@kodax-ai/kodax 0.7.96 → 0.7.97-alpha.2

package/dist/types-chunks/{exec-policy.d-BPESl90L.d.ts → run-manager.d-C7Q71rin.d.ts}

@@ -1,10 +1,65 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
-import { K as KodaXBaseProvider } from './base.d-Bt9lhwSV.js';
-import { a as CostTracker } from './cost-tracker.d-BWI4lFWn.js';
-import { cb as RunnerToolCall, cH as ToolGuardrail, aM as GuardrailContext, aQ as GuardrailVerdict } from './controller.d-J2t1q8Ly.js';
-import { k as KodaXMessage } from './types.d-BrQMB-hy.js';
-import { S as SideQueryDiagnostics } from './side-query.d-DHWG1JZg.js';
-import { b$ as ToolSideEffect, aE as KodaXShellPermissionMode } from './bash-prefix-extractor.d-DWFIMg0v.js';
+import { K as KodaXBaseProvider } from './base.d-ZBOdjDUT.js';
+import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
+import { aD as RunnerToolCall, b7 as ToolGuardrail, z as GuardrailContext, J as GuardrailVerdict, x as Guardrail } from './controller.d-yyKajPTi.js';
+import { k as KodaXMessage } from './types.d-BjOq57-z.js';
+import { S as SideQueryDiagnostics } from './side-query.d-DTrhVd_r.js';
+import { c0 as ToolSideEffect, aF as KodaXShellPermissionMode, J as KodaXChildAgentResult, aa as KodaXOptions, S as KodaXContextOptions, v as KodaXActorHost, b9 as KodaXToolExecutionContext, L as KodaXChildContextBundle, M as KodaXChildExecutionResult, c1 as WorkflowHostPolicy, V as KodaXEvents } from './bash-prefix-extractor.d-DvswAXKS.js';
+import { b5 as WorkflowEventCorrelation, bL as WorkflowTaskSummaryEventUpdate, a_ as WorkflowAgentBackend, bz as WorkflowProcessTrackerOptions, b4 as WorkflowEvent, b2 as WorkflowArtifactRef, bb as WorkflowMeta, bC as WorkflowRunState, bd as WorkflowModule, b0 as WorkflowApproval, bm as WorkflowProcessEvent, b1 as WorkflowApprovalSummary, b9 as WorkflowLimits, aV as ManagedWorkflowSnapshot$1, bt as WorkflowProcessSnapshot, bB as WorkflowRunManager$1 } from './types.d-o7t9dds4.js';
+import { aG as KodaXSessionStorage, a as AgentActorClient, q as AgentCapabilities } from './review-inbox.d-BeaLRNHx.js';
+import { b as WorkflowScriptManifest } from './manifest.d-Bw2i-zQi.js';
+
+/**
+ * Circuit Breaker — FEATURE_092 Phase 2b.4 (v0.7.33).
+ *
+ * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
+ * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
+ * callers temporarily skip classifier calls and apply the Accept-edits
+ * failure boundary. The selected Auto engine remains `llm`; health state is
+ * diagnostic, not a mode change.
+ *
+ * Pure functional API: each operation returns a new breaker. No mutation.
+ * Memory bound: stale timestamps are pruned on each recordError call so
+ * the timestamps array never grows unbounded.
+ */
+declare const ERROR_THRESHOLD = 5;
+declare const WINDOW_MS: number;
+interface CircuitBreaker {
+    readonly timestamps: readonly number[];
+}
+declare function createCircuitBreaker(): CircuitBreaker;
+declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
+declare function shouldFallback$1(b: CircuitBreaker, now: number): boolean;
+
+/**
+ * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
+ *
+ * Tracks classifier blocks per session. When either threshold is crossed,
+ * threshold state is exposed for diagnostics and does not mutate the selected
+ * Auto engine.
+ *
+ *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
+ *   - 10 blocks in the last 50 completed reviews → broader review loop
+ *
+ * Both are session-scoped, shared with subagents (per design doc, to defend
+ * against threshold-bypass via spawning).
+ *
+ * Pure functional API: each operation returns a new tracker. No mutation.
+ */
+declare const CONSECUTIVE_THRESHOLD = 3;
+declare const RECENT_DENIAL_THRESHOLD = 10;
+declare const RECENT_WINDOW_SIZE = 50;
+interface DenialTracker {
+    readonly consecutive: number;
+    /** Lifetime diagnostic only; never trips the breaker by itself. */
+    readonly cumulative: number;
+    /** Bounded completed-review window. `true` means the reviewer denied. */
+    readonly recent?: readonly boolean[];
+}
+declare function createDenialTracker(): DenialTracker;
+declare function recordBlock(t: DenialTracker): DenialTracker;
+declare function recordAllow(t: DenialTracker): DenialTracker;
+declare function shouldFallback(t: DenialTracker): boolean;
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -487,58 +542,6 @@ type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCw
  */
 declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, executionCwd?: string): AbsoluteDenyResult;
 
-/**
- * Circuit Breaker — FEATURE_092 Phase 2b.4 (v0.7.33).
- *
- * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
- * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
- * callers temporarily skip classifier calls and apply the Accept-edits
- * failure boundary. The selected Auto engine remains `llm`; health state is
- * diagnostic, not a mode change.
- *
- * Pure functional API: each operation returns a new breaker. No mutation.
- * Memory bound: stale timestamps are pruned on each recordError call so
- * the timestamps array never grows unbounded.
- */
-declare const ERROR_THRESHOLD = 5;
-declare const WINDOW_MS: number;
-interface CircuitBreaker {
-    readonly timestamps: readonly number[];
-}
-declare function createCircuitBreaker(): CircuitBreaker;
-declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
-declare function shouldFallback$1(b: CircuitBreaker, now: number): boolean;
-
-/**
- * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
- *
- * Tracks classifier blocks per session. When either threshold is crossed,
- * threshold state is exposed for diagnostics and does not mutate the selected
- * Auto engine.
- *
- *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
- *   - 10 blocks in the last 50 completed reviews → broader review loop
- *
- * Both are session-scoped, shared with subagents (per design doc, to defend
- * against threshold-bypass via spawning).
- *
- * Pure functional API: each operation returns a new tracker. No mutation.
- */
-declare const CONSECUTIVE_THRESHOLD = 3;
-declare const RECENT_DENIAL_THRESHOLD = 10;
-declare const RECENT_WINDOW_SIZE = 50;
-interface DenialTracker {
-    readonly consecutive: number;
-    /** Lifetime diagnostic only; never trips the breaker by itself. */
-    readonly cumulative: number;
-    /** Bounded completed-review window. `true` means the reviewer denied. */
-    readonly recent?: readonly boolean[];
-}
-declare function createDenialTracker(): DenialTracker;
-declare function recordBlock(t: DenialTracker): DenialTracker;
-declare function recordAllow(t: DenialTracker): DenialTracker;
-declare function shouldFallback(t: DenialTracker): boolean;
-
 /**
  * AutoModeToolGuardrail — FEATURE_092 Phase 2b.6 (v0.7.33).
  *
@@ -782,8 +785,6 @@ interface AutoModeGuardrailConfig {
      * Layer-owned high-impact pattern checks. They add classifier evidence.
      */
     readonly extraAbsoluteDenyChecks?: readonly AbsoluteDenyCheck[];
-    /** @deprecated Retained as inert source-compatibility input. */
-    readonly speculativeWindowMs?: number;
 }
 /**
  * Snapshot of the auto-mode guardrail's session-scoped state. Returned by
@@ -894,5 +895,327 @@ declare function tokenizeShellCommand(command: string): {
     readonly compound: boolean;
 };
 
-export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS as L, DEFAULT_CLASSIFIER_TIMEOUT_MS as M, ERROR_THRESHOLD as O, RECENT_DENIAL_THRESHOLD as a3, RECENT_WINDOW_SIZE as a4, WINDOW_MS as a8, buildClassifierPrompt as a9, checkAbsoluteDeny as aa, classify as ab, collectAllSignals as ac, createAutoModeToolGuardrail as ad, createCircuitBreaker as ae, createDenialTracker as af, createExecPolicyOperation as ag, evaluateExecPolicy as ah, evaluateShellExecPolicy as ai, formatAgentsForPrompt as aj, formatExecPolicyConfigurationError as ak, formatExecPolicyRejection as al, getKodaxGlobalDir as am, loadAgentsFiles as an, loadExecPolicy as ao, parseClassifierOutput as ap, parseExecPolicy as aq, recordAllow as ar, recordBlock as as, recordError as at, shouldFallback as au, shouldFallback$1 as av, tokenizeShellCommand as aw, CONSECUTIVE_THRESHOLD as t };
-export type { LoadAgentsOptions as $, AbsoluteDenyCheck as A, BuildClassifierPromptInput as B, ClassifierObservedProtocol as D, ClassifierOutputWarningCode as E, ClassifierParseFailureCode as F, ClassifierPrompt as G, ClassifierProtocol as H, ClassifierToolProjectionResolver as I, ClassifyDecision as J, ClassifyOptions as K, DenialTracker as N, ExecPolicyCriticalEffect as P, ExecPolicyDecision as Q, ExecPolicyEvaluation as R, ExecPolicyOperation as S, ExecPolicyRejection as T, ExecPolicyRule as U, ExecPolicyRuleInput as V, ExecPolicySource as W, KodaXMcpConnectMode as X, KodaXMcpServerConfig as Y, KodaXMcpServersConfig as Z, KodaXMcpTransport as _, AbsoluteDenyMatch as a, LoadExecPolicyOptions as a0, LoadExecPolicyResult as a1, ParseExecPolicyResult as a2, SignalCollector as a5, TierZeroPatternId as a6, ToolCallSignal as a7, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeGuardrailConfig as i, AutoModePermissionBoundary as j, AutoModePermissionOperation as k, AutoModePermissionReview as l, AutoModePermissionTarget as m, AutoModeRulesContext as n, AutoModeRulesDecision as o, AutoModeRulesEvaluator as p, AutoModeSharedState as q, AutoModeStats as r, AutoModeToolGuardrail as s, CircuitBreaker as u, ClassifierAttemptDiagnostics as v, ClassifierAttemptOutcome as w, ClassifierDecision as x, ClassifierFailureKind as y, ClassifierHazard as z };
+/**
+ * Predicate the parent REPL injects so the child executor can enforce plan-mode
+ * constraints without `packages/coding` reverse-depending on `packages/repl`.
+ *
+ * The predicate MUST read the parent's permission mode lazily (e.g., through a
+ * closure over a ref), so mid-run mode toggles propagate to in-flight child tool
+ * calls. Returns the block reason (string) for tools/inputs that are currently
+ * plan-mode-violating, or `null` when the call is allowed right now.
+ */
+type PlanModeBlockCheck = (tool: string, input: Record<string, unknown>) => string | null;
+interface WorkflowChildDigestUpdate {
+    readonly childId: string;
+    readonly digest?: string;
+    readonly digestFailed?: boolean;
+    readonly totalTokensUsed: number;
+    readonly digestTokensUsed?: number;
+    readonly usage?: {
+        readonly inputTokens?: number;
+        readonly outputTokens?: number;
+        readonly totalTokens?: number;
+        readonly cacheReadTokens?: number;
+    };
+}
+interface ChildExecutorOptions {
+    readonly onIteration?: (iteration: NonNullable<KodaXChildAgentResult['iteration']>) => void;
+    readonly maxParallel: number;
+    readonly maxIterationsPerChild: number;
+    readonly abortSignal?: AbortSignal;
+    /** Parent-provided persistence capability for an isolated child-owned lineage. */
+    readonly historyStorage?: KodaXSessionStorage;
+    readonly parentOptions: Readonly<Partial<Pick<KodaXOptions, 'provider' | 'model' | 'effort' | 'reasoningMode' | 'extensionRuntime' | 'events' | 'compaction' | 'disablePromptCache' | 'sandbox'> & Pick<KodaXContextOptions, 'repoIntelligenceMode' | 'repoIntelligenceTrace' | 'contextDiagnostics' | 'shellExecution' | 'permissionIntent'>>>;
+    readonly parentRole: string;
+    readonly parentHarness: string;
+    /**
+     * FEATURE_217 (v0.7.49): set by the workflow agent backend to enable the
+     * one-turn, no-tool self-distill digest for workflow-launched children.
+     * Distinct from `parentHarness` because workflow children must keep
+     * `parentHarness:'tool-dispatch'` so `validateWriteBundles` still admits
+     * write children — the two concerns cannot share one field.
+     */
+    readonly workflowChild?: boolean;
+    /**
+     * Workflow child digest mode. `blocking` preserves FEATURE_217 behavior.
+     * `async` returns the child result immediately and reports the digest through
+     * `onWorkflowChildDigest`; worktree-isolated children still use blocking mode
+     * so the digest runs before cleanup removes the worktree.
+     */
+    readonly workflowDigestMode?: 'blocking' | 'async';
+    readonly onWorkflowChildDigest?: (update: WorkflowChildDigestUpdate) => void;
+    readonly workflowCorrelation?: WorkflowEventCorrelation;
+    /** User-facing child label for live telemetry surfaces. Defaults to bundle id. */
+    readonly childActivityName?: string;
+    /** Progress callback for REPL status display. Called when children start, progress, and complete. */
+    readonly onProgress?: (status: string) => void;
+    /**
+     * FEATURE_074: Predicate provided by the parent REPL to evaluate plan-mode block
+     * reasons at each child tool call. The predicate closes over parent state so
+     * mid-run mode toggles propagate to in-flight children. When absent, children
+     * run without plan-mode enforcement.
+     */
+    readonly planModeBlockCheck?: PlanModeBlockCheck;
+    /**
+     * FEATURE_092 phase 2b.7b slice D: parent-Runner guardrails forwarded into
+     * each child's `Runner.run` via `KodaXOptions.guardrails`. The auto-mode
+     * guardrail's mutable review-denial and circuit-breaker state is shared by
+     * passing the SAME instance, so children cannot restart the parent's bounded
+     * denial budget.
+     */
+    readonly guardrails?: readonly Guardrail[];
+    /** Runtime-minted principal inherited by the child runtime for recursive collaboration. */
+    readonly actorControl?: AgentActorClient;
+    /** Exact non-root parent identity for nested live-context attribution. */
+    readonly actorParentAgentId?: string;
+    /** Exact admitted Actor Turn id used as the child run's live Turn identity. */
+    readonly actorTurnId?: string;
+    /** Trusted host bridge inherited beside the principal for nested Workflow owners. */
+    readonly actorHost?: KodaXActorHost;
+    /** Prior Actor turns and committed mailbox facts projected into this turn. */
+    readonly initialMessages?: readonly KodaXMessage[];
+    /** Runtime-minted ceiling applied after specialist/default tool resolution. */
+    readonly actorCapabilities?: AgentCapabilities;
+    /** Logical diagnostics identity when bundle ids are local to a Workflow backend. */
+    readonly contextAgentId?: string;
+    /** Logical diagnostics parent paired with contextAgentId. */
+    readonly contextParentAgentId?: string;
+}
+
+/** Coding Workflow adapter over the Runtime-owned Actor control plane. */
+
+/** The subset of `ChildExecutorOptions` the caller fixes once per run. */
+type WorkflowChildOptions = Omit<ChildExecutorOptions, 'maxParallel' | 'abortSignal' | 'workflowChild' | 'workflowDigestMode' | 'onWorkflowChildDigest' | 'workflowCorrelation'>;
+interface CodingWorkflowBackendDeps {
+    /** Parent tool-execution context carrying the Workflow owner's Actor binding. */
+    readonly ctx: KodaXToolExecutionContext;
+    /** Fixed per-run child options (parentRole / parentHarness / parentOptions
+     *  / maxIterationsPerChild / guardrails / …). */
+    readonly childOptions: WorkflowChildOptions;
+    /** Seam: child runner. Defaults to `executeChildAgents`. */
+    readonly runChild?: (bundles: readonly KodaXChildContextBundle[], ctx: KodaXToolExecutionContext, options: ChildExecutorOptions) => Promise<KodaXChildExecutionResult>;
+    /** Seam: unique child id generator. */
+    readonly generateId?: () => string;
+    /** Workflow run id for correlating child-agent SDK callbacks. */
+    readonly runId?: string;
+    /** Default child write policy from the workflow manifest. */
+    readonly defaultChildReadOnly?: boolean;
+    /** Seam: workspace changed path reader. Defaults to git status/diff. */
+    readonly listChangedFiles?: (ctx: KodaXToolExecutionContext) => Promise<readonly string[]>;
+    readonly onTaskSummary?: (taskId: string, update: WorkflowTaskSummaryEventUpdate) => void;
+    /** True only for scripts generated by KodaX in this run; never inferred from schema content. */
+    readonly kodaxAuthored?: boolean;
+}
+/**
+ * Build a `WorkflowAgentBackend` over the coding child-dispatch substrate.
+ */
+declare function createCodingWorkflowBackend(deps: CodingWorkflowBackendDeps): WorkflowAgentBackend;
+
+/**
+ * FEATURE_217 (v0.7.49) Phase D — Durable workflow run graph.
+ *
+ * Persists a workflow run as `run.json` + append-only `events.jsonl` +
+ * `artifacts/` under a caller-supplied run directory (the REPL points
+ * this at `~/.kodax/workflow-runs/<project-key>/<runId>/` via
+ * `getAgentConfigPath`). Modelling the run as an event stream — not a
+ * single summary blob — keeps the agent relationships (spawn / message /
+ * complete / synthesize) inspectable after the fact.
+ *
+ * `appendFileSync` is used for events so the on-disk order matches the
+ * recorder's `seq` order with no async interleave.
+ */
+
+type WorkflowRunProcessMetadata = Pick<WorkflowProcessTrackerOptions, 'displayName' | 'goal' | 'source' | 'savedWorkflowName' | 'sourceRunId' | 'sourceWorkflowName' | 'revisionOf' | 'resumedFromRunId' | 'hostMetadata'>;
+interface RunGraphWriterDeps {
+    /** Clock for the per-event `ts` stamp. Defaults to `Date.now`. */
+    readonly now?: () => number;
+}
+interface RunJsonInput {
+    readonly meta: WorkflowMeta;
+    readonly args: unknown;
+    readonly state: WorkflowRunState;
+    readonly startedAt: number;
+    readonly endedAt: number;
+    readonly scriptSnapshot?: WorkflowScriptSnapshotRef;
+    readonly resultSummary?: string;
+    readonly processMetadata?: WorkflowRunProcessMetadata;
+}
+interface WorkflowScriptSnapshotInput {
+    readonly source: string;
+    readonly manifest?: WorkflowScriptManifest;
+}
+interface WorkflowScriptSnapshotRef {
+    readonly scriptPath: string;
+    readonly manifestPath?: string;
+}
+interface RunGraphWriter {
+    readonly runDir: string;
+    /** Append one event to `events.jsonl`. */
+    onEvent(event: WorkflowEvent): void;
+    /** Persist an artifact under `artifacts/<safe-name>.json`. */
+    writeArtifact(name: string, value: unknown): WorkflowArtifactRef;
+    /** Persist generated workflow source + optional manifest beside run.json. */
+    writeScriptSnapshot(input: WorkflowScriptSnapshotInput): WorkflowScriptSnapshotRef;
+    /** Write the terminal `run.json` summary. */
+    writeRunJson(input: RunJsonInput): void;
+}
+declare function safeWorkflowArtifactName(name: string): string;
+declare function createRunGraphWriter(runDir: string, deps?: RunGraphWriterDeps): RunGraphWriter;
+
+interface WorktreeSweepDeps {
+    /** Run a git subcommand from `cwd`, resolving stdout. Defaults to `execFile`. */
+    readonly runGit?: (args: readonly string[], cwd: string) => Promise<string>;
+    /** Worktree directory mtime in ms. Defaults to `statSync`. Layer 3 only. */
+    readonly mtimeMs?: (path: string) => number;
+    /** Clock for staleness comparison. Defaults to `Date.now`. Layer 3 only. */
+    readonly now?: () => number;
+}
+
+/**
+ * FEATURE_217 (v0.7.49) Phase D — Headless workflow orchestrator.
+ *
+ * Ties together: the approval gate, the coding agent backend (Phase B),
+ * the durable run-graph writer, and the agent-layer `runWorkflow`
+ * envelope. This is the REPL-agnostic core the `/workflow` command
+ * (Phase D.2) drives; it is fully testable with a fake backend + temp
+ * run dir + a stub approval callback.
+ */
+
+declare const SYSTEM_WORKFLOW_LIMITS: {
+    readonly maxAgents: 64;
+    readonly tokenBudget: 200000;
+};
+interface RunWorkflowModuleOptions {
+    readonly module: WorkflowModule;
+    readonly args: unknown;
+    readonly runId: string;
+    /** Directory for the durable run graph (run.json / events.jsonl / artifacts). */
+    readonly runDir: string;
+    /** Parent context — required when the backend is built internally. */
+    readonly ctx?: KodaXToolExecutionContext;
+    /** Per-run child options — required when the backend is built internally. */
+    readonly childOptions?: WorkflowChildOptions;
+    /** Pre-built backend (test seam). When omitted, built from ctx + childOptions. */
+    readonly backend?: WorkflowAgentBackend;
+    /** Approval gate. When omitted, the run auto-proceeds (SDK / headless). */
+    readonly approval?: WorkflowApproval;
+    /** Optional host/SDK ceilings. These may only lower manifest/system limits. */
+    readonly hostPolicy?: WorkflowHostPolicy;
+    readonly signal?: AbortSignal;
+    /** Extra event sink (e.g. live UI), in addition to the durable writer. */
+    readonly onEvent?: (event: WorkflowEvent) => void;
+    /** Host/SDK process snapshot stream. */
+    readonly onWorkflowProcessEvent?: (event: WorkflowProcessEvent) => void;
+    readonly now?: () => number;
+    readonly scriptSnapshot?: WorkflowScriptSnapshotInput;
+    /** FEATURE_246 Part D (ADR-048): a prior run dir to seed the result cache from
+     *  for same-session resume. Unchanged effects replay from it; only changed
+     *  effects re-run live. */
+    readonly resumeFromRunDir?: string;
+    readonly processMetadata?: WorkflowRunProcessMetadata;
+    /** Optional lifecycle gate, used by WorkflowRunManager pause/resume. */
+    readonly beforeSpawn?: () => Promise<void>;
+    /** Test seam: inject git/mtime for the worktree sweep (FEATURE_217 Layer 2/3). */
+    readonly worktreeSweepDeps?: WorktreeSweepDeps;
+}
+type RunWorkflowModuleOutcome = {
+    readonly kind: 'denied';
+    readonly summary: WorkflowApprovalSummary;
+} | {
+    readonly kind: 'completed';
+    readonly result: unknown;
+    readonly state: WorkflowRunState;
+} | {
+    readonly kind: 'failed';
+    readonly error: Error;
+    readonly state: WorkflowRunState;
+};
+/** Build the pre-run approval summary from a workflow module's metadata. */
+declare function buildApprovalSummary(module: WorkflowModule, hostPolicy?: WorkflowHostPolicy): WorkflowApprovalSummary;
+declare function clampWorkflowLimits(meta: WorkflowMeta, hostPolicy?: WorkflowHostPolicy): WorkflowLimits;
+/**
+ * Run a workflow module end-to-end: approval → runtime + backend +
+ * durable run graph → terminal `run.json`. A workflow execution failure
+ * surfaces as `{ kind: 'failed' }` and a denied approval as
+ * `{ kind: 'denied' }`. Only a misconfiguration (no backend AND no
+ * ctx+childOptions) throws — that is a programmer precondition error.
+ */
+declare function runWorkflowModule(opts: RunWorkflowModuleOptions): Promise<RunWorkflowModuleOutcome>;
+interface RunWorkflowFromOptionsInput {
+    readonly module: WorkflowModule;
+    readonly args: unknown;
+    readonly options: KodaXOptions;
+    readonly runId: string;
+    readonly runDir: string;
+    readonly approval?: WorkflowApproval;
+    readonly signal?: AbortSignal;
+    readonly onEvent?: (event: WorkflowEvent) => void;
+    readonly onWorkflowProcessEvent?: (event: WorkflowProcessEvent) => void;
+    readonly now?: () => number;
+    readonly scriptSnapshot?: WorkflowScriptSnapshotInput;
+    /** FEATURE_246 Part D (ADR-048): prior run dir to seed the resume cache. */
+    readonly resumeFromRunDir?: string;
+    readonly processMetadata?: WorkflowRunProcessMetadata;
+    readonly beforeSpawn?: () => Promise<void>;
+}
+/**
+ * ADR-049: forward a single workflow child-agent terminal/summary event to the
+ * REPL's per-agent digest hook. Coarse gate here (the four summary event types);
+ * the REPL's `formatWorkflowAgentDigest` does the fine filtering (status, pending
+ * summaries) so inline and slash `/workflow` digests stay identical.
+ */
+declare function emitWorkflowAgentDigest(events: KodaXEvents | undefined, runId: string, event: WorkflowEvent): void;
+/**
+ * High-level entry: build a tool-execution context + child options from
+ * `KodaXOptions` (provider / model / extensionRuntime) and run the
+ * workflow module. ctx construction stays inside `@kodax-ai/coding` — the
+ * REPL passes plain `KodaXOptions` (from `createKodaXOptions`) rather than
+ * reaching into run-loop internals.
+ */
+declare function runWorkflowFromOptions(input: RunWorkflowFromOptionsInput): Promise<RunWorkflowModuleOutcome>;
+
+/**
+ * FEATURE_246 Part A0b (ADR-046) — coding adapter over the neutral agent-layer
+ * workflow run manager.
+ *
+ * The lifecycle core (registry / pause / resume / stop / process tracking /
+ * settle) now lives in `@kodax-ai/agent` (`createWorkflowRunManager`). This
+ * adapter preserves the coding-facing API (`start` / `startFromOptions` driven
+ * by `RunWorkflowModuleOptions` / `KodaXOptions` + durable run dirs) by building
+ * the agent manager's injected `runFn` from `runWorkflowModule` /
+ * `runWorkflowFromOptions`, and augments the neutral snapshot with the
+ * coding-specific `runDir`. Dependency arrows point coding → agent only.
+ */
+
+/** Coding snapshot = the neutral agent snapshot plus the durable run dir. */
+interface ManagedWorkflowSnapshot extends ManagedWorkflowSnapshot$1 {
+    readonly runDir: string;
+}
+interface ManagedWorkflowRun {
+    readonly runId: string;
+    readonly done: Promise<RunWorkflowModuleOutcome>;
+    readonly getSnapshot?: () => ManagedWorkflowSnapshot | undefined;
+    readonly getProcessSnapshot?: () => WorkflowProcessSnapshot | undefined;
+}
+interface WorkflowRunManager {
+    start(opts: RunWorkflowModuleOptions): ManagedWorkflowRun;
+    startFromOptions(input: RunWorkflowFromOptionsInput): ManagedWorkflowRun;
+    list(): readonly ManagedWorkflowSnapshot[];
+    get(runId: string): ManagedWorkflowSnapshot | undefined;
+    subscribeWorkflowProcess(listener: (event: WorkflowProcessEvent) => void): () => void;
+    getWorkflowProcessSnapshot(runId: string): WorkflowProcessSnapshot | undefined;
+    listWorkflowProcessSnapshots(options?: {
+        readonly activeOnly?: boolean;
+        readonly limit?: number;
+    }): readonly WorkflowProcessSnapshot[];
+    pause(runId: string): boolean;
+    resume(runId: string): boolean;
+    stop(runId: string, reason?: string): boolean;
+}
+declare function createWorkflowRunManager(deps?: {
+    readonly now?: () => number;
+}, agent?: WorkflowRunManager$1): WorkflowRunManager;
+declare function getDefaultWorkflowRunManager(): WorkflowRunManager;
+
+export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS as M, DEFAULT_CLASSIFIER_TIMEOUT_MS as N, ERROR_THRESHOLD as P, RECENT_DENIAL_THRESHOLD as a6, RECENT_WINDOW_SIZE as a7, createWorkflowRunManager as aA, emitWorkflowAgentDigest as aB, evaluateExecPolicy as aC, evaluateShellExecPolicy as aD, formatAgentsForPrompt as aE, formatExecPolicyConfigurationError as aF, formatExecPolicyRejection as aG, getDefaultWorkflowRunManager as aH, getKodaxGlobalDir as aI, loadAgentsFiles as aJ, loadExecPolicy as aK, parseClassifierOutput as aL, parseExecPolicy as aM, recordAllow as aN, recordBlock as aO, recordError as aP, runWorkflowFromOptions as aQ, runWorkflowModule as aR, safeWorkflowArtifactName as aS, shouldFallback as aT, shouldFallback$1 as aU, tokenizeShellCommand as aV, SYSTEM_WORKFLOW_LIMITS as ae, WINDOW_MS as ai, buildApprovalSummary as ao, buildClassifierPrompt as ap, checkAbsoluteDeny as aq, clampWorkflowLimits as ar, classify as as, collectAllSignals as at, createAutoModeToolGuardrail as au, createCircuitBreaker as av, createCodingWorkflowBackend as aw, createDenialTracker as ax, createExecPolicyOperation as ay, createRunGraphWriter as az, CONSECUTIVE_THRESHOLD as t };
+export type { KodaXMcpTransport as $, AbsoluteDenyCheck as A, BuildClassifierPromptInput as B, ClassifierObservedProtocol as D, ClassifierOutputWarningCode as E, ClassifierParseFailureCode as F, ClassifierPrompt as G, ClassifierProtocol as H, ClassifierToolProjectionResolver as I, ClassifyDecision as J, ClassifyOptions as K, CodingWorkflowBackendDeps as L, DenialTracker as O, ExecPolicyCriticalEffect as Q, ExecPolicyDecision as R, ExecPolicyEvaluation as S, ExecPolicyOperation as T, ExecPolicyRejection as U, ExecPolicyRule as V, ExecPolicyRuleInput as W, ExecPolicySource as X, KodaXMcpConnectMode as Y, KodaXMcpServerConfig as Z, KodaXMcpServersConfig as _, AbsoluteDenyMatch as a, LoadAgentsOptions as a0, LoadExecPolicyOptions as a1, LoadExecPolicyResult as a2, ManagedWorkflowRun as a3, ManagedWorkflowSnapshot as a4, ParseExecPolicyResult as a5, RunGraphWriter as a8, RunGraphWriterDeps as a9, RunJsonInput as aa, RunWorkflowFromOptionsInput as ab, RunWorkflowModuleOptions as ac, RunWorkflowModuleOutcome as ad, SignalCollector as af, TierZeroPatternId as ag, ToolCallSignal as ah, WorkflowChildOptions as aj, WorkflowRunManager as ak, WorkflowRunProcessMetadata as al, WorkflowScriptSnapshotInput as am, WorkflowScriptSnapshotRef as an, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeGuardrailConfig as i, AutoModePermissionBoundary as j, AutoModePermissionOperation as k, AutoModePermissionReview as l, AutoModePermissionTarget as m, AutoModeRulesContext as n, AutoModeRulesDecision as o, AutoModeRulesEvaluator as p, AutoModeSharedState as q, AutoModeStats as r, AutoModeToolGuardrail as s, CircuitBreaker as u, ClassifierAttemptDiagnostics as v, ClassifierAttemptOutcome as w, ClassifierDecision as x, ClassifierFailureKind as y, ClassifierHazard as z };

package/dist/types-chunks/runtime-client-info-CxnlZlW5.d.ts

@@ -0,0 +1,175 @@
+import { ap as ClientSubmitInput, c as ClientCommandInput, a4 as ClientReviewInput, ar as ClientToolInvocationInput, ax as ClientWorkflowStartInput } from './client-contract-A1jdk6xz.js';
+import { M as AgentSpawnInput } from './review-inbox.d-BeaLRNHx.js';
+
+/** Trusted Main bridge contracts; keep this leaf free of Node and Runtime implementation types. */
+
+interface RuntimeCredentialRequest {
+    readonly leaseId: string;
+    readonly provider: string;
+    readonly sessionId: string;
+    readonly runId: string;
+}
+type RuntimeCredentialBroker = (request: RuntimeCredentialRequest) => Promise<string | undefined>;
+/** Public binding only carries authority; credential material never crosses this input. */
+type RuntimeCredentialBinding = {
+    readonly leaseId: string;
+    /** v1 compatibility: one credential is acquired for the complete Run. */
+    readonly provider: string;
+} | {
+    readonly leaseId: string;
+    readonly mode: "scoped";
+    /** Operation-local narrowing of the registered v2 lease allowlist. */
+    readonly providers: readonly string[];
+};
+type RuntimeScopedCredentialTarget = {
+    readonly kind: "run";
+    readonly runId: string;
+} | {
+    readonly kind: "operation";
+    readonly operationId: string;
+    readonly operation: "session.compact";
+} | {
+    readonly kind: "actor_turn";
+    readonly actorPath: string;
+    readonly turnId: string;
+    readonly parentRunId?: string;
+} | {
+    readonly kind: "workflow";
+    readonly workflowRunId: string;
+    readonly parentRunId?: string;
+};
+type RuntimeScopedCredentialPurpose = "primary" | "fallback" | "classifier" | "sidecar" | "compaction" | "workflow" | "utility";
+interface RuntimeScopedCredentialRequest {
+    readonly requestId: string;
+    readonly leaseId: string;
+    readonly provider: string;
+    readonly sessionId: string;
+    readonly target: RuntimeScopedCredentialTarget;
+    readonly purpose: RuntimeScopedCredentialPurpose;
+}
+type RuntimeScopedCredentialBroker = (request: RuntimeScopedCredentialRequest) => Promise<string | undefined>;
+interface RuntimeCredentialLease {
+    readonly id: string;
+    readonly providers: readonly string[];
+    readonly expiresAt?: string;
+    /** Absent on legacy v1 daemons. */
+    readonly brokerVersion?: 1 | 2;
+}
+interface RuntimeCredentialService {
+    register(input: {
+        readonly providers: readonly string[];
+        readonly expiresAt?: string;
+    }, broker: RuntimeCredentialBroker): Promise<RuntimeCredentialLease>;
+    resume(leaseId: string, broker: RuntimeCredentialBroker): Promise<RuntimeCredentialLease>;
+    registerScoped(input: {
+        readonly providers: readonly string[];
+        readonly expiresAt?: string;
+    }, broker: RuntimeScopedCredentialBroker): Promise<RuntimeCredentialLease>;
+    resumeScoped(leaseId: string, broker: RuntimeScopedCredentialBroker): Promise<RuntimeCredentialLease>;
+    revoke(leaseId: string): Promise<boolean>;
+}
+interface RuntimeHostToolDescriptor {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    readonly sideEffect: "none" | "idempotent" | "non_idempotent";
+}
+interface RuntimeHostToolInvocation {
+    readonly invocationId: string;
+    readonly leaseId: string;
+    readonly toolName: string;
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly input: Readonly<Record<string, unknown>>;
+}
+interface RuntimeHostToolResult {
+    readonly content: string;
+    readonly structuredContent?: unknown;
+}
+type RuntimeHostToolHandler = (invocation: RuntimeHostToolInvocation) => Promise<RuntimeHostToolResult>;
+interface RuntimeHostToolLease {
+    readonly id: string;
+    readonly tools: readonly RuntimeHostToolDescriptor[];
+}
+interface RuntimeHostToolInvocationStatus {
+    readonly invocationId: string;
+    readonly leaseId: string;
+    readonly toolName: string;
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly state: "prepared" | "dispatched" | "completed" | "unknown" | "not_dispatched";
+    readonly updatedAt: string;
+}
+interface RuntimeHostToolService {
+    register(tools: readonly RuntimeHostToolDescriptor[], handlers: Readonly<Record<string, RuntimeHostToolHandler>>): Promise<RuntimeHostToolLease>;
+    resume(leaseId: string, handlers: Readonly<Record<string, RuntimeHostToolHandler>>): Promise<RuntimeHostToolLease>;
+    getInvocation(invocationId: string): Promise<RuntimeHostToolInvocationStatus | undefined>;
+    revoke(leaseId: string): Promise<boolean>;
+}
+/** Non-secret capabilities selected by trusted Main code, never by a Product input. */
+interface RuntimeExecutionAuthorization {
+    readonly credential?: Extract<RuntimeCredentialBinding, {
+        readonly mode: 'scoped';
+    }>;
+    readonly hostTools?: {
+        readonly leaseId: string;
+    };
+    /** Additional ceiling for independently admitted Actor turns. */
+    readonly tools?: readonly string[];
+}
+type KodaXClientExecutionRequest = {
+    readonly kind: 'input';
+    readonly input: ClientSubmitInput;
+} | {
+    readonly kind: 'command';
+    readonly input: ClientCommandInput;
+} | {
+    readonly kind: 'review' | 'agents_lean';
+    readonly input: ClientReviewInput;
+} | {
+    readonly kind: 'tool';
+    readonly input: ClientToolInvocationInput;
+} | {
+    readonly kind: 'workflow';
+    readonly input: ClientWorkflowStartInput;
+} | {
+    readonly kind: 'agent_spawn';
+    readonly input: {
+        readonly sessionId: string;
+        readonly agent: AgentSpawnInput;
+    };
+} | {
+    readonly kind: 'agent_followup';
+    readonly input: {
+        readonly sessionId: string;
+        readonly actorPath: string;
+        readonly objective: string;
+        readonly expectedRevision?: number;
+    };
+} | {
+    readonly kind: 'compaction';
+    readonly input: {
+        readonly sessionId: string;
+        readonly customInstructions?: string;
+    };
+};
+type KodaXClientHostAuthorization = (request: KodaXClientExecutionRequest, services: {
+    readonly credentials: RuntimeCredentialService;
+    readonly hostTools: RuntimeHostToolService;
+}) => Promise<RuntimeExecutionAuthorization | undefined>;
+
+/** Display classification only; never authority for process control. */
+type RuntimeDaemonClientType = 'app' | 'cli' | 'diagnostic' | 'automation' | 'unknown';
+interface RuntimeClientInfo {
+    readonly name: string;
+    /** Stable host-generated identity used only after daemon authentication. */
+    readonly instanceId?: string;
+    /** Stable host-generated secret; persist in OS keychain to resume client-owned leases. */
+    readonly instanceSecret?: string;
+    readonly title?: string;
+    readonly version?: string;
+    /** Display-only classification; never use it for authorization or process control. */
+    readonly clientType?: RuntimeDaemonClientType;
+}
+
+export type { KodaXClientExecutionRequest as K, RuntimeClientInfo as R, KodaXClientHostAuthorization as a, RuntimeCredentialBinding as b, RuntimeCredentialBroker as c, RuntimeCredentialLease as d, RuntimeCredentialRequest as e, RuntimeCredentialService as f, RuntimeDaemonClientType as g, RuntimeExecutionAuthorization as h, RuntimeHostToolDescriptor as i, RuntimeHostToolHandler as j, RuntimeHostToolInvocation as k, RuntimeHostToolInvocationStatus as l, RuntimeHostToolLease as m, RuntimeHostToolResult as n, RuntimeHostToolService as o, RuntimeScopedCredentialBroker as p, RuntimeScopedCredentialPurpose as q, RuntimeScopedCredentialRequest as r, RuntimeScopedCredentialTarget as s };