@opengeni/runtime 0.7.1 → 0.13.0

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{index-DIiiwQY2.d.ts → index-DGUrY_yR.d.ts}

@@ -1,6 +1,6 @@
 import { Settings } from '@opengeni/config';
-import { SandboxBackend, CapabilityDescriptor, SandboxOs, SessionCapabilities, StreamTokenPayload, SessionEventType, SessionStructuredCapabilities, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, GitChangedPayload, GitDiffHunk, GitFileStatusCode, CapabilityUnavailableReason } from '@opengeni/contracts';
-import { Manifest, SandboxClient, SandboxSessionState } from '@openai/agents/sandbox';
+import { SandboxBackend, CapabilityDescriptor, SandboxOs, SessionCapabilities, StreamTokenPayload, RunCredentialFile, RunCredentialAuthNeeded, RunCredentialRedaction, RunCredentialsResolution, SessionEventType, SessionStructuredCapabilities, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, GitChangedPayload, GitDiffHunk, GitFileStatusCode, CapabilityUnavailableReason } from '@opengeni/contracts';
+import { SandboxSessionLike, ExecCommandArgs, SandboxClient, Manifest, SandboxSessionState } from '@openai/agents/sandbox';
 import * as modal from 'modal';
 import { ControlRequest, ControlResponse, ErrorCode, AgentError, ExecResponse, DesktopInputRequest, ExecRequest } from '@opengeni/agent-proto';
 
@@ -120,6 +120,7 @@ type ModalOrphanSweepResult = {
     terminated: ModalOrphanSweepTermination[];
     skipped: number;
 };
+type RevalidateModalOrphanTermination = (candidate: ModalOrphanSweepTermination) => Promise<boolean>;
 declare function modalSandboxAttributionEnvironment(input: ModalSandboxAttribution): Record<string, string>;
 declare function modalSandboxAttributionTags(input: ModalSandboxAttribution): Record<string, string>;
 type ModalModule = typeof modal;
@@ -142,6 +143,9 @@ declare function sweepModalOrphanSandboxes(settings: Settings, liveLeases: LiveM
     maxTerminations?: number;
     unattributedGraceMs?: number;
     client?: ModalClientLike;
+    /** Re-read durable ownership immediately before provider termination. A
+     * false result or callback failure skips the destructive action. */
+    revalidateTermination?: RevalidateModalOrphanTermination;
 }): Promise<ModalOrphanSweepResult>;
 
 interface NegotiationContext {
@@ -173,7 +177,7 @@ interface NegotiationContext {
      *  (settings.computerUseReadOnly). v1 default false (the agent clicks/types). */
     computerUseReadOnly?: boolean;
     /**
-     * Whether a scoped-stream-token secret is resolvable (I8/OD-8). When desktop
+     * Whether a scoped-stream-token secret is resolvable (stream-token availability contract). When desktop
      * is enabled but this is false (no streamTokenSecret AND no delegationSecret),
      * the desktop plane GRACEFULLY DEGRADES to transport:null — the deployment
      * boots, but the pixel plane cannot mint scoped tokens. Defaults to true so a
@@ -319,7 +323,7 @@ declare const DEFAULT_DESKTOP_GEOMETRY: DesktopGeometry;
  *  value to viewers by the caller; this error is for diagnostics. */
 declare class DisplayStackError extends Error {
     readonly exitCode: number;
-    readonly stage: "xvfb" | "x11vnc" | "websockify" | "paint" | "unknown";
+    readonly stage: "xvfb" | "x11vnc" | "websockify" | "paint" | "lock" | "timeout" | "unknown";
     constructor(exitCode: number, output: string);
 }
 /** Thrown when the provider session cannot run commands (a headless-only
@@ -328,12 +332,39 @@ declare class DisplayStackError extends Error {
 declare class DisplayStackUnsupportedError extends Error {
     constructor(message: string);
 }
+type DisplayStackCallerKind = "viewer" | "computer" | "unknown";
+type DisplayStackClassification = "cold" | "already_ready" | "contention" | "unknown";
+type DisplayStackTelemetryStatus = "started" | "waiting" | "completed" | "failed";
+/** Secret-free, bounded-cardinality stage observation. Provider/sandbox IDs are
+ * log correlation fields, never metric labels. */
+type DisplayStackTelemetryEvent = {
+    type: "display_stack.stage";
+    requestId: string;
+    stage: string;
+    status: DisplayStackTelemetryStatus;
+    elapsedMs: number;
+    source: "host" | "sandbox";
+    classification: DisplayStackClassification;
+    callerKind: DisplayStackCallerKind;
+    sandboxId?: string;
+    leaseEpoch?: number;
+    providerSessionId?: number;
+};
+type DisplayStackTelemetryContext = {
+    callerKind: DisplayStackCallerKind;
+    sandboxId?: string;
+    leaseEpoch?: number;
+};
 type EnsureDisplayStackOptions = {
     geometry?: DesktopGeometry;
     /** The exposed stream port; defaults to 6080. */
     port?: number;
-    /** Per-exec timeout; defaults to DISPLAY_STACK_TIMEOUT_MS. */
+    /** Whole-operation wall-clock timeout; defaults to DISPLAY_STACK_TIMEOUT_MS. */
     timeoutMs?: number;
+    /** Caller correlation. Supplying it enables the default structured log sink. */
+    telemetryContext?: DisplayStackTelemetryContext;
+    /** Optional non-blocking telemetry sink (tests/embedders may replace logging). */
+    onTelemetry?: (event: DisplayStackTelemetryEvent) => void | Promise<void>;
 };
 type EnsureDisplayStackResult = {
     /** The exposed port the stack listens on (websockify/noVNC). */
@@ -414,7 +445,11 @@ type EnsureTerminalServerResult = {
  *
  * Exported (pure, side-effect-free) so the ensureTerminalServer unit test can
  * assert the exact command sequence without a live box. Mirrors
- * buildDisplayStackScript.
+ * buildDisplayStackScript. A ttyd process is sandbox-group-global, not
+ * OpenGeni-session-specific, so it must never inherit the box-global legacy
+ * Toolspace pointer. Session-scoped interactive exec/PTY uses Channel A; the
+ * shared ttyd shell fails closed for Toolspace until that stream plane itself is
+ * session-isolated.
  */
 declare function buildTerminalServerScript(options?: EnsureTerminalServerOptions): string;
 /**
@@ -435,6 +470,92 @@ declare function ensureTerminalServer(session: unknown, options?: EnsureTerminal
  *  missing process. Mirrors tearDownDisplayStack. */
 declare function tearDownTerminalServer(session: unknown): Promise<void>;
 
+type RunCredentialExpectedScope = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+};
+type NormalizedRunCredentialMaterial = {
+    environment: Record<string, string>;
+    files: RunCredentialFile[];
+    fileEnvironment: Record<string, string>;
+    expiresAt: Date | null;
+    authNeeded: RunCredentialAuthNeeded[];
+    redactions: RunCredentialRedaction[];
+};
+type RunCredentialCommandSession = Pick<SandboxSessionLike, "exec" | "execCommand">;
+type RunCredentialCommandRunner = (session: RunCredentialCommandSession, args: ExecCommandArgs) => Promise<unknown>;
+type RunCredentialSessionReady = (session: RunCredentialCommandSession) => Promise<void> | void;
+declare class RunCredentialValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Validate the untrusted host-port response before any secret is written to a
+ * box. The host owns credential selection; OpenGeni owns scope checks, bounds,
+ * path safety, and the transport lifecycle.
+ */
+declare function normalizeRunCredentialsResolution(resolution: Extract<RunCredentialsResolution, {
+    status: "not_applicable";
+}>, expected: RunCredentialExpectedScope, now?: Date): null;
+declare function normalizeRunCredentialsResolution(resolution: Exclude<RunCredentialsResolution, {
+    status: "not_applicable";
+}>, expected: RunCredentialExpectedScope, now?: Date): NormalizedRunCredentialMaterial;
+declare function normalizeRunCredentialsResolution(resolution: RunCredentialsResolution, expected: RunCredentialExpectedScope, now?: Date): NormalizedRunCredentialMaterial | null;
+declare function runCredentialRoot(sessionId: string): string;
+declare function runCredentialPointerFile(sessionId: string): string;
+type MaterializeRunCredentialsOptions = {
+    sessionId: string;
+    attemptId: string;
+    executionGeneration: number;
+    /** Initial provision after recovery may prune generations from older attempts. */
+    pruneOtherAttempts?: boolean;
+    /** An all-auth-needed replacement removes every prior readable generation. */
+    prunePreviousGenerations?: boolean;
+    /** Renewal keeps the active and immediately prior same-attempt generations. */
+    pruneSupersededGenerations?: boolean;
+    commandRunner?: RunCredentialCommandRunner;
+};
+/** Materialize one complete immutable generation, then atomically flip current. */
+declare function materializeRunCredentials(session: RunCredentialCommandSession, material: NormalizedRunCredentialMaterial, options: MaterializeRunCredentialsOptions): Promise<void>;
+declare function clearRunCredentials(session: RunCredentialCommandSession, sessionId: string, commandRunner?: RunCredentialCommandRunner): Promise<void>;
+/**
+ * Remove only generations owned by one attempt. A successor may already have
+ * atomically activated its own pointer after queue admission; this cleanup must
+ * never clear or overwrite that newer generation.
+ */
+declare function clearRunCredentialsForAttempt(session: RunCredentialCommandSession, options: Pick<MaterializeRunCredentialsOptions, "sessionId" | "attemptId" | "executionGeneration">, commandRunner?: RunCredentialCommandRunner): Promise<void>;
+/** Prefix one sandbox command so every new process observes the active generation. */
+declare function withRunCredentialEnvironment(cmd: string, sessionId: string): string;
+/**
+ * Preserve the provider session identity/capabilities while decorating only
+ * command creation. Non-command methods stay bound to the original instance.
+ */
+declare function withRunCredentialsSession<T extends object>(session: T, sessionId: string): T;
+/** Decorate every client-created/resumed session after the host seeds it. */
+declare function withRunCredentialsClient(client: SandboxClient, sessionId: string, onSessionReady?: RunCredentialSessionReady): SandboxClient;
+
+declare class ToolspaceTokenPathError extends Error {
+    constructor(message: string);
+}
+/**
+ * Derive the per-session token file beside the legacy manifest pointer.
+ *
+ * The manifest pointer stays box-global so an already-warm shared sandbox does
+ * not receive an illegal environment delta. Every OpenGeni command overrides
+ * that pointer with this deterministic path. The hash is path hygiene and
+ * avoids disclosing host/session ids in filenames; filesystem paths are not an
+ * authorization boundary. The delegated bearer's session claim remains the
+ * authority boundary for Toolspace calls.
+ */
+declare function toolspaceTokenFileForSession(manifestTokenFile: string, sessionId: string): string;
+declare function toolspaceTokenFileFromEnvironment(environment: Readonly<Record<string, string>>, sessionId: string): string;
+/** Prefix one sandbox command with its session-specific Toolspace pointer. */
+declare function withToolspaceTokenEnvironment(cmd: string, tokenFile: string): string;
+/** Preserve provider identity/capabilities while decorating command creation. */
+declare function withToolspaceTokenSession<T extends object>(session: T, tokenFile: string): T;
+/** Decorate every client-created/resumed session with one session pointer. */
+declare function withToolspaceTokenClient(client: SandboxClient, tokenFile: string): SandboxClient;
+
 /** The provider-resolved endpoint for an exposed port. Mirrors the SDK's
  *  `ExposedPortEndpoint` (host/port/tls/query/...) WITHOUT importing the
  *  agent-loop barrel — the leaf stays agent-loop-free. */
@@ -595,6 +716,9 @@ declare function deleteRecordingArtifacts(session: unknown, proc: RecordingProce
 /** The storage object key for a recording artifact (parallels the file-asset layout). */
 declare function recordingStorageKey(workspaceId: string, sessionId: string, recordingId: string, codec: RecordingCodec): string;
 
+declare function parseExecBannerSessionId(raw: string): number | null;
+declare function parseExecBannerExitCode(raw: string): number | null;
+
 type ChannelAExecResult = {
     output?: string;
     stdout?: string;
@@ -638,6 +762,12 @@ type ChannelASession = {
 declare class ChannelAValidationError extends Error {
     constructor(message: string);
 }
+/** A structurally valid Channel-A request could not be completed because the
+ * sandbox/provider control plane was temporarily unavailable. Callers may retry
+ * this class; it must never be presented as a bad user path. */
+declare class ChannelAUnavailableError extends Error {
+    constructor(message: string);
+}
 declare class ChannelAConflictError extends Error {
     constructor(message: string);
 }
@@ -678,11 +808,22 @@ declare class SandboxChannelAService {
     capabilities(repos?: string[]): SessionStructuredCapabilities;
     private run;
     fsList(req: FsListRequest): Promise<FsListResponse>;
+    /**
+     * Worker-only fast path for a bounded whole-workspace index. Matching
+     * directory nodes are emitted but pruned by `find` before descent, so residue
+     * such as node_modules cannot consume the result budget. The public fs/list
+     * wire remains unchanged; interactive callers still expand every directory
+     * they explicitly request.
+     */
+    fsListPruned(req: FsListRequest, pruneDirectoryNames: readonly string[]): Promise<FsListResponse>;
+    private fsListInternal;
     fsRead(req: FsReadRequest): Promise<FsReadResponse>;
-    /** Read a file by base64-ing it through exec. Binary-safe and — crucially —
-     *  NOT subject to the provider's native-readFile workspace-escape validation,
-     *  so it can render a symlink whose target lives outside /workspace (the link
-     *  node itself is in-workspace). `base64 <path>` follows the symlink. */
+    private assertConfinedExistingDirectory;
+    private assertConfinedMutationParent;
+    private assertConfinementResult;
+    /** Binary-safe fallback for sessions without native reads. The file is opened
+     *  before checking `/proc/.../fd/3`, so a symlink swap cannot redirect the
+     *  subsequent read after confinement has been established. */
     private fsReadViaExec;
     private shapeRead;
     fsWrite(req: FsWriteRequest): Promise<FsWriteResponse>;
@@ -697,9 +838,10 @@ declare class SandboxChannelAService {
     /**
      * Detect repo roots within every supported workspace layout.
      *
-     * The platform seeds GitHub repositories at
-     * `repos/<owner>/<repo>`, which puts the `.git` marker at depth four from the
-     * workspace root. Do not reintroduce a fixed maxdepth here. Traversal is
+     * The platform normally seeds repositories at
+     * `repos/<encoded-host>/<owner>/<repo>`, while explicit mount paths and
+     * connected-machine layouts can be deeper. Do not reintroduce a fixed
+     * maxdepth here. Traversal is
      * bounded instead by pruning known machine/build residue, a wall-clock
      * timeout, and a result limit. `.git` may be either a directory (ordinary
      * clone/submodule) or a file (linked worktree).
@@ -741,6 +883,10 @@ declare class SandboxChannelAService {
     /** The current FS revision (for the caller to persist/seed). */
     currentRevision(): number;
     private joinRoot;
+    /** Validate and enter an FS/Git directory in the same remote command that
+     * performs the operation. This preserves confinement without adding a full
+     * provider round-trip to every tree expansion or Git query. */
+    private runInConfinedDirectory;
     private repoWorkdir;
     private terminalWorkdir;
     private emitEvents;
@@ -750,9 +896,7 @@ declare class SandboxChannelAService {
     emitGitChanged(repoPath: string, reason: GitChangedPayload["reason"]): Promise<void>;
 }
 declare function stripExecBanner(raw: string): string;
-declare function isWorkspaceEscapeError(error: unknown): boolean;
 declare function isExecSessionLostBanner(out: string, execSessionId: number): boolean;
-declare function parseExecBannerSessionId(raw: string): number | null;
 declare function assertSafeRelPath(p: string): string;
 declare function parsePorcelainV2(z: string): Omit<GitStatusResponse, "revision">;
 type NumstatEntry = {
@@ -1511,6 +1655,13 @@ declare class SelfhostedSession {
         workdir?: string;
         runAs?: string;
     }): Promise<string>;
+    /**
+     * Physical turn-cancellation seam used by the runtime tool fence. Only the
+     * op-stream transport has a process-tree cancellation protocol; a legacy
+     * runner returns false and the caller remains fail-closed until its exec
+     * deadline rather than claiming the machine is quiescent.
+     */
+    cancelExecCommand(opId: string): Promise<boolean>;
     /** SDK shell capability never calls this (gated on `supportsPty()` which is
      *  false), but the surface advertises it. Selfhosted exec has no interactive PTY
      *  session over the structured RPC, so a stdin write is unsupported. */
@@ -1608,7 +1759,7 @@ declare class SelfhostedSession {
      * after asking the agent to ensure a stream channel for the port. M8b wires the
      * real relay tier (the byte pump) behind THIS seam.
      *
-     * THE CHANNEL-KEY QUERY (the M8b relay-dial contract, dossier §10.5): the relay
+     * THE CHANNEL-KEY QUERY (the M8b relay-dial contract): the relay
      * routes by `{workspaceId, agentId, port}` — the EXACT `ChannelKey::query` the
      * agent's relay client (`opengeni-agent-stream`) appends when it registers the
      * producer side: `ws=<workspaceId>&agent=<agentId>&port=<port>`. We append the
@@ -1753,7 +1904,7 @@ declare function buildSelfhostedBackendSession(deps: SelfhostedSessionBuild): Pr
 }>;
 /**
  * The selfhosted NotFound discriminator — THE load-bearing safety property
- * (dossier §10.2/§19): for selfhosted, `agent-offline` (no responder) is NEVER a
+ *: for selfhosted, `agent-offline` (no responder) is NEVER a
  * provider NotFound. A user's real machine is not recreatable; if the lease saw
  * agent-offline as NotFound it would cold-create a RIVAL box (a Modal box) for
  * the user's machine. So this ALWAYS returns FALSE for selfhosted — there is no
@@ -1955,6 +2106,7 @@ interface RoutableBackendSession {
     exec?(args: unknown): Promise<unknown>;
     execCommand?(args: unknown): Promise<string>;
     writeStdin?(args: unknown): Promise<string>;
+    cancelExecCommand?(opId: string): Promise<boolean>;
     readFile?(args: unknown): Promise<string | Uint8Array>;
     writeFile?(args: unknown): Promise<unknown>;
     createEditor?(runAs?: string): unknown;
@@ -2116,6 +2268,7 @@ declare class RoutingSandboxSession implements RoutableBackendSession {
     exec(args: unknown): Promise<unknown>;
     execCommand(args: unknown): Promise<string>;
     writeStdin(args: unknown): Promise<string>;
+    cancelExecCommand(opId: string): Promise<boolean>;
     readFile(args: unknown): Promise<string | Uint8Array>;
     writeFile(args: unknown): Promise<unknown>;
     listDir(args: unknown): Promise<unknown>;
@@ -2448,4 +2601,4 @@ declare function establishSandboxSessionFromEnvelope(settings: Settings, envelop
  */
 declare function serializeEstablishedSandboxEnvelope(established: EstablishedSandboxSession): Promise<Record<string, unknown> | null>;
 
-export { type OpStreamTransport as $, type ActiveBackendResolverDeps as A, type BackendUnresolvableCode as B, ChannelAConflictError as C, DEFAULT_DESKTOP_GEOMETRY as D, type EnsureDisplayStackOptions as E, FAULT_FIELD_WHAT_HAPPENED as F, type MockExecHandler as G, type ModalModuleLoader as H, type ModalOrphanSweepResult as I, type ModalSandboxAttribution as J, NatsControlRpc as K, type LiveModalSandboxLeaseAttribution as L, type MintStreamTokenInput as M, NEVER_SENT_DETAIL_KEY as N, type NatsOpStreamConnection as O, NatsOpStreamTransport as P, type NatsRequestConnection as Q, type RuntimeMetricsHooks as R, type NegotiationContext as S, type NumstatEntry as T, OP_STREAM_ACK_INTERVAL_MS as U, OP_STREAM_DEFAULT_WINDOW_BYTES as V, OP_STREAM_RECONNECT_HOLD_MS as W, OP_STREAM_SILENCE_TIMEOUT_MS as X, type OpStreamExecOutcome as Y, type OpStreamJournal as Z, type OpStreamSubscription as _, ActiveBackendUnresolvableError as a, type SwapTargetEstablishability as a$, OpStreamUnavailableError as a0, PROVIDER_REGISTRY as a1, type ProviderConstructionContext as a2, type ProviderRegistration as a3, REPOSITORY_DISCOVERY_LIMIT as a4, type RecordingArtifactMetadata as a5, type RecordingCodec as a6, type RecordingContentType as a7, RecordingError as a8, type RecordingProcess as a9, SandboxConfigError as aA, type SandboxCreatedCallback as aB, SandboxProviderUnavailableError as aC, SandboxResumeStateUnavailableError as aD, type SelfhostedApplyDiff as aE, SelfhostedControlError as aF, type SelfhostedEditor as aG, type SelfhostedEnrollment as aH, type SelfhostedExecArgs as aI, type SelfhostedExecResult as aJ, type SelfhostedImageOutput as aK, type SelfhostedLivenessState as aL, type SelfhostedNegotiationInput as aM, type SelfhostedOpObservation as aN, type SelfhostedOpObserver as aO, type SelfhostedOpStreamDeps as aP, type SelfhostedRelayConfig as aQ, type SelfhostedRetryClock as aR, type SelfhostedRetryDecision as aS, SelfhostedSandboxClient as aT, SelfhostedSession as aU, type SelfhostedSessionBuild as aV, type SelfhostedSessionDeps as aW, type SelfhostedSessionState as aX, type SelfhostedUnavailableReason as aY, type StartRecordingInput as aZ, StreamPortUnavailableError as a_, RecordingUnavailableError as aa, type RepositoryDiscoveryDegradedReason as ab, type RepositoryDiscoveryResult as ac, type ResolvedActiveBackend as ad, type RoutableBackendSession as ae, type RoutableSandbox as af, RoutingSandboxSession as ag, type RoutingSandboxSessionDeps as ah, type RoutingTransitionEvent as ai, RoutingUnsupportedError as aj, SELFHOSTED_DEFAULT_TIMEOUT_MS as ak, SELFHOSTED_DRAINING_MAX_RETRIES as al, SELFHOSTED_EXEC_DRAINING_MAX_RETRIES as am, SELFHOSTED_IDEMPOTENT_READONLY_OPS as an, SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES as ao, SELFHOSTED_NEVER_SENT_MAX_RETRIES as ap, SELFHOSTED_RECONNECT_WINDOW_MS as aq, SELFHOSTED_RELAY_STREAM_PATH as ar, SELFHOSTED_RETRY_BACKOFF_BASE_MS as as, SELFHOSTED_RETRY_BACKOFF_CAP_MS as at, SELFHOSTED_RETRY_BACKOFF_FACTOR as au, SELFHOSTED_TIMEOUT_MAX_RETRIES as av, STREAM_PORT as aw, STREAM_TOKEN_DEFAULT_TTL_SECONDS as ax, SandboxChannelAService as ay, type SandboxChannelAServiceOptions as az, type ActivePointer as b, serializeEstablishedSandboxEnvelope as b$, TERMINAL_SERVER_TIMEOUT_MS as b0, TerminalServerError as b1, TerminalServerUnsupportedError as b2, agentErrorToControlError as b3, assertDescriptorRegistryInvariants as b4, assertProviderRegistryInvariants as b5, assertSafeRelPath as b6, backendSupportsOs as b7, buildDisplayStackScript as b8, buildSelfhostedBackendSession as b9, makeActiveBackendResolver as bA, mintStreamToken as bB, modalSandboxAttributionEnvironment as bC, modalSandboxAttributionTags as bD, negotiateCapabilities as bE, negotiateSelfhostedCapabilities as bF, nextDurableOpId as bG, offlineAgentError as bH, offlineControlResponse as bI, opAckSubject as bJ, opFrameSubject as bK, parseExecBannerSessionId as bL, parseNumstatZ as bM, parsePorcelainV2 as bN, parseUnifiedPatch as bO, payloadTooLargeMessage as bP, readWorkspaceArchiveFromEnvelopeSessionState as bQ, recordingStorageKey as bR, renderSelfhostedFault as bS, restoredSandboxSessionStateFromEntry as bT, runWithToolCallCorrelation as bU, sandboxStateEntryFromRunState as bV, sanitizeOpIdToken as bW, selectBackend as bX, selfhostedFaultClass as bY, selfhostedLiveness as bZ, selfhostedRetryBackoffMs as b_, buildStreamUrl as ba, buildTerminalServerScript as bb, contentTypeForCodec as bc, createSandboxClient as bd, createSandboxClientForBackend as be, decideSelfhostedRetry as bf, decodeModalSnapshotId as bg, defaultSelfhostedRetryClock as bh, deletePriorPersistedSnapshot as bi, deleteRecordingArtifacts as bj, deserializeSandboxSessionStateEnvelope as bk, desktopCapableBackend as bl, drainingExhaustedError as bm, drainingMessage as bn, ensureDisplayStack as bo, ensureModalRegistryImage as bp, ensureTerminalServer as bq, establishSandboxSessionFromEnvelope as br, execDeadlineHint as bs, exposeStreamPort as bt, extForCodec as bu, inspectRecordingArtifact as bv, isExecSessionLostBanner as bw, isProviderSandboxNotFoundError as bx, isSelfhostedProviderNotFoundError as by, isWorkspaceEscapeError as bz, type ChannelAEmitter as c, setSelfhostedApplyDiff as c0, startRecording as c1, stopRecording as c2, stripExecBanner as c3, subjectFor as c4, swapTargetEstablishability as c5, sweepModalOrphanSandboxes as c6, tagModalSandbox as c7, tearDownDisplayStack as c8, tearDownTerminalServer as c9, terminateModalSandboxById as ca, timeoutAgentError as cb, timeoutControlResponse as cc, uploadRecordingArtifact as cd, verifyStreamToken as ce, type ChannelAExecArgs as d, type ChannelAExecResult as e, ChannelANotFoundError as f, type ChannelASession as g, ChannelAUnsupportedError as h, ChannelAValidationError as i, type ControlRpc as j, DISPLAY_STACK_TIMEOUT_MS as k, type DesktopGeometry as l, DisplayStackError as m, DisplayStackUnsupportedError as n, type EnsureDisplayStackResult as o, type EnsureTerminalServerOptions as p, type EnsureTerminalServerResult as q, type EstablishedSandboxSession as r, type ExposeStreamPortInput as s, type ExposeStreamPortResult as t, type ExposedPortEndpoint as u, FAULT_FIELD_WHAT_PRESERVED as v, FAULT_FIELD_WHAT_TO_TRY as w, FAULT_FIELD_WHICH_LAYER as x, MockAgentResponder as y, type MockAgentResponderOptions as z };
+export { type NegotiationContext as $, type ActiveBackendResolverDeps as A, type BackendUnresolvableCode as B, ChannelAConflictError as C, DEFAULT_DESKTOP_GEOMETRY as D, type EnsureDisplayStackOptions as E, type ExposeStreamPortResult as F, type ExposedPortEndpoint as G, FAULT_FIELD_WHAT_HAPPENED as H, FAULT_FIELD_WHAT_PRESERVED as I, FAULT_FIELD_WHAT_TO_TRY as J, FAULT_FIELD_WHICH_LAYER as K, type LiveModalSandboxLeaseAttribution as L, type MaterializeRunCredentialsOptions as M, type MintStreamTokenInput as N, MockAgentResponder as O, type MockAgentResponderOptions as P, type MockExecHandler as Q, type RunCredentialSessionReady as R, type ModalModuleLoader as S, type ModalOrphanSweepResult as T, type ModalOrphanSweepTermination as U, type ModalSandboxAttribution as V, NEVER_SENT_DETAIL_KEY as W, NatsControlRpc as X, type NatsOpStreamConnection as Y, NatsOpStreamTransport as Z, type NatsRequestConnection as _, type RuntimeMetricsHooks as a, type SelfhostedNegotiationInput as a$, type NormalizedRunCredentialMaterial as a0, type NumstatEntry as a1, OP_STREAM_ACK_INTERVAL_MS as a2, OP_STREAM_DEFAULT_WINDOW_BYTES as a3, OP_STREAM_RECONNECT_HOLD_MS as a4, OP_STREAM_SILENCE_TIMEOUT_MS as a5, type OpStreamExecOutcome as a6, type OpStreamJournal as a7, type OpStreamSubscription as a8, type OpStreamTransport as a9, SELFHOSTED_DRAINING_MAX_RETRIES as aA, SELFHOSTED_EXEC_DRAINING_MAX_RETRIES as aB, SELFHOSTED_IDEMPOTENT_READONLY_OPS as aC, SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES as aD, SELFHOSTED_NEVER_SENT_MAX_RETRIES as aE, SELFHOSTED_RECONNECT_WINDOW_MS as aF, SELFHOSTED_RELAY_STREAM_PATH as aG, SELFHOSTED_RETRY_BACKOFF_BASE_MS as aH, SELFHOSTED_RETRY_BACKOFF_CAP_MS as aI, SELFHOSTED_RETRY_BACKOFF_FACTOR as aJ, SELFHOSTED_TIMEOUT_MAX_RETRIES as aK, STREAM_PORT as aL, STREAM_TOKEN_DEFAULT_TTL_SECONDS as aM, SandboxChannelAService as aN, type SandboxChannelAServiceOptions as aO, SandboxConfigError as aP, type SandboxCreatedCallback as aQ, SandboxProviderUnavailableError as aR, SandboxResumeStateUnavailableError as aS, type SelfhostedApplyDiff as aT, SelfhostedControlError as aU, type SelfhostedEditor as aV, type SelfhostedEnrollment as aW, type SelfhostedExecArgs as aX, type SelfhostedExecResult as aY, type SelfhostedImageOutput as aZ, type SelfhostedLivenessState as a_, OpStreamUnavailableError as aa, PROVIDER_REGISTRY as ab, type ProviderConstructionContext as ac, type ProviderRegistration as ad, REPOSITORY_DISCOVERY_LIMIT as ae, type RecordingArtifactMetadata as af, type RecordingCodec as ag, type RecordingContentType as ah, RecordingError as ai, type RecordingProcess as aj, RecordingUnavailableError as ak, type RepositoryDiscoveryDegradedReason as al, type RepositoryDiscoveryResult as am, type ResolvedActiveBackend as an, type RevalidateModalOrphanTermination as ao, type RoutableBackendSession as ap, type RoutableSandbox as aq, RoutingSandboxSession as ar, type RoutingSandboxSessionDeps as as, type RoutingTransitionEvent as at, RoutingUnsupportedError as au, type RunCredentialCommandRunner as av, type RunCredentialCommandSession as aw, type RunCredentialExpectedScope as ax, RunCredentialValidationError as ay, SELFHOSTED_DEFAULT_TIMEOUT_MS as az, ActiveBackendUnresolvableError as b, offlineControlResponse as b$, type SelfhostedOpObservation as b0, type SelfhostedOpObserver as b1, type SelfhostedOpStreamDeps as b2, type SelfhostedRelayConfig as b3, type SelfhostedRetryClock as b4, type SelfhostedRetryDecision as b5, SelfhostedSandboxClient as b6, SelfhostedSession as b7, type SelfhostedSessionBuild as b8, type SelfhostedSessionDeps as b9, deletePriorPersistedSnapshot as bA, deleteRecordingArtifacts as bB, deserializeSandboxSessionStateEnvelope as bC, desktopCapableBackend as bD, drainingExhaustedError as bE, drainingMessage as bF, ensureDisplayStack as bG, ensureModalRegistryImage as bH, ensureTerminalServer as bI, establishSandboxSessionFromEnvelope as bJ, execDeadlineHint as bK, exposeStreamPort as bL, extForCodec as bM, inspectRecordingArtifact as bN, isExecSessionLostBanner as bO, isProviderSandboxNotFoundError as bP, isSelfhostedProviderNotFoundError as bQ, makeActiveBackendResolver as bR, materializeRunCredentials as bS, mintStreamToken as bT, modalSandboxAttributionEnvironment as bU, modalSandboxAttributionTags as bV, negotiateCapabilities as bW, negotiateSelfhostedCapabilities as bX, nextDurableOpId as bY, normalizeRunCredentialsResolution as bZ, offlineAgentError as b_, type SelfhostedSessionState as ba, type SelfhostedUnavailableReason as bb, type StartRecordingInput as bc, StreamPortUnavailableError as bd, type SwapTargetEstablishability as be, TERMINAL_SERVER_TIMEOUT_MS as bf, TerminalServerError as bg, TerminalServerUnsupportedError as bh, ToolspaceTokenPathError as bi, agentErrorToControlError as bj, assertDescriptorRegistryInvariants as bk, assertProviderRegistryInvariants as bl, assertSafeRelPath as bm, backendSupportsOs as bn, buildDisplayStackScript as bo, buildSelfhostedBackendSession as bp, buildStreamUrl as bq, buildTerminalServerScript as br, clearRunCredentials as bs, clearRunCredentialsForAttempt as bt, contentTypeForCodec as bu, createSandboxClient as bv, createSandboxClientForBackend as bw, decideSelfhostedRetry as bx, decodeModalSnapshotId as by, defaultSelfhostedRetryClock as bz, type ActivePointer as c, opAckSubject as c0, opFrameSubject as c1, parseExecBannerExitCode as c2, parseExecBannerSessionId as c3, parseNumstatZ as c4, parsePorcelainV2 as c5, parseUnifiedPatch as c6, payloadTooLargeMessage as c7, readWorkspaceArchiveFromEnvelopeSessionState as c8, recordingStorageKey as c9, toolspaceTokenFileFromEnvironment as cA, uploadRecordingArtifact as cB, verifyStreamToken as cC, withRunCredentialEnvironment as cD, withRunCredentialsClient as cE, withRunCredentialsSession as cF, withToolspaceTokenClient as cG, withToolspaceTokenEnvironment as cH, withToolspaceTokenSession as cI, renderSelfhostedFault as ca, restoredSandboxSessionStateFromEntry as cb, runCredentialPointerFile as cc, runCredentialRoot as cd, runWithToolCallCorrelation as ce, sandboxStateEntryFromRunState as cf, sanitizeOpIdToken as cg, selectBackend as ch, selfhostedFaultClass as ci, selfhostedLiveness as cj, selfhostedRetryBackoffMs as ck, serializeEstablishedSandboxEnvelope as cl, setSelfhostedApplyDiff as cm, startRecording as cn, stopRecording as co, stripExecBanner as cp, subjectFor as cq, swapTargetEstablishability as cr, sweepModalOrphanSandboxes as cs, tagModalSandbox as ct, tearDownDisplayStack as cu, tearDownTerminalServer as cv, terminateModalSandboxById as cw, timeoutAgentError as cx, timeoutControlResponse as cy, toolspaceTokenFileForSession as cz, type ChannelAEmitter as d, type ChannelAExecArgs as e, type ChannelAExecResult as f, ChannelANotFoundError as g, type ChannelASession as h, ChannelAUnavailableError as i, ChannelAUnsupportedError as j, ChannelAValidationError as k, type ControlRpc as l, DISPLAY_STACK_TIMEOUT_MS as m, type DesktopGeometry as n, type DisplayStackCallerKind as o, type DisplayStackClassification as p, DisplayStackError as q, type DisplayStackTelemetryContext as r, type DisplayStackTelemetryEvent as s, type DisplayStackTelemetryStatus as t, DisplayStackUnsupportedError as u, type EnsureDisplayStackResult as v, type EnsureTerminalServerOptions as w, type EnsureTerminalServerResult as x, type EstablishedSandboxSession as y, type ExposeStreamPortInput as z };