@khorsheed/dsh-local-agent 0.1.0-rc.6

package/lib/types/client/use-configuration-menu.js

@@ -0,0 +1,61 @@
+import { useEffect, useLayoutEffect, useRef, useState } from 'react';
+/** Shared dismissal and placement for settings and member configuration menus. */
+export function useConfigurationMenu(preferred) {
+    const root = useRef(null);
+    const panel = useRef(null);
+    const [open, setOpen] = useState(false);
+    const [style, setStyle] = useState();
+    useEffect(() => {
+        const dismiss = (event) => {
+            if (root.current?.open && event.target instanceof Node && !root.current.contains(event.target)) {
+                root.current.open = false;
+                setOpen(false);
+            }
+        };
+        const escape = (event) => {
+            if (event.key !== 'Escape' || !root.current?.open)
+                return;
+            event.preventDefault();
+            event.stopPropagation();
+            root.current.open = false;
+            setOpen(false);
+            root.current.querySelector('summary')?.focus();
+        };
+        document.addEventListener('pointerdown', dismiss, true);
+        document.addEventListener('focusin', dismiss);
+        document.addEventListener('keydown', escape, true);
+        return () => {
+            document.removeEventListener('pointerdown', dismiss, true);
+            document.removeEventListener('focusin', dismiss);
+            document.removeEventListener('keydown', escape, true);
+        };
+    }, []);
+    useLayoutEffect(() => {
+        if (!open)
+            return;
+        const place = () => {
+            if (!root.current || !panel.current)
+                return;
+            const anchor = root.current.getBoundingClientRect();
+            const dialog = root.current.closest('[role="dialog"], dialog')?.getBoundingClientRect();
+            const bounds = { left: Math.max(8, (dialog?.left ?? 0) + 8), right: Math.min(window.innerWidth - 8, (dialog?.right ?? window.innerWidth) - 8), top: Math.max(8, (dialog?.top ?? 0) + 8), bottom: Math.min(window.innerHeight - 8, (dialog?.bottom ?? window.innerHeight) - 8) };
+            const above = Math.max(0, anchor.top - bounds.top - 6);
+            const below = Math.max(0, bounds.bottom - anchor.bottom - 6);
+            const needed = Math.min(panel.current.scrollHeight, 400);
+            const up = preferred === 'above' ? above >= needed || above >= below : below < needed && above > below;
+            const width = Math.max(0, Math.min(300, bounds.right - bounds.left));
+            const left = Math.max(bounds.left, Math.min(preferred === 'above' ? anchor.right - width : anchor.left, bounds.right - width)) - anchor.left;
+            setStyle({ width, left, right: 'auto', top: up ? 'auto' : 'calc(100% + 6px)', bottom: up ? 'calc(100% + 6px)' : 'auto', maxHeight: Math.min(400, up ? above : below) });
+        };
+        place();
+        const observer = typeof ResizeObserver === 'undefined' ? undefined : new ResizeObserver(place);
+        if (panel.current)
+            observer?.observe(panel.current);
+        window.addEventListener('resize', place);
+        const scroll = (event) => { if (!(event.target instanceof Node) || !root.current?.contains(event.target))
+            place(); };
+        document.addEventListener('scroll', scroll, true);
+        return () => { observer?.disconnect(); window.removeEventListener('resize', place); document.removeEventListener('scroll', scroll, true); };
+    }, [open, preferred]);
+    return { root, panel, open, setOpen, style };
+}

package/lib/types/container.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Container exec transport for one delegation round: rewrite a CLI launch
+ * (argv + explicit env layer) into the `docker exec` form that runs the SAME
+ * argv inside an already-acquired container. Nothing downstream of the spawn
+ * changes — stdio stays piped, the stream parsers, settle chain, readback and
+ * delegation recording are byte-for-byte the host path's.
+ *
+ * The transport owns exactly one docker verb, `exec`. Acquiring, inspecting,
+ * mounting and destroying a container belong to the caller (lab); a provider
+ * that reached for another verb would be running an experiment nobody
+ * declared.
+ * @module @khorsheed/dsh-local-agent/container
+ */
+import type { DelegationExecTarget } from './types.ts';
+/** One CLI launch: the argv a provider would spawn and its explicit env layer. */
+export interface ContainerExecLaunch {
+    /** The CLI argv (`['codex', 'exec', …]`), unchanged by the transport. */
+    readonly argv: readonly string[];
+    /**
+     * The provider's explicit env layer as {@link delegationEnv} built it:
+     * defined entries are the round's own variables, `undefined` entries are
+     * tombstones for the shared scrub and carry no value to forward.
+     */
+    readonly env: Readonly<NodeJS.ProcessEnv>;
+}
+/**
+ * Rewrite a host CLI launch into its container form:
+ * `docker exec -w <workdir> [-e NAME…] <container> <original argv>`.
+ *
+ * **Values never ride the argv.** Each forwarded variable appears as a
+ * NAME-only `-e` flag, and the docker CLI resolves it from its OWN
+ * environment — which this function also returns. A credential the provider
+ * resolved (the sub-dsh API key) therefore stays out of the host process
+ * table, exactly as it does on the host path. Names are sorted, so one launch
+ * always produces one argv.
+ *
+ * What gets forwarded: every DEFINED entry of the provider's explicit env
+ * layer (tombstones carry no value and are dropped), overridden per key by
+ * the target's own `env` — the caller's entries are the in-container truth
+ * (`CODEX_HOME=/creds/codex` replacing the host scoped-home path). The
+ * ambient allowlist (`PATH`, `HOME`, the proxy variables) is deliberately NOT
+ * forwarded: inside the container those belong to the image and the `docker
+ * run` that created it, not to the host that is driving it.
+ * @param target - the container, in-container workdir, and env overrides.
+ * @param launch - the argv and explicit env layer of the host launch.
+ * @param who - the provider name, for error messages.
+ * @returns the argv and env for `ctx.subprocess.spawn` (the docker client).
+ */
+export declare function containerExecSpawn(target: DelegationExecTarget, launch: ContainerExecLaunch, who: string): {
+    argv: string[];
+    env: NodeJS.ProcessEnv;
+};
+/**
+ * Require the caller to name the CLI's scoped home as an IN-CONTAINER path.
+ * Every harness points its CLI at a scoped home through one environment
+ * variable, and the provider's own value is a host path: forwarded verbatim
+ * it would send the CLI to a directory that does not exist inside the unit,
+ * where it would silently start from an empty state — no credentials, no
+ * rollout to read back, and a delegation that fails for a reason nothing in
+ * the output names. The caller bind-mounts the host scoped home and declares
+ * where it landed; a target that forgets fails before anything spawns.
+ * @param target - the caller's exec target.
+ * @param key - the harness's scoped-home variable (`CODEX_HOME`, …).
+ * @param who - the provider name, for the error message.
+ * @returns the declared in-container scoped home.
+ * @throws when the target does not declare the variable.
+ */
+export declare function containerScopedHome(target: DelegationExecTarget, key: string, who: string): string;
+//# sourceMappingURL=container.d.ts.map

package/lib/types/container.js

@@ -0,0 +1,129 @@
+/**
+ * Container exec transport for one delegation round: rewrite a CLI launch
+ * (argv + explicit env layer) into the `docker exec` form that runs the SAME
+ * argv inside an already-acquired container. Nothing downstream of the spawn
+ * changes — stdio stays piped, the stream parsers, settle chain, readback and
+ * delegation recording are byte-for-byte the host path's.
+ *
+ * The transport owns exactly one docker verb, `exec`. Acquiring, inspecting,
+ * mounting and destroying a container belong to the caller (lab); a provider
+ * that reached for another verb would be running an experiment nobody
+ * declared.
+ * @module @khorsheed/dsh-local-agent/container
+ */
+import { delegationEnv } from './env.js';
+/**
+ * Docker client configuration a delegation must not lose when the CLI moves
+ * into a container: without them the `docker exec` would talk to the wrong
+ * daemon (or none). They are read from the HOST process environment, apply to
+ * the docker CLI itself, and never reach the container.
+ */
+const DOCKER_CLIENT_ENV = [
+    'DOCKER_HOST',
+    'DOCKER_CONTEXT',
+    'DOCKER_CONFIG',
+    'DOCKER_API_VERSION',
+    'DOCKER_CERT_PATH',
+    'DOCKER_TLS_VERIFY',
+];
+/** A valid POSIX environment variable name (no `=`, no NUL, not empty). */
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Validate one exec target, failing loud on the shapes docker would reject
+ * later (or, worse, misread as its own flags).
+ * @param target - the caller's exec target.
+ * @param who - the provider name, for the error message.
+ * @throws when the container name or workdir is empty, flag-shaped, or (for
+ *   the workdir) not absolute, or when an env key is not a variable name.
+ */
+function assertTarget(target, who) {
+    if (target.container === '' || target.container.startsWith('-')) {
+        throw new Error(`${who}: the container exec target needs a container name, got ${JSON.stringify(target.container)}`);
+    }
+    if (!target.workdir.startsWith('/')) {
+        throw new Error(`${who}: the container exec target's workdir must be an absolute in-container path, got ${JSON.stringify(target.workdir)}`);
+    }
+    for (const key of Object.keys(target.env ?? {})) {
+        if (!ENV_NAME.test(key)) {
+            throw new Error(`${who}: ${JSON.stringify(key)} is not a usable environment variable name for the container exec target`);
+        }
+    }
+}
+/**
+ * Rewrite a host CLI launch into its container form:
+ * `docker exec -w <workdir> [-e NAME…] <container> <original argv>`.
+ *
+ * **Values never ride the argv.** Each forwarded variable appears as a
+ * NAME-only `-e` flag, and the docker CLI resolves it from its OWN
+ * environment — which this function also returns. A credential the provider
+ * resolved (the sub-dsh API key) therefore stays out of the host process
+ * table, exactly as it does on the host path. Names are sorted, so one launch
+ * always produces one argv.
+ *
+ * What gets forwarded: every DEFINED entry of the provider's explicit env
+ * layer (tombstones carry no value and are dropped), overridden per key by
+ * the target's own `env` — the caller's entries are the in-container truth
+ * (`CODEX_HOME=/creds/codex` replacing the host scoped-home path). The
+ * ambient allowlist (`PATH`, `HOME`, the proxy variables) is deliberately NOT
+ * forwarded: inside the container those belong to the image and the `docker
+ * run` that created it, not to the host that is driving it.
+ * @param target - the container, in-container workdir, and env overrides.
+ * @param launch - the argv and explicit env layer of the host launch.
+ * @param who - the provider name, for error messages.
+ * @returns the argv and env for `ctx.subprocess.spawn` (the docker client).
+ */
+export function containerExecSpawn(target, launch, who) {
+    assertTarget(target, who);
+    const forwarded = {};
+    for (const [key, value] of Object.entries(launch.env)) {
+        if (value !== undefined && ENV_NAME.test(key))
+            forwarded[key] = value;
+    }
+    for (const [key, value] of Object.entries(target.env ?? {}))
+        forwarded[key] = value;
+    const names = Object.keys(forwarded).sort();
+    const client = {};
+    for (const key of DOCKER_CLIENT_ENV) {
+        const value = process.env[key];
+        if (value !== undefined)
+            client[key] = value;
+    }
+    return {
+        argv: [
+            'docker',
+            'exec',
+            '-w',
+            target.workdir,
+            ...names.flatMap(name => ['-e', name]),
+            target.container,
+            ...launch.argv,
+        ],
+        // The docker client is the process being spawned, so it carries the
+        // forwarded VALUES (the `-e NAME` flags read them here) plus its own
+        // daemon coordinates, under the same scrub the host path uses.
+        env: delegationEnv({ ...client, ...forwarded }),
+    };
+}
+/**
+ * Require the caller to name the CLI's scoped home as an IN-CONTAINER path.
+ * Every harness points its CLI at a scoped home through one environment
+ * variable, and the provider's own value is a host path: forwarded verbatim
+ * it would send the CLI to a directory that does not exist inside the unit,
+ * where it would silently start from an empty state — no credentials, no
+ * rollout to read back, and a delegation that fails for a reason nothing in
+ * the output names. The caller bind-mounts the host scoped home and declares
+ * where it landed; a target that forgets fails before anything spawns.
+ * @param target - the caller's exec target.
+ * @param key - the harness's scoped-home variable (`CODEX_HOME`, …).
+ * @param who - the provider name, for the error message.
+ * @returns the declared in-container scoped home.
+ * @throws when the target does not declare the variable.
+ */
+export function containerScopedHome(target, key, who) {
+    const value = target.env?.[key];
+    if (value === undefined || value === '') {
+        throw new Error(`${who}: a container exec target must declare ${key} as the in-container path of the scoped home `
+            + '(bind-mount the host scoped home read-write and name its mount point) — the host path means nothing inside the unit');
+    }
+    return value;
+}

package/lib/types/env.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Build the explicit `env` layer of a delegation spawn spec: the caller's
+ * entries (scoped home variable, credentials, endpoint overrides) plus an
+ * `undefined` tombstone for every ambient key outside the platform's
+ * inheritance allowlist. The result only makes sense as a
+ * `SubprocessSpawnSpec.env` — the subprocess seam merges it over
+ * `scrubbedParentEnv()`, so allowlisted keys arrive by inheritance and never
+ * appear here, while tombstoned keys are removed from the child. Caller's
+ * entries always win, including over the allowlist. Anything the child truly
+ * needs beyond the allowlist must be passed explicitly by the provider, which
+ * is the point: the delegation env is reviewed, not inherited by accident.
+ * @param extra - the provider's explicit entries (and any deliberate
+ *   tombstones) for this spawn.
+ * @returns the explicit env layer to hand to `ctx.subprocess.spawn`.
+ */
+export declare function delegationEnv(extra: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv;
+//# sourceMappingURL=env.d.ts.map

package/lib/types/env.js

@@ -0,0 +1,89 @@
+import { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess';
+/**
+ * Ambient keys a delegated CLI child may inherit on POSIX. Everything else the
+ * harness process carries is tombstoned: the CLIs read far more of the
+ * environment than they document (claude 2.1.236's credential resolution
+ * breaks when `USER` is present — bisected on a live host), so inheriting by
+ * default turns every host-specific variable into a per-harness incident.
+ * `USER`/`LOGNAME` are deliberately absent; git resolves the author from
+ * `HOME`'s gitconfig. Proxy variables pass through in both casings.
+ */
+const POSIX_INHERITED = new Set([
+    'PATH',
+    'HOME',
+    'TMPDIR',
+    'SHELL',
+    'TERM',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'LC_MESSAGES',
+    'XDG_CONFIG_HOME',
+    'XDG_DATA_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_RUNTIME_DIR',
+    'SSH_AUTH_SOCK',
+    'NO_COLOR',
+    'GIT_TERMINAL_PROMPT',
+    'http_proxy',
+    'https_proxy',
+    'all_proxy',
+    'no_proxy',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'ALL_PROXY',
+    'NO_PROXY',
+]);
+/**
+ * The Windows counterpart, matched case-insensitively per the platform's
+ * environment semantics. `USERNAME` is excluded for symmetry with POSIX
+ * `USER`.
+ */
+const WINDOWS_INHERITED = new Set([
+    'PATH',
+    'PATHEXT',
+    'SYSTEMROOT',
+    'SYSTEMDRIVE',
+    'WINDIR',
+    'COMSPEC',
+    'TEMP',
+    'TMP',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROGRAMDATA',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'ALL_PROXY',
+    'NO_PROXY',
+]);
+/**
+ * Build the explicit `env` layer of a delegation spawn spec: the caller's
+ * entries (scoped home variable, credentials, endpoint overrides) plus an
+ * `undefined` tombstone for every ambient key outside the platform's
+ * inheritance allowlist. The result only makes sense as a
+ * `SubprocessSpawnSpec.env` — the subprocess seam merges it over
+ * `scrubbedParentEnv()`, so allowlisted keys arrive by inheritance and never
+ * appear here, while tombstoned keys are removed from the child. Caller's
+ * entries always win, including over the allowlist. Anything the child truly
+ * needs beyond the allowlist must be passed explicitly by the provider, which
+ * is the point: the delegation env is reviewed, not inherited by accident.
+ * @param extra - the provider's explicit entries (and any deliberate
+ *   tombstones) for this spawn.
+ * @returns the explicit env layer to hand to `ctx.subprocess.spawn`.
+ */
+export function delegationEnv(extra) {
+    const windows = process.platform === 'win32';
+    const normalize = (key) => (windows ? key.toUpperCase() : key);
+    const explicit = new Set(Object.keys(extra).map(normalize));
+    const inherited = windows ? WINDOWS_INHERITED : POSIX_INHERITED;
+    const env = {};
+    for (const key of Object.keys(scrubbedParentEnv())) {
+        if (explicit.has(normalize(key)) || inherited.has(normalize(key)))
+            continue;
+        env[key] = undefined;
+    }
+    return { ...env, ...extra };
+}

package/lib/types/gateway.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Read-only Remote channel for the local-agent family: roster, per-harness
+ * auth status, and scoped session records. The web client polls these through
+ * Typert Gateway instead of the slash-command channel, so UI refreshes never
+ * leave `command/run`/`command/done` lifecycle nodes in the session log.
+ * Sign-out and login stay on the command channel: they are user-initiated
+ * actions whose visible command node is the expected feedback.
+ * @module @khorsheed/dsh-local-agent/gateway
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import type { LocalAgentDelegationView, LocalAgentModelInfo, LocalAgentModelDirectory, LocalAgentPromptResult, LocalAgentSessionRecord, LocalAgentStreamFrame, LocalAgentMemberControlState, LocalAgentMemberInbox, LocalAgentMemberConfiguration, LocalAgentControlReceipt, LocalAgentMemberFeedRequest, LocalAgentMemberFeedEvent } from './types.ts';
+import type { LocalAgentRosterRow, LocalAgentStatus } from './types.ts';
+export default class LocalAgentGateway extends TypertRemoteService {
+    static inject: string[];
+    constructor(ctx: Context);
+    /**
+     * Follow one member's transient output with a complete reconnect baseline.
+     * @param childSessionId - mirrored session identity.
+     * @param signal - Remote-owned cancellation, including browser disconnects.
+     * @returns bounded incremental updates; final content remains in session history.
+     */
+    followMemberOutput(childSessionId: string, signal: AbortSignal): AsyncIterable<LocalAgentStreamFrame>;
+    /** Shared browser stream: adding visible members does not consume more HTTP connections. */
+    followMembers(requests: readonly LocalAgentMemberFeedRequest[], signal: AbortSignal): AsyncIterable<LocalAgentMemberFeedEvent>;
+    private memberFeed;
+    private directoryBroker;
+    /**
+     * Read or explicitly refresh native model discovery, without changing a member.
+     * @param name - owning harness.
+     * @param childSessionId - member context, or undefined for the harness default.
+     * @param refresh - bypass the discovery TTL.
+     * @returns source-labelled discovery state, or null for an unavailable broker.
+     */
+    modelDirectory(name: string, childSessionId: string | undefined, refresh: boolean): Promise<LocalAgentModelDirectory | null>;
+    /**
+     * Keep a currently open model picker synchronized with discovery completion.
+     * @param name - owning harness.
+     * @param childSessionId - member context, or undefined for the harness default.
+     * @param signal - Remote-owned cancellation.
+     * @returns directory baselines and subsequent snapshots.
+     */
+    followModelDirectory(name: string, childSessionId: string | undefined, signal: AbortSignal): AsyncIterable<LocalAgentModelDirectory>;
+    /** Resolve directory ownership from the recorded member, never a UI provider guess. */
+    memberDirectory(childSessionId: string, refresh: boolean): Promise<LocalAgentModelDirectory | null>;
+    followMemberDirectory(childSessionId: string, signal: AbortSignal): AsyncIterable<LocalAgentModelDirectory>;
+    /**
+     * Registered harnesses in registration order.
+     * @returns the roster rows.
+     */
+    roster(): readonly LocalAgentRosterRow[];
+    /**
+     * The child session ids with an in-flight delegation run (the
+     * active-delegation registry's key set). Surfaces that render one-shot
+     * subagent rows poll this to mark a row as actually running — the official
+     * session summary's `running` flag is agent-based and stays false for
+     * external CLI one-shots, which have no live agent — and to offer the
+     * stop verb that dispatches `/local-agent stop <childSessionId>`.
+     * @returns the in-flight child session ids.
+     */
+    activeDelegations(): readonly string[];
+    /**
+     * One harness's auth status, in the default scope or in a named one.
+     * @param name - the harness name.
+     * @param scope - the named scope to report on; absent means the default
+     *   scope, so a client written before scopes existed gets exactly the
+     *   snapshot it always got.
+     * @returns the status snapshot.
+     */
+    status(name: string, scope?: string): Promise<LocalAgentStatus>;
+    /**
+     * One harness's scoped session records, optionally narrowed to the sessions
+     * whose working directory is a given dsh session's cwd — the delegations a
+     * session's workspace actually produced, so one project's kimi sessions do
+     * not surface in another project's session.
+     * @param name - the harness name.
+     * @param sessionId - optional dsh session whose cwd filters the records.
+     * @returns the matching session records.
+     */
+    sessions(name: string, sessionId?: string): Promise<readonly LocalAgentSessionRecord[]>;
+    /**
+     * The member channel's membership check: the delegation view for one dsh
+     * child session, or null when the family never delegated it. The composer
+     * chain elects on the session snapshot alone (one-shot subagent), then
+     * confirms membership through this Remote — a null answer renders the same
+     * read-only panel the official composer shows, never a writable box.
+     * The CLI-session resume handle (`cliSessionId`) deliberately stays off the
+     * wire: the resume facade resolves it host-side from the record.
+     * @param childSessionId - the dsh child session id being viewed.
+     * @returns the delegation view, or null for a non-member session.
+     */
+    memberOf(childSessionId: string): LocalAgentDelegationView | null;
+    /**
+     * The model surface of one harness without a member — the settings card's
+     * "what would a round run with" read. Null when the harness is unknown or
+     * exposes no model broker: the card then keeps its free-text field exactly
+     * as before brokers existed. The core fills `lastObserved` from the
+     * delegation records (the harness's own provider) when the broker's answer
+     * carries none — display context for the cli-builtin layer, never a layer —
+     * and appends it to `choices` when no broker choice lists it, so the card's
+     * menu offers what last ran instead of staying empty.
+     * @param name - the harness name.
+     * @returns the layer-by-layer surface, or null.
+     */
+    harnessModel(name: string): Promise<LocalAgentModelInfo | null>;
+    /**
+     * The model surface of one member — the composer's picker read. The
+     * delegation record's requested model rides in from the core so the broker
+     * can rank it between the override and the settings layer; the record's
+     * OBSERVED model fills `lastObserved` when the broker's answer carries none
+     * (a broker that names one itself always wins — spread order: the broker's
+     * answer first, the core's fill only over an absent field) and joins
+     * `choices` as the last entry when no broker choice lists it, so a member
+     * that ran once has a one-item pick list instead of an empty menu. Null for a
+     * non-member session or a brokerless harness.
+     * @param childSessionId - the dsh child session id of the member.
+     * @returns the layer-by-layer surface, or null.
+     */
+    memberModel(childSessionId: string): Promise<LocalAgentModelInfo | null>;
+    /**
+     * Switch a member's session-level model (the composer's picker write). The
+     * override outranks the delegation's recorded model and the settings
+     * layer; with the live driver on it retires the member's resident runtime
+     * so the NEXT round respawns onto the new model — the CLI session itself
+     * (its rollout) carries over. Failures arrive structured, never raw.
+     * @param childSessionId - the dsh child session id of the member.
+     * @param model - the model identifier, or undefined to clear the override
+     *   (the member then follows the settings layer again).
+     * @returns `{ ok: true }` once applied, or a structured error.
+     */
+    setMemberModel(childSessionId: string, model?: string): Promise<LocalAgentPromptResult>;
+    memberConfiguration(childSessionId: string): Promise<LocalAgentMemberControlState>;
+    selectMemberConfiguration(childSessionId: string, requestId: string, expectedRevision: number, selection: LocalAgentMemberConfiguration): Promise<LocalAgentControlReceipt>;
+    cancelMemberConfiguration(childSessionId: string, requestId: string, expectedRevision: number): Promise<LocalAgentControlReceipt>;
+    retryMemberConfiguration(childSessionId: string, expectedRevision: number): Promise<void>;
+    followMemberConfiguration(childSessionId: string, signal: AbortSignal): AsyncIterable<LocalAgentMemberControlState>;
+    /**
+     * Send one human-authored follow-up to a family member: continue the
+     * member's SAME CLI session inside the SAME dsh child session. The child
+     * session id is the membership proof — the user opened the real child
+     * session, and the recorded delegation is the authorization source — so
+     * there is no model-forged handle surface; the resume handle never enters
+     * the prompt text. The prompt goes through the facade
+     * ({@link LocalAgentRegistry.resume}) unchanged: ownership check, resume
+     * lock, reattach, and run tracking all apply.
+     * @param childSessionId - the dsh child session id of the member.
+     * @param text - the human's follow-up message.
+     * @returns `{ ok: true }` once the run started, or a structured error
+     *   (unknown member, parent not live, resume in flight) for the composer to
+     *   render inline — raw exceptions never cross the wire.
+     */
+    promptMember(childSessionId: string, text: string, requestId?: string): Promise<LocalAgentPromptResult>;
+    memberInbox(childSessionId: string): LocalAgentMemberInbox;
+    controlMemberInbox(childSessionId: string, action: 'pause' | 'resume' | 'cancel' | 'reconcile', requestId?: string, outcome?: 'done' | 'cancelled', evidence?: string): LocalAgentPromptResult;
+    /**
+     * Interrupt a member's in-flight run (the composer's Stop).
+     * @param childSessionId - the dsh child session id of the member.
+     * @returns whether an in-flight run was found and signalled.
+     */
+    stopMember(childSessionId: string): boolean;
+}
+//# sourceMappingURL=gateway.d.ts.map