@linxin666/dsh-client-ui-task-board 0.4.3 → 0.4.5

package/lib/types/host/verification-gate.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Goal acceptance gate: the board's evaluator-backed certification of a goal
+ * completion claim.
+ *
+ * The gate sits on the official tool pre-execute lifecycle and intercepts the
+ * one call that ends a goal run — `update_goal` with `action: 'complete'`
+ * — BEFORE it takes effect. This is why the board does not ask the agent to
+ * verify itself: the tool call that finishes the goal is refused until a
+ * matching acceptance pass record exists, so no prompt wording and no
+ * self-report can route around it.
+ *
+ * Semantics owned here:
+ * - one acceptance cycle per EXECUTION, spent at most twice: the first failure
+ *   returns its findings to the fixing agent, the second ends the cycle;
+ * - a repeated completion call during a repair, a new automatic goal round, a
+ *   plugin reload and a Host restart all reuse the same cycle rather than
+ *   resetting it (the budget is persisted on the execution record);
+ * - an anomaly (timeout, authentication, unparseable answer, an unusable judge
+ *   route) is recorded separately from a quality verdict and is never treated
+ *   as one;
+ * - concurrent completion calls for one execution share one acceptance.
+ */
+import type { PreToolDecision } from '@deepseek-ai/dsh-tools';
+import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
+import { type WorkspaceChangeSource } from './workspace-evidence.ts';
+import type { HostTaskLedger } from '../host-ledger.ts';
+/** The subset of the official goal service this gate drives. */
+export interface GoalFace {
+    get(agent: unknown): {
+        id: string;
+        revision: number;
+        objective: string;
+    } | undefined;
+    block(agent: unknown, ref: {
+        id: string;
+        revision: number;
+    }, reason: {
+        code: string;
+        message: string;
+    }): unknown;
+}
+/** Everything the gate needs from its owner. */
+export interface GoalVerificationGateDeps {
+    ledger: HostTaskLedger;
+    /** Resolve the optional model runtime lazily (it may activate later). */
+    llm?: () => LlmRuntime | undefined;
+    /** Resolve the optional goal service lazily. */
+    goals?: () => GoalFace | undefined;
+    /**
+     * Resolve the optional host change service lazily. Absent (or a deployment
+     * that serves none) simply means the judge sees the trajectory alone.
+     */
+    workspaceChanges?: () => WorkspaceChangeSource | undefined;
+    logger: {
+        warn(message: string, ...rest: unknown[]): void;
+    };
+    now?: () => number;
+}
+/** The shape of one tool pre-execution the gate inspects. */
+export interface GateExecution {
+    name: string;
+    arguments: unknown;
+    agent?: unknown;
+    signal: AbortSignal;
+}
+/**
+ * Create the goal acceptance gate.
+ * @param deps - the ledger, the model runtime, the goal service and the settings.
+ * @returns the `tools/pre-execute` listener body (without the waterfall next()).
+ */
+export declare function createGoalVerificationGate(deps: GoalVerificationGateDeps): (exec: GateExecution) => Promise<PreToolDecision | undefined>;

package/lib/types/host/verification-runner.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Goal acceptance runner: evidence assembly and the judge calls of one
+ * acceptance attempt.
+ *
+ * Lives in the host half because it needs the live session event log and the
+ * official `llm` service; every rule it applies (criteria, scale, tags,
+ * thresholds, budgets, caps) comes from `../core/verification.ts`, which mirrors
+ * the installed dsh-llm-verifier 0.8.4 default final acceptance.
+ */
+import { type LlmRuntime } from '@deepseek-ai/dsh-llm';
+import { type VerificationAttempt, type VerificationRoute, type VerificationUsage } from '../core/verification.ts';
+/** Largest trace handed to the judge, mirroring the verifier's default cap. */
+export declare const VERIFICATION_MAX_TRACE_CHARS = 80000;
+/** Largest single trace entry; one huge tool result must not eat the budget. */
+export declare const VERIFICATION_MAX_ENTRY_CHARS = 4000;
+/** Largest per-finding text kept from one judge answer. */
+export declare const VERIFICATION_MAX_FINDING_CHARS = 400;
+/** Findings kept per judge answer and per acceptance. */
+export declare const VERIFICATION_MAX_FINDINGS_PER_CALL = 3;
+export declare const VERIFICATION_MAX_FINDINGS = 6;
+/** One judge request's ceiling and its retry budget. */
+export declare const VERIFICATION_CALL_TIMEOUT_MS = 120000;
+export declare const VERIFICATION_MAX_TOKENS = 16384;
+export declare const VERIFICATION_TEMPERATURE = 0.2;
+export declare const VERIFICATION_REQUEST_ATTEMPTS = 3;
+/** Redaction patterns, mirrored from the verifier's defaults. */
+export declare const VERIFICATION_REDACT_PATTERNS: readonly string[];
+/** Why one acceptance could not produce a verdict. */
+export type VerificationErrorKind = 'route-unavailable' | 'timeout' | 'auth' | 'parse' | 'request' | 'aborted';
+/** An acceptance anomaly: never a quality verdict, always recorded as one. */
+export declare class VerificationError extends Error {
+    readonly kind: VerificationErrorKind;
+    readonly usage: VerificationUsage;
+    constructor(kind: VerificationErrorKind, message: string, usage?: VerificationUsage, options?: {
+        cause?: unknown;
+    });
+}
+/** Fresh zeroed usage counters. */
+export declare function emptyUsage(): VerificationUsage;
+/** Structural view of one session event, as the host log carries it. */
+interface RawEvent {
+    type?: unknown;
+    seq?: unknown;
+    time?: unknown;
+    data?: unknown;
+}
+/** Read one session's events across the shapes the SDK cohort exposes. */
+export declare function sessionEvents(session: unknown): readonly RawEvent[];
+/** Evidence assembled for one acceptance attempt. */
+export interface AcceptanceEvidence {
+    problem: string;
+    trace: string;
+    entries: number;
+    fromSeq?: number;
+    toSeq?: number;
+    omittedCharacters: number;
+    hash: string;
+}
+/**
+ * Assemble the evidence one acceptance judges.
+ *
+ * The window starts at the execution's own `startedAt`, never at the session's
+ * first event: a reused session carries the history of earlier executions, and
+ * those runs must not be judged as this one's work. Only observed output is
+ * rendered — tool calls with their arguments and their results, assistant
+ * prose, goal round markers and team messages — and the result is redacted and
+ * capped before it ever reaches a judge.
+ * @param session - the live session of the execution.
+ * @param problem - the execution's composed prompt, shown as the task statement.
+ * @param startedAt - the instant the execution opened (ms epoch).
+ * @returns the bounded, redacted evidence.
+ */
+/**
+ * The session events inside one execution's own window.
+ *
+ * A reused session carries the history of earlier executions; only the events
+ * at or after this execution's start belong to the work being judged.
+ * @param session - the live session.
+ * @param startedAt - the execution's start instant (ms epoch).
+ * @returns the events of this execution, oldest first.
+ */
+export declare function evidenceEvents(session: unknown, startedAt: number): readonly RawEvent[];
+export declare function collectEvidence(session: unknown, problem: string, startedAt: number): AcceptanceEvidence;
+/** The verdict of one acceptance attempt. */
+export interface AcceptanceResult {
+    attempt: VerificationAttempt;
+}
+/**
+ * Run one acceptance: every criterion is judged twice, the odd round with the
+ * A/B slots swapped, and the per-round scores are mapped back and averaged per
+ * criterion.
+ * @param input - the judge route, evidence, threshold and cancellation.
+ * @returns the recorded attempt (quality verdict or anomaly).
+ */
+export declare function runAcceptance(input: {
+    llm: LlmRuntime;
+    route: VerificationRoute;
+    evidence: AcceptanceEvidence;
+    threshold: number;
+    index: number;
+    signal: AbortSignal;
+    /** Host-observed workspace changes, rendered as the prompt's reference context. */
+    context?: string;
+    /** How many changed files that context shows. */
+    workspaceFiles?: number;
+    now?: () => number;
+}): Promise<AcceptanceResult>;
+export {};

package/lib/types/host/workspace-evidence.d.ts

@@ -0,0 +1,53 @@
+/** The subset of the host change service this module drives. */
+export interface WorkspaceChangeSource {
+    summary(sessionId: string, seq: number): unknown;
+    diff(sessionId: string, seq: number, index: number, signal: AbortSignal): Promise<unknown>;
+}
+/** One session event, as the host log carries it. */
+interface RawEvent {
+    type?: unknown;
+    seq?: unknown;
+}
+/** How many changed files one evidence block renders. */
+export declare const MAX_WORKSPACE_FILES = 8;
+/** Character ceiling for the whole rendered block. */
+export declare const WORKSPACE_EVIDENCE_MAX_CHARS = 24000;
+/** Character ceiling for one file's rendered comparison. */
+export declare const WORKSPACE_EVIDENCE_MAX_FILE_CHARS = 6000;
+/**
+ * Resolve the optional host change service from a context-like object.
+ * @param ctx - anything exposing @@get(name)@@.
+ * @returns the service, or undefined when this deployment serves none.
+ */
+export declare function probeWorkspaceChanges(ctx: {
+    get(name: string): unknown;
+}): WorkspaceChangeSource | undefined;
+/** The sequence of the newest change event inside the reviewed window. */
+export declare function latestChangeEvent(events: readonly RawEvent[]): {
+    seq: number;
+    turn?: number;
+} | undefined;
+/**
+ * Render the host's own record of what the reviewed window changed.
+ *
+ * Bounded twice — at most {@link MAX_WORKSPACE_FILES} files, and a shared
+ * character budget split across them — so one enormous generated file cannot
+ * crowd out every other change. Every failure degrades to less evidence (or an
+ * empty block) instead of an error, because the acceptance being prepared must
+ * still reach a verdict.
+ * @param events - session events already bounded to the execution's window.
+ * @param sessionId - the session whose changes these are.
+ * @param source - the probed host service.
+ * @param options - budget, cancellation and the diagnostic sink.
+ * @returns the rendered block plus how many files it shows.
+ */
+export declare function renderWorkspaceEvidence(events: readonly RawEvent[], sessionId: string, source: WorkspaceChangeSource, options: {
+    signal: AbortSignal;
+    warn?: (message: string) => void;
+    maxChars?: number;
+}): Promise<{
+    text: string;
+    files: number;
+    hash: string;
+}>;
+export {};

package/lib/types/host-ledger.d.ts

@@ -1,5 +1,6 @@
 import { type ExecutionOutcome, type ExecutionRecord, type TaskRecord } from './core/tasks.ts';
 import { type TaskBoardAction, type TaskBoardSchedulerSnapshot } from './protocol.ts';
+import type { ExecutionVerification } from './core/verification.ts';
 import { type TaskPermission } from './core/handover.ts';
 export interface LedgerState {
     revision: number;
@@ -23,11 +24,20 @@ export interface OpenExecutionReference {
     readonly executionId: string;
     readonly sessionId: string | undefined;
     readonly startedAt: number;
+    /**
+     * True for a member of a team-mode run other than its Lead. A teammate is a
+     * durable member of the Team: it stays alive after its turn ends, so the
+     * roster may keep reporting its session as running, and the turn it completed
+     * is the only verdict it exposes.
+     */
+    readonly teamMember: boolean;
 }
 /** Minimal value copy used by the Host scheduler. */
 export interface DueScheduleReference {
     readonly taskId: string;
     readonly cron: string;
+    /** Zone this rule's wall clock is read in. */
+    readonly timeZone: string;
     readonly nextRunAt: number;
 }
 /** Derived runtime data for one session-poll pass. */
@@ -80,8 +90,14 @@ export declare class HostTaskLedger {
     readonly lockFile: string;
     /** Small sidecar for the 30 s scheduler heartbeat (lastTickAt only). */
     readonly schedulerFile: string;
-    /** Session-default permission the confirmation gate compares against. */
-    readonly sessionDefaultPermission: TaskPermission;
+    /** Resolves the baseline the confirmation gate compares a binding against. */
+    private readonly sessionDefault;
+    /**
+     * Session-default permission the confirmation gate compares against. Read
+     * through the resolver on every use, so a baseline that follows the Host's
+     * own default preset tracks a Settings change made while the board runs.
+     */
+    get sessionDefaultPermission(): TaskPermission;
     /**
      * Deployment subtask depth limit (1..3): the lineage gate every write obeys.
      * The settings card edits it live, so {@link setMaxSubtaskDepth} mutates it
@@ -89,7 +105,7 @@ export declare class HostTaskLedger {
      */
     private depthLimit;
     constructor(dir?: string, now?: () => number, options?: {
-        sessionDefaultPermission?: TaskPermission;
+        sessionDefaultPermission?: TaskPermission | (() => TaskPermission);
         maxSubtaskDepth?: number;
     });
     /** Current subtask depth limit (1..3). */
@@ -149,16 +165,21 @@ export declare class HostTaskLedger {
      */
     settle(taskId: string, executionId: string, outcome: ExecutionOutcome, error?: string): void;
     attachSession(taskId: string, executionId: string, sessionId: string): void;
+    allTasks(): readonly TaskRecord[];
+    getTask(id: string): TaskRecord | undefined;
+    saveTaskRecord(task: TaskRecord): void;
     private apply;
     /**
      * The binding that makes a run illegal, if any.
      *
      * A plain cascade launches one session per participant, so every participant
      * carries its own resolved binding and each one gates the run. A team run
-     * launches only the Lead session: the Lead's binding gates it, while a
-     * subtask's OWN above-default pin cannot be applied to a teammate and is
-     * refused instead of being silently dropped (an inherited binding is the
-     * Lead's own and stays allowed once the Lead is confirmed).
+     * launches only the Lead session: the Lead's binding gates it, and a
+     * teammate inherits that session's permission, so a subtask's OWN pin is
+     * refused exactly when the Lead session does not already carry it — the
+     * teammate could never be given that authority, and dropping the pin
+     * silently would misreport the work (an inherited binding is the Lead's own
+     * and stays allowed once the Lead is confirmed).
      * @param root - the task being run.
      * @returns the first refusal, or undefined when the run may start.
      */
@@ -191,15 +212,90 @@ export declare class HostTaskLedger {
      * (failure dominates, then cancellation).
      */
     private settleCascade;
+    /**
+     * Close every run that is already decided, and fold every lineage whose
+     * members are all settled. The Host poll calls this on every tick, so a run
+     * can no longer be left in the running column by a settle nobody observed:
+     *
+     * - A team run is governed by its Lead. Once the Lead's own outcome is
+     *   recorded, its still-open members are settled with that verdict. A
+     *   teammate is a durable member of the Team and may never report a turn of
+     *   its own, and without this the whole lineage waits on it forever.
+     * - A cascade parent whose members are all settled is finalized here even
+     *   when the settle that completed the tree happened in another process, or
+     *   was interrupted between its child write and its parent write.
+     *
+     * Idempotent: a run that is already folded is left untouched, so a caller may
+     * invoke it on every tick.
+     * @param persist - false to leave the document for the caller to commit.
+     * @returns whether the document changed.
+     */
+    finalizeReadyRuns(persist?: boolean): boolean;
+    /**
+     * The verdict a team run's Lead has already recorded: its own turn outcome
+     * once that turn ended, or the folded outcome once its card settled.
+     */
+    private leadVerdict;
+    /**
+     * Settle every still-open member of a team run with the Lead's verdict.
+     * A teammate that already reported its own outcome keeps it: the ordinary
+     * fold still lets a failure dominate.
+     * @param leadId - the Lead card's task id (never settled here).
+     * @param groupId - the team run's group.
+     * @param verdict - the Lead's outcome, inherited by members that never reported.
+     * @param error - the Lead's failure text, inherited with a failed verdict.
+     * @param now - clock instant (ms epoch).
+     * @returns whether the document changed.
+     */
+    private closeTeamMembers;
     private repairSchedules;
     private reconcileInterruptedStarts;
     /**
-     * Field-preserving v2 to v3 migration. v3 adds no fields yet, so the
-     * migration reuses the v3 normalization, but it first proves every task
-     * row is structurally valid: a v2 document that would silently drop or
-     * coerce rows fails loudly instead (no quarantined-empty restart).
+     * Field-preserving migration of an older document. It first proves every task
+     * row is structurally valid, so a document that would silently drop or coerce
+     * rows fails loudly instead (no quarantined-empty restart), and then reuses
+     * the current normalization.
+     *
+     * v4 adds `ScheduleRule.timeZone`. A rule written before v4 was evaluated in
+     * whatever zone the Host process happened to report, so the migration stamps
+     * that zone onto every enabled rule: the trigger instant is preserved exactly
+     * (the stored `nextRunAt` already encodes the old zone), but the rule stops
+     * following a later `TZ` change, which is what made an existing schedule
+     * silently move when the Host's zone changed.
+     *
+     * v5 adds the per-execution acceptance block. The migration deliberately does
+     * NOT stamp one: an execution opened before v5 keeps no contract, so it
+     * settles on its own historical verdict and no in-flight run is retroactively
+     * judged by a gate that was never armed for it.
      */
     private migrateLegacyDocument;
+    /**
+     * Find the still-open execution that ran in one session, with its task.
+     *
+     * The completion gate keys on the session id its tool call arrives from: the
+     * execution record is the only object binding a session to a card, and an
+     * already-settled execution is deliberately not returned (a session the board
+     * no longer owns must not be gated).
+     * @param sessionId - the DSH session the tool call runs in.
+     * @returns the open execution and its task, or undefined.
+     */
+    findOpenExecutionBySession(sessionId: string): {
+        task: TaskRecord;
+        execution: ExecutionRecord;
+    } | undefined;
+    /**
+     * Replace one execution's acceptance block (creating it when absent).
+     *
+     * A no-op when the serialized value is unchanged, so a coarse caller that
+     * re-writes the same state never bumps the ledger revision. A settled
+     * execution keeps its record: the report of a finished cycle must survive,
+     * and only the board's own settlement moves the card.
+     * @param taskId - the task owning the execution.
+     * @param executionId - the execution to update.
+     * @param verification - the new block.
+     * @returns true when the ledger changed.
+     */
+    setVerification(taskId: string, executionId: string, verification: ExecutionVerification): boolean;
     private load;
     private normalizeDocument;
     /** Quarantine an unreadable document and start from an empty ledger. */

package/lib/types/host-runner.d.ts

@@ -3,7 +3,10 @@ import type { SessionSummary } from '@deepseek-ai/dsh-api-session-controller/typ
 import type { CommandResult } from '@deepseek-ai/dsh-commands/types';
 import type { Workspace } from '@deepseek-ai/dsh-workspace/types';
 import type { TaskRecord } from './core/tasks.ts';
-/** Host services needed to validate a task's workspace before creating a session. */
+/**
+ * Host services needed to validate a task's workspace before creating a
+ * session, and to resolve the workspace an unpinned card runs in.
+ */
 export interface TaskBoardWorkspaceRegistry {
     list(): readonly Workspace[];
 }
@@ -23,8 +26,18 @@ type ExecutionSessionId = SessionSummary['sessionId'];
 export interface SessionCommandDispatcher {
     execute(sessionId: ExecutionSessionId, line: string, signal: AbortSignal): Promise<CommandResult | undefined>;
 }
-export type ExecutionInspection = {
+export type ExecutionInspection = 
+/**
+ * No verdict yet. `unreadable` separates "the work may still be in progress"
+ * from "this session's history could not be read at all": a reader failure is
+ * not progress, and the caller decides how long to keep waiting before it
+ * reports the execution as undeterminable instead of holding a card open
+ * forever.
+ */
+{
     outcome: 'pending';
+    unreadable?: true;
+    reason?: string;
 } | {
     outcome: 'succeeded';
 } | {
@@ -64,6 +77,17 @@ export interface PromptContext {
     peers?: readonly PromptPeer[];
     /** True when those members run as teammates inside this session (Team Lead). */
     team?: boolean;
+    /**
+     * Scheduled-run provenance: the instant the cron rule actually fired and the
+     * IANA zone its wall clock was read in. Present only for a cron-triggered
+     * run, so the model can resolve an unqualified date in the run's own terms
+     * instead of guessing from the Host clock (issue #1722).
+     */
+    schedule?: {
+        triggeredAt: number;
+        timeZone: string;
+        cron: string;
+    };
 }
 /**
  * Build the execution prompt for one task.
@@ -72,6 +96,16 @@ export interface PromptContext {
  * @returns the prompt text.
  */
 export declare function promptText(task: TaskRecord, context?: PromptContext): string;
+/**
+ * Build the objective the built-in `/goal` command receives. A prompt whose
+ * text would be read as a goal operation is prefixed with a neutral label: the
+ * instruction stays intact, and the command arms an objective instead of
+ * clearing, pausing, or editing an unrelated goal (or refusing for a missing
+ * one).
+ * @param prompt - the composed execution prompt.
+ * @returns the objective text for `/goal <objective>`.
+ */
+export declare function goalObjective(prompt: string): string;
 export declare class HostExecutionRunner {
     private readonly gateway;
     private readonly commands?;
@@ -87,6 +121,14 @@ export declare class HostExecutionRunner {
     });
     private invoke;
     private stream;
+    /**
+     * The workspace an unpinned run lands in: the deployment's most recently used
+     * one. Undefined when the deployment serves no workspace registry or has
+     * registered none yet; the launch then keeps the "let the Host decide" shape,
+     * which is the only remaining path to the Host's own working directory.
+     * @returns the workspace id to create the session in, when one is known.
+     */
+    private recentWorkspaceId;
     /**
      * Launch one execution. Without `options.reuseSessionId` a fresh session is
      * created, renamed, pinned, and prompted (the historical contract). With it,
@@ -100,6 +142,8 @@ export declare class HostExecutionRunner {
     launch(task: TaskRecord, options?: {
         reuseSessionId?: string;
         promptContext?: PromptContext;
+        onSession?: (sessionId: string) => void;
+        onGoalArmed?: (armed: boolean) => void;
     }): Promise<string>;
     /**
      * Fail closed when a reused session records a different Agent preset than
@@ -122,6 +166,46 @@ export declare class HostExecutionRunner {
      * the same permission/model pins before the prompt.
      */
     private pinAndPrompt;
+    /**
+     * Read the host's model catalog: the default route an unconfigured session
+     * starts at, and each provider's models with the reasoning metadata its
+     * adapter exposes. The acceptance settings card and the frozen contract both
+     * resolve against it, so "inherit host" means the host's own configuration
+     * rather than a session's or a card's pinned model.
+     * @returns the raw catalog value, or undefined when this cohort serves none.
+     */
+    modelCatalog(): Promise<unknown>;
+    /**
+     * Arm dsh's built-in goal on the session. The task prompt is queued FIRST, so
+     * the session's first turn carries the instruction verbatim; `/goal
+     * <objective>` then turns the same text into a persistent objective, and
+     * dsh's goal-round driver keeps starting continuation rounds until the agent
+     * marks it complete (see {@link goalVerdict} for how the run settles).
+     *
+     * Opt-out: a task whose `goalRun` is an explicit false runs one plain turn.
+     * A refusal (no command dispatcher, no `/goal` command in this cohort, an
+     * objective the command rejects) is reported and the run continues as that
+     * plain turn: the task was asked to run, and a missing goal mode must not
+     * lose the work.
+     */
+    private armGoal;
+    /**
+     * The verdict an armed dsh goal imposes on an otherwise completed turn.
+     *
+     * A goal run is one session working many automatic continuation rounds:
+     * dsh's goal-round driver queues the next round whenever the agent goes
+     * idle, so the first completed `turn/end` is not the execution's result.
+     * Settling there would leave the card in `done` while the session keeps
+     * working, and a scheduled task would fire a second, concurrent session.
+     * The session projection is the authority: an `active` goal keeps the
+     * execution pending, a `blocked` goal fails it with the recorded reason, and
+     * any other phase (complete, paused, or no goal at all) leaves the turn
+     * verdict in place.
+     *
+     * An unreadable projection falls back to that turn verdict: a cohort whose
+     * gateway withdrew `session/projections` must not hang every execution.
+     */
+    private goalVerdict;
     listRunning(): Promise<{
         known: true;
         count: number;
@@ -129,6 +213,17 @@ export declare class HostExecutionRunner {
     } | {
         known: false;
     }>;
-    /** Resolve an execution outcome from the session list and bounded history pages. */
-    inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[]): Promise<ExecutionInspection>;
+    /**
+     * Resolve an execution outcome from the session list and bounded history pages.
+     * @param sessionId - the session the execution runs in.
+     * @param startedAt - instant the execution opened; earlier events are not its own.
+     * @param sessions - roster from the caller's own poll, when it already has one.
+     * @param options.whileRunning - read the first completed turn even while the
+     *   roster reports the session as running. A durable Agent Teams teammate
+     *   stays alive after its turn ends, so `running` never clears for it and the
+     *   turn it completed is the only verdict it will ever expose.
+     */
+    inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[], options?: {
+        whileRunning?: boolean;
+    }): Promise<ExecutionInspection>;
 }