@prismer/runtime 1.9.1 → 1.9.6

package/dist/index.d.ts

@@ -1,2063 +1,1643 @@
-import * as http from 'node:http';
-import { FsContext } from '@prismer/sandbox-runtime';
-import { ParaEvent } from '@prismer/wire';
+import { z } from 'zod';
 import { EventEmitter } from 'node:events';
+import Database from 'better-sqlite3';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { Command } from 'commander';
 
-type DaemonState = 'starting' | 'running' | 'shutting_down' | 'stopped';
-interface DaemonOptions {
-    pidFile?: string;
-    dataDir?: string;
-    logFile?: string;
-    installSignalHandlers?: boolean;
-}
-interface ShutdownHandler {
-    name: string;
-    handler: () => Promise<void> | void;
-}
-declare class DaemonAlreadyRunningError extends Error {
-    readonly existingPid: number;
-    readonly pidFile: string;
-    constructor(pid: number, pidFile: string);
-}
-declare class DaemonProcess {
-    private _state;
-    private readonly _pidFile;
-    private readonly _dataDir;
-    private readonly _logFile;
-    private readonly _installSignalHandlers;
-    private readonly _shutdownHandlers;
-    private readonly _signalHistory;
-    private _shutdownInProgress;
-    private _sigTermHandler;
-    private _sigIntHandler;
-    private _sigHupHandler;
-    private _signalReceived;
-    constructor(opts?: DaemonOptions);
-    get state(): DaemonState;
-    get pid(): number;
-    get pidFile(): string;
-    get dataDir(): string;
-    get signalHistory(): ReadonlyArray<{
-        signal: string;
-        ts: number;
-    }>;
-    start(): Promise<void>;
-    onShutdown(h: ShutdownHandler): void;
-    shutdown(signal?: NodeJS.Signals | 'manual'): Promise<void>;
-    reload(): Promise<void>;
-    static isRunning(pidFile: string): boolean;
-    static cleanupStalePidFile(pidFile: string): boolean;
-    private _atomicPidWrite;
-    private _recordSignal;
-    private _readPidFromFile;
-}
-
-interface EventBusEnvelope<T = unknown> {
-    topic: string;
-    ts: number;
-    payload: T;
-    source?: string;
-    requestId?: string;
-}
+type AdapterKind = 'long-running' | 'interactive';
 /**
- * Unified subscription handler that accepts EventBusEnvelope.
- * This matches the EventBus API expectation.
+ * Adapter definition: how the daemon hosts one class of agent
+ * (Hermes, Claude Code, OpenClaw, ...).
+ *
+ * One Adapter ←(1:N)─ Agent ←(1:N)─ AgentProfile
+ *
+ * Long-running adapters implement {@link AdapterDef.ensureService} and
+ * return a reusable {@link AdapterService} (e.g. HTTP client to
+ * `hermes gateway`). Interactive adapters implement
+ * {@link AdapterDef.dispatch} and spawn a fresh subprocess per task
+ * (e.g. `claude --headless`).
  */
-type SubscriptionHandler<T = unknown> = (ev: EventBusEnvelope<T>) => void | Promise<void>;
-interface Subscription {
-    id: string;
-    pattern: string;
-    unsubscribe(): void;
-}
-interface EventBusOptions {
-    onSubscriberError?: (err: unknown, sub: Subscription, ev: EventBusEnvelope) => void;
-    queueWarnThreshold?: number;
-}
-declare class EventBus {
-    private readonly _subscribers;
-    private _monotonicTs;
-    private _totalPublished;
-    private readonly _onError;
-    private readonly _warnThreshold;
-    constructor(opts?: EventBusOptions);
-    publish<T>(topic: string, payload: T, meta?: {
-        source?: string;
-        requestId?: string;
-    }): void;
-    subscribe<T>(topic: string, handler: SubscriptionHandler<T>): Subscription;
-    unsubscribeAll(): void;
-    get subscriberCount(): number;
-    get totalPublished(): number;
-    private _drain;
-}
-
-type AgentState = 'registered' | 'spawning' | 'running' | 'degraded' | 'crashed' | 'backoff' | 'stopping' | 'stopped' | 'failed';
-interface AgentDescriptor {
-    id: string;
+interface AdapterDef {
+    /** Unique name, e.g. 'hermes', 'claude-code'. Matches `IMAgentCard.adapterName`. */
     name: string;
-    command: string;
-    args?: string[];
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-    healthCheck?: () => Promise<boolean> | boolean;
-    backoff?: {
-        initialMs?: number;
-        multiplier?: number;
-        maxMs?: number;
-        maxRestarts?: number;
-        resetAfterMs?: number;
-    };
-    attachPid?: number;
+    /** Long-running services expose ensureService; interactive adapters expose dispatch. */
+    kind: AdapterKind;
+    /** Capability tags surfaced to mobile (e.g. ['shell', 'code', 'mcp']). */
+    capabilities: string[];
+    /** Zod schema validating `AgentProfile.config` for this adapter. */
+    workspaceSchema: z.ZodSchema;
+    /** Long-running: ensure the underlying service is reachable. May spawn or just connect. */
+    ensureService?(profile: AgentProfile): Promise<AdapterService>;
+    /** Interactive: one-shot dispatch (spawn-per-task). */
+    dispatch?(profile: AgentProfile, task: TaskInput): Promise<TaskResult>;
+    /** Validate config before persisting `AgentProfile.config`. */
+    validate(config: unknown): ValidationResult;
+    /** Health probe — binary in PATH, HTTP endpoint reachable, etc. */
+    health(): Promise<HealthStatus>;
 }
-interface AgentStatus {
-    id: string;
-    state: AgentState;
-    pid?: number;
-    startedAt?: number;
-    restarts: number;
-    lastExitCode?: number;
-    lastSignal?: NodeJS.Signals | null;
-    lastHealthError?: string;
-    nextRestartAt?: number;
-}
-interface SupervisorOptions {
-    eventBus: EventBus;
-    healthProbeIntervalMs?: number;
-    degradedThreshold?: number;
-    stopTimeoutMs?: number;
-}
-declare class AgentSupervisor {
-    private readonly _bus;
-    private readonly _probeIntervalMs;
-    private readonly _degradedThreshold;
-    private readonly _stopTimeoutMs;
-    private readonly _agents;
-    constructor(opts: SupervisorOptions);
-    register(descriptor: AgentDescriptor): void;
-    unregister(id: string): Promise<void>;
-    spawn(id: string): Promise<void>;
-    stop(id: string, reason?: string): Promise<void>;
-    restart(id: string): Promise<void>;
-    attach(id: string, pid: number): Promise<void>;
-    get(id: string): AgentStatus | undefined;
-    list(): AgentStatus[];
-    shutdown(): Promise<void>;
-    private _doSpawn;
-    private _handleCrash;
-    private _scheduleRestart;
-    private _killOwned;
-    private _cancelBackoff;
-    private _startProbe;
-    private _stopProbe;
-    private _runProbe;
-    private _pollAttached;
-    private _require;
-    private _publish;
-}
-
 /**
- * Prismer Runtime — Adapter Registry (Sprint A3, D4 dispatch mux).
+ * AgentProfile mirrors the cloud `im_agent_profiles` row.
  *
- * One process-wide registry maps adapter `name` → `AdapterImpl`. The
- * registry is the data store; selection policy lives in DispatchMux
- * (dispatch-mux.ts) so the same registry can drive multiple selectors
- * (capability-based, name-based, weighted load, etc.) without coupling.
+ * Field names match Track A's `IMAgentProfile` Prisma model + `AgentProfileDTO`
+ * in `src/im/api/agent-profiles.ts` (m1, merged in d5186ca / a4b3d89).
  *
- * An adapter advertises:
- *   - `name`            : stable identifier (matches catalog name).
- *   - `tiersSupported`  : PARA Tier numbers it can host (e.g. [1..7]).
- *   - `capabilityTags`  : tags from the task's `requiresCapability`
- *                         vocabulary that this adapter can satisfy.
- *
- * On register conflict, replace — adapter modules are expected to be
- * the only source of truth for their own descriptor.
- *
- * Adapters typically run as out-of-process workers (Claude Code CLI,
- * OpenClaw daemon plug-in, Hermes Python). The `dispatch` boundary
- * here is the *runtime side* of that bridge — it returns a Promise
- * whose resolution corresponds to the adapter's reported completion.
+ * Daemon-local SQLite mirror columns use snake_case
+ * (workspace_id / agent_im_user_id) per docs/refactor/04-daemon-runtime.md
+ * §SQLite schema; the TS types stay camelCase across the boundary.
  */
-interface AdapterDescriptor {
-    /** Stable identifier — must match the catalog entry. */
+interface AgentProfile {
+    id: string;
+    workspaceId: string;
+    agentImUserId: string;
+    adapterName: string;
     name: string;
-    /** PARA Tier numbers (L1–L10). */
-    tiersSupported: number[];
-    /** Capability tag vocabulary (e.g. ["code.write", "code.review"]). */
-    capabilityTags: string[];
-    /** Free-form for telemetry — version, build, etc. */
-    metadata?: Record<string, unknown>;
+    config: Record<string, unknown>;
+    version: number;
+    createdAt: Date;
+    updatedAt: Date;
+    /**
+     * IMUser.username of the agent bound to this profile. Used by long-running
+     * adapters (e.g. Hermes) to derive a stable, human-readable per-agent
+     * profile directory and to scope MCP env so per-call agent identity is not
+     * lost when multiple agents share a daemon. Parallel task F1 populates this
+     * on the cloud DTO; runtime treats it as optional to stay backwards-compat
+     * with snapshots produced before F1 lands.
+     */
+    agentUsername?: string;
 }
-interface AdapterDispatchInput {
-    /** Cloud task ID (im_tasks.id). */
+interface TaskInput {
     taskId: string;
-    /** Step index when the task is multi-step (route step). */
-    stepIdx?: number;
-    /** Capability the cloud asked for — drives adapter selection. */
-    capability: string;
-    /** User-facing prompt / instruction. */
     prompt: string;
-    /** Free-form metadata passed through to the adapter. */
     metadata?: Record<string, unknown>;
-    /** Optional deadline (ms epoch). Adapters should respect it best-effort. */
-    deadlineAt?: number;
-}
-interface AdapterDispatchResult {
+    timeoutMs?: number;
+    onProgress?: (p: {
+        progress: number;
+        message?: string;
+        detail?: Record<string, unknown>;
+    }) => void;
+    signal?: AbortSignal;
+}
+interface TaskResult {
     ok: boolean;
-    /** Output text (stdout, summary, etc.). */
     output?: string;
-    /** Files produced by the adapter (paths are relative to the agent
-     *  workspace; cloud uploads them via the artifact stream). */
+    error?: {
+        code: string;
+        message: string;
+    };
     artifacts?: Array<{
-        path: string;
-        bytes: number;
+        kind: string;
+        storageUri: string;
         mime?: string;
+        size?: number;
     }>;
-    /** Failure reason — must be set when ok=false. */
-    error?: string;
-    /** Free-form telemetry — token counts, latency, model, etc. */
+    metrics?: {
+        tokensUsed?: number;
+        durationMs?: number;
+    };
+    /** Adapter-private metadata used by daemon-side bridges/observability. */
     metadata?: Record<string, unknown>;
 }
-interface AdapterImpl extends AdapterDescriptor {
-    /** Dispatch a task step to this adapter. Should not throw — errors
-     *  belong in the result. */
-    dispatch(input: AdapterDispatchInput): Promise<AdapterDispatchResult>;
-    /** Optional: per-adapter health probe. Defaults to "healthy". */
-    health?(): Promise<{
-        healthy: boolean;
-        reason?: string;
-    }>;
-    /**
-     * Reset adapter state for a specific agent (or all agents if undefined).
-     *
-     * v1.9.x remote-command `agent_restart` semantic: abort/clear whatever
-     * per-agent context the adapter holds. For stateless adapters (CLI shim),
-     * this is a no-op; for Mode B adapters, it's typically a POST /reset to
-     * the loopback so the adapter host clears its own session state.
-     *
-     * NOT a process restart — the adapter is not expected to own a PID.
-     *
-     * @param agentName  Optional agent name to scope the reset. Undefined = reset all.
-     * @returns Arbitrary result; ok:true for success, ok:false+reason otherwise.
-     */
-    reset?(agentName?: string): Promise<{
-        ok: boolean;
-        state?: string;
-        reason?: string;
-        [k: string]: unknown;
-    }>;
+/**
+ * Reusable handle to a long-running adapter's underlying service.
+ * For Hermes this wraps an HTTP client to `hermes gateway`; for OpenClaw
+ * (1.9.5+) it wraps an in-process TS worker.
+ */
+interface AdapterService {
+    /** Service-specific identifier (e.g. 'http://127.0.0.1:8642' for hermes). */
+    id: string;
+    dispatch(task: TaskInput): Promise<TaskResult>;
+    healthy(): Promise<boolean>;
+    /** Optional: stop the service. May be no-op if user owns lifecycle. */
+    shutdown?(): Promise<void>;
+    /** Optional: subscribe to crash events. */
+    on?(event: 'crash', cb: (err: Error) => void): void;
+}
+interface ValidationResult {
+    ok: boolean;
+    errors?: string[];
 }
+interface HealthStatus {
+    available: boolean;
+    reason?: string;
+    hint?: string;
+}
+
+/**
+ * Process-wide adapter registry.
+ *
+ * Maps `adapter.name` → {@link AdapterDef}. Selection policy lives in
+ * `daemon/dispatch.ts`; the registry is just a typed Map.
+ *
+ * Shell cherry-picked (conceptually, not via cp) from
+ * `feat/release190-milestone:sdk/prismer-cloud/runtime/src/adapter-registry.ts`.
+ * The registered type was swapped `AdapterImpl` → `AdapterDef` per the
+ * 1.9.x adapter contract; `tiersSupported` (PARA tier) is dropped — 1.9.x
+ * uses capability tags only.
+ */
 declare class AdapterRegistry {
     private readonly adapters;
-    register(adapter: AdapterImpl): void;
+    register(adapter: AdapterDef): void;
     unregister(name: string): boolean;
     has(name: string): boolean;
-    get(name: string): AdapterImpl | undefined;
-    list(): AdapterDescriptor[];
+    get(name: string): AdapterDef | undefined;
+    list(): AdapterDef[];
     size(): number;
     /**
-     * Find adapters that can satisfy the given capability tag.
+     * Find adapters that satisfy a capability tag.
      *
-     * An adapter matches if `capabilityTags` includes the tag verbatim or
-     * if the adapter declared a wildcard prefix match (e.g. `code.*` matches
-     * `code.write`). Returns deterministic ordering — adapters are sorted by
-     * name so callers see the same result for the same registry state.
-     */
-    findByCapability(capability: string): AdapterImpl[];
-    /**
-     * Find adapters that can host a given PARA tier.
+     * Match rules (deterministic, sorted by name):
+     * - exact: adapter declared the tag verbatim
+     * - wildcard: adapter declared `code.*` → matches `code.write`
      */
-    findByTier(tier: number): AdapterImpl[];
+    findByCapability(capability: string): AdapterDef[];
 }
 
+declare const HermesProfileConfigSchema: z.ZodObject<{
+    /** Hermes profile name (default: AgentProfile.id slice). */
+    hermesProfileName: z.ZodOptional<z.ZodString>;
+    /** Hermes API server port. Distinct profiles use distinct ports to avoid clashes. */
+    port: z.ZodDefault<z.ZodNumber>;
+    /** Bearer token from `~/.hermes/.env API_SERVER_KEY`. */
+    apiKey: z.ZodString;
+    /** Auto-spawn `hermes -p <name> gateway run` if not reachable. Default false. */
+    autoStart: z.ZodDefault<z.ZodBoolean>;
+    /** Wait timeout when autoStart=true. */
+    startupTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Configure Hermes' inference provider to use Prismer Cloud's existing
+     * OpenAI-compatible provider endpoint before starting the gateway.
+     */
+    configurePrismerProvider: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Auto-install the @prismer/mcp-server stdio MCP server into the Hermes
+     * profile so the long-running role agent can drive Workspace tasks
+     * (create / update / approve / move) through tool calls. Default true.
+     */
+    installPrismerMcpServer: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Override the absolute path to @prismer/mcp-server's `dist/index.js`.
+     * If unset the adapter resolves it via Node's module resolver from the
+     * runtime install location, then falls back to PRISMER_MCP_SERVER env.
+     */
+    prismerMcpServerPath: z.ZodOptional<z.ZodString>;
+    /** Model sent to Prismer's /api/v1/chat/completions endpoint. */
+    model: z.ZodDefault<z.ZodString>;
+    /** Named custom provider written into Hermes config.yaml. */
+    prismerProviderName: z.ZodDefault<z.ZodString>;
+    /** Override cloud provider base. Defaults to PRISMER_BASE_URL + /api/v1. */
+    prismerProviderBaseUrl: z.ZodOptional<z.ZodString>;
+    /** Env key Hermes reads from profile .env for the Prismer API key. */
+    prismerApiKeyEnv: z.ZodDefault<z.ZodString>;
+    /**
+     * Mirror Prismer work_item projections into Hermes native Kanban as triage
+     * cards. Triage avoids duplicate execution; Prismer's agent_run remains the
+     * executable source of truth.
+     */
+    mirrorNativeKanban: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Mirror Prismer standing-objective IMTask projections into Hermes' native
+     * per-session GoalManager state (`state.db.state_meta["goal:<session_id>"]`).
+     * Hermes has no public goals REST/CLI surface; this writes the documented
+     * native state key directly and records the exact bridge result on the task.
+     */
+    mirrorNativeGoals: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Optional checkout path for Hermes Agent source. Used only as a fallback
+     * when the installed `hermes` binary is older than the native Kanban CLI
+     * surface but the local source tree contains hermes_cli/kanban_db.py.
+     */
+    hermesSourceDir: z.ZodOptional<z.ZodString>;
+    nativeMirrorTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    port: number;
+    apiKey: string;
+    autoStart: boolean;
+    startupTimeoutMs: number;
+    configurePrismerProvider: boolean;
+    installPrismerMcpServer: boolean;
+    model: string;
+    prismerProviderName: string;
+    prismerApiKeyEnv: string;
+    mirrorNativeKanban: boolean;
+    mirrorNativeGoals: boolean;
+    nativeMirrorTimeoutMs: number;
+    hermesProfileName?: string | undefined;
+    prismerMcpServerPath?: string | undefined;
+    prismerProviderBaseUrl?: string | undefined;
+    hermesSourceDir?: string | undefined;
+}, {
+    apiKey: string;
+    hermesProfileName?: string | undefined;
+    port?: number | undefined;
+    autoStart?: boolean | undefined;
+    startupTimeoutMs?: number | undefined;
+    configurePrismerProvider?: boolean | undefined;
+    installPrismerMcpServer?: boolean | undefined;
+    prismerMcpServerPath?: string | undefined;
+    model?: string | undefined;
+    prismerProviderName?: string | undefined;
+    prismerProviderBaseUrl?: string | undefined;
+    prismerApiKeyEnv?: string | undefined;
+    mirrorNativeKanban?: boolean | undefined;
+    mirrorNativeGoals?: boolean | undefined;
+    hermesSourceDir?: string | undefined;
+    nativeMirrorTimeoutMs?: number | undefined;
+}>;
+type HermesProfileConfig = z.infer<typeof HermesProfileConfigSchema>;
+declare const hermesAdapter: AdapterDef;
+
+interface WsClientOptions {
+    /** Cloud WS URL, e.g. `wss://cloud.prismer.dev/ws` or `ws://127.0.0.1:3000/ws`. */
+    url: string;
+    /** API key passed as `?token=<apiKey>` (matches 1.7.x token query auth). */
+    apiKey: string;
+    /** Initial reconnect delay (ms). Defaults to 1000. */
+    reconnectInitialMs?: number;
+    /** Reconnect cap (ms). Defaults to 60_000. */
+    reconnectMaxMs?: number;
+    /** Max consecutive reconnect attempts before entering degraded mode. Defaults to 30. */
+    maxReconnectAttempts?: number;
+    /** How long to stay in degraded mode before retrying (ms). Defaults to 5 minutes. */
+    degradedCooldownMs?: number;
+}
+/** Subset of close codes we special-case. */
+declare const WS_CLOSE: {
+    /** RFC 6455 normal closure — no reconnect. */
+    readonly NORMAL: 1000;
+    /** Custom auth failure — no auto-reconnect; surface to user. */
+    readonly AUTH: 4001;
+};
 /**
- * Prismer Runtime — Dispatch Mux (Sprint A3, D4).
- *
- * Picks an adapter for an incoming task and forwards the dispatch call.
- * Selection policy (in priority order):
- *
- *   1. `preferAdapter` (caller-supplied) wins if registered AND the
- *      adapter can satisfy the requested capability.
- *   2. If exactly one adapter matches the capability, use it.
- *   3. If multiple match, pick deterministically — adapters sorted by
- *      `name` (so the same task always lands on the same adapter when
- *      multiple are eligible). Future: load/latency-aware ranking.
- *   4. None matches → return a structured "no_adapter" failure rather
- *      than throw — the caller (cloud) decides whether to reroute.
+ * Events emitted:
+ *  - `open`             ws successfully opened
+ *  - `message` (msg)    incoming JSON-parsed message
+ *  - `close` (code, reason)  connection closed (auto-reconnect happens after this)
+ *  - `error` (err)      transport error or invalid JSON received
+ *  - `drop` (msg)       send() called when not OPEN; caller may enqueue
+ *  - `auth-failed`      close code 4001 — user must rerun setup; no auto-reconnect
+ *  - `degraded`         max reconnect attempts hit; pausing for cooldown
+ *  - `reconnect-scheduled` (ms) reconnect timer set
+ */
+declare class WsClient extends EventEmitter {
+    private opts;
+    private ws?;
+    private reconnectMs;
+    private reconnectAttempts;
+    private closed;
+    private reconnectTimer?;
+    constructor(opts: WsClientOptions);
+    start(): void;
+    /** Send a JSON-serializable message. Caller is responsible for envelope construction. */
+    send(msg: unknown): void;
+    /** Close intentionally — no reconnect. */
+    close(code?: 1000): void;
+    isOpen(): boolean;
+    private connect;
+    private scheduleReconnect;
+}
+
+type LocalDb = Database.Database;
+/**
+ * Open `~/.prismer/local.db` (or any path), enable WAL, run migrations.
+ * Idempotent — safe to call multiple times.
  *
- * The mux never throws on adapter errors; it always returns a result
- * with `ok=false` so the cloud-side TaskRouter can report `step_failed`
- * instead of seeing a daemon-side stack trace.
+ * Pass `:memory:` for in-test usage.
  */
+declare function openLocalDb(path: string): LocalDb;
+declare function runMigrations(db: LocalDb): void;
+declare function currentSchemaVersion(db: LocalDb): number;
+declare const TARGET_SCHEMA_VERSION = 2;
 
-interface DispatchMuxRequest extends AdapterDispatchInput {
-    /** If set and registered, win selection. */
-    preferAdapter?: string;
+type SyncResourceType = 'workspace' | 'agent' | 'agent_profile';
+type SyncOperation = 'create' | 'update' | 'delete';
+type SyncStatus = 'pending' | 'failed_conflict' | 'failed_other';
+interface SyncQueueRow {
+    id: number;
+    resource_type: SyncResourceType;
+    resource_id: string;
+    operation: SyncOperation;
+    payload: string;
+    attempt_count: number;
+    last_attempt_at: number | null;
+    next_attempt_at: number;
+    status: SyncStatus;
+}
+declare function nextBackoffMs(attemptCount: number): number;
+declare class SyncQueue {
+    private db;
+    constructor(db: LocalDb);
+    enqueue(input: {
+        resourceType: SyncResourceType;
+        resourceId: string;
+        operation: SyncOperation;
+        payload: unknown;
+        /** Defaults to now (ready immediately). */
+        runAt?: number;
+    }): number;
+    /** Take up to `limit` rows whose next_attempt_at <= now and status='pending'. Oldest first. */
+    dequeueBatch(limit: number, now?: number): SyncQueueRow[];
+    markCompleted(id: number): void;
+    markConflict(id: number): void;
+    /** Increment attempt + reschedule via backoff. Caller passes the current attempt_count. */
+    markBackoff(id: number, currentAttemptCount: number): void;
+    /** Permanent failure (4xx other than 409). */
+    markFailedOther(id: number): void;
+    pendingCount(): number;
+    /** All rows for a given resource (debugging / CLI status). */
+    listForResource(type: SyncResourceType, id: string): SyncQueueRow[];
 }
-interface DispatchMuxResult extends AdapterDispatchResult {
-    /** Which adapter handled this request. Useful for telemetry +
-     *  debugging when the answer "feels wrong". */
-    adapter?: string;
+
+interface FlushResult {
+    ok: boolean;
+    /** HTTP status when applicable. 409 → markConflict; 400-499 (other) → markFailedOther; else markBackoff. */
+    status?: number;
+    message?: string;
+}
+/** Caller injects the actual cloud HTTP push (m3). Scaffold uses a noop that returns ok:true. */
+type FlushFn = (row: SyncQueueRow) => Promise<FlushResult>;
+interface SyncWorkerOptions {
+    queue: SyncQueue;
+    flush: FlushFn;
+    /** Tick interval in ms. Defaults to 5000. */
+    tickMs?: number;
+    /** Max rows per tick. Defaults to 10. */
+    batchSize?: number;
 }
-declare class DispatchMux {
-    private readonly registry;
-    constructor(registry: AdapterRegistry);
+/**
+ * Events:
+ *  - `tick` ({ pending, processed })   each completed tick
+ *  - `flushed` (row, result)           one row push outcome
+ *  - `error` (err, row?)               unexpected error in flush()
+ */
+declare class SyncWorker extends EventEmitter {
+    private opts;
+    private timer?;
+    private running;
+    constructor(opts: SyncWorkerOptions);
+    start(): void;
+    stop(): void;
     /**
-     * Resolve the adapter that would handle a given request without
-     * actually dispatching. Returned undefined means "no adapter matches".
-     * Useful for cloud-side capability probing.
+     * Drain up to `batchSize` ready rows. Public for test injection.
+     * Re-entrant guarded — concurrent ticks return immediately.
      */
-    resolve(req: {
-        capability: string;
-        preferAdapter?: string;
-    }): {
-        adapter: string;
+    tick(): Promise<{
+        processed: number;
+    }>;
+    private handleResult;
+}
+
+interface RoleTemplate {
+    templateName: string;
+    displayName: string;
+    description: string;
+    applicableAdapters: string[];
+    configSchema: Record<string, unknown>;
+}
+declare const BUILTIN_ROLE_TEMPLATES: ReadonlyArray<RoleTemplate>;
+declare function getRoleTemplate(name: string): RoleTemplate | undefined;
+declare function listRoleTemplates(): ReadonlyArray<{
+    name: string;
+    displayName: string;
+    description: string;
+}>;
+
+declare const ConfigSchema: z.ZodObject<{
+    /** API key from `prismer setup`, or env override. */
+    api_key: z.ZodString;
+    /** Cloud REST + WS base; `ws://` is derived by stripping `http`. */
+    cloud_api_base: z.ZodString;
+    /** Stable per-machine daemon identifier. Generated once on first setup. */
+    daemon_id: z.ZodString;
+    /** Optional adapter-specific overrides keyed by adapter name. */
+    adapters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    /** Local daemon shell execution. Default disabled. */
+    shell: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        default_cwd: z.ZodOptional<z.ZodString>;
+        defaultCwd: z.ZodOptional<z.ZodString>;
+        shell: z.ZodOptional<z.ZodEnum<["bash", "zsh", "sh"]>>;
+        max_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        maxTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        max_output_bytes: z.ZodOptional<z.ZodNumber>;
+        maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+        allowed_workspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowedWorkspaces: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        shell?: "bash" | "zsh" | "sh" | undefined;
+        default_cwd?: string | undefined;
+        defaultCwd?: string | undefined;
+        max_timeout_ms?: number | undefined;
+        maxTimeoutMs?: number | undefined;
+        max_output_bytes?: number | undefined;
+        maxOutputBytes?: number | undefined;
+        allowed_workspaces?: string[] | undefined;
+        allowedWorkspaces?: string[] | undefined;
+    }, {
+        shell?: "bash" | "zsh" | "sh" | undefined;
+        enabled?: boolean | undefined;
+        default_cwd?: string | undefined;
+        defaultCwd?: string | undefined;
+        max_timeout_ms?: number | undefined;
+        maxTimeoutMs?: number | undefined;
+        max_output_bytes?: number | undefined;
+        maxOutputBytes?: number | undefined;
+        allowed_workspaces?: string[] | undefined;
+        allowedWorkspaces?: string[] | undefined;
+    }>>;
+    /** Local cache settings. */
+    cache: z.ZodOptional<z.ZodObject<{
+        max_bytes: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        max_bytes: number;
+    }, {
+        max_bytes?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    api_key: string;
+    cloud_api_base: string;
+    daemon_id: string;
+    shell?: {
+        enabled: boolean;
+        shell?: "bash" | "zsh" | "sh" | undefined;
+        default_cwd?: string | undefined;
+        defaultCwd?: string | undefined;
+        max_timeout_ms?: number | undefined;
+        maxTimeoutMs?: number | undefined;
+        max_output_bytes?: number | undefined;
+        maxOutputBytes?: number | undefined;
+        allowed_workspaces?: string[] | undefined;
+        allowedWorkspaces?: string[] | undefined;
+    } | undefined;
+    adapters?: Record<string, Record<string, unknown>> | undefined;
+    cache?: {
+        max_bytes: number;
     } | undefined;
-    dispatch(req: DispatchMuxRequest): Promise<DispatchMuxResult>;
+}, {
+    api_key: string;
+    cloud_api_base: string;
+    daemon_id: string;
+    shell?: {
+        shell?: "bash" | "zsh" | "sh" | undefined;
+        enabled?: boolean | undefined;
+        default_cwd?: string | undefined;
+        defaultCwd?: string | undefined;
+        max_timeout_ms?: number | undefined;
+        maxTimeoutMs?: number | undefined;
+        max_output_bytes?: number | undefined;
+        maxOutputBytes?: number | undefined;
+        allowed_workspaces?: string[] | undefined;
+        allowedWorkspaces?: string[] | undefined;
+    } | undefined;
+    adapters?: Record<string, Record<string, unknown>> | undefined;
+    cache?: {
+        max_bytes?: number | undefined;
+    } | undefined;
+}>;
+type Config = z.infer<typeof ConfigSchema>;
+interface ConfigPaths {
+    /** Default `~/.prismer`. */
+    root: string;
+    configFile: string;
+    localDb: string;
+    cacheDir: string;
+    logsDir: string;
+    /**
+     * Per-task run scratch dirs. Each chat-mention dispatch creates
+     * `${runsDir}/${taskId}/_outbox/` for adapter-produced files; the
+     * OutboxWatcher uploads from there into IMAssets.
+     */
+    runsDir: string;
 }
+/**
+ * Resolve paths for the prismer home directory. Honors `PRISMER_HOME` env var;
+ * defaults to `~/.prismer`.
+ */
+declare function resolvePaths(home?: string): ConfigPaths;
+declare function configExists(paths?: ConfigPaths): boolean;
+/**
+ * Read and validate config. Env vars override file values for `api_key` and
+ * `cloud_api_base` (handy in CI / dev without rewriting config.toml).
+ */
+declare function loadConfig(paths?: ConfigPaths): Config;
+declare function saveConfig(config: Config, paths?: ConfigPaths): void;
+/** Derive a `wss?://` URL from a `https?://` base. Trailing `/ws` appended. */
+declare function deriveWsUrl(httpBase: string): string;
 
-interface PairOfferRecord {
-    offer: string;
-    uri: string;
-    expiresAt: number;
-    createdAt: number;
-    paired: boolean;
-    bindingId?: string;
-    deviceName?: string;
-    transport?: 'lan' | 'relay';
-    clientPubKey?: string;
+declare function newDaemonId(): string;
+declare function isDaemonId(s: string): boolean;
+
+interface CloudClientOptions {
+    baseUrl: string;
+    apiKey: string;
+    /** Per-request timeout (ms). Defaults to 30s. */
+    defaultTimeoutMs?: number;
+    /** Pluggable fetch (tests inject a stub). */
+    fetchImpl?: typeof fetch;
 }
-interface PairingStatus {
-    paired: boolean;
-    expired: boolean;
-    bindingId?: string;
-    deviceName?: string;
-    transport?: 'lan' | 'relay';
-}
-declare class PairingManager {
-    private readonly offers;
-    createOffer(ttlSec?: number): PairOfferRecord;
-    getStatus(offer: string): PairingStatus | null;
-    confirm(offer: string, input?: {
-        bindingId?: string;
-        deviceName?: string;
-        transport?: 'lan' | 'relay';
-        clientPubKey?: string;
-    }): PairingStatus;
-    cleanExpired(): void;
+interface CloudResponse<T> {
+    ok: boolean;
+    status: number;
+    data?: T;
+    error?: {
+        code: string;
+        message: string;
+    };
 }
+declare class CloudClient {
+    private readonly opts;
+    private readonly fetchImpl;
+    constructor(opts: CloudClientOptions);
+    /** Low-level request. Caller decides on retry; sync-worker handles backoff. */
+    request<T = unknown>(method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE', path: string, init?: {
+        body?: unknown;
+        headers?: Record<string, string>;
+        signal?: AbortSignal;
+        timeoutMs?: number;
+        auth?: boolean;
+    }): Promise<CloudResponse<T>>;
+    /** Convenience: GET expecting `{ ok, data }` envelope. Returns `data` or throws. */
+    get<T>(path: string, opts?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
+    urlFor(path: string): string;
+    /** Raw byte download (for asset cache). Returns response so caller can stream body. */
+    fetchRaw(path: string, init?: {
+        headers?: Record<string, string>;
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<Response>;
+}
+declare class CloudError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+
+interface Envelope<T = unknown> {
+    type: string;
+    payload: T;
+    requestId?: string;
+    timestamp: number;
+}
+declare function envelope<T>(type: string, payload: T, requestId?: string): Envelope<T>;
 
+interface CachedAsset {
+    contentHash: string;
+    sizeBytes: number;
+    mime: string | null;
+    localPath: string;
+    fetchedAt: number;
+    lastUsedAt: number;
+    pin: boolean;
+}
+interface AssetCacheOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    /** ~/.prismer/cache. */
+    cacheDir: string;
+    /** LRU cap in bytes. Default 5 GiB. */
+    maxBytes?: number;
+}
 /**
- * event-handler.ts — PARA event subscription and processing for Daemon
- *
- * Implements PARA event subscription, Tier-based event routing, and
- * integration with daemon startup workflow.
+ * Local asset cache.
  *
- * Reference: docs/version190/04-sandbox-permissions.md §5.3
+ * `getOrFetch(hash, opts)` returns the local path; downloads from
+ * `GET /api/im/assets/by-hash/:hash?wsId=…` on miss. Pinned rows survive LRU.
  */
+declare class AssetCache {
+    private readonly db;
+    private readonly cloud;
+    private readonly cacheDir;
+    private readonly maxBytes;
+    constructor(opts: AssetCacheOptions);
+    /** Local file path for a content hash. Files split by first 2 chars for fs scaling. */
+    pathFor(hash: string): string;
+    get(hash: string): CachedAsset | undefined;
+    /** Bump `last_used_at` (call when an asset is consulted). */
+    touch(hash: string): void;
+    pin(hash: string): void;
+    unpin(hash: string): void;
+    /**
+     * Get or fetch by hash. On miss, downloads the raw bytes and caches them.
+     *
+     * Why two endpoints: `GET /api/im/assets/by-hash/:hash` returns the JSON
+     * `AssetDTO` (id, contentHash, storageUri, …) — *metadata only*. The raw
+     * bytes live at `GET /api/im/assets/:id`. If `opts.assetId` is supplied
+     * the caller already has the id from an `AssetRef`, so we go straight to
+     * the byte endpoint; otherwise we resolve `hash → id` first (one extra
+     * round-trip on the metadata route) before downloading the body.
+     *
+     * Earlier this method called `by-hash` and treated the JSON body as the
+     * asset content — the daemon stored the 500-byte metadata blob on disk
+     * and `resolveAssetRefs` inlined that JSON into the prompt. The agent
+     * saw `{"id":"…","storageUri":"…"}` instead of the user's file and
+     * concluded the upload had failed.
+     */
+    getOrFetch(hash: string, opts?: {
+        workspaceIdHint?: string;
+        signal?: AbortSignal;
+        assetId?: string;
+    }): Promise<CachedAsset>;
+    /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
+    registerLocal(hash: string, localPath: string, mime?: string): CachedAsset;
+    /** Total bytes across all rows (incl. pinned). */
+    totalBytes(): number;
+    /** Run LRU eviction until under cap. Pinned rows are never evicted. */
+    evictIfOver(): {
+        removed: number;
+        freed: number;
+    };
+}
 
-interface EventHandlerOptions {
-    bus: EventBus;
-    supervisor: AgentSupervisor;
-    /** Optional tier filter for event routing */
-    tierFilter?: number;
-}
-declare class EventHandler {
-    private readonly _bus;
-    private readonly _supervisor;
-    private readonly _tierFilter?;
-    private readonly _subscriptions;
-    private readonly _blockedEvents;
-    private _registered;
-    constructor(opts: EventHandlerOptions);
+interface WorkspaceFileBinding {
+    workspaceId: string;
+    path: string;
+    assetId: string;
+    contentHash: string;
+    version: number;
+    syncedAt: number | null;
+    dirty: boolean;
+}
+interface WorkspaceMirrorOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    workspaceId: string;
     /**
-     * Start subscribing to PARA events.
-     * Must be called after daemon is fully initialized.
+     * Per-workspace state dir. Caller should pass ~/.prismer/<wid>/ so different
+     * paired workspaces don't race on the cursor file.
      */
-    start(): void;
+    workspaceStateDir: string;
+}
+/**
+ * Mirror reads cloud-side path→asset bindings into SQLite for fast local
+ * lookup. The cursor file is the only piece of state that must survive
+ * daemon restart; the SQLite mirror is rebuilt from scratch by the very
+ * first pullDelta() with no cursor.
+ */
+declare class WorkspaceMirror {
+    private readonly db;
+    private readonly cloud;
+    private readonly workspaceId;
+    private readonly cursorPath;
+    constructor(opts: WorkspaceMirrorOptions);
+    /** Persisted cursor for this workspace, or null on first run / corrupted file. */
+    readCursor(): string | null;
+    private writeCursor;
+    /**
+     * Pull workspace_file changes since the persisted cursor and upsert into
+     * the local mirror. Soft-deleted rows are removed from the mirror; active
+     * rows are upserted with synced_at = now and dirty = 0.
+     *
+     * Returns the count of items applied + the new cursor (may be unchanged
+     * when the cloud has nothing new). Idempotent — safe to retry.
+     */
+    pullDelta(opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        applied: number;
+        cursor: string | null;
+    }>;
+    /** Lookup the active binding for a workspace path. Returns undefined if not mirrored. */
+    lookupByPath(path: string): WorkspaceFileBinding | undefined;
+    /** Find an asset's contentHash via any path binding (asset may map to many paths). */
+    hashForAssetId(assetId: string): string | undefined;
+    /** All active bindings for this workspace — used by status / debug surfaces. */
+    list(): WorkspaceFileBinding[];
+    /** Wipe the mirror for this workspace (e.g., re-pair). Cursor file is left intact. */
+    clear(): void;
+}
+
+interface ParseClaim {
+    id: string;
+    workspaceId: string;
+    assetId: string;
+    ingestVersion: number;
+    claimantImUserId: string;
+    claimantDeviceId: string;
+    status: 'active' | 'completed' | 'abandoned';
+    claimedAt: string;
+    heartbeatAt: string;
+    completedAt: string | null;
+}
+type AcquireResult = {
+    kind: 'acquired';
+    claim: ParseClaim;
+} | {
+    kind: 'refreshed';
+    claim: ParseClaim;
+} | {
+    kind: 'claimed_active';
+    current: ParseClaim;
+} | {
+    kind: 'already_complete';
+    current: ParseClaim;
+};
+type ClaimLostReason = 'claim_taken_over' | 'claim_inactive';
+interface ParseClaimControllerOptions {
+    cloud: CloudClient;
+    /** Daemon's persisted device id. Same value across heartbeats / completions. */
+    deviceId: string;
+    /** Heartbeat interval (ms). Default 10s — well below the 30s server TTL. */
+    heartbeatIntervalMs?: number;
+}
+interface HeartbeatHandle {
+    stop: () => void;
     /**
-     * Stop all event subscriptions.
+     * Symbol.dispose so consumers can write `using hb = ctrl.startHeartbeat(...)`
+     * once they're on TypeScript 5.2 + Node 22 explicit-resource-management.
+     * Without that runtime support the field is harmless dead weight; the
+     * explicit `stop()` is the universal contract.
      */
-    stop(): void;
+    [Symbol.dispose]: () => void;
+}
+/**
+ * Coordinates a single daemon's asset-parse claims. Owns no global state —
+ * callers may run multiple controllers if they share the same device id.
+ */
+declare class ParseClaimController {
+    private readonly cloud;
+    private readonly deviceId;
+    private readonly heartbeatIntervalMs;
+    constructor(opts: ParseClaimControllerOptions);
     /**
-     * Subscribe to a specific PARA event type with optional tier filter.
+     * Acquire (or refresh) a claim. The return value is a 4-variant tagged
+     * union — callers must branch on `kind`. Throws on transport / 5xx / 4xx
+     * codes that aren't part of the documented contract (e.g. `claim_race`
+     * is mapped to a thrown Error so the worker can retry).
      */
-    private _subscribe;
+    acquire(input: {
+        assetId: string;
+        ingestVersion: number;
+    }): Promise<AcquireResult>;
     /**
-     * Unsubscribe from a specific event type.
+     * Refresh the heartbeat for an active claim. Throws `ClaimLostError` on
+     * HTTP 410 with code `claim_taken_over` or `claim_inactive` — caller
+     * should abort the parse work. Throws plain `Error` on any other failure.
      */
-    unsubscribe(eventType: string, handler?: SubscriptionHandler<ParaEvent>): void;
+    sendHeartbeat(claimId: string): Promise<ParseClaim>;
     /**
-     * Handle agent registration event
+     * Mark a claim complete. Throws `ClaimLostError` on 410 (claim was
+     * stolen before the worker finished — output should be discarded).
      */
-    private _handleAgentRegister;
+    complete(claimId: string): Promise<ParseClaim>;
     /**
-     * Handle session started event
+     * Start a heartbeat loop in the background. Returns a handle with `stop()`
+     * and a Symbol.dispose alias for the `using` pattern.
+     *
+     * On 410 (claim taken over or marked inactive) the loop stops itself and
+     * invokes `opts.onLost` so the parse worker can abort. Other transient
+     * errors (network blip, 5xx) are logged to stderr and the loop retries on
+     * the next tick — the server-side TTL (default 30s) will only drop us if
+     * the partition outlasts the TTL.
      */
-    private _handleSessionStarted;
+    startHeartbeat(claimId: string, opts?: {
+        onLost?: (reason: ClaimLostReason) => void;
+    }): HeartbeatHandle;
+}
+
+type PrismerUriType = 'asset' | 'file';
+interface ParsedPrismerUri {
+    /** Original full URI string. */
+    raw: string;
+    /**
+     * Owner segment for legacy `prismer://<owner>/...` form (informational,
+     * not ACL-checked). For `prismer://workspace/<wid>/...` this is the
+     * literal string 'workspace' — prefer `workspaceId` instead.
+     */
+    owner: string;
+    type: PrismerUriType;
+    /** For type='asset': the sha256 hash. For legacy file URIs: '<wsId>/<path>'. */
+    rest: string;
+    /** Convenience parses for type='file' and for workspace-form 'asset'. */
+    workspaceId?: string;
+    filePath?: string;
+}
+/**
+ * Find every recognized `prismer://...` reference in a string.
+ * Only `asset` and `file` types are recognized — other types (memory,
+ * context, conversation, evolution, task, pair) pass through untouched.
+ */
+declare function parseUris(text: string): ParsedPrismerUri[];
+interface UriResolverOptions {
+    db: LocalDb;
+    cloud: CloudClient;
+    assetCache: AssetCache;
+}
+declare class UriResolver {
+    private readonly db;
+    private readonly cloud;
+    private readonly assetCache;
+    constructor(opts: UriResolverOptions);
+    /**
+     * Resolve a single URI to a local file path. Throws on auth/4xx;
+     * caller decides whether to leave the URI in place (best-effort) or fail.
+     */
+    resolveOne(uri: ParsedPrismerUri, opts?: {
+        signal?: AbortSignal;
+    }): Promise<string>;
+    /**
+     * Walk a string, replace every `prismer://(asset|file)/...` with `file://<localPath>`.
+     * Unrecognized URIs pass through. Returns rewritten text + the list of pinned hashes.
+     */
+    rewrite(text: string, opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+    }): Promise<{
+        text: string;
+        resolvedHashes: string[];
+    }>;
+    /** Bulk-rewrite an array of strings (e.g. context entries' content). */
+    rewriteAll(texts: string[], opts?: {
+        pin?: boolean;
+        signal?: AbortSignal;
+    }): Promise<{
+        texts: string[];
+        resolvedHashes: string[];
+    }>;
+    private lookupFile;
+}
+
+type IMAgentStatus = 'online' | 'busy' | 'idle' | 'offline';
+interface HostedAgentDeclaration {
+    imUserId: string;
+    name: string;
+    adapterName: string;
+    capabilities: string[];
+    profiles: Array<{
+        id: string;
+        version: number;
+    }>;
+}
+interface AgentHostDeclarePayload {
+    daemonId: string;
+    daemonVersion: string;
+    platform: 'darwin' | 'linux' | 'win32';
+    agents: HostedAgentDeclaration[];
+}
+interface HostAckedPayload {
+    workspaceId: string;
+    syncCursor: {
+        workspaces: number;
+        agent_profiles: number;
+        [key: string]: number;
+    };
+    profilesToSync: string[];
+}
+interface AgentStatusChangedPayload {
+    agentImUserId: string;
+    status: IMAgentStatus;
+    activeProfileId?: string;
+    runningTaskIds?: string[];
+}
+interface TaskDispatchContextEntry {
+    sender: string;
+    senderRole: 'human' | 'agent' | 'admin' | 'system';
+    content: string;
+    createdAt: string;
+    /** Wave-8 W1: assets the human attached to THIS chat message. */
+    attachedAssetIds?: string[];
+}
+/** Wave-8 W1: hydrated asset reference attached to a dispatch. */
+interface AssetRef {
+    assetId: string;
+    contentHash: string;
+    mime: string | null;
+    sizeBytes: number | null;
+    kind: string;
+    workspaceId: string;
+    role: 'attachment' | 'context';
+}
+interface TaskDispatchRequestPayload {
+    taskId: string;
+    /** Agent target for runtimeRoute='agent'. Shell dispatches do not use this. */
+    agentImUserId?: string;
+    /** Runtime/device target for runtimeRoute='shell'. */
+    targetDaemonId?: string;
+    profileId: string;
+    capability: string;
+    prompt: string;
+    /** Execution surface. `shell` is daemon-local command execution. */
+    runtimeRoute?: 'agent' | 'sandbox' | 'shell';
+    metadata?: Record<string, unknown>;
+    timeoutMs?: number;
+    context?: TaskDispatchContextEntry[];
+    conversationId?: string;
+    /**
+     * Channel mode for the originating conversation. Optional and
+     * forward-compatible: when missing, daemon renders 'unknown' in the
+     * [Channel context] prompt block. See appendChannelContext in
+     * daemon/dispatch.ts.
+     *   - `direct`: 1:1 DM (no @-mention needed in reply).
+     *   - `group`: multi-party room (end reply with `@<recipient>` to
+     *     continue the chain).
+     */
+    conversationType?: 'direct' | 'group';
+    /**
+     * Active participants of the dispatch's conversation. Daemon injects this
+     * into [Channel context] so the agent knows the authoritative recipient list
+     * without hallucinating or having to call `prismer.conversation.listAgents`. Capped at 50
+     * entries server-side.
+     */
+    participants?: Array<{
+        imUserId: string;
+        username: string;
+        displayName: string;
+        role: string;
+        agentType?: string | null;
+    }>;
+    /** Wave-8 W1: assets cloud wants daemon to fold into agent context. */
+    assetRefs?: AssetRef[];
+}
+interface TaskDispatchProgressPayload {
+    taskId: string;
+    progress: number;
+    message?: string;
+    detail?: Record<string, unknown>;
+}
+/** Wave-8 W1: how the daemon handled a single AssetRef. */
+type AssetDispatchStrategy = 'inline-text' | 'inline-text-truncated' | 'uri-only' | 'error';
+interface AssetDispatchObservation {
+    assetId: string;
+    contentHash: string;
+    mime: string | null;
+    sizeBytes: number | null;
+    strategy: AssetDispatchStrategy;
+    inlinedBytes?: number;
+    error?: string;
+}
+interface TaskDispatchReplyPayload {
+    taskId: string;
+    ok: boolean;
+    output?: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+    assetIds?: string[];
+    metrics?: {
+        tokensUsed?: number;
+        durationMs?: number;
+    };
+    /** Wave-8 W1: per-asset handling report. */
+    assetObservability?: AssetDispatchObservation[];
+}
+interface TaskCancelPayload {
+    taskId: string;
+    reason?: string;
+}
+interface IMWSMessage<T = unknown> {
+    type: string;
+    payload: T;
+    requestId?: string;
+    timestamp: number;
+}
+interface WorkspaceChangedPayload {
+    workspaceId: string;
+    /** ISO-8601 timestamp from im_workspaces.updatedAt. */
+    updatedAt: string;
+}
+interface AgentProfileChangedPayload {
+    profileId: string;
+    version: number;
+}
+interface AgentChangedPayload {
+    agentImUserId: string;
+    fields: {
+        displayName?: string;
+        capabilities?: string[];
+    };
+}
+interface WorkspaceFileChangedPayload {
+    workspaceId: string;
+    path: string;
+    operation: 'create' | 'update' | 'delete';
+    assetId?: string;
+    contentHash?: string;
+    version: number;
+}
+
+interface OutboxWatcherOptions {
+    /**
+     * Default directory to watch when no setActiveTask has narrowed it.
+     * Container mode: `/workspace/_outbox`. Host mode: omit (no default
+     * scan — only watch when an active task points at a specific dir).
+     */
+    outboxDir?: string;
+    /** Cloud client (already configured with apiKey + baseUrl). */
+    cloud: CloudClient;
+    /**
+     * Container identifier — required by the cloud's kind=sandbox-output
+     * contract as metadata.containerId. Read from env PRISMER_CONTAINER_ID
+     * when controller injected one; otherwise the daemon_id as fallback so
+     * the request still passes validation. Host-mode (kind=agent-output)
+     * uploads bypass containerId validation.
+     */
+    containerId: string;
+    /**
+     * Resolver for the owning workspace at upload time. Returns null when no
+     * workspace context is yet known — the watcher will skip the file and
+     * retry on the next scan tick.
+     */
+    workspaceId: () => string | null;
+    /** Poll interval in ms. Default 2000. */
+    pollIntervalMs?: number;
+    /** Optional log sink (default writes to stdout/stderr). */
+    log?: {
+        info: (msg: string) => void;
+        warn: (msg: string) => void;
+    };
+}
+interface ActiveTask {
+    taskId: string;
+    /** Adapter name; surfaces in upload metadata for observability. */
+    adapter?: string;
     /**
-     * Handle session ended event
+     * Per-task outbox directory. When set, scans this directory in
+     * addition to `opts.outboxDir`. Files uploaded from here are tagged
+     * with `kind=agent-output` (host-mode contract).
      */
-    private _handleSessionEnded;
+    outboxDir?: string;
+}
+declare class OutboxWatcher {
+    private opts;
+    private timer?;
+    private uploaded;
     /**
-     * Handle agent state change
+     * Host-mode tasks keyed by taskId. Each entry has its own `outboxDir`
+     * and the watcher scans every entry's directory each tick. Concurrent
+     * dispatches (Wave-9: orchestrator + spawned worker on the same daemon)
+     * each occupy their own slot — finishing one dispatch only removes its
+     * slot, leaving every other concurrent dispatch's tracking intact.
+     *
+     * Replaces the v1 single `activeTask` slot which was last-wins and
+     * caused cross-dispatch clobbering: an orchestrator finishing first
+     * would `setActiveTask(null)` and silently discard the concurrent
+     * worker's outbox tracking.
      */
-    private _handleAgentState;
+    private activeTasks;
     /**
-     * Handle skill activation
+     * Legacy container/sandbox task. Used only when an `ActiveTask` is set
+     * **without** an `outboxDir` (i.e. the legacy `setActiveTask` shape
+     * where the watcher's default `opts.outboxDir` is the scan target).
+     * Single slot because the legacy container deployment only ever runs
+     * one task at a time per container.
      */
-    private _handleSkillActivated;
+    private legacyContainerTask;
+    private busy;
     /**
-     * Handle skill deactivation
+     * Per-task accumulated assetIds. Populated on each successful upload
+     * keyed by the task whose outbox dir the file came from.
+     * `flushPending(taskId)` drains and returns this list so dispatch.ts
+     * can stamp it onto task.dispatch.reply.assetIds.
      */
-    private _handleSkillDeactivated;
+    private pendingByTask;
+    constructor(opts: OutboxWatcherOptions);
     /**
-     * Handle approval request
+     * Register a host-mode task envelope. Each call adds (or replaces) an
+     * entry keyed by `task.taskId` so concurrent dispatches do not clobber
+     * each other.
+     *
+     * Requires `task.outboxDir` to be set — the per-task workdir is the
+     * isolation boundary. For the legacy container/sandbox single-slot
+     * shape (no per-task dir), use `setActiveTask` instead.
      */
-    private _handleApprovalRequest;
+    addActiveTask(task: ActiveTask): void;
     /**
-     * Handle approval result
+     * Remove a host-mode task entry by id. No-op if the id was not
+     * registered. Idempotent — dispatch.ts calls this in `finally{}` after
+     * `flushPending` so a failed dispatch still clears its slot.
      */
-    private _handleApprovalResult;
+    removeActiveTask(taskId: string): void;
     /**
-     * Handle task creation
+     * Legacy single-slot API.
+     *
+     *   - Non-null with `outboxDir` → forwards to `addActiveTask` (host
+     *     mode). The caller is still responsible for `removeActiveTask`
+     *     (or another `setActiveTask(null)`) at teardown.
+     *   - Non-null **without** `outboxDir` → store in the legacy container
+     *     slot. Uploads from `opts.outboxDir` are tagged with this task.
+     *   - `null` → clear the legacy container slot only. Does NOT touch
+     *     the host-mode `activeTasks` map; concurrent host-mode dispatches
+     *     keep their own slots until they call `removeActiveTask`
+     *     themselves.
+     *
+     * The null-clears-only-legacy semantic is the core fix for the
+     * Wave-9 concurrency race: previously a finishing orchestrator's
+     * `setActiveTask(null)` would clobber a still-running worker's
+     * tracking, dropping its uploads on the floor.
      */
-    private _handleTaskCreated;
+    setActiveTask(task: ActiveTask | null): void;
     /**
-     * Handle task completion
+     * Drain and return the assetIds collected for `taskId` since the last
+     * flush. Idempotent — calling twice with the same id returns `[]` the
+     * second time. dispatch.ts calls this once at reply-build time.
      */
-    private _handleTaskCompleted;
+    flushPending(taskId: string): string[];
+    start(): void;
+    stop(): void;
     /**
-     * Handle LLM pre-request
+     * Force a synchronous scan — useful for tests + e2e harnesses that want to
+     * trigger upload after writing a file rather than wait for the next tick.
+     * Also used by dispatch.ts at reply-build time to drain any pending files
+     * before flushPending() is called.
      */
-    private _handleLlmPre;
+    scanNow(): Promise<void>;
+    private log;
     /**
-     * Handle LLM post-request
+     * Build the list of directories to scan this tick — one entry per
+     * concurrently-active task plus the legacy container slot (if any).
+     * Each entry carries its own `task` envelope so uploads can be tagged
+     * and accumulated per-task without sharing global mutable state.
+     *
+     * Dedup so a directory configured in both spots only scans once
+     * (legacy single-task case where opts.outboxDir == legacyTask.outboxDir
+     * is unlikely but cheap to handle).
      */
-    private _handleLlmPost;
-}
-
-/** Authenticated identity returned by the authenticate callback. */
-interface AuthenticatedIdentity {
-    agentId: string;
-    bearerSub?: string;
-}
-interface DaemonHttpOptions {
-    host?: string;
-    port?: number;
-    eventBus: EventBus;
-    supervisor: AgentSupervisor;
-    fsContextProvider?: (req: {
-        agentId: string;
-        workspace?: string;
-    }) => FsContext | undefined;
-    pairingManager?: PairingManager;
-    eventHandler?: EventHandler;
-    /** When provided, every non-health request must carry a valid Bearer token (null = 401).
-     *  When absent, localhost trust mode: body agentId is used as-is. */
-    authenticate?: (bearerToken: string | undefined) => AuthenticatedIdentity | null;
-}
-/** Generic extension-point route handler registered via registerRoute() (Q3). */
-type RouteHandler = (req: http.IncomingMessage, res: http.ServerResponse, ctx: {
-    authed: AuthenticatedIdentity | null;
-    body: Buffer;
-}) => Promise<void> | void;
-declare class DaemonHttpServer {
-    private readonly _host;
-    private readonly _port;
-    private readonly _bus;
-    private readonly _supervisor;
-    private readonly _fsCtxProvider?;
-    private readonly _authenticate?;
-    private readonly _pairingManager;
-    private readonly _eventHandler?;
-    private _server;
-    private _url;
-    private _running;
-    private readonly _sseClients;
-    private readonly _inFlight;
-    private readonly _startedAt;
-    private readonly _customRoutes;
-    constructor(opts: DaemonHttpOptions);
-    get url(): string | undefined;
-    get isRunning(): boolean;
-    /** Register a custom route handler. Built-in routes take precedence. */
-    registerRoute(method: 'GET' | 'POST' | 'PATCH' | 'DELETE', path: string, handler: RouteHandler): void;
-    /** Remove a previously registered custom route. */
-    unregisterRoute(method: string, path: string): void;
-    private _findCustomRoute;
-    start(): Promise<{
-        host: string;
-        port: number;
-    }>;
-    stop(timeoutMs?: number): Promise<void>;
-    private _handleRequest;
-    private _handleHealth;
-    private _handlePairOffer;
-    private _handlePairStatus;
-    private _handlePairConfirm;
-    private _handleTransportStatus;
-    /** Read-only snapshot of transport state, used by /gui/status. Returns
-     *  null when the multi-path transport isn't enabled. */
-    private _snapshotTransportStatus;
-    private _handleLanProbe;
-    private _handleTransportReprobe;
-}
-
-interface LLMMessage {
-    role: 'system' | 'user' | 'assistant';
-    content: string;
-}
-interface LLMRequest {
-    messages: LLMMessage[];
-    maxTokens?: number;
-    temperature?: number;
-    maxCostUsd?: number;
-    maxLatencyMs?: number;
-    capabilities?: string[];
-}
-interface LLMResponse {
-    content: string;
-    usage: {
-        promptTokens: number;
-        completionTokens: number;
-        totalTokens: number;
-    };
-    provider: string;
-    model: string;
-    latencyMs: number;
-    costUsd?: number;
-}
-interface LLMProvider {
-    name: string;
-    model: string;
-    priority: number;
-    capabilities?: string[];
-    pricing?: {
-        inputPer1kUsd: number;
-        outputPer1kUsd: number;
-    };
-    invoke: (req: LLMRequest, signal: AbortSignal) => Promise<Omit<LLMResponse, 'provider' | 'model' | 'latencyMs'>>;
-    healthCheck?: () => Promise<boolean>;
-}
-interface RoutingPolicy {
-    strategy: 'priority' | 'cheapest' | 'fastest' | 'round-robin';
-    retryOnFailure?: boolean;
-    maxRetries?: number;
-    healthCheckIntervalMs?: number;
-    timeoutMs?: number;
-}
-interface ProviderStats {
-    invocations: number;
-    successes: number;
-    failures: number;
-    p50Ms: number;
-    p95Ms: number;
-    avgCostUsd: number;
-}
-declare class AllProvidersFailedError extends Error {
-    attempts: Array<{
-        provider: string;
-        error: string;
-    }>;
-    constructor(attempts: AllProvidersFailedError['attempts']);
-}
-declare class LLMDispatcher {
-    private readonly providers;
-    private policy;
-    private readonly state;
-    private rrCounter;
-    private healthTimer;
-    constructor(providers: LLMProvider[], policy?: RoutingPolicy);
-    complete(req: LLMRequest): Promise<LLMResponse>;
-    get stats(): Record<string, ProviderStats>;
-    setPolicy(policy: RoutingPolicy): void;
-    markProviderDown(name: string): void;
-    markProviderUp(name: string): void;
-    stopHealthChecks(): void;
-    private startHealthChecks;
-    private runHealthChecks;
-    _runHealthChecksNow(): Promise<void>;
-    private isDown;
-    private estimateCostUsd;
-    private selectProviders;
+    private currentScanDirs;
+    private tick;
+    private scanDir;
+    private upload;
 }
 
+interface DispatchDeps {
+    registry: AdapterRegistry;
+    cloud: CloudClient;
+    uriResolver: UriResolver;
+    assetCache: AssetCache;
+    ws: WsClient;
+    /** Cap on total chars of joined context history. Default 8000. */
+    contextMaxChars?: number;
+    /** Resolves a long-running adapter's service handle (cached across calls). */
+    ensureService: (profile: AgentProfile, adapter: AdapterDef) => Promise<AdapterService>;
+    /** Aborts the in-flight adapter dispatch when cloud sends task.cancel. */
+    signal?: AbortSignal;
+    /** Hook for tests / observability. */
+    onProgress?: (taskId: string, p: TaskDispatchProgressPayload) => void;
+    /**
+     * Outbox uploader. When provided, dispatch creates a per-task outbox
+     * directory under `paths.runsDir`, points the watcher at it via
+     * setActiveTask, and drains its assetIds into reply.assetIds at flush
+     * time. Optional so tests can omit it.
+     */
+    outboxWatcher?: OutboxWatcher;
+    /** Daemon paths — used to derive the per-task outbox dir. */
+    paths?: ConfigPaths;
+}
+declare function handleDispatch(payload: TaskDispatchRequestPayload, requestId: string | undefined, deps: DispatchDeps): Promise<TaskDispatchReplyPayload>;
 /**
- * Prismer Runtime — Evolution Gateway HTTP API
- *
- * Exposes evolution gateway operations via HTTP for daemon process.
- * Integrates with LLM Dispatcher for distillation triggers.
+ * Concatenate context entries + current prompt. Trims oldest entries first when
+ * total chars exceed `maxChars` (matches Track C's `trimContextWindow` behavior).
  *
- * Endpoints:
- * - POST /evolution/signal — Extract signals from tool output / log
- * - POST /evolution/record — Record gene execution outcome
- * - POST /evolution/analyze — Analyze signals and recommend gene
- * - POST /evolution/genes — Create new gene
- * - GET /evolution/genes — Query available genes
- * - GET /evolution/personality — Get agent personality
- * - POST /evolution/distill — Trigger distillation
- *
- * @see docs/version190/IMPLEMENTATION-PLAN-RUNTIME-GAP.md
+ * `assetBlocks` (Wave-8 W1) is prepended above the conversation history. They
+ * are *not* counted against `maxChars` — assets are content the user
+ * explicitly attached, so dropping them silently when the chat history
+ * happens to be long would defeat the whole point of the attachment.
  */
+declare function composePrompt(currentPrompt: string, context: TaskDispatchContextEntry[], maxChars: number, assetBlocks?: string[]): string;
 
-interface EvolutionGatewayOptions {
-    eventBus: EventBus;
-    supervisor: AgentSupervisor;
-    llmDispatcher?: LLMDispatcher;
-    /** Cloud API base URL (default: https://prismer.cloud) */
-    cloudApiBase?: string;
-    /** Authenticated identity (from Bearer token or API key) */
-    authenticate?: (bearerToken: string | undefined) => AuthenticatedIdentity | null;
+declare class ServicePool {
+    private readonly services;
     /**
-     * v1.9.0 B.7.a — API key used as the Bearer token when forwarding daemon
-     * requests to the cloud Evolution API. When undefined, outbound requests
-     * omit the Authorization header (callers get 401 from cloud until the
-     * daemon is started with `apiKey`).
+     * Returns a service handle for the profile, lazily calling `adapter.ensureService`
+     * on first use or after a crash. Re-checks `healthy()` before returning a cached entry.
      */
-    cloudApiKey?: string;
-}
-interface SignalExtractionRequest {
-    toolOutput?: {
-        toolName?: string;
-        output?: string;
-        exitCode?: number;
-        error?: string;
-        durationMs?: number;
-    };
-    logFile?: {
-        logPath?: string;
-        logContent?: string;
-        timestamp?: string;
-    };
-    provider?: string;
-    stage?: string;
-    severity?: string;
-    tags?: string[];
-}
-interface AnalyzeRequest {
-    signals: string[];
-    taskCapability?: string;
-    provider?: string;
-    stage?: string;
-    severity?: string;
-}
-interface RecordRequest {
-    geneId: string;
-    signals: string[];
-    outcome: 'success' | 'failed';
-    score?: number;
-    summary?: string;
-    costCredits?: number;
-    transitionReason?: 'gene_applied' | 'fallback_relaxed' | 'fallback_neighbor' | 'baseline';
-}
-interface CreateGeneRequest {
-    category: 'repair' | 'optimize' | 'innovate' | 'diagnostic';
-    signalsMatch: string[];
-    strategy: string[];
-    preconditions?: string[];
-    constraints?: {
-        maxCredits?: number;
-        maxRetries?: number;
-        maxExecutionTime?: number;
-    };
+    ensureService(profile: AgentProfile, adapter: AdapterDef): Promise<AdapterService>;
+    /** Drop a service handle (e.g. on profile delete or daemon shutdown). */
+    drop(profileId: string): Promise<void>;
+    /** Drop all handles, e.g. on graceful shutdown. */
+    shutdown(): Promise<void>;
+    size(): number;
 }
-interface DistillationRequest {
-    /** Skip LLM verification and trigger immediately */
-    dryRun?: boolean;
-}
-declare class EvolutionGatewayHttpHandler {
-    private readonly eventBus;
-    private readonly supervisor;
-    private readonly llmDispatcher;
-    private readonly cloudApiBase;
-    private readonly authenticate;
-    private readonly cloudApiKey;
-    private readonly routes;
-    constructor(opts: EvolutionGatewayOptions);
-    private cloudAuthHeaders;
-    private registerRoutes;
-    /** Get all registered routes */
-    getRoutes(): Map<string, RouteHandler>;
-    /** Get a specific route handler */
-    getRoute(method: string, path: string): RouteHandler | undefined;
-    /**
-     * POST /evolution/signal
-     * Extract signals from tool output or log file.
-     */
-    private handleExtractSignal;
-    /**
-     * POST /evolution/analyze
-     * Analyze signals and recommend the best gene.
-     */
-    private handleAnalyze;
-    /**
-     * POST /evolution/record
-     * Record gene execution outcome.
-     */
-    private handleRecord;
+
+interface LocalServerOptions {
+    port: number;
+    /** Snapshot getter — runner provides current state on demand. */
+    getState: () => LocalServerState;
     /**
-     * POST /evolution/genes
-     * Create a new gene.
+     * Optional dispatch sink called when POST /v1/runs receives a task envelope
+     * from the sandbox controller. Phase 1 contract: the sink is fire-and-forget;
+     * daemon acks immediately with `{ runId, status: 'accepted' }`. Cloud-side
+     * task lifecycle (status → done/failed) is closed asynchronously by the
+     * daemon's WS upstream channel in S4 follow-up. The runner provides this
+     * sink; tests may pass a stub.
      */
-    private handleCreateGene;
+    onDispatch?: (payload: DispatchPayload, runId: string) => void;
     /**
-     * GET /evolution/genes
-     * Query available genes.
+     * Install or update one hosted agent/profile in the daemon's local mirror.
+     * The runner persists it, reloads hostedAgents, and redeclares to cloud.
      */
-    private handleQueryGenes;
+    onInstallAgent?: (payload: InstallAgentPayload) => Promise<InstallAgentResult>;
     /**
-     * GET /evolution/personality
-     * Get agent personality.
+     * Filesystem root for snapshot manifests. Default `/workspace`. POST
+     * /v1/snapshot walks this tree, computes per-file sha256 + size + mtime,
+     * and returns the manifest. Cloud-side persistence (POST
+     * /api/sandboxes/:id/snapshot/manifest) is a separate step in Phase 1.
      */
-    private handleGetPersonality;
+    snapshotRoot?: string;
     /**
-     * POST /evolution/distill
-     * Trigger gene distillation.
+     * Optional first-pass handler for `/local/memory/*` routes. Returns true
+     * if the request was handled (response written); false to let the normal
+     * route table fall through. Wired by the daemon runner from
+     * `attachMemoryRpc()` in `daemon/memory/rpc.ts` when memory is enabled.
+     * When set, /healthz reports `memoryReady: true`.
      */
-    private handleDistill;
+    attachMemory?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
     /**
-     * GET /evolution/unmatched
-     * Get unmatched signals (evolution frontier).
+     * Optional handler for `POST /local/asset/write` — agent-gen adapter
+     * (daemon/asset/origin/agent-gen.ts). Synchronous: agent posts bytes,
+     * daemon uploads to cloud, returns prismer:// URI in one round-trip.
+     * Sink receives the parsed JSON body and returns a structured result.
      */
-    private handleGetUnmatched;
-    private parseCloudResponse;
-    private callCloudAnalyze;
-    private callCloudRecord;
-    private callCloudCreateGene;
-    private callCloudQueryGenes;
-    private callCloudGetPersonality;
-    private callCloudDistill;
-    private callCloudGetUnmatched;
-    private triggerLocalDistillation;
-    private extractSignalsLocal;
+    onAssetWrite?: (body: unknown) => Promise<AssetWriteHandlerResult>;
+}
+interface AssetWriteHandlerResult {
+    status: 200 | 400 | 502;
+    body: unknown;
 }
-
 /**
- * Prismer Runtime — Task Router
+ * Dispatch envelope received from the sandbox controller proxy. The schema
+ * mirrors `DaemonDispatchSchema` in `infra/sandbox-controller/src/api/v1/
+ * containers.ts` — kept permissive so the controller can pass through any
+ * future fields without a daemon-side bump.
  *
- * v1.9.0 Task Router: HTTP API for routing tasks to agents,
- * capability matching, and SSE streaming of task state changes.
- *
- * Integrates with:
- * - Cloud API (/api/im/tasks) for persistent task store
- * - AgentSupervisor for local agent status
- * - EventBus for SSE streaming
- *
- * Design reference: docs/version190/IMPLEMENTATION-PLAN-RUNTIME-GAP.md §P1
- */
-
-/**
- * Task routing state machine per §16.4.
- *
- * State transitions:
- *   created → dispatching → step_running → step_completed → (next step or completed)
- *   step_running → step_failed → retrying (×3) → retry_exhausted → needs_human
- *   step_running → step_timeout → rerouting → step_running (new agent)
+ * Phase 1 escape hatch: when `shellCommand` is present, the daemon spawns
+ * it via `bash -c` with cwd=/workspace as a fire-and-forget subprocess.
+ * This bridges the gap until S4 wires the WS-mediated adapter dispatch +
+ * completion path. Production traffic does NOT set shellCommand — task
+ * service forwards it only when present in IMTask.metadata.shellCommand
+ * (a test escape hatch).
  */
-declare enum TaskRouteState {
-    Created = "created",
-    Dispatching = "dispatching",
-    StepRunning = "step_running",
-    StepCompleted = "step_completed",
-    StepFailed = "step_failed",
-    StepTimeout = "step_timeout",
-    Retrying = "retrying",
-    RetryExhausted = "retry_exhausted",
-    NeedsHuman = "needs_human",
-    Rerouting = "rerouting",
-    Completed = "completed",
-    Cancelled = "cancelled"
-}
-interface TaskRouterOptions {
-    eventBus: EventBus;
-    supervisor: AgentSupervisor;
-    cloudBaseUrl?: string;
-    apiToken?: string;
-}
-interface TaskInfo {
-    id: string;
-    title: string;
-    status: TaskRouteState | string;
-    requiresCapability?: string | null;
-    runtimeRoute?: unknown[] | null;
-    assigneeId?: string | null;
-    progress?: number | null;
-    statusMessage?: string | null;
-    createdAt: string;
-    updatedAt: string;
-}
-interface RouteTaskRequest {
-    taskId?: string;
-    priority?: 'high' | 'normal' | 'low';
-    preferredAgentId?: string;
-}
-interface RouteTaskResponse {
+interface DispatchPayload {
     taskId: string;
-    agentId: string;
-    capability: string;
-    stepIdx: number;
-    totalSteps: number;
-}
-interface AssignTaskRequest {
-    agentId: string;
-    taskId?: string;
-}
-interface StepCompletedRequest {
-    taskId?: string;
-    stepId: string;
-    result?: Record<string, unknown>;
-    metadata?: Record<string, unknown>;
-}
-interface CancelTaskRequest {
-    taskId?: string;
-    reason: string;
-}
-interface StepFailedRequest {
-    taskId?: string;
-    stepId: string;
-    error?: string;
-    metadata?: Record<string, unknown>;
-}
-interface StepTimeoutRequest {
-    taskId?: string;
-    stepId: string;
-    capability?: string;
-    metadata?: Record<string, unknown>;
-}
-declare class TaskRouter {
-    private readonly _bus;
-    private readonly _supervisor;
-    private readonly _cloudBaseUrl;
-    private readonly _apiToken;
-    private _sseClients;
-    /** Per-step retry counters: key = `${taskId}:${stepId}` */
-    private readonly _retryCounters;
-    constructor(opts: TaskRouterOptions);
-    /**
-     * Register HTTP routes with the daemon server.
-     * Call this from daemon-http.ts to expose task router endpoints.
-     */
-    registerRoutes(server: {
-        registerRoute: (method: 'GET' | 'POST' | 'PATCH' | 'DELETE', path: string, handler: RouteHandler) => void;
-    }): void;
-    private _handleRouteTask;
-    private _handleAssignTask;
-    private _handleStepCompleted;
-    private _handleCancelTask;
-    private _handleStepFailed;
-    private _handleStepTimeout;
-    private _handleGetTask;
-    private _handleListTasks;
-    /** Publish a task.state event with the given TaskRouteState and optional extra fields. */
-    private _publishState;
-    private _callCloudApi;
-}
-
-type KeychainBackend = 'macos-keychain' | 'libsecret' | 'pass' | 'encrypted-file';
-interface KeychainAdapter {
-    name: KeychainBackend;
-    available(): Promise<boolean>;
-    get(service: string, account: string): Promise<string | null>;
-    set(service: string, account: string, value: string): Promise<void>;
-    delete(service: string, account: string): Promise<void>;
-    list(service: string): Promise<string[]>;
-}
-interface KeychainOptions {
-    preferredBackend?: KeychainBackend;
-    masterPassphrase?: string;
-    encryptedFilePath?: string;
-}
-declare class NoKeychainBackendError extends Error {
-    constructor();
-}
-declare class KeychainOperationError extends Error {
-    constructor(op: string, cause: unknown);
-}
-declare class Keychain {
-    private readonly opts;
-    private resolvedBackend;
-    private detecting;
-    constructor(opts?: KeychainOptions);
-    backend(): Promise<KeychainAdapter>;
-    private buildCandidateList;
-    private makeAdapter;
-    get(service: string, account: string): Promise<string | null>;
-    set(service: string, account: string, value: string): Promise<void>;
-    delete(service: string, account: string): Promise<void>;
-    list(service: string): Promise<string[]>;
-}
-
-interface PrismerConfig {
-    apiKey?: string;
-    apiBase?: string;
-    daemon?: {
-        host?: string;
-        port?: number;
+    adapter?: string;
+    prompt?: string;
+    env?: Record<string, string>;
+    shellCommand?: string;
+    [k: string]: unknown;
+}
+interface InstallAgentPayload {
+    workspaceId: string;
+    imUserId: string;
+    name: string;
+    adapterName: string;
+    capabilities: string[];
+    profile: {
+        id: string;
+        name: string;
+        adapterName: string;
+        config: Record<string, unknown>;
+        version: number;
     };
-    agents?: Record<string, {
-        enabled?: boolean;
-        apiKey?: string;
-        [key: string]: unknown;
-    }>;
-    [key: string]: unknown;
-}
-interface LoadConfigOptions {
-    path?: string;
-    keychain?: Keychain;
-    resolvePlaceholders?: boolean;
-}
-declare class ConfigError extends Error {
-    constructor(message: string);
-}
-declare function parseKeyringPlaceholder(value: string): {
-    service: string;
-    account: string;
-} | null;
-declare function loadConfig(opts?: LoadConfigOptions): Promise<PrismerConfig>;
-declare function writeConfig(config: PrismerConfig, opts?: {
-    path?: string;
-}): Promise<void>;
-
-interface MigrateStep {
-    level: 'info' | 'ok' | 'warn' | 'error';
-    message: string;
-    detail?: string;
-}
-interface MigrateSecretsOptions {
-    configPath?: string;
-    keychain: Keychain;
-    dryRun?: boolean;
-    onStep?: (step: MigrateStep) => void;
-}
-interface MigrateSecretsResult {
-    migrated: Array<{
-        path: string;
-        service: string;
-        account: string;
-    }>;
-    skipped: Array<{
-        path: string;
-        reason: string;
-    }>;
-    errors: Array<{
-        path: string;
-        error: string;
-    }>;
 }
-declare function migrateSecrets(opts: MigrateSecretsOptions): Promise<MigrateSecretsResult>;
-
-interface DaemonRunnerOptions {
-    host?: string;
-    port?: number;
-    pidFile?: string;
-    dataDir?: string;
-    installSignalHandlers?: boolean;
-    authBearer?: string;
-    apiKey?: string;
-    daemonId?: string;
-    userId?: string;
-    enableTransport?: boolean;
-    forceProbe?: boolean;
-    workspace?: string;
-    /**
-     * v1.9.0 B.7.a — cloud base URL (https://prismer.cloud for prod,
-     * https://cloud.prismer.dev for test). Forwarded to EvolutionGateway so
-     * daemon→cloud calls hit the same env the API key was issued against.
-     */
-    cloudApiBase?: string;
-}
-interface DaemonRunnerHandle {
-    stop(): Promise<void>;
-    readonly url: string;
-    readonly pid: number;
-    readonly dataDir: string;
-}
-declare function startDaemonRunner(opts?: DaemonRunnerOptions): Promise<DaemonRunnerHandle>;
-
-declare function assertBrandVoice(text: string, label?: string): void;
-
-type OutputMode = 'pretty' | 'json' | 'quiet';
-interface UIOptions {
-    mode?: OutputMode;
-    color?: boolean;
-    stream?: NodeJS.WritableStream;
-    errStream?: NodeJS.WritableStream;
-}
-interface TableRow {
-    [column: string]: string;
-}
-interface TableOptions {
-    columns: string[];
-    maxWidth?: number;
-}
-interface LegacyTableOptions {
-    columns: string[];
-    rows: TableRow[];
-    maxWidth?: number;
-}
-
-declare class UI {
-    readonly mode: OutputMode;
-    readonly colorEnabled: boolean;
-    private readonly stream;
-    private readonly errStream;
-    constructor(opts?: UIOptions);
-    private ansi;
-    private green;
-    private red;
-    private yellow;
-    private cyan;
-    private dim;
-    private bold;
-    private gray;
-    private brandMark;
-    private colorBrandLine;
-    write(text: string): void;
-    writeErr(text: string): void;
-    header(text: string): void;
-    smallHeader(subtitle?: string): void;
-    banner(subtitle?: string, opts?: {
-        full?: boolean;
-    }): void;
-    blank(): void;
-    line(text: string): void;
-    info(text: string): void;
-    secondary(text: string, indent?: number): void;
-    tip(text: string): void;
-    next(text: string): void;
-    ok(text: string, detail?: string): void;
-    success(text: string, detail?: string): void;
-    fail(text: string, detail?: string): void;
-    online(text: string): void;
-    offline(text: string): void;
-    notInstalled(text: string): void;
-    pending(text: string): void;
-    warn(text: string, detail?: string): void;
-    error(what: string, cause?: string, fix?: string): void;
-    table(rows: TableRow[], opts: TableOptions): void;
-    table(opts: LegacyTableOptions): void;
-    spinner(text: string): {
-        update(t: string): void;
-        stop(final?: string): void;
-    };
-    progress(text: string, total: number): {
-        update(current: number, detail?: string): void;
-        stop(final?: string): void;
+interface InstallAgentResult {
+    ok: true;
+    daemonId: string;
+    installedAgent: {
+        imUserId: string;
+        name: string;
+        adapterName: string;
+        profileId: string;
     };
-    json(payload: unknown, opts?: {
-        pretty?: boolean;
-    }): void;
-    result<T>(pretty: () => void, jsonPayload: T): void;
-}
-declare function getUI(): UI;
-declare function setUI(ui: UI): void;
-declare function applyCommonFlags(argv: string[]): {
-    mode: OutputMode;
-    color: boolean;
-    restArgv: string[];
-};
-
-interface CliContext {
-    ui: UI;
-    keychain: Keychain;
-    cwd: string;
-    argv: string[];
-}
-declare function createCliContext(opts?: {
-    argv?: string[];
-    ui?: UI;
-}): Promise<CliContext>;
-
-interface AgentCatalogEntry {
-    name: string;
-    displayName: string;
-    packPackage: string;
-    packVersionRange: string;
-    hookConfigPath: string;
-    mcpConfigPath?: string;
-    upstreamBinary: string;
-    upstreamVersionRange?: string;
-    localSourcePath?: string;
-    installCommand?: string;
-    tiersSupported: number[];
-    capabilityTags: string[];
-    detect: () => Promise<{
-        found: boolean;
-        binaryPath?: string;
-        version?: string;
+    hostedAgents: Array<{
+        imUserId: string;
+        name: string;
+        adapterName: string;
     }>;
 }
-declare const AGENT_CATALOG: AgentCatalogEntry[];
-declare function getAgent(name: string): AgentCatalogEntry | undefined;
-
-type HookFormat = 'v1.8' | 'v1.9';
-interface HookEntry {
-    command?: string;
-    webhook?: string;
-    enabled?: boolean;
-    [key: string]: unknown;
-}
-interface HookConfig {
-    hooks: Record<string, HookEntry | HookEntry[]>;
-    [key: string]: unknown;
-}
-interface MergeResult {
-    merged: HookConfig;
-    added: string[];
-    preserved: string[];
-    replaced: string[];
-    backupPath?: string;
-}
-interface MergeOptions {
-    daemonUrl: string;
-    dryRun?: boolean;
-    /** Absolute path to the installed claude-code-plugin root (contains hooks/para-emit.mjs). */
-    pluginRoot?: string;
-}
-declare function mergeHooks(existing: HookConfig | null, opts: MergeOptions): MergeResult;
-declare function readHookConfig(filePath: string): Promise<HookConfig | null>;
-declare function writeHookConfig(filePath: string, cfg: HookConfig): Promise<void>;
-declare function installHooks(configPath: string, existing: HookConfig | null, opts: MergeOptions): Promise<MergeResult>;
-declare function rollbackHooks(configPath: string): Promise<{
-    restored: boolean;
-    fromBackup: string | null;
-}>;
-
-interface PairOffer {
-    offer: string;
-    uri: string;
-    expiresAt: number;
-    relayUrl?: string;
-    lanHost?: string;
-    lanPort?: number;
-}
-interface PairedDevice {
-    id: string;
-    name: string;
-    method: 'qr' | 'api-key';
-    transport: 'lan' | 'relay';
-    lastSeenAt: number;
-    pairedAt: number;
-}
-
-interface MigrateOptions {
-    dryRun?: boolean;
-    configPath?: string;
-    homeDir?: string;
-    yes?: boolean;
-    /**
-     * Dependency-injection hook for tests — override the TTY confirmation prompt.
-     * When provided, replaces the readline-based promptConfirm call entirely.
-     */
-    confirmer?: () => Promise<boolean>;
-}
-interface MigrateResult {
-    apiKeyMigrated: boolean;
-    hooksBackedUp: string[];
-    hooksRedirected: string[];
-    memoryFilesImported: number;
-    networkEndpointsRewritten: Array<{
-        file: string;
-        rewrites: number;
-        backupPath: string;
-    }>;
-    errors: Array<{
-        step: string;
-        error: string;
+interface LocalServerState {
+    daemonId: string;
+    cloudBaseUrl?: string;
+    workspaceId?: string | null;
+    pid: number;
+    startedAt: number;
+    wsConnected: boolean;
+    hostedAgents: Array<{
+        imUserId: string;
+        name: string;
+        adapterName: string;
     }>;
-}
-
-interface EncryptionConfig {
-    enabled: boolean;
-    key?: Buffer;
-}
-interface MemoryFile {
-    id: string;
-    ownerId: string;
-    ownerType: 'user' | 'agent';
-    scope: string;
-    path: string;
-    content: string;
-    version: number;
-    memoryType?: string;
-    description?: string;
-    contentHash: string;
-    createdAt: string;
-    updatedAt: string;
-    stale: boolean;
-}
-interface MemoryFileVersion {
-    id: string;
-    fileId: string;
-    version: number;
-    content: string;
-    createdAt: string;
-}
-interface DreamCompaction {
-    id: string;
-    ownerId: string;
-    scope: string;
-    summary: string;
-    createdAt: string;
-}
-interface WriteMemoryFileInput {
-    ownerId: string;
-    ownerType: 'user' | 'agent';
-    scope?: string;
-    path: string;
-    content: string;
-    memoryType?: string;
-    description?: string;
-}
-interface MemoryFileFilters {
-    ownerId?: string;
-    scope?: string;
-    path?: string;
-    memoryType?: string;
-    stale?: boolean;
-    limit?: number;
-    offset?: number;
-}
-interface MemorySearchResult extends MemoryFile {
-    relevance: number;
-    snippet?: string;
-}
-interface MemoryStats {
-    fileCount: number;
-    totalSize: number;
-    totalBytes: number;
-    staleFiles: number;
-    ftsIndexed: number;
-    recallP95: number;
-}
-declare class MemoryDB {
-    private readonly filePath;
-    private readonly db;
-    private readonly crypto;
-    constructor(_encryptionConfig?: EncryptionConfig, opts?: {
-        filePath?: string;
-    });
-    writeMemoryFile(input: WriteMemoryFileInput): MemoryFile;
-    getMemoryFileById(id: string): MemoryFile | null;
-    deleteMemoryFile(id: string): boolean;
-    listMemoryFiles(filters?: MemoryFileFilters): MemoryFile[];
-    searchMemoryFiles(keyword: string, filters?: MemoryFileFilters): MemorySearchResult[];
-    getStats(ownerId?: string): MemoryStats;
-    close(): void;
-}
-declare function getMemoryDB(): MemoryDB;
-declare function closeMemoryDB(): void;
-declare function generateSalt(): Buffer;
-declare function deriveKey(password: string, salt: Buffer): Buffer;
-declare function encrypt(plaintext: string, key: Buffer): string;
-declare function decrypt(encoded: string, key: Buffer): string;
-
-interface WriteMemoryRequest {
-    ownerId: string;
-    ownerType: 'user' | 'agent';
-    path: string;
-    content: string;
-    scope?: string;
-    memoryType?: string;
-    description?: string;
-    encrypt?: boolean;
-}
-interface RecallRequest {
-    keyword: string;
-    ownerId?: string;
-    scope?: string;
-    limit?: number;
-    useCloudFallback?: boolean;
-}
-interface ListMemoryRequest {
-    ownerId?: string;
-    scope?: string;
-    path?: string;
-    memoryType?: string;
-    stale?: boolean;
-    limit?: number;
-    offset?: number;
-}
-interface MemoryResponse {
-    success: boolean;
-    data?: unknown;
-    error?: {
-        code: string;
-        message: string;
+    runningTaskIds: string[];
+    observability?: {
+        adapters?: Record<string, unknown>;
+        lastTaskError?: {
+            taskId: string;
+            message: string;
+            at: string;
+        };
     };
 }
-
-interface DreamResult {
-    ok: boolean;
-    compactedFiles: number;
-    summary?: DreamCompaction;
-}
-interface DreamSchedulerOptions {
-    ownerId?: string;
-    scope?: string;
-    intervalMs?: number;
-}
-declare class DreamScheduler {
-    private readonly opts;
-    private timer;
-    constructor(opts?: DreamSchedulerOptions);
-    start(): void;
-    stop(): void;
-}
-declare function createDreamScheduler(opts?: DreamSchedulerOptions): DreamScheduler;
-declare function runDream(opts?: DreamSchedulerOptions): Promise<DreamResult>;
-
-/**
- * PARA L8 — Session Export Trace Writer
- *
- * Per PARA spec §4.2 L8 (docs/version190/03-para-spec.md):
- *   session export 必须是 pre-compaction 的原始 trace。compaction 会把历史消息替换为 summary——
- *   这种 adapter 必须额外持久化原始 trace 到 `.prismer/trace/<sessionId>.jsonl.zst`
- *   （append-only + zstd 压缩），compaction 只影响 working memory，不动 trace。
- *
- * Implementation:
- *   - Each `append()` JSON-stringifies the envelope, adds '\n', zstd-compresses it,
- *     then sync-appends the compressed bytes to the trace file.
- *   - zstd supports concatenated frames — multiple independent compressed blobs
- *     catenated together decompress back to the concatenation of their inputs.
- *     This is what makes append-only valid without holding a long-lived stream.
- *   - File mode 0o600 (trace may contain sensitive payloads).
- *   - Node 22+ gives us native `zlib.zstdCompressSync`. Older Node: append is a no-op
- *     and a single stderr warning is emitted at construction time. We do NOT throw
- *     or crash the daemon — daemon must still start on Node 20.
- */
-
-interface TraceWriterOptions {
-    sessionId: string;
+declare class LocalServer {
+    private opts;
+    private server?;
+    constructor(opts: LocalServerOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private route;
+    private routeStandard;
     /**
-     * Override home directory; trace file will live at
-     * `<homeDir>/.prismer/trace/<sessionId>.jsonl.zst`. Defaults to `os.homedir()`.
+     * POST /v1/agents/install — cloud/controller installs one hosted agent on
+     * this daemon. The payload is intentionally explicit and idempotent: the
+     * runner upserts local `agents` and `agent_profiles` rows, reloads the
+     * in-memory declaration set, then sends `agent.host.declare` immediately.
      */
-    homeDir?: string;
+    private handleInstallAgent;
     /**
-     * Explicit trace directory. Overrides homeDir if provided. Useful when the
-     * daemon runs with a non-default `dataDir`.
+     * POST /v1/snapshot — daemon-first FS manifest snapshot.
+     *
+     * Walks `snapshotRoot` (default `/workspace`), computes per-file
+     * sha256 + sizeBytes + mtime, returns `{ files: [...], rootPath }`.
+     * Skips dotfiles + the `_outbox/_uploaded` reserved subdir. Phase 1
+     * caller (cloud or controller) is responsible for POSTing the result
+     * to `/api/sandboxes/:id/snapshot/manifest`.
      */
-    traceDir?: string;
-}
-declare class TraceWriter {
-    private readonly _sessionId;
-    private readonly _filePath;
-    private readonly _compress;
-    private _bytesWritten;
-    private _warnedAppendError;
-    private _closed;
-    constructor(opts: TraceWriterOptions);
-    /** Absolute path of the trace file: `<home>/.prismer/trace/<sessionId>.jsonl.zst`. */
-    get filePath(): string;
-    /** Session ID this writer is bound to. */
-    get sessionId(): string;
-    /** Total compressed bytes appended since construction. */
-    get bytesWritten(): number;
-    /** True if zstd is unavailable (Node < 22); append() is a no-op. */
-    get disabled(): boolean;
+    private handleSnapshot;
     /**
-     * Synchronously append one event envelope to the trace as a new zstd frame.
-     * Safe to call after close() — becomes a no-op. Errors are logged once and swallowed.
+     * POST /local/asset/write — agent-gen adapter RPC.
+     *
+     * Body: { workspaceId, bytes (base64), filename, mime?, path?, description?, sourceAgentImUserId? }
+     * Response 200: { assetId, contentHash, prismerUri }
+     * 400 on validation failure; 502 on cloud upstream failure; 501 if no sink wired.
      */
-    append(event: EventBusEnvelope): void;
+    private handleAssetWrite;
     /**
-     * Close the writer. Currently a no-op because we use sync append with one
-     * self-contained zstd frame per event. The API exists so callers can switch to
-     * a streaming implementation later without changing integration code.
+     * POST /v1/runs — dispatch ack-only (Cloud 3 S3 Phase 1).
+     *
+     * The sandbox controller resolves the pod IP and POSTs a task envelope here.
+     * Phase 1 just acknowledges receipt and forwards the payload to onDispatch
+     * (the runner). Actual task execution + cloud-side completion are wired in
+     * S4 (daemon WS upstream emits task.dispatch.reply once the adapter finishes).
+     *
+     * Response on success: 202 + `{ runId, status: 'accepted' }`.
+     * Bad JSON / missing taskId: 400. Internal error: 500.
      */
-    close(): void;
-}
-interface TraceWriterManagerOptions {
-    /** Override home directory (tests). Defaults to os.homedir(). */
-    homeDir?: string;
-    /** Explicit trace directory — takes precedence over homeDir when set. */
-    traceDir?: string;
-}
-/**
- * Routes events from the EventBus (`bus.subscribe('*', ...)`) to the per-session
- * TraceWriter.
- *
- *   agent.session.started → open writer for payload.sessionId
- *   agent.session.ended   → close + remove writer
- *   any other event       → pick the writer by payload.sessionId if present;
- *                           events without sessionId are skipped (not guessed)
- */
-declare class TraceWriterManager {
-    private readonly _writers;
-    private readonly _homeDir;
-    private readonly _traceDir;
-    private readonly _warnedOpenFailures;
-    constructor(opts?: TraceWriterManagerOptions);
-    /** Event-bus subscription handler. Pass via `bus.subscribe('*', mgr.handle)`. */
-    readonly handle: (ev: EventBusEnvelope) => void;
-    /** Close all writers — call on daemon shutdown. */
-    shutdown(): void;
-    /** Test / introspection helper. */
-    activeSessions(): string[];
-    private _openWriter;
-    private _closeWriter;
+    private handleDispatch;
 }
 
-/**
- * Prismer Runtime — E2EE Crypto Module (v1.9.0)
- *
- * End-to-end encryption for LAN direct connections.
- * Uses X25519 for key exchange and XSalsa20-Poly1305 for encryption.
- *
- * Security model:
- *   - Daemon and mobile each generate X25519 keypair
- *   - Keys are exchanged via QR code or relay (out-of-band)
- *   - Each session derives unique encryption key via HKDF
- *   - All LAN traffic is encrypted - relay never sees plaintext
- *
- * This implementation uses Node.js built-in crypto module for
- * compatibility and no external dependencies.
- */
-interface KeyPair {
-    publicKey: Buffer;
-    privateKey: Buffer;
-}
-interface E2EEContext {
-    localKeyPair: KeyPair;
-    remotePublicKey: Buffer;
-    sharedSecret: Buffer;
-    sendKey: Buffer;
-    recvKey: Buffer;
-    sendNonce: Buffer;
-    recvNonce: Buffer;
-}
-interface EncryptedEnvelope {
-    version: number;
-    nonce: Buffer;
-    ciphertext: Buffer;
-    authTag: Buffer;
-}
-/**
- * Generate X25519 keypair for E2EE
- */
-declare function generateKeyPair(): KeyPair;
-/**
- * Derive shared secret from local private key and remote public key (X25519)
- */
-declare function deriveSharedSecret(localPrivateKey: Buffer, remotePublicKey: Buffer): Buffer;
-/**
- * Derive send/recv keys from shared secret using HKDF-SHA256.
- *
- * Role is determined by lexicographic comparison of the two public keys
- * so both peers agree without an explicit role flag. Without the keys
- * (legacy single-context callers), defaults to the "A" role.
- */
-declare function deriveSessionKeys(sharedSecret: Buffer, localPublicKey?: Buffer, remotePublicKey?: Buffer): {
-    sendKey: Buffer;
-    recvKey: Buffer;
-};
-/**
- * Serialize encrypted envelope to buffer
- */
-declare function serializeEnvelope(envelope: EncryptedEnvelope): Buffer;
-/**
- * Deserialize encrypted envelope from buffer
- */
-declare function deserializeEnvelope(data: Buffer): EncryptedEnvelope;
-/**
- * Create E2EE context for a session
- */
-declare function createE2EEContext(localKeyPair: KeyPair, remotePublicKey: Buffer): E2EEContext;
-/**
- * Encrypt message using E2EE context
- */
-declare function encryptMessage(context: E2EEContext, plaintext: Buffer): Buffer;
-/**
- * Decrypt message using E2EE context
- */
-declare function decryptMessage(context: E2EEContext, data: Buffer): Buffer;
-
-/**
- * Prismer Runtime — E2EE Key Storage (v1.9.0)
- *
- * Secure storage for E2EE keys on daemon side.
- * Uses keychain backend with encrypted JSON fallback for offline/keyless systems.
- *
- * Storage model:
- *   - Primary: Keychain (macOS Keychain / libsecret / pass)
- *   - Fallback: Encrypted JSON file (~/.prismer/e2ee-keys.json)
- *   - Per-session keys with TTL (30 min default)
- *   - Automatic cleanup of expired keys
- *
- * Security:
- *   - Keys encrypted at rest (keychain or encrypted file)
- *   - Master passphrase required for file fallback
- *   - Automatic key rotation on session expiry
- *   - Forward secrecy: ephemeral keys discarded after session
- */
-
-interface E2EEKeyEntry {
-    /** Session ID (userId:daemonId or userId:deviceId) */
-    sessionId: string;
-    /** User ID who owns this key */
-    userId: string;
-    /** Daemon ID or Device ID */
-    endpointId: string;
-    /** Local keypair (ephemeral) */
-    keyPair: {
-        publicKey: string;
-        privateKey: string;
-    };
-    /** Remote public key */
-    remotePublicKey: string;
-    /** When this key was created */
-    createdAt: number;
-    /** When this key expires (unix timestamp) */
-    expiresAt: number;
-    /** Current sequence number */
-    seq: number;
-}
-interface E2EEStorageStats {
-    totalKeys: number;
-    activeKeys: number;
-    expiredKeys: number;
-    oldestKeyAge: number;
-    newestKeyAge: number;
-}
-declare class E2EEKeyStorage {
-    private keychain;
-    private useEncryptedFile;
-    private masterPassphrase?;
-    private cleanupInterval?;
-    constructor(options?: {
-        masterPassphrase?: string;
-    });
-    /**
-     * Initialize storage (try keychain, fallback to encrypted file)
-     */
-    initialize(): Promise<void>;
-    /**
-     * Store E2EE key for a session
-     */
-    storeKey(entry: E2EEKeyEntry): Promise<void>;
-    /**
-     * Retrieve E2EE key for a session
-     */
-    getKey(sessionId: string): Promise<E2EEKeyEntry | null>;
+interface RunnerOptions {
+    /** Override config path; defaults to ~/.prismer. */
+    paths?: ConfigPaths;
+    /** Skip starting the local 127.0.0.1 server (useful in tests). */
+    startLocalServer?: boolean;
+    /** Local server port; defaults to 3210. */
+    localPort?: number;
+    /** Override daemonVersion reported in agent.host.declare. */
+    daemonVersion?: string;
+    /** Pre-loaded config (skip filesystem read). */
+    configOverride?: Config;
+    /** Override built-in adapter list (tests). */
+    adaptersOverride?: AdapterDef[];
+}
+declare class Runner extends EventEmitter {
+    private opts;
+    private config;
+    private paths;
+    private db;
+    private cloud;
+    private ws;
+    private syncWorker;
+    private syncQueue;
+    private assetCache;
+    private uriResolver;
+    private registry;
+    private servicePool;
+    private shellConfig;
+    private localServer?;
+    private outboxWatcher?;
+    private memoryWiring?;
+    private state;
+    private startedAt;
+    private workspaceId;
+    private wsConnected;
+    private readonly hostedAgents;
+    private readonly runningTasks;
+    private lastTaskError?;
+    private heartbeatTimer?;
+    private taskReaperTimer?;
+    constructor(opts?: RunnerOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    isRunning(): boolean;
     /**
-     * Remove E2EE key for a session
+     * Phase 1 escape hatch — see `DispatchPayload.shellCommand`. Spawns
+     * `bash -c <cmd>` with cwd=/workspace, mirrors output to pod logs.
+     * Fire-and-forget; nothing here writes back to cloud.
      */
-    removeKey(sessionId: string): Promise<void>;
+    private runShellCommand;
+    snapshotState(): LocalServerState;
     /**
-     * Get all keys for a user (for recovery)
+     * Re-read the local `agents` table (populated by `prismer agent register`)
+     * and re-populate `hostedAgents` map. Profiles per agent come from local
+     * `agent_profiles` table (filled by host.acked sync).
      */
-    getAllKeysForUser(userId: string): Promise<E2EEKeyEntry[]>;
+    loadAgentsFromDb(): void;
     /**
-     * Get storage statistics
+     * Register an in-process AgentProfile snapshot (called by agent CLI / sync layer).
+     * Used to populate the `agents` list in agent.host.declare.
      */
-    getStats(userId?: string): Promise<E2EEStorageStats>;
-    /**
-     * Cleanup expired keys
+    setHostedAgent(agent: {
+        imUserId: string;
+        name: string;
+        adapterName: string;
+        capabilities: string[];
+        profiles: Array<{
+            id: string;
+            version: number;
+        }>;
+    }): void;
+    private installHostedAgent;
+    private installStaticHostedAgentFromEnv;
+    private wireWsHandlers;
+    private sendDeclare;
+    private handleIncoming;
+    private onHostAcked;
+    private onTaskDispatch;
+    private onTaskCancel;
+    private onAgentChanged;
+    private onAgentProfileChanged;
+    private syncProfileFromCloud;
+    private resolveOwnedAgent;
+    private onWorkspaceChanged;
+    private onWorkspaceFileChanged;
+    private snapshotAdapterObservability;
+    /**
+     * SyncWorker FlushFn — pushes local writes to cloud.
+     *
+     * Maps:
+     *   workspace      → PATCH /api/im/workspaces/:id
+     *   agent_profile  → PATCH /api/im/agent_profiles/:id
+     *   agent          → PATCH /api/im/agents/:imUserId
+     * On 'create' we POST instead. On 'delete' we DELETE.
      */
-    cleanupExpiredKeys(): Promise<void>;
     /**
-     * Shutdown storage (cleanup interval)
-     */
-    destroy(): void;
-    private ensureStorageFile;
-    private readEncryptedFile;
-    private writeEncryptedFile;
-    private encryptFile;
-    private decryptFile;
-    private storeInEncryptedFile;
-    private getFromEncryptedFile;
-    private removeFromEncryptedFile;
-    private getAllFromEncryptedFile;
-    private storeInKeychain;
-    private getFromKeychain;
-    private removeFromKeychain;
-    private getAllFromKeychain;
-}
-/**
- * Generate session ID for E2EE storage
- * Format: {userId}:{endpointId}
- */
-declare function generateSessionId(userId: string, endpointId: string): string;
-/**
- * Parse session ID into components
- */
-declare function parseSessionId(sessionId: string): {
-    userId: string;
-    endpointId: string;
-};
-/**
- * Create E2EE key entry from runtime context
- */
-declare function createKeyEntry(userId: string, endpointId: string, keyPair: KeyPair, remotePublicKey: string, seq?: number): E2EEKeyEntry;
-
-/**
- * secret-scan — local-side secret detection for memory team sync.
- *
- * Mirror of src/im/services/memory/team-sync.service.ts SECRET_PATTERNS.
- * Kept in sync by convention — if you add a pattern there, add it here.
- *
- * Used by memory-team-sync.ts before POSTing bytes to the server (so secrets
- * never leave the device). Server has its own independent scanner (defense
- * in depth).
- *
- * Design: docs/version190/14e-memory-cc-compat.md §8.5
- */
-interface SecretHit {
-    /** Pattern name (e.g. 'aws-access-key'). */
-    pattern: string;
-    /** Truncated match (never more than 80 chars — no full secret echo). */
-    match: string;
-    /** 1-based line number. */
-    line: number;
-    /**
-     * If true, this hit is informational only — not strong enough evidence
-     * to block a push on its own (e.g. JWT-shaped strings).
+     * SyncWorker FlushFn — pushes one local sync row to cloud via CloudClient.
+     *
+     * resource_type × operation → endpoint:
+     *   workspace.create      → POST   /api/im/workspaces
+     *   workspace.update      → PATCH  /api/im/workspaces/:id
+     *   workspace.delete      → DELETE /api/im/workspaces/:id
+     *   agent.create          → POST   /api/im/register   (the only public path
+     *                                                       that creates an
+     *                                                       IMUser of role='agent')
+     *   agent.update          → PATCH  /api/im/agents/:id
+     *   agent.delete          → DELETE /api/im/agents/:id
+     *   agent_profile.create  → POST   /api/im/agent_profiles
+     *   agent_profile.update  → PATCH  /api/im/agent_profiles/:id
+     *   agent_profile.delete  → DELETE /api/im/agent_profiles/:id
+     *
+     * Error classification per docs/refactor/13-error-handling.md §2.1 / §2.7:
+     *   2xx           → ok:true   (SyncWorker drops the row)
+     *   408 / 429     → retryable (SyncWorker re-queues with exponential backoff)
+     *   5xx / net err → retryable
+     *   4xx (other)   → permanent (SyncWorker marks failed; 409 is conflict)
      */
-    warnOnly: boolean;
+    private flushSyncRow;
 }
-/** Scan content for known secret patterns. Returns the list of hits. */
-declare function scanForSecrets(content: string): SecretHit[];
-/**
- * Convenience: true if content has at least one blocking (non-warnOnly) hit.
- */
-declare function hasBlockingSecret(content: string): boolean;
 
-/**
- * memory-team-sync — client-side delta push + server-wins pull for team memory.
- *
- * Walks a local directory (typically `~/.claude/memory/team/<owner>/<repo>/`),
- * diffs content hashes against a persisted `last-sync.json`, pushes only the
- * changed files, and writes any server-side-newer rows back to disk.
- *
- * Design: docs/version190/14e-memory-cc-compat.md §8.5
- *
- * Secret scanning (local): any file whose content matches a blocking pattern
- * is rejected before it leaves the device. The server also scans (defense in
- * depth).
- */
-/** Per-file content size limit (matches server). */
-declare const MEMORY_TEAM_SYNC_MAX_BYTES: number;
-/** Name of the sidecar state file. */
-declare const LAST_SYNC_FILE = ".prismer-team-sync.json";
-interface SyncTeamMemoryOptions {
-    /** Team identifier, e.g. `'acme/widgets'`. */
-    team: string;
-    /** Root directory to sync (scanned recursively). */
-    rootDir: string;
-    /** Prismer API key (Bearer). */
-    apiKey: string;
-    /**
-     * Base URL for the IM API — typically the cloud host.
-     * e.g. `'https://prismer.cloud/api/im'` or `'http://localhost:3000/api/im'`.
-     */
-    baseUrl: string;
-    /**
-     * Optional override of the since timestamp. Normally we read this from the
-     * sidecar state file and ignore this param. Exposed mainly for testing.
-     */
-    since?: string;
-    /**
-     * Custom fetch (for tests). Defaults to the global fetch.
-     */
+interface PairOptions {
+    cloudBaseUrl: string;
+    /** Human-readable label visible to the approver in mobile UI. */
+    deviceName?: string;
+    /** Override config save path (tests). */
+    paths?: ConfigPaths;
+    /** Number of poll attempts (5 s each). Default 60 → 5 min. */
+    maxPollAttempts?: number;
+    /** Pluggable fetch (tests). */
     fetchImpl?: typeof fetch;
-    /**
-     * If true, do not write pulled[] rows to disk and do not update sidecar.
-     * Useful for dry-run/preflight.
-     */
-    dryRun?: boolean;
-}
-interface SyncTeamMemoryResult {
-    pushed: number;
-    pulled: number;
-    rejected: Array<{
-        path: string;
-        reason: string;
-        detail?: string;
-    }>;
-    skippedLocalSecrets: Array<{
-        path: string;
-        pattern: string;
-        line: number;
-    }>;
-    serverTime: string;
-}
-/** Walk rootDir recursively for .md files (only). Returns POSIX-style rel paths. */
-declare function listMarkdownFiles(rootDir: string): string[];
-/**
- * Sync a team-memory directory with the cloud.
- *
- *   1. Walk rootDir for .md files
- *   2. Hash each; diff against last-sync.json → push[] candidates
- *   3. Local secret scan → any hits are skipped (not pushed)
- *   4. POST /memory/team/sync with push[] and since
- *   5. Write pulled[] to disk (server wins)
- *   6. Update last-sync.json
- */
-declare function syncTeamMemory(opts: SyncTeamMemoryOptions): Promise<SyncTeamMemoryResult>;
-/**
- * Remove the sidecar state file — forces the next sync to re-push everything.
- * Useful from CLI tooling.
- */
-declare function resetTeamSyncState(rootDir: string): void;
-
-/**
- * Shamir Secret Sharing over GF(256) — byte-oriented implementation.
- *
- * Split a secret Buffer into N shares such that any M (threshold) shares can
- * reconstruct the original, but fewer than M reveal zero information.
- *
- * Field: GF(256) with AES irreducible polynomial 0x11B.
- *        Addition = XOR. Multiplication = carryless multiply mod 0x11B.
- *        Share-id x ∈ {1..255} (x=0 is the secret itself).
- *
- * Each byte of the secret is split independently using a polynomial of degree
- * m-1:  P(x) = s + a_1*x + a_2*x^2 + ... + a_{m-1}*x^{m-1}  (all arithmetic in GF(256))
- * where s is the secret byte and a_1..a_{m-1} are uniformly random.
- *
- * Recovery uses Lagrange interpolation evaluated at x=0.
- *
- * Mnemonic format: Crockford base32 with 1-byte version header (0x01) and
- * CRC-16/CCITT-FALSE checksum. Groups of 4 characters separated by hyphens.
- *
- * No external npm dependencies.
- *
- * See: Shamir, "How to Share a Secret", 1979. GF(256) byte-level variant used
- * by industry (Trezor Shamir Backup, HashiCorp Vault, etc.).
- */
-/**
- * Branded `Buffer` that has been validated as a Shamir share by this module.
- *
- * Nominal typing prevents accidentally passing an arbitrary `Buffer` (e.g.
- * `Buffer.from('hello')`) into {@link combineShares} or
- * {@link encodeShareAsMnemonic}. TypeScript structural equality is defeated
- * by the `__brand` phantom field, so the only path to a `ShamirShare` value
- * is through this module's own functions (`splitSecret`,
- * `decodeShareFromMnemonic`) or the explicit escape hatch
- * {@link unsafeAsShamirShare}.
- *
- * This is a compile-time guard only; runtime validation (duplicate ids,
- * inconsistent lengths, CRC) still happens inside `combineShares` /
- * `decodeShareFromMnemonic`.
- */
-type ShamirShare = Buffer & {
-    readonly __brand: unique symbol;
-};
-/**
- * Escape hatch for interop paths that already hold raw share Buffers
- * (e.g. legacy callers that read bytes off the wire themselves and cannot
- * route through {@link decodeShareFromMnemonic}).
- *
- * This is a **sharp edge**: the caller is asserting the buffer is a
- * well-formed share byte string (`[share_id, y_byte_1, y_byte_2, ...]` with
- * `share_id ∈ 1..255`). Passing an arbitrary buffer here will compile, and
- * will pass length / id / duplicate checks inside `combineShares`, but will
- * reconstruct a plausibly-shaped yet **semantically wrong** secret.
- *
- * Prefer `decodeShareFromMnemonic` wherever possible — the CRC-16 check
- * there catches tampered or wrong-batch shares.
- */
-declare function unsafeAsShamirShare(buf: Buffer): ShamirShare;
-/**
- * Split a secret into n shares; any m can recombine.
- *
- * Each returned share Buffer is [share_id_byte, y_byte_1, y_byte_2, ...].
- * The share-id is 1..n (never 0).
- *
- * @param secret plaintext bytes
- * @param n total shares (2..255)
- * @param m threshold (2..n)
- */
-declare function splitSecret(secret: Buffer, n: number, m: number): ShamirShare[];
-/**
- * Combine shares to recover the secret. Any m of n suffice (where m is the
- * threshold used at split time).
- *
- * @param shares array of share Buffers (each [x_byte, y_bytes...])
- * @returns recovered secret
- */
-declare function combineShares(shares: ShamirShare[]): Buffer;
-/**
- * Encode a share as a mnemonic string.
- *
- * Framing (before base32 encoding):
- *   [0x01 version] [share bytes...] [CRC-16/CCITT-FALSE of (version||share)]
- *
- * Output is Crockford base32, grouped in blocks of 4 characters separated by
- * hyphens for readability. Case-insensitive on decode.
- */
-declare function encodeShareAsMnemonic(share: ShamirShare): string;
-/**
- * Decode a mnemonic string back into a share Buffer. Strips whitespace,
- * hyphens, and normalizes case. Validates the version byte and CRC-16.
- */
-declare function decodeShareFromMnemonic(encoded: string): ShamirShare;
+    /** Allow overwriting existing config. Default false. */
+    force?: boolean;
+    /** Hook for test capture of the QR URL. */
+    onQrReady?: (qrUrl: string) => void;
+    /**
+     * LAN-dev bypass: skip QR + mobile approval and auto-approve the offer
+     * as the named human IMUser. Requires `LOCAL_ONLY=1` in this process AND
+     * cloud-side `LOCAL_ONLY=1 && NODE_ENV !== 'production'`. Without those
+     * env conditions the cloud returns 403 and we surface the error.
+     */
+    asUserEmail?: string;
+    /** Override LOCAL_ONLY env read (tests). */
+    isLocalOnly?: () => boolean;
+    /** Override poll wait (tests). Default 5_000ms. */
+    pollIntervalMs?: number;
+}
+interface PairResult {
+    config: Config;
+    paths: ConfigPaths;
+}
+declare function pair(opts: PairOptions): Promise<PairResult>;
 
-interface TimelineEntry {
-    seq: number;
-    opcode: number;
-    slot: number;
-    payload: Buffer;
-    createdAt: number;
-}
-interface OutboxEntry {
-    id: number;
-    seq: number;
-    frame: Buffer;
-    createdAt: number;
-    attempts: number;
-}
-interface DeadLetterEntry {
-    id: number;
-    originalId: number;
-    seq: number;
-    createdAt: number;
-    failedAt: number;
-    attempts: number;
-}
-interface DroppedFrame {
-    id: number;
-    seq: number;
-    attempts: number;
-}
-interface DaemonOutboxOptions {
-    bindingId: string;
-    dataDir?: string;
-    timelineCap?: number;
-    outboxCap?: number;
-    maxAttempts?: number;
-    onDrop?: (entries: DroppedFrame[]) => void;
-}
-declare class DaemonOutbox {
-    private db;
-    private bindingId;
-    private timelineCap;
-    private outboxCap;
-    private maxAttempts;
-    private onDrop?;
-    private currentSeq;
-    private droppedCount;
-    constructor(opts: DaemonOutboxOptions);
-    private initSchema;
-    appendSent(opcode: number, slot: number, payload: Buffer): number;
-    getTimelineSince(lastSeq: number, limit?: number): TimelineEntry[];
-    getCurrentSeq(): number;
-    private enforceTimelineCap;
-    queue(seq: number, frame: Buffer): number;
-    drain(limit?: number): OutboxEntry[];
-    ack(outboxId: number): void;
-    bumpAttempts(outboxId: number): {
-        attempts: number;
-        deadLettered: boolean;
-    };
-    private moveToDeadLetter;
-    getDeadLetterCount(): number;
-    getDeadLetterEntries(limit?: number, includeFrame?: boolean): (DeadLetterEntry & {
-        frame?: Buffer;
-    })[];
-    pendingCount(): number;
-    getDroppedCount(): number;
-    private enforceOutboxCap;
-    close(): void;
-}
-/** 2-byte header + payload per §5.6.4 */
-declare function frameFromParts(opcode: number, slot: number, payload: Buffer): Buffer;
-
-/**
- * Prismer Runtime — WSS Relay Client (v1.9.0)
- *
- * WebSocket client for cloud relay communication. Connects to the main
- * cloud host (derived from `cloudApiBase`) under the `/ws/daemon/*` path
- * prefix — there is no separate relay subdomain.
- *
- * Responsibilities:
- *   - Register daemon binding with API key
- *   - Receive remote command pushes (control channel)
- *   - Route encrypted envelopes (data channel)
- *   - Heartbeat keepalive (30s interval)
- *   - Auto-reconnect with exponential backoff
- */
+declare const CCConfigSchema: z.ZodObject<{
+    cwd: z.ZodString;
+    model: z.ZodDefault<z.ZodString>;
+    systemPrompt: z.ZodOptional<z.ZodString>;
+    envVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    mcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        command: string;
+        env?: Record<string, string> | undefined;
+        args?: string[] | undefined;
+    }, {
+        name: string;
+        command: string;
+        env?: Record<string, string> | undefined;
+        args?: string[] | undefined;
+    }>, "many">>;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    maxTurns: z.ZodDefault<z.ZodNumber>;
+    baseURL: z.ZodOptional<z.ZodString>;
+    apiKeyRef: z.ZodOptional<z.ZodString>;
+    route: z.ZodDefault<z.ZodEnum<["default", "prismer", "omniroute"]>>;
+}, "strip", z.ZodTypeAny, {
+    model: string;
+    cwd: string;
+    maxTurns: number;
+    route: "default" | "prismer" | "omniroute";
+    systemPrompt?: string | undefined;
+    allowedTools?: string[] | undefined;
+    envVars?: Record<string, string> | undefined;
+    mcpServers?: {
+        name: string;
+        command: string;
+        env?: Record<string, string> | undefined;
+        args?: string[] | undefined;
+    }[] | undefined;
+    baseURL?: string | undefined;
+    apiKeyRef?: string | undefined;
+}, {
+    cwd: string;
+    model?: string | undefined;
+    systemPrompt?: string | undefined;
+    allowedTools?: string[] | undefined;
+    envVars?: Record<string, string> | undefined;
+    mcpServers?: {
+        name: string;
+        command: string;
+        env?: Record<string, string> | undefined;
+        args?: string[] | undefined;
+    }[] | undefined;
+    maxTurns?: number | undefined;
+    baseURL?: string | undefined;
+    apiKeyRef?: string | undefined;
+    route?: "default" | "prismer" | "omniroute" | undefined;
+}>;
+type ClaudeCodeConfig = z.infer<typeof CCConfigSchema>;
+declare const claudeCodeAdapter: AdapterDef;
 
-declare const OPCODE: {
-    readonly JSON_CONTROL: 0;
-    readonly AGENT_OUTPUT: 1;
-    readonly TERMINAL_IO: 2;
-    readonly FILE_CHUNK: 3;
-    readonly AUDIT_TAP: 4;
-    readonly BACKFILL_REQUEST: 5;
-    readonly BACKFILL_CHUNK: 6;
-};
-interface RelayClientOptions {
-    apiKey: string;
-    daemonId: string;
-    userId: string;
-    /**
-     * Base WSS URL for the relay (e.g. `wss://cloud.prismer.dev`). The client
-     * appends `/ws/daemon/control` and `/ws/daemon/data` to this base. Callers
-     * typically derive it from `cloudApiBase` via `deriveWsFromHttp()`.
-     */
-    relayUrl: string;
-    heartbeatIntervalMs?: number;
-    reconnectDelayMs?: number;
-    maxReconnectDelayMs?: number;
-    autoReconnect?: boolean;
-    /** v1.9.0 — bindingId enables daemon-side outbox + timeline backfill (§5.6.5). */
-    bindingId?: string;
-    /** Override outbox location (for tests); defaults to ~/.prismer/daemon/{bindingId}. */
-    outboxDataDir?: string;
-}
-interface RelayState {
-    connected: boolean;
-    channel: 'control' | 'data' | null;
-    lastHeartbeat?: number;
-    reconnectAttempts: number;
-    lastError?: string;
-}
-interface RemoteCommand {
-    id: string;
-    type: string;
-    payload: Record<string, unknown>;
-    createdAt: number;
-}
-declare class RelayClient extends EventEmitter {
-    private apiKey;
-    private daemonId;
-    private userId;
-    private relayUrl;
-    private heartbeatIntervalMs;
-    private reconnectDelayMs;
-    private maxReconnectDelayMs;
-    private autoReconnect;
-    private controlWs;
-    private dataWs;
-    private heartbeatInterval?;
-    private heartbeatTimer?;
-    private reconnectTimer?;
-    private state;
-    private isShuttingDown;
-    private outbox?;
-    constructor(opts: RelayClientOptions);
-    /**
-     * Connect to relay server (both control and data channels)
-     */
-    connect(): Promise<void>;
-    /**
-     * Disconnect from relay server
-     */
-    disconnect(): Promise<void>;
-    /**
-     * Send command to mobile client via relay (data channel).
-     *
-     * v1.9.0 — if bindingId was provided, every tracked data-plane frame
-     * (AGENT_OUTPUT / TERMINAL_IO / FILE_CHUNK) is recorded in the local
-     * timeline before send. If the data channel is down, the frame is queued
-     * to the outbox and will be replayed on next successful connect.
-     */
-    /**
-     * Send JSON control message to cloud via the control channel.
-     * v1.9.x — used by daemon to ack remote commands (e.g. command.result).
-     * Returns false silently if control channel is not connected.
-     */
-    sendControl(message: unknown): boolean;
-    sendCommand(data: Buffer | string): boolean;
-    /**
-     * Get current connection state
-     */
-    getState(): RelayState;
-    /**
-     * Get connection status summary
-     */
-    getStatus(): {
-        controlConnected: boolean;
-        dataConnected: boolean;
-        lastHeartbeat?: number;
-        reconnectAttempts: number;
-    };
-    /**
-     * Connect to control channel (/ws/daemon/control)
-     */
-    private connectControlChannel;
-    /**
-     * Connect to data channel (/ws/daemon/data)
-     */
-    private connectDataChannel;
-    private relayEndpoint;
-    /**
-     * Register daemon with relay server
-     */
-    private registerDaemon;
-    /**
-     * Handle incoming control channel messages
-     */
-    private handleControlMessage;
-    /** RPC method handlers registered by the daemon process. Keyed by method
-     *  name (e.g. 'fs.read'). Result is serialized into the rpc.response
-     *  envelope. Thrown errors → `error` field. */
-    private rpcHandlers;
-    /** Register an RPC handler. Daemon code calls this at startup for each
-     *  method it wants to expose to cloud relay (mobile → cloud → daemon). */
-    registerRpcHandler(method: string, handler: (params: unknown) => Promise<unknown>): void;
-    private handleRpcRequest;
-    private sendRpcResponse;
-    /**
-     * Handle incoming data channel messages.
-     *
-     * v1.9.0 — intercept backfill-request (opcode 0x05) from the cloud
-     * (cloud forwards it on behalf of a reconnecting mobile client) and
-     * respond with backfill-chunk frames (opcode 0x06) for every timeline
-     * entry with seq > payload.lastSeq.
-     */
-    private handleDataMessage;
-    /**
-     * Drain outbox by replaying queued frames over the data channel.
-     * Called after reconnect() succeeds. Stops on the first send failure
-     * to preserve ordering.
-     */
-    private replayOutbox;
-    /** Pending count for status reporting. */
-    getOutboxPending(): number;
-    /**
-     * Handle remote command from mobile
-     */
-    private handleRemoteCommand;
+declare const CodexConfigSchema: z.ZodObject<{
+    /** Working directory for the codex subprocess. */
+    cwd: z.ZodString;
     /**
-     * Start heartbeat interval
+     * Model identifier passed to --model (e.g. 'codex-mini-latest', 'o4-mini').
+     * Default matches the Codex CLI built-in default as of 2026-05.
      */
-    private startHeartbeat;
+    model: z.ZodDefault<z.ZodString>;
     /**
-     * Clear heartbeat timers
+     * Sandbox level for the codex subprocess.
+     *   read-only         — analysis only; code-gen tasks will stall
+     *   workspace-write   — write inside cwd, read-only outside (recommended)
+     *   danger-full-access — no restrictions; safe only inside isolated containers
      */
-    private clearHeartbeat;
+    sandbox: z.ZodDefault<z.ZodEnum<["read-only", "workspace-write", "danger-full-access"]>>;
+    /** Optional system prompt prepended to the user prompt as a preamble (see U4). */
+    systemPrompt: z.ZodOptional<z.ZodString>;
+    /** Extra env vars merged into the codex subprocess environment. */
+    envVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
-     * Send heartbeat to relay
+     * Name of the env var holding the OpenAI API key. Defaults to
+     * 'OPENAI_API_KEY' (Codex CLI default). Override if using a workspace-
+     * scoped key under a different name.
      */
-    private sendHeartbeat;
-    /**
-     * Acknowledge heartbeat from relay
-     */
-    private sendHeartbeatAck;
-    /**
-     * Handle disconnection from one or both channels
-     */
-    private handleDisconnect;
-    /**
-     * Schedule reconnection with exponential backoff
-     */
-    private scheduleReconnect;
-    /**
-     * Clear reconnect timer
-     */
-    private clearReconnectTimer;
-    /**
-     * Close control channel
-     */
-    private closeControlChannel;
-    /**
-     * Close data channel
-     */
-    private closeDataChannel;
-}
+    apiKeyEnv: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    model: string;
+    sandbox: "read-only" | "workspace-write" | "danger-full-access";
+    cwd: string;
+    apiKeyEnv: string;
+    systemPrompt?: string | undefined;
+    envVars?: Record<string, string> | undefined;
+}, {
+    cwd: string;
+    model?: string | undefined;
+    systemPrompt?: string | undefined;
+    sandbox?: "read-only" | "workspace-write" | "danger-full-access" | undefined;
+    envVars?: Record<string, string> | undefined;
+    apiKeyEnv?: string | undefined;
+}>;
+type CodexConfig = z.infer<typeof CodexConfigSchema>;
+/**
+ * Parse `codex exec --json` stdout. The CLI emits newline-delimited JSON
+ * lines on stdout; we look for the final-message line and extract its
+ * content. Tolerant: any parse failure falls back to raw stdout.
+ */
+declare function parseCodexOutput(stdout: string): string;
+declare const codexAdapter: AdapterDef;
 
-declare const RUNTIME_VERSION = "1.9.0";
+declare function buildProgram(): Command;
+declare function runCli(argv?: string[]): Promise<void>;
 
-export { AGENT_CATALOG, type AdapterDescriptor, type AdapterDispatchInput, type AdapterDispatchResult, type AdapterImpl, AdapterRegistry, type AgentCatalogEntry, type AgentDescriptor, type AgentState, type AgentStatus, AgentSupervisor, AllProvidersFailedError, type AnalyzeRequest, type AssignTaskRequest, type AuthenticatedIdentity, type CancelTaskRequest, type CliContext, ConfigError, type CreateGeneRequest, DaemonAlreadyRunningError, type DaemonHttpOptions, DaemonHttpServer, type DaemonOptions, DaemonOutbox, type DaemonOutboxOptions, DaemonProcess, type DaemonRunnerHandle, type DaemonRunnerOptions, type DaemonState, DispatchMux, type DispatchMuxRequest, type DispatchMuxResult, type DistillationRequest, type DreamCompaction, type DreamResult, DreamScheduler, type DreamSchedulerOptions, type E2EEContext, type E2EEKeyEntry, type KeyPair as E2EEKeyPair, E2EEKeyStorage, type E2EEStorageStats, type EncryptedEnvelope, type EncryptionConfig, EventBus, type EventBusEnvelope, type EventBusOptions, EvolutionGatewayHttpHandler, type EvolutionGatewayOptions, type HookConfig, type HookEntry, type HookFormat, Keychain, type KeychainAdapter, type KeychainBackend, KeychainOperationError, type KeychainOptions, LAST_SYNC_FILE, LLMDispatcher, type LLMMessage, type LLMProvider, type LLMRequest, type LLMResponse, type ListMemoryRequest, type LoadConfigOptions, MEMORY_TEAM_SYNC_MAX_BYTES, MemoryDB, type MemoryFile, type MemoryFileVersion, type MemoryResponse, type MergeOptions, type MergeResult, type MigrateOptions, type MigrateResult, type MigrateSecretsOptions, type MigrateSecretsResult, NoKeychainBackendError, OPCODE, type OutboxEntry, type OutputMode, type PairOffer, type PairedDevice, type PrismerConfig, type ProviderStats, RUNTIME_VERSION, type RecallRequest, type RecordRequest, RelayClient, type RelayClientOptions, type RelayState, type RemoteCommand, type RouteHandler, type RouteTaskRequest, type RouteTaskResponse, type RoutingPolicy, type SecretHit, type ShamirShare, type ShutdownHandler, type SignalExtractionRequest, type StepCompletedRequest, type StepFailedRequest, type StepTimeoutRequest, type Subscription, type SubscriptionHandler, type SupervisorOptions, type SyncTeamMemoryOptions, type SyncTeamMemoryResult, type TableOptions, type TableRow, type TaskInfo, TaskRouteState, TaskRouter, type TaskRouterOptions, type TimelineEntry, TraceWriter, TraceWriterManager, type TraceWriterManagerOptions, type TraceWriterOptions, UI, type UIOptions, type WriteMemoryRequest, applyCommonFlags, assertBrandVoice, closeMemoryDB, combineShares, createCliContext, createDreamScheduler, createE2EEContext, createKeyEntry, decodeShareFromMnemonic, decrypt, decryptMessage, deriveKey, deriveSessionKeys, deriveSharedSecret, deserializeEnvelope, encodeShareAsMnemonic, encrypt, encryptMessage, frameFromParts, generateKeyPair as generateE2EEKeyPair, generateSalt, generateSessionId, getAgent, getMemoryDB, getUI, hasBlockingSecret, installHooks, listMarkdownFiles, loadConfig, mergeHooks, migrateSecrets, parseKeyringPlaceholder, parseSessionId, readHookConfig, resetTeamSyncState, rollbackHooks, runDream, scanForSecrets, serializeEnvelope, setUI, splitSecret, startDaemonRunner, syncTeamMemory, unsafeAsShamirShare, writeConfig, writeHookConfig };
+export { type AcquireResult, type AdapterDef, type AdapterKind, AdapterRegistry, type AdapterService, type AgentChangedPayload, type AgentHostDeclarePayload, type AgentProfile, type AgentProfileChangedPayload, type AgentStatusChangedPayload, AssetCache, type AssetCacheOptions, type AssetDispatchObservation, type AssetDispatchStrategy, type AssetRef, BUILTIN_ROLE_TEMPLATES, type CachedAsset, type ClaudeCodeConfig, CloudClient, type CloudClientOptions, CloudError, type CloudResponse, type CodexConfig, type Config, type ConfigPaths, ConfigSchema, type DispatchDeps, type Envelope, type FlushFn, type FlushResult, type HealthStatus, type HermesProfileConfig, type HostAckedPayload, type HostedAgentDeclaration, type IMAgentStatus, type IMWSMessage, type LocalDb, LocalServer, type LocalServerOptions, type LocalServerState, type PairOptions, type PairResult, type ParseClaim, ParseClaimController, type ParseClaimControllerOptions, type ParsedPrismerUri, type PrismerUriType, type RoleTemplate, Runner, type RunnerOptions, ServicePool, type SyncOperation, SyncQueue, type SyncQueueRow, type SyncResourceType, type SyncStatus, SyncWorker, type SyncWorkerOptions, TARGET_SCHEMA_VERSION, type TaskCancelPayload, type TaskDispatchContextEntry, type TaskDispatchProgressPayload, type TaskDispatchReplyPayload, type TaskDispatchRequestPayload, type TaskInput, type TaskResult, UriResolver, type UriResolverOptions, type ValidationResult, WS_CLOSE, type WorkspaceChangedPayload, type WorkspaceFileBinding, type WorkspaceFileChangedPayload, WorkspaceMirror, type WorkspaceMirrorOptions, WsClient, type WsClientOptions, buildProgram, claudeCodeAdapter, codexAdapter, composePrompt, configExists, currentSchemaVersion, deriveWsUrl, envelope, getRoleTemplate, handleDispatch, hermesAdapter, isDaemonId, listRoleTemplates, loadConfig, newDaemonId, nextBackoffMs, openLocalDb, pair, parseCodexOutput, parseUris, resolvePaths, runCli, runMigrations, saveConfig };