCodexHomeIfNeeded}'s identical testability reasoning.
  * @complexity O(1) plus {@link prepareClaudeConfigDirForRun}'s own cost.
  */
-export declare function prepareClaudeConfigDirIfNeeded(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-}, deps: {
-    readonly enabled: boolean;
-    readonly claudeConfigDirIsolation: ClaudeConfigDirIsolationOptions | undefined;
-    readonly hostEnv: NodeJS.ProcessEnv;
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function prepareClaudeConfigDirIfNeeded({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+    };
+    readonly deps: {
+        readonly enabled: boolean;
+        readonly claudeConfigDirIsolation: ClaudeConfigDirIsolationOptions | undefined;
+        readonly hostEnv: NodeJS.ProcessEnv;
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<PreparedClaudeConfigDir | null>;
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */
-export declare function guardWindowsCommandLineBudget(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly launchPath: string;
-    readonly args: readonly string[];
-}, deps: {
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function guardWindowsCommandLineBudget({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly launchPath: string;
+        readonly args: readonly string[];
+    };
+    readonly deps: {
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<void>;
 /** {@link spawnAgentChildProcess}'s result — a discriminated union rather than a thrown/rejected outcome so the call can stay synchronous; see that function's doc for why. */
 export type SpawnAgentChildProcessResult = {
@@ -1391,30 +1570,44 @@ export type SpawnAgentChildProcessResult = {
  * which are safe to make asynchronous since no child (and hence no listener race) exists yet.
  * @complexity O(1) plus `spawn`'s own cost.
  */
-export declare function spawnAgentChildProcess(input: {
-    readonly cwd: string;
-    readonly childEnv: NodeJS.ProcessEnv;
-    readonly invocation: ReturnType<typeof createCommandInvocation>;
-}, deps: {
-    readonly spawn: typeof nodeSpawn;
+export declare function spawnAgentChildProcess({ input, deps }: {
+    readonly input: {
+        readonly cwd: string;
+        readonly childEnv: NodeJS.ProcessEnv;
+        readonly invocation: ReturnType<typeof createCommandInvocation>;
+    };
+    readonly deps: {
+        readonly spawn: typeof nodeSpawn;
+    };
 }): SpawnAgentChildProcessResult;
 /** Named predicate replacing an inline `streamFormat === 'acp-json-rpc' || streamFormat === 'pi-rpc'` check — the two formats that own their own prompt/event protocol and skip `wireChildLifecycle`. */
-export declare function isStdinDrivenFormat(streamFormat: SupportedStreamFormat): streamFormat is ChildDrivenStreamFormat;
+export declare function isStdinDrivenFormat(args: {
+    readonly streamFormat: SupportedStreamFormat;
+}): args is {
+    readonly streamFormat: ChildDrivenStreamFormat;
+};
 /** Phase 13: awaits spawn confirmation, routing a failure through the same `failBeforeSpawn` shape every earlier guard uses. */
-export declare function confirmChildSpawned(input: {
-    readonly runId: string;
-    readonly def: RuntimeAgentDef;
-    readonly child: ChildProcess;
-}, deps: {
-    readonly releaseStagedResources: () => Promise<void>;
-    readonly failBeforeSpawn: FailBeforeSpawn;
+export declare function confirmChildSpawned({ input, deps }: {
+    readonly input: {
+        readonly runId: string;
+        readonly def: RuntimeAgentDef;
+        readonly child: ChildProcess;
+    };
+    readonly deps: {
+        readonly releaseStagedResources: () => Promise<void>;
+        readonly failBeforeSpawn: FailBeforeSpawn;
+    };
 }): Promise<void>;
 /** Phase 14: starts a `runtimeLock` def's handoff watcher once a live process exists to consume the locked side effect — a no-op when the def declared no `waitForHandoff`. Deliberately not awaited; see `RuntimeLockHold.waitForHandoff`'s own doc. */
-export declare function armHandoffWatcher(runtimeLockHold: RuntimeLockHold | undefined, handoffInput: {
-    readonly logFilePath: string | undefined;
-    readonly model: string | undefined;
-    readonly processExited: AbortSignal;
-}, release: () => void): void;
+export declare function armHandoffWatcher({ runtimeLockHold, handoffInput, release }: {
+    readonly runtimeLockHold: RuntimeLockHold | undefined;
+    readonly handoffInput: {
+        readonly logFilePath: string | undefined;
+        readonly model: string | undefined;
+        readonly processExited: AbortSignal;
+    };
+    readonly release: () => void;
+}): void;
 interface RunAcpDispatchInput {
     readonly runId: string;
     readonly agentId: string;
@@ -1438,7 +1631,10 @@ interface RunAcpDispatchDeps extends TerminateChildTreeDeps {
     readonly failBeforeSpawn: FailBeforeSpawn;
 }
 /** Phase 15 (ACP branch): attaches the ACP session, escalating process-tree teardown and failing the run through `failBeforeSpawn` on an attach-time throw. */
-export declare function runAcpDispatch(input: RunAcpDispatchInput, deps: RunAcpDispatchDeps): Promise<void>;
+export declare function runAcpDispatch({ input, deps }: {
+    readonly input: RunAcpDispatchInput;
+    readonly deps: RunAcpDispatchDeps;
+}): Promise<void>;
 interface RunPiRpcDispatchInput {
     readonly runId: string;
     readonly agentId: string;
@@ -1460,7 +1656,10 @@ interface RunPiRpcDispatchDeps extends TerminateChildTreeDeps {
     readonly failBeforeSpawn: FailBeforeSpawn;
 }
 /** Phase 15 (pi-rpc branch): same discipline as {@link runAcpDispatch}, for the one `'pi-rpc'` def. */
-export declare function runPiRpcDispatch(input: RunPiRpcDispatchInput, deps: RunPiRpcDispatchDeps): Promise<void>;
-export declare function createAgentExecutor(options: CreateAgentExecutorOptions): AgentExecutor;
+export declare function runPiRpcDispatch({ input, deps }: {
+    readonly input: RunPiRpcDispatchInput;
+    readonly deps: RunPiRpcDispatchDeps;
+}): Promise<void>;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "getAgentDef" | "resolveAgentLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=agent-executor.d.ts.map