@opengeni/runtime 0.7.0 → 0.11.0

package/dist/{index-DIiiwQY2.d.ts → index-D6yi-JcU.d.ts}

@@ -1,6 +1,6 @@
 import { Settings } from '@opengeni/config';
-import { SandboxBackend, CapabilityDescriptor, SandboxOs, SessionCapabilities, StreamTokenPayload, SessionEventType, SessionStructuredCapabilities, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, GitChangedPayload, GitDiffHunk, GitFileStatusCode, CapabilityUnavailableReason } from '@opengeni/contracts';
-import { Manifest, SandboxClient, SandboxSessionState } from '@openai/agents/sandbox';
+import { SandboxBackend, CapabilityDescriptor, SandboxOs, SessionCapabilities, StreamTokenPayload, RunCredentialFile, RunCredentialAuthNeeded, RunCredentialRedaction, RunCredentialsResolution, SessionEventType, SessionStructuredCapabilities, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, GitChangedPayload, GitDiffHunk, GitFileStatusCode, CapabilityUnavailableReason } from '@opengeni/contracts';
+import { SandboxSessionLike, ExecCommandArgs, SandboxClient, Manifest, SandboxSessionState } from '@openai/agents/sandbox';
 import * as modal from 'modal';
 import { ControlRequest, ControlResponse, ErrorCode, AgentError, ExecResponse, DesktopInputRequest, ExecRequest } from '@opengeni/agent-proto';
 
@@ -173,7 +173,7 @@ interface NegotiationContext {
      *  (settings.computerUseReadOnly). v1 default false (the agent clicks/types). */
     computerUseReadOnly?: boolean;
     /**
-     * Whether a scoped-stream-token secret is resolvable (I8/OD-8). When desktop
+     * Whether a scoped-stream-token secret is resolvable (stream-token availability contract). When desktop
      * is enabled but this is false (no streamTokenSecret AND no delegationSecret),
      * the desktop plane GRACEFULLY DEGRADES to transport:null — the deployment
      * boots, but the pixel plane cannot mint scoped tokens. Defaults to true so a
@@ -414,7 +414,11 @@ type EnsureTerminalServerResult = {
  *
  * Exported (pure, side-effect-free) so the ensureTerminalServer unit test can
  * assert the exact command sequence without a live box. Mirrors
- * buildDisplayStackScript.
+ * buildDisplayStackScript. A ttyd process is sandbox-group-global, not
+ * OpenGeni-session-specific, so it must never inherit the box-global legacy
+ * Toolspace pointer. Session-scoped interactive exec/PTY uses Channel A; the
+ * shared ttyd shell fails closed for Toolspace until that stream plane itself is
+ * session-isolated.
  */
 declare function buildTerminalServerScript(options?: EnsureTerminalServerOptions): string;
 /**
@@ -435,6 +439,92 @@ declare function ensureTerminalServer(session: unknown, options?: EnsureTerminal
  *  missing process. Mirrors tearDownDisplayStack. */
 declare function tearDownTerminalServer(session: unknown): Promise<void>;
 
+type RunCredentialExpectedScope = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+};
+type NormalizedRunCredentialMaterial = {
+    environment: Record<string, string>;
+    files: RunCredentialFile[];
+    fileEnvironment: Record<string, string>;
+    expiresAt: Date | null;
+    authNeeded: RunCredentialAuthNeeded[];
+    redactions: RunCredentialRedaction[];
+};
+type RunCredentialCommandSession = Pick<SandboxSessionLike, "exec" | "execCommand">;
+type RunCredentialCommandRunner = (session: RunCredentialCommandSession, args: ExecCommandArgs) => Promise<unknown>;
+type RunCredentialSessionReady = (session: RunCredentialCommandSession) => Promise<void> | void;
+declare class RunCredentialValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate the untrusted host-port response before any secret is written to a
+ * box. The host owns credential selection; OpenGeni owns scope checks, bounds,
+ * path safety, and the transport lifecycle.
+ */
+declare function normalizeRunCredentialsResolution(resolution: Extract<RunCredentialsResolution, {
+    status: "not_applicable";
+}>, expected: RunCredentialExpectedScope, now?: Date): null;
+declare function normalizeRunCredentialsResolution(resolution: Exclude<RunCredentialsResolution, {
+    status: "not_applicable";
+}>, expected: RunCredentialExpectedScope, now?: Date): NormalizedRunCredentialMaterial;
+declare function normalizeRunCredentialsResolution(resolution: RunCredentialsResolution, expected: RunCredentialExpectedScope, now?: Date): NormalizedRunCredentialMaterial | null;
+declare function runCredentialRoot(sessionId: string): string;
+declare function runCredentialPointerFile(sessionId: string): string;
+type MaterializeRunCredentialsOptions = {
+    sessionId: string;
+    attemptId: string;
+    executionGeneration: number;
+    /** Initial provision after recovery may prune generations from older attempts. */
+    pruneOtherAttempts?: boolean;
+    /** An all-auth-needed replacement removes every prior readable generation. */
+    prunePreviousGenerations?: boolean;
+    /** Renewal keeps the active and immediately prior same-attempt generations. */
+    pruneSupersededGenerations?: boolean;
+    commandRunner?: RunCredentialCommandRunner;
+};
+/** Materialize one complete immutable generation, then atomically flip current. */
+declare function materializeRunCredentials(session: RunCredentialCommandSession, material: NormalizedRunCredentialMaterial, options: MaterializeRunCredentialsOptions): Promise<void>;
+declare function clearRunCredentials(session: RunCredentialCommandSession, sessionId: string, commandRunner?: RunCredentialCommandRunner): Promise<void>;
+/**
+ * Remove only generations owned by one attempt. A successor may already have
+ * atomically activated its own pointer after queue admission; this cleanup must
+ * never clear or overwrite that newer generation.
+ */
+declare function clearRunCredentialsForAttempt(session: RunCredentialCommandSession, options: Pick<MaterializeRunCredentialsOptions, "sessionId" | "attemptId" | "executionGeneration">, commandRunner?: RunCredentialCommandRunner): Promise<void>;
+/** Prefix one sandbox command so every new process observes the active generation. */
+declare function withRunCredentialEnvironment(cmd: string, sessionId: string): string;
+/**
+ * Preserve the provider session identity/capabilities while decorating only
+ * command creation. Non-command methods stay bound to the original instance.
+ */
+declare function withRunCredentialsSession<T extends object>(session: T, sessionId: string): T;
+/** Decorate every client-created/resumed session after the host seeds it. */
+declare function withRunCredentialsClient(client: SandboxClient, sessionId: string, onSessionReady?: RunCredentialSessionReady): SandboxClient;
+
+declare class ToolspaceTokenPathError extends Error {
+    constructor(message: string);
+}
+/**
+ * Derive the per-session token file beside the legacy manifest pointer.
+ *
+ * The manifest pointer stays box-global so an already-warm shared sandbox does
+ * not receive an illegal environment delta. Every OpenGeni command overrides
+ * that pointer with this deterministic path. The hash is path hygiene and
+ * avoids disclosing host/session ids in filenames; filesystem paths are not an
+ * authorization boundary. The delegated bearer's session claim remains the
+ * authority boundary for Toolspace calls.
+ */
+declare function toolspaceTokenFileForSession(manifestTokenFile: string, sessionId: string): string;
+declare function toolspaceTokenFileFromEnvironment(environment: Readonly<Record<string, string>>, sessionId: string): string;
+/** Prefix one sandbox command with its session-specific Toolspace pointer. */
+declare function withToolspaceTokenEnvironment(cmd: string, tokenFile: string): string;
+/** Preserve provider identity/capabilities while decorating command creation. */
+declare function withToolspaceTokenSession<T extends object>(session: T, tokenFile: string): T;
+/** Decorate every client-created/resumed session with one session pointer. */
+declare function withToolspaceTokenClient(client: SandboxClient, tokenFile: string): SandboxClient;
+
 /** The provider-resolved endpoint for an exposed port. Mirrors the SDK's
  *  `ExposedPortEndpoint` (host/port/tls/query/...) WITHOUT importing the
  *  agent-loop barrel — the leaf stays agent-loop-free. */
@@ -638,6 +728,12 @@ type ChannelASession = {
 declare class ChannelAValidationError extends Error {
     constructor(message: string);
 }
+/** A structurally valid Channel-A request could not be completed because the
+ * sandbox/provider control plane was temporarily unavailable. Callers may retry
+ * this class; it must never be presented as a bad user path. */
+declare class ChannelAUnavailableError extends Error {
+    constructor(message: string);
+}
 declare class ChannelAConflictError extends Error {
     constructor(message: string);
 }
@@ -678,11 +774,22 @@ declare class SandboxChannelAService {
     capabilities(repos?: string[]): SessionStructuredCapabilities;
     private run;
     fsList(req: FsListRequest): Promise<FsListResponse>;
+    /**
+     * Worker-only fast path for a bounded whole-workspace index. Matching
+     * directory nodes are emitted but pruned by `find` before descent, so residue
+     * such as node_modules cannot consume the result budget. The public fs/list
+     * wire remains unchanged; interactive callers still expand every directory
+     * they explicitly request.
+     */
+    fsListPruned(req: FsListRequest, pruneDirectoryNames: readonly string[]): Promise<FsListResponse>;
+    private fsListInternal;
     fsRead(req: FsReadRequest): Promise<FsReadResponse>;
-    /** Read a file by base64-ing it through exec. Binary-safe and — crucially —
-     *  NOT subject to the provider's native-readFile workspace-escape validation,
-     *  so it can render a symlink whose target lives outside /workspace (the link
-     *  node itself is in-workspace). `base64 <path>` follows the symlink. */
+    private assertConfinedExistingDirectory;
+    private assertConfinedMutationParent;
+    private assertConfinementResult;
+    /** Binary-safe fallback for sessions without native reads. The file is opened
+     *  before checking `/proc/.../fd/3`, so a symlink swap cannot redirect the
+     *  subsequent read after confinement has been established. */
     private fsReadViaExec;
     private shapeRead;
     fsWrite(req: FsWriteRequest): Promise<FsWriteResponse>;
@@ -697,9 +804,10 @@ declare class SandboxChannelAService {
     /**
      * Detect repo roots within every supported workspace layout.
      *
-     * The platform seeds GitHub repositories at
-     * `repos/<owner>/<repo>`, which puts the `.git` marker at depth four from the
-     * workspace root. Do not reintroduce a fixed maxdepth here. Traversal is
+     * The platform normally seeds repositories at
+     * `repos/<encoded-host>/<owner>/<repo>`, while explicit mount paths and
+     * connected-machine layouts can be deeper. Do not reintroduce a fixed
+     * maxdepth here. Traversal is
      * bounded instead by pruning known machine/build residue, a wall-clock
      * timeout, and a result limit. `.git` may be either a directory (ordinary
      * clone/submodule) or a file (linked worktree).
@@ -741,6 +849,10 @@ declare class SandboxChannelAService {
     /** The current FS revision (for the caller to persist/seed). */
     currentRevision(): number;
     private joinRoot;
+    /** Validate and enter an FS/Git directory in the same remote command that
+     * performs the operation. This preserves confinement without adding a full
+     * provider round-trip to every tree expansion or Git query. */
+    private runInConfinedDirectory;
     private repoWorkdir;
     private terminalWorkdir;
     private emitEvents;
@@ -750,9 +862,11 @@ declare class SandboxChannelAService {
     emitGitChanged(repoPath: string, reason: GitChangedPayload["reason"]): Promise<void>;
 }
 declare function stripExecBanner(raw: string): string;
-declare function isWorkspaceEscapeError(error: unknown): boolean;
 declare function isExecSessionLostBanner(out: string, execSessionId: number): boolean;
 declare function parseExecBannerSessionId(raw: string): number | null;
+/** Recover a completed execCommand fallback's exit status from its banner.
+ * Only the banner region is inspected, so command output cannot spoof success. */
+declare function parseExecBannerExitCode(raw: string): number | null;
 declare function assertSafeRelPath(p: string): string;
 declare function parsePorcelainV2(z: string): Omit<GitStatusResponse, "revision">;
 type NumstatEntry = {
@@ -1511,6 +1625,13 @@ declare class SelfhostedSession {
         workdir?: string;
         runAs?: string;
     }): Promise<string>;
+    /**
+     * Physical turn-cancellation seam used by the runtime tool fence. Only the
+     * op-stream transport has a process-tree cancellation protocol; a legacy
+     * runner returns false and the caller remains fail-closed until its exec
+     * deadline rather than claiming the machine is quiescent.
+     */
+    cancelExecCommand(opId: string): Promise<boolean>;
     /** SDK shell capability never calls this (gated on `supportsPty()` which is
      *  false), but the surface advertises it. Selfhosted exec has no interactive PTY
      *  session over the structured RPC, so a stdin write is unsupported. */
@@ -1608,7 +1729,7 @@ declare class SelfhostedSession {
      * after asking the agent to ensure a stream channel for the port. M8b wires the
      * real relay tier (the byte pump) behind THIS seam.
      *
-     * THE CHANNEL-KEY QUERY (the M8b relay-dial contract, dossier §10.5): the relay
+     * THE CHANNEL-KEY QUERY (the M8b relay-dial contract): the relay
      * routes by `{workspaceId, agentId, port}` — the EXACT `ChannelKey::query` the
      * agent's relay client (`opengeni-agent-stream`) appends when it registers the
      * producer side: `ws=<workspaceId>&agent=<agentId>&port=<port>`. We append the
@@ -1753,7 +1874,7 @@ declare function buildSelfhostedBackendSession(deps: SelfhostedSessionBuild): Pr
 }>;
 /**
  * The selfhosted NotFound discriminator — THE load-bearing safety property
- * (dossier §10.2/§19): for selfhosted, `agent-offline` (no responder) is NEVER a
+ *: for selfhosted, `agent-offline` (no responder) is NEVER a
  * provider NotFound. A user's real machine is not recreatable; if the lease saw
  * agent-offline as NotFound it would cold-create a RIVAL box (a Modal box) for
  * the user's machine. So this ALWAYS returns FALSE for selfhosted — there is no
@@ -1955,6 +2076,7 @@ interface RoutableBackendSession {
     exec?(args: unknown): Promise<unknown>;
     execCommand?(args: unknown): Promise<string>;
     writeStdin?(args: unknown): Promise<string>;
+    cancelExecCommand?(opId: string): Promise<boolean>;
     readFile?(args: unknown): Promise<string | Uint8Array>;
     writeFile?(args: unknown): Promise<unknown>;
     createEditor?(runAs?: string): unknown;
@@ -2116,6 +2238,7 @@ declare class RoutingSandboxSession implements RoutableBackendSession {
     exec(args: unknown): Promise<unknown>;
     execCommand(args: unknown): Promise<string>;
     writeStdin(args: unknown): Promise<string>;
+    cancelExecCommand(opId: string): Promise<boolean>;
     readFile(args: unknown): Promise<string | Uint8Array>;
     writeFile(args: unknown): Promise<unknown>;
     listDir(args: unknown): Promise<unknown>;
@@ -2448,4 +2571,4 @@ declare function establishSandboxSessionFromEnvelope(settings: Settings, envelop
  */
 declare function serializeEstablishedSandboxEnvelope(established: EstablishedSandboxSession): Promise<Record<string, unknown> | null>;
 
-export { type OpStreamTransport as $, type ActiveBackendResolverDeps as A, type BackendUnresolvableCode as B, ChannelAConflictError as C, DEFAULT_DESKTOP_GEOMETRY as D, type EnsureDisplayStackOptions as E, FAULT_FIELD_WHAT_HAPPENED as F, type MockExecHandler as G, type ModalModuleLoader as H, type ModalOrphanSweepResult as I, type ModalSandboxAttribution as J, NatsControlRpc as K, type LiveModalSandboxLeaseAttribution as L, type MintStreamTokenInput as M, NEVER_SENT_DETAIL_KEY as N, type NatsOpStreamConnection as O, NatsOpStreamTransport as P, type NatsRequestConnection as Q, type RuntimeMetricsHooks as R, type NegotiationContext as S, type NumstatEntry as T, OP_STREAM_ACK_INTERVAL_MS as U, OP_STREAM_DEFAULT_WINDOW_BYTES as V, OP_STREAM_RECONNECT_HOLD_MS as W, OP_STREAM_SILENCE_TIMEOUT_MS as X, type OpStreamExecOutcome as Y, type OpStreamJournal as Z, type OpStreamSubscription as _, ActiveBackendUnresolvableError as a, type SwapTargetEstablishability as a$, OpStreamUnavailableError as a0, PROVIDER_REGISTRY as a1, type ProviderConstructionContext as a2, type ProviderRegistration as a3, REPOSITORY_DISCOVERY_LIMIT as a4, type RecordingArtifactMetadata as a5, type RecordingCodec as a6, type RecordingContentType as a7, RecordingError as a8, type RecordingProcess as a9, SandboxConfigError as aA, type SandboxCreatedCallback as aB, SandboxProviderUnavailableError as aC, SandboxResumeStateUnavailableError as aD, type SelfhostedApplyDiff as aE, SelfhostedControlError as aF, type SelfhostedEditor as aG, type SelfhostedEnrollment as aH, type SelfhostedExecArgs as aI, type SelfhostedExecResult as aJ, type SelfhostedImageOutput as aK, type SelfhostedLivenessState as aL, type SelfhostedNegotiationInput as aM, type SelfhostedOpObservation as aN, type SelfhostedOpObserver as aO, type SelfhostedOpStreamDeps as aP, type SelfhostedRelayConfig as aQ, type SelfhostedRetryClock as aR, type SelfhostedRetryDecision as aS, SelfhostedSandboxClient as aT, SelfhostedSession as aU, type SelfhostedSessionBuild as aV, type SelfhostedSessionDeps as aW, type SelfhostedSessionState as aX, type SelfhostedUnavailableReason as aY, type StartRecordingInput as aZ, StreamPortUnavailableError as a_, RecordingUnavailableError as aa, type RepositoryDiscoveryDegradedReason as ab, type RepositoryDiscoveryResult as ac, type ResolvedActiveBackend as ad, type RoutableBackendSession as ae, type RoutableSandbox as af, RoutingSandboxSession as ag, type RoutingSandboxSessionDeps as ah, type RoutingTransitionEvent as ai, RoutingUnsupportedError as aj, SELFHOSTED_DEFAULT_TIMEOUT_MS as ak, SELFHOSTED_DRAINING_MAX_RETRIES as al, SELFHOSTED_EXEC_DRAINING_MAX_RETRIES as am, SELFHOSTED_IDEMPOTENT_READONLY_OPS as an, SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES as ao, SELFHOSTED_NEVER_SENT_MAX_RETRIES as ap, SELFHOSTED_RECONNECT_WINDOW_MS as aq, SELFHOSTED_RELAY_STREAM_PATH as ar, SELFHOSTED_RETRY_BACKOFF_BASE_MS as as, SELFHOSTED_RETRY_BACKOFF_CAP_MS as at, SELFHOSTED_RETRY_BACKOFF_FACTOR as au, SELFHOSTED_TIMEOUT_MAX_RETRIES as av, STREAM_PORT as aw, STREAM_TOKEN_DEFAULT_TTL_SECONDS as ax, SandboxChannelAService as ay, type SandboxChannelAServiceOptions as az, type ActivePointer as b, serializeEstablishedSandboxEnvelope as b$, TERMINAL_SERVER_TIMEOUT_MS as b0, TerminalServerError as b1, TerminalServerUnsupportedError as b2, agentErrorToControlError as b3, assertDescriptorRegistryInvariants as b4, assertProviderRegistryInvariants as b5, assertSafeRelPath as b6, backendSupportsOs as b7, buildDisplayStackScript as b8, buildSelfhostedBackendSession as b9, makeActiveBackendResolver as bA, mintStreamToken as bB, modalSandboxAttributionEnvironment as bC, modalSandboxAttributionTags as bD, negotiateCapabilities as bE, negotiateSelfhostedCapabilities as bF, nextDurableOpId as bG, offlineAgentError as bH, offlineControlResponse as bI, opAckSubject as bJ, opFrameSubject as bK, parseExecBannerSessionId as bL, parseNumstatZ as bM, parsePorcelainV2 as bN, parseUnifiedPatch as bO, payloadTooLargeMessage as bP, readWorkspaceArchiveFromEnvelopeSessionState as bQ, recordingStorageKey as bR, renderSelfhostedFault as bS, restoredSandboxSessionStateFromEntry as bT, runWithToolCallCorrelation as bU, sandboxStateEntryFromRunState as bV, sanitizeOpIdToken as bW, selectBackend as bX, selfhostedFaultClass as bY, selfhostedLiveness as bZ, selfhostedRetryBackoffMs as b_, buildStreamUrl as ba, buildTerminalServerScript as bb, contentTypeForCodec as bc, createSandboxClient as bd, createSandboxClientForBackend as be, decideSelfhostedRetry as bf, decodeModalSnapshotId as bg, defaultSelfhostedRetryClock as bh, deletePriorPersistedSnapshot as bi, deleteRecordingArtifacts as bj, deserializeSandboxSessionStateEnvelope as bk, desktopCapableBackend as bl, drainingExhaustedError as bm, drainingMessage as bn, ensureDisplayStack as bo, ensureModalRegistryImage as bp, ensureTerminalServer as bq, establishSandboxSessionFromEnvelope as br, execDeadlineHint as bs, exposeStreamPort as bt, extForCodec as bu, inspectRecordingArtifact as bv, isExecSessionLostBanner as bw, isProviderSandboxNotFoundError as bx, isSelfhostedProviderNotFoundError as by, isWorkspaceEscapeError as bz, type ChannelAEmitter as c, setSelfhostedApplyDiff as c0, startRecording as c1, stopRecording as c2, stripExecBanner as c3, subjectFor as c4, swapTargetEstablishability as c5, sweepModalOrphanSandboxes as c6, tagModalSandbox as c7, tearDownDisplayStack as c8, tearDownTerminalServer as c9, terminateModalSandboxById as ca, timeoutAgentError as cb, timeoutControlResponse as cc, uploadRecordingArtifact as cd, verifyStreamToken as ce, type ChannelAExecArgs as d, type ChannelAExecResult as e, ChannelANotFoundError as f, type ChannelASession as g, ChannelAUnsupportedError as h, ChannelAValidationError as i, type ControlRpc as j, DISPLAY_STACK_TIMEOUT_MS as k, type DesktopGeometry as l, DisplayStackError as m, DisplayStackUnsupportedError as n, type EnsureDisplayStackResult as o, type EnsureTerminalServerOptions as p, type EnsureTerminalServerResult as q, type EstablishedSandboxSession as r, type ExposeStreamPortInput as s, type ExposeStreamPortResult as t, type ExposedPortEndpoint as u, FAULT_FIELD_WHAT_PRESERVED as v, FAULT_FIELD_WHAT_TO_TRY as w, FAULT_FIELD_WHICH_LAYER as x, MockAgentResponder as y, type MockAgentResponderOptions as z };
+export { OP_STREAM_SILENCE_TIMEOUT_MS as $, type ActiveBackendResolverDeps as A, type BackendUnresolvableCode as B, ChannelAConflictError as C, DEFAULT_DESKTOP_GEOMETRY as D, type EnsureDisplayStackOptions as E, FAULT_FIELD_WHAT_HAPPENED as F, type MintStreamTokenInput as G, MockAgentResponder as H, type MockAgentResponderOptions as I, type MockExecHandler as J, type ModalModuleLoader as K, type LiveModalSandboxLeaseAttribution as L, type MaterializeRunCredentialsOptions as M, type ModalOrphanSweepResult as N, type ModalSandboxAttribution as O, NEVER_SENT_DETAIL_KEY as P, NatsControlRpc as Q, type RunCredentialSessionReady as R, type NatsOpStreamConnection as S, NatsOpStreamTransport as T, type NatsRequestConnection as U, type NegotiationContext as V, type NormalizedRunCredentialMaterial as W, type NumstatEntry as X, OP_STREAM_ACK_INTERVAL_MS as Y, OP_STREAM_DEFAULT_WINDOW_BYTES as Z, OP_STREAM_RECONNECT_HOLD_MS as _, type RuntimeMetricsHooks as a, SelfhostedSandboxClient as a$, type OpStreamExecOutcome as a0, type OpStreamJournal as a1, type OpStreamSubscription as a2, type OpStreamTransport as a3, OpStreamUnavailableError as a4, PROVIDER_REGISTRY as a5, type ProviderConstructionContext as a6, type ProviderRegistration as a7, REPOSITORY_DISCOVERY_LIMIT as a8, type RecordingArtifactMetadata as a9, SELFHOSTED_RETRY_BACKOFF_BASE_MS as aA, SELFHOSTED_RETRY_BACKOFF_CAP_MS as aB, SELFHOSTED_RETRY_BACKOFF_FACTOR as aC, SELFHOSTED_TIMEOUT_MAX_RETRIES as aD, STREAM_PORT as aE, STREAM_TOKEN_DEFAULT_TTL_SECONDS as aF, SandboxChannelAService as aG, type SandboxChannelAServiceOptions as aH, SandboxConfigError as aI, type SandboxCreatedCallback as aJ, SandboxProviderUnavailableError as aK, SandboxResumeStateUnavailableError as aL, type SelfhostedApplyDiff as aM, SelfhostedControlError as aN, type SelfhostedEditor as aO, type SelfhostedEnrollment as aP, type SelfhostedExecArgs as aQ, type SelfhostedExecResult as aR, type SelfhostedImageOutput as aS, type SelfhostedLivenessState as aT, type SelfhostedNegotiationInput as aU, type SelfhostedOpObservation as aV, type SelfhostedOpObserver as aW, type SelfhostedOpStreamDeps as aX, type SelfhostedRelayConfig as aY, type SelfhostedRetryClock as aZ, type SelfhostedRetryDecision as a_, type RecordingCodec as aa, type RecordingContentType as ab, RecordingError as ac, type RecordingProcess as ad, RecordingUnavailableError as ae, type RepositoryDiscoveryDegradedReason as af, type RepositoryDiscoveryResult as ag, type ResolvedActiveBackend as ah, type RoutableBackendSession as ai, type RoutableSandbox as aj, RoutingSandboxSession as ak, type RoutingSandboxSessionDeps as al, type RoutingTransitionEvent as am, RoutingUnsupportedError as an, type RunCredentialCommandRunner as ao, type RunCredentialCommandSession as ap, type RunCredentialExpectedScope as aq, RunCredentialValidationError as ar, SELFHOSTED_DEFAULT_TIMEOUT_MS as as, SELFHOSTED_DRAINING_MAX_RETRIES as at, SELFHOSTED_EXEC_DRAINING_MAX_RETRIES as au, SELFHOSTED_IDEMPOTENT_READONLY_OPS as av, SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES as aw, SELFHOSTED_NEVER_SENT_MAX_RETRIES as ax, SELFHOSTED_RECONNECT_WINDOW_MS as ay, SELFHOSTED_RELAY_STREAM_PATH as az, ActiveBackendUnresolvableError as b, parseUnifiedPatch as b$, SelfhostedSession as b0, type SelfhostedSessionBuild as b1, type SelfhostedSessionDeps as b2, type SelfhostedSessionState as b3, type SelfhostedUnavailableReason as b4, type StartRecordingInput as b5, StreamPortUnavailableError as b6, type SwapTargetEstablishability as b7, TERMINAL_SERVER_TIMEOUT_MS as b8, TerminalServerError as b9, ensureModalRegistryImage as bA, ensureTerminalServer as bB, establishSandboxSessionFromEnvelope as bC, execDeadlineHint as bD, exposeStreamPort as bE, extForCodec as bF, inspectRecordingArtifact as bG, isExecSessionLostBanner as bH, isProviderSandboxNotFoundError as bI, isSelfhostedProviderNotFoundError as bJ, makeActiveBackendResolver as bK, materializeRunCredentials as bL, mintStreamToken as bM, modalSandboxAttributionEnvironment as bN, modalSandboxAttributionTags as bO, negotiateCapabilities as bP, negotiateSelfhostedCapabilities as bQ, nextDurableOpId as bR, normalizeRunCredentialsResolution as bS, offlineAgentError as bT, offlineControlResponse as bU, opAckSubject as bV, opFrameSubject as bW, parseExecBannerExitCode as bX, parseExecBannerSessionId as bY, parseNumstatZ as bZ, parsePorcelainV2 as b_, TerminalServerUnsupportedError as ba, ToolspaceTokenPathError as bb, agentErrorToControlError as bc, assertDescriptorRegistryInvariants as bd, assertProviderRegistryInvariants as be, assertSafeRelPath as bf, backendSupportsOs as bg, buildDisplayStackScript as bh, buildSelfhostedBackendSession as bi, buildStreamUrl as bj, buildTerminalServerScript as bk, clearRunCredentials as bl, clearRunCredentialsForAttempt as bm, contentTypeForCodec as bn, createSandboxClient as bo, createSandboxClientForBackend as bp, decideSelfhostedRetry as bq, decodeModalSnapshotId as br, defaultSelfhostedRetryClock as bs, deletePriorPersistedSnapshot as bt, deleteRecordingArtifacts as bu, deserializeSandboxSessionStateEnvelope as bv, desktopCapableBackend as bw, drainingExhaustedError as bx, drainingMessage as by, ensureDisplayStack as bz, type ActivePointer as c, payloadTooLargeMessage as c0, readWorkspaceArchiveFromEnvelopeSessionState as c1, recordingStorageKey as c2, renderSelfhostedFault as c3, restoredSandboxSessionStateFromEntry as c4, runCredentialPointerFile as c5, runCredentialRoot as c6, runWithToolCallCorrelation as c7, sandboxStateEntryFromRunState as c8, sanitizeOpIdToken as c9, withToolspaceTokenEnvironment as cA, withToolspaceTokenSession as cB, selectBackend as ca, selfhostedFaultClass as cb, selfhostedLiveness as cc, selfhostedRetryBackoffMs as cd, serializeEstablishedSandboxEnvelope as ce, setSelfhostedApplyDiff as cf, startRecording as cg, stopRecording as ch, stripExecBanner as ci, subjectFor as cj, swapTargetEstablishability as ck, sweepModalOrphanSandboxes as cl, tagModalSandbox as cm, tearDownDisplayStack as cn, tearDownTerminalServer as co, terminateModalSandboxById as cp, timeoutAgentError as cq, timeoutControlResponse as cr, toolspaceTokenFileForSession as cs, toolspaceTokenFileFromEnvironment as ct, uploadRecordingArtifact as cu, verifyStreamToken as cv, withRunCredentialEnvironment as cw, withRunCredentialsClient as cx, withRunCredentialsSession as cy, withToolspaceTokenClient as cz, type ChannelAEmitter as d, type ChannelAExecArgs as e, type ChannelAExecResult as f, ChannelANotFoundError as g, type ChannelASession as h, ChannelAUnavailableError as i, ChannelAUnsupportedError as j, ChannelAValidationError as k, type ControlRpc as l, DISPLAY_STACK_TIMEOUT_MS as m, type DesktopGeometry as n, DisplayStackError as o, DisplayStackUnsupportedError as p, type EnsureDisplayStackResult as q, type EnsureTerminalServerOptions as r, type EnsureTerminalServerResult as s, type EstablishedSandboxSession as t, type ExposeStreamPortInput as u, type ExposeStreamPortResult as v, type ExposedPortEndpoint as w, FAULT_FIELD_WHAT_PRESERVED as x, FAULT_FIELD_WHAT_TO_TRY as y, FAULT_FIELD_WHICH_LAYER as z };