@ricsam/r5d-worker 0.0.137 → 0.0.138

package/dist/types/main.d.ts

@@ -1,1169 +1,2 @@
 #!/usr/bin/env bun
-import type { BrowserUploadChunk, BrowserUploadReadInput } from "@ricsam/r5d-api/browser-upload";
-import type { WorkerLintPlansResult, WorkerUpdatePlanTaskResult } from "./plan-paths";
-import { WORKER_RESUMABLE_PROTOCOL, type WorkerRecoveryClientMessage, type WorkerRecoveryServerMessage } from "./recovery-protocol";
-import { Database } from "bun:sqlite";
-import type { WorkerGitIdentity } from "./git-identity";
-import { configureGitHubRegistryAuthFiles, type PreparedPrivateAuthFileGeneration } from "./registry-auth";
-import { WorkspaceMountHoldFence } from "./workspace-mount-hold-fence";
-import { type WorkspaceCommandProjectTarget } from "./workspace-command-targets";
-import { type WorkerHydrationRecovery } from "./workspace-hydration-recovery-state";
-import { type WorkspaceHydrationTransactionHooks, type WorkspaceGitSyncResult } from "./workspace-git-sync";
-type WorkerProjectConfig = {
-    projectId: string;
-    checkoutPathSegments: [namespace: string, project: string];
-    projectPath: string;
-    repoHttpUrl: string | null;
-    repoAuthHeader: string | null;
-    defaultBranch: string;
-    repositoryTransitionId: string | null;
-    executionDisabled: boolean;
-    mirrorWritesDisabled: boolean;
-    preserveOnlyBranches: Array<{
-        branchId: string;
-        branchName: string;
-    }>;
-    branches: Array<{
-        branchId: string;
-        branchName: string;
-        sourceBranchName: string | null;
-        baseCommitHash: string;
-    }>;
-};
-type WorkerAheadOfOriginBranch = {
-    projectId: string;
-    branchName: string;
-    ahead: number;
-};
-type WorkerLifecycleProgress = {
-    phase: "starting" | "recovering" | "configuring" | "syncing" | "ready" | "failed";
-    operationId: string;
-    detail?: string;
-    completedBytes?: number;
-    totalBytes?: number;
-    completedItems?: number;
-    totalItems?: number;
-};
-declare function boundedWorkerLifecycleProgress(progress: WorkerLifecycleProgress): WorkerLifecycleProgress;
-declare function workerServerHeartbeatAction(input: {
-    elapsedMs: number;
-    probeElapsedMs?: number;
-    timeoutMs: number;
-    watchdogSweepDelayed: boolean;
-}): "wait" | "start_probe" | "terminate";
-/**
- * A hydration transaction runs on the workspace filesystem executor thread
- * and on a stalled disk it can run for a long time; the server bounds its
- * deadlines by a hydration heartbeat lease rather than by the ordinary
- * request timeout. Declare that lease first: the server keeps the control
- * socket open and defers the affected request deadlines while the lease is
- * active, which is what turned one slow hydration into a mandatory canonical
- * reset before the lease existed (incident 3bccab03). The extra event-loop
- * turn lets control messages that were already queued run before the busy
- * observation that precedes the transaction. The hooks also hold every mount
- * a job reads or writes on the process-wide fence, so command admission for
- * those mounts waits until the job ended (incident 10).
- */
-declare function createWorkspaceHydrationLeaseHooks(send: (message: Extract<WorkerClientMessage, {
-    type: "heartbeat_lease";
-}>) => void, options: {
-    fence: WorkspaceMountHoldFence;
-    yieldToEventLoop?: () => Promise<void>;
-    log?: (line: string) => void;
-    now?: () => number;
-}): WorkspaceHydrationTransactionHooks;
-export declare const workerLifecycleTestHarness: {
-    boundedWorkerLifecycleProgress: typeof boundedWorkerLifecycleProgress;
-    workerServerHeartbeatAction: typeof workerServerHeartbeatAction;
-    createWorkspaceHydrationLeaseHooks: typeof createWorkspaceHydrationLeaseHooks;
-    workerCommandHasWorkspaceEffect: typeof workerCommandHasWorkspaceEffect;
-};
-type WorkspaceSyncTrigger = {
-    type: "connect" | "inbound_head" | "write" | "edit" | "shell_inline" | "process_terminal" | "process_cancel" | "periodic" | "manual" | "remediation" | "remediation_confirm" | "remediation_reset";
-    sessionId?: string;
-    processRunId?: string;
-    toolCallId?: string;
-    projectId?: string;
-    branchName?: string;
-    detail?: string;
-};
-type WorkspaceSyncResult = {
-    hydrationRecovery?: WorkerHydrationRecovery;
-    mountSkipReasons?: WorkspaceGitSyncResult["mountSkipReasons"];
-    type: "workspace_sync";
-    attemptId: string;
-    workerLabel: string;
-    trigger: WorkspaceSyncTrigger;
-    outcome: "no_change" | "published" | "updated" | "conflict_reset" | "large_diff_blocked" | "conflict_blocked" | "reset" | "failed";
-    startingHead: string | null;
-    localHead?: string;
-    publishedHead?: string;
-    rebaseCount: number;
-    diffSizeBytes: number;
-    gitStatus: string;
-    affectedProjects: string[];
-    affectedPaths: string[];
-    activeMountIds?: string[];
-    skippedMountIds?: string[];
-    /** Configured checkouts this cycle excluded because their directory is absent or is not a linked worktree of the project. */
-    missingCheckouts?: Array<{
-        projectId: string;
-        branchName: string;
-        reason: "missing" | "not_a_worktree";
-    }>;
-    activeProjectBranchPublications?: Array<{
-        branchId: string;
-        projectId: string;
-        branchName: string;
-    }>;
-    discardedPaths: string[];
-    localChangesDiscarded: boolean;
-    conflictPaths?: string[];
-    conflictSnapshotRefs?: {
-        local: string;
-        remote: string;
-    };
-    conflictKind?: "integration_rebase" | "projection_merge";
-    verifiedAncestorHeads?: string[];
-    telemetry?: {
-        totalMs: number;
-        queueMs: number;
-        prepareMs: number;
-        synchronizeMs: number;
-    };
-    error?: string;
-    /** Typed reason for a failed outcome the server should surface loudly. */
-    failureReason?: "unsafe_hydration" | "hydration_recovery_required";
-    /** Consecutive in-process recovery bounces taken for unsafe hydration failures. */
-    recoveryAttempt?: number;
-};
-export type WorkerSessionTarget = {
-    type: "project";
-    projectId: string;
-    branchName: string;
-} | {
-    type: "workspace";
-    ownerUserId: string;
-    rootProfile: "visible_projects" | "canonical_sync";
-};
-type WorkerCancelScope = "unstarted";
-type WorkerCancelOutcome = "unstarted" | "started" | "stopped" | "unknown";
-type WorkerClientMessage = WorkerRecoveryClientMessage | {
-    type: "capacity_report";
-    capacity: import("./command-launcher").CommandLaunchCapacityReport & {
-        reportedAt: string;
-    };
-} | {
-    type: "hello";
-    resumableProtocol: typeof WORKER_RESUMABLE_PROTOCOL;
-    runtimeId: string;
-    ledgerId: string;
-    hostInfo?: Record<string, unknown>;
-    startupReady?: boolean;
-} | {
-    type: "worker_progress";
-    progress: WorkerLifecycleProgress;
-} | {
-    type: "heartbeat_lease";
-    operationId: string;
-    active: boolean;
-    /** A hydration transaction may block the worker for hours; the server bounds it separately from preparation leases. */
-    kind?: "hydration";
-} | {
-    type: "startup_ready";
-} | {
-    type: "active_processes";
-    processes: Array<{
-        runId: string;
-        target: WorkerSessionTarget;
-        sessionId: string;
-        platform: string;
-        arch: string;
-        mode: "foreground" | "detached";
-        pid?: number;
-        processGroupId?: number;
-        credentialId?: string;
-        argv: string[];
-        command: string;
-        cwd?: string;
-        startedAt: string;
-        interactive?: boolean;
-        workspaceEffect?: "none";
-        commandClass?: "control";
-    }>;
-} | {
-    type: "pty_opened";
-    requestId: string;
-    ptyId: string;
-} | {
-    type: "pty_output";
-    ptyId: string;
-    data: string;
-} | {
-    type: "pty_exit";
-    ptyId: string;
-    exitCode: number;
-    signal?: number | string;
-} | {
-    type: "pty_error";
-    ptyId: string;
-    requestId?: string;
-    error: string;
-} | {
-    type: "browser_upload_read_result";
-    requestId: string;
-    result?: WorkerOperationResult;
-    error?: string;
-} | {
-    type: "operation_result";
-    requestId: string;
-    result?: WorkerOperationResult;
-    error?: string;
-} | {
-    /** Immediate receipt for a branch create/delete; `queuePosition` is 0 when it runs at once. */
-    type: "operation_queued";
-    requestId: string;
-    queuePosition: number;
-} | {
-    type: "exec_result";
-    requestId: string;
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    durationMs?: number;
-    error?: string;
-} | {
-    type: "exec_accepted";
-    requestId: string;
-    runId: string;
-} | {
-    type: "exec_started";
-    requestId: string;
-    runId: string;
-    cwd: string;
-    pid?: number;
-    processGroupId?: number;
-} | {
-    type: "exec_start_error";
-    requestId: string;
-    runId: string;
-    error: string;
-} | {
-    type: "exec_output";
-    runId: string;
-    stream: "stdout" | "stderr";
-    data: string;
-} | {
-    type: "exec_exit";
-    runId: string;
-    exitCode: number;
-    durationMs?: number;
-    timedOut?: boolean;
-    workspaceEffect?: "none";
-    canonicalWorkspaceHead?: string;
-} | {
-    type: "exec_error";
-    runId: string;
-    error: string;
-    durationMs?: number;
-    workspaceEffect?: "none";
-    canonicalWorkspaceHead?: string;
-} | {
-    type: "cancel_result";
-    requestId: string;
-    runId: string;
-    cancelled: boolean;
-    message?: string;
-    /** `unstarted`: a launch that had not spawned was revoked; `started`: a spawned process was left alone; `stopped`; `unknown`: no record, cancellation recorded. */
-    outcome?: WorkerCancelOutcome;
-} | {
-    type: "pong";
-} | {
-    type: "workspace_configured";
-    requestId: string;
-    result: WorkspaceSyncResult;
-    pendingCheckouts: Array<{
-        projectId: string;
-        branchName: string;
-    }>;
-    aheadOfOriginBranches: WorkerAheadOfOriginBranch[];
-    deferredWorkspaceSyncForIncidentId?: string;
-    /**
-     * The configuration was not applied because these projects have visible
-     * checkout activity; every executable checkout above is pending and the
-     * previous generation stays on disk until a retry lands on idle checkouts.
-     */
-    deferredForBusyProjectIds?: string[];
-} | {
-    type: "workspace_sync_started";
-    attemptId: string;
-} | {
-    type: "workspace_sync_result";
-    requestId?: string;
-    result: WorkspaceSyncResult;
-} | {
-    type: "session_artifacts_sync_result";
-    requestId: string;
-    sessionId: string;
-    error?: string;
-} | {
-    type: "update_clis_result";
-    requestId: string;
-    installedWorkerVersion?: string;
-    installedR5dctlVersion?: string;
-    error?: string;
-};
-type WorkerServerMessage = WorkerRecoveryServerMessage | {
-    type: "connected";
-    label: string;
-    workerId: string;
-} | {
-    type: "workspace_config";
-    recoverHydrationTransactionId?: string;
-    requestId: string;
-    projects: WorkerProjectConfig[];
-    workspaceRemoteUrl: string;
-    gitIdentity: WorkerGitIdentity;
-    githubCredential: WorkerGitHubCredential | null;
-    deferWorkspaceSyncForIncidentId?: string;
-    resetToCanonical?: boolean;
-} | {
-    type: "sync_workspace";
-    requestId: string;
-    attemptId: string;
-    trigger: WorkspaceSyncTrigger;
-    confirmedLargeDiff?: boolean;
-    confirmationReason?: string;
-    resetToCanonical?: boolean;
-    requiredAncestorHeads?: string[];
-} | {
-    /**
-     * Content-derived tokens naming ref state the server read from disk:
-     * `tokens` per canonical project repository, `mountTokens` per
-     * checked-out project branch (keyed by project id then branch name),
-     * and the current head of the hidden workspace repository. Replace-all:
-     * anything absent from a message has no advertised token and the
-     * corresponding fetch runs. Older servers send `tokens` only. See
-     * `project-mirror-fetch-policy.ts`.
-     */
-    type: "project_mirror_refs_tokens";
-    tokens: Record<string, string>;
-    mountTokens?: Record<string, Record<string, string>>;
-    workspaceHead?: string;
-} | {
-    type: "create_project_branch";
-    requestId: string;
-    branchId: string;
-    projectId: string;
-    sourceBranch: string;
-    targetBranch: string;
-    /** `carry` copies the source checkout's uncommitted changes; `clean` checks out its commit only. */
-    workingTree: "carry" | "clean";
-} | {
-    type: "delete_project_branch";
-    requestId: string;
-    branchId: string;
-    projectId: string;
-    branchName: string;
-} | {
-    type: "code_list";
-    requestId: string;
-    target: Extract<WorkerSessionTarget, {
-        type: "project";
-    }>;
-    path: string;
-} | {
-    type: "browser_upload_read";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId: string;
-    input: BrowserUploadReadInput;
-} | {
-    type: "code_read";
-    requestId: string;
-    target: Extract<WorkerSessionTarget, {
-        type: "project";
-    }>;
-    path: string;
-} | {
-    type: "sync_session_artifacts";
-    requestId: string;
-    sessionId: string;
-} | {
-    type: "workspace_incident_updated";
-    incidentId: string | null;
-    status: "remediating" | "waiting_for_worker" | "resolved" | "confirmed" | "reset" | null;
-    originWorkerLabel?: string;
-} | {
-    type: "exec_terminal_ack";
-    runId: string;
-} | {
-    type: "port_forward_connect";
-    forwardId: string;
-    relayConnectionId: string;
-    workerPort: number;
-} | {
-    type: "update_clis";
-    requestId: string;
-    workerPackageSpec: string;
-    r5dctlPackageSpec: string;
-    targetWorkerVersion: string;
-    targetR5dctlVersion: string;
-} | {
-    type: "exec";
-    requestId: string;
-    runId: string;
-    target: WorkerSessionTarget;
-    /** Sibling checkouts fenced for the command's lifetime alongside `target`; project branches only. */
-    additionalTargets?: WorkspaceCommandProjectTarget[];
-    sessionId?: string;
-    argv: string[];
-    cwd?: string;
-    env?: Record<string, string>;
-    timeoutMs?: number;
-    workspaceEffect?: "none";
-} | {
-    type: "exec_start";
-    requestId: string;
-    runId: string;
-    target: WorkerSessionTarget;
-    /** Fixed at admission; kept until the process exits, whatever happens to the claim that produced it. */
-    additionalTargets?: WorkspaceCommandProjectTarget[];
-    sessionId: string;
-    argv: string[];
-    command: string;
-    mode: "foreground" | "detached";
-    credentialId?: string;
-    cwd?: string;
-    env?: Record<string, string>;
-    envFiles?: Array<{
-        path: string;
-        content: string;
-        mode?: number;
-    }>;
-    accountEnvironmentWorkerId?: string;
-    timeoutMs?: number;
-    interactive?: boolean;
-    workspaceEffect?: "none";
-    commandClass?: "control";
-} | {
-    type: "exec_stdin";
-    requestId: string;
-    runId: string;
-    data?: string;
-    eof?: boolean;
-} | {
-    type: "pty_open";
-    requestId: string;
-    ptyId: string;
-    target: WorkerSessionTarget;
-    /** Fixed when the shell opens; kept until the PTY exits. */
-    additionalTargets?: WorkspaceCommandProjectTarget[];
-    cols: number;
-    rows: number;
-    command?: string;
-    env?: Record<string, string>;
-    envFiles?: Array<{
-        path: string;
-        content: string;
-        mode?: number;
-    }>;
-} | {
-    type: "pty_input";
-    requestId: string;
-    ptyId: string;
-    data: string;
-} | {
-    type: "pty_resize";
-    requestId: string;
-    ptyId: string;
-    cols: number;
-    rows: number;
-} | {
-    type: "pty_close";
-    requestId: string;
-    ptyId: string;
-} | {
-    type: "read_plan";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    planId: string;
-    createIfMissing: boolean;
-} | {
-    type: "lint_plans";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    glob?: string;
-} | {
-    type: "update_task_status";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    planId: string;
-    taskId: string;
-    checked: boolean;
-} | {
-    type: "read";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    filePath: string;
-    offset?: number;
-    limit?: number;
-} | {
-    type: "write";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    filePath: string;
-    content: string;
-} | {
-    type: "edit";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    filePath: string;
-    edits: Array<{
-        oldText: string;
-        newText: string;
-    }>;
-} | {
-    type: "grep";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    pattern: string;
-    path?: string;
-    glob?: string;
-    caseSensitive?: boolean;
-    limit?: number;
-} | {
-    type: "find";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    pattern?: string;
-    path?: string;
-    entryType?: string;
-    limit?: number;
-} | {
-    type: "ls";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    path?: string;
-    limit?: number;
-} | {
-    type: "view_file_bytes";
-    requestId: string;
-    target: WorkerSessionTarget;
-    sessionId?: string;
-    activePlanId?: string;
-    filePath: string;
-} | {
-    type: "cancel";
-    requestId: string;
-    runId: string;
-    /** `unstarted`: the server's start-deadline abandonment; never touch a spawned process. */
-    scope?: WorkerCancelScope;
-} | {
-    type: "ping";
-};
-type WorkerReadFileResult = {
-    type: "read";
-    kind: "text";
-    file: string;
-    gitBlobHash?: string;
-    content: string;
-    totalLines: number;
-    startLine: number;
-    endLine: number;
-    truncated: boolean;
-    continuation?: string;
-};
-type WorkerGitHubCredential = {
-    host: "github.com";
-    registry: "ghcr.io";
-    username: string;
-    token: string;
-    missingScopes: Array<"repo" | "read:org" | "gist" | "workflow" | "read:packages" | "write:packages">;
-};
-type WorkerReadPlanResult = {
-    type: "read_plan";
-    read: WorkerReadFileResult;
-    created: boolean;
-};
-type WorkerWriteFileResult = {
-    type: "write";
-    file: string;
-    gitBlobHash?: string;
-};
-type WorkerEditFileResult = {
-    type: "edit";
-    file: string;
-    edits: number;
-};
-type WorkerGrepResult = {
-    type: "grep";
-    content: string;
-    matchCount: number;
-    truncated: boolean;
-};
-type WorkerFindResult = {
-    type: "find";
-    content: string;
-    count: number;
-    truncated: boolean;
-};
-type WorkerLsResult = {
-    type: "ls";
-    path: string;
-    content: string;
-    count: number;
-    truncated: boolean;
-};
-type WorkerViewFileBytesResult = {
-    type: "view_file_bytes";
-    filePath: string;
-    mediaType: "image/png" | "image/jpeg";
-    base64: string;
-    fileSizeBytes: number;
-    width: number;
-    height: number;
-};
-type WorkerExecStdinAck = {
-    type: "exec_stdin";
-    runId: string;
-    bytesWritten: number;
-    eof: boolean;
-};
-type WorkerCreateProjectBranchResult = {
-    type: "create_project_branch";
-    branchId: string;
-    branchName: string;
-    baseCommitHash: string;
-};
-type WorkerDeleteProjectBranchResult = {
-    type: "delete_project_branch";
-    branchId: string;
-    branchName: string;
-};
-type WorkerCodeEntry = {
-    name: string;
-    type: "file" | "directory";
-    size: number | null;
-    mtime: string;
-};
-type WorkerCodeListResult = {
-    type: "code_list";
-    path: string;
-    entries: WorkerCodeEntry[];
-};
-type WorkerCodeReadResult = {
-    type: "code_read";
-    path: string;
-    size: number;
-    mtime: string;
-    base64: string;
-};
-type WorkerOperationResult = WorkerReadFileResult | WorkerReadPlanResult | WorkerLintPlansResult | WorkerUpdatePlanTaskResult | WorkerWriteFileResult | WorkerEditFileResult | WorkerGrepResult | WorkerFindResult | WorkerLsResult | WorkerViewFileBytesResult | WorkerExecStdinAck | WorkerCreateProjectBranchResult | WorkerDeleteProjectBranchResult | WorkerCodeListResult | WorkerCodeReadResult | BrowserUploadChunk;
-type WorkerOperationServerMessage = Extract<WorkerServerMessage, {
-    type: "read_plan" | "lint_plans" | "update_task_status" | "read" | "write" | "edit" | "grep" | "find" | "ls" | "view_file_bytes" | "code_list" | "code_read" | "browser_upload_read";
-}>;
-declare class WorkspaceSyncAdmissionChangedError extends Error {
-    readonly name = "WorkspaceSyncAdmissionChangedError";
-}
-declare function assertWorkerChildAdmission(input: {
-    capturedGeneration: number;
-    currentGeneration: number;
-    sourceSocketIsCurrent: boolean;
-    sourceSocketOpen: boolean;
-    workspaceConfigured: boolean;
-    runtimeHealthy: boolean;
-}): void;
-type WorkerPty = {
-    write(data: string): void;
-    resize(cols: number, rows: number): void;
-    kill(): void;
-    terminate(): Promise<void>;
-};
-type ActiveWorkerPty = WorkerPty & {
-    target: WorkerSessionTarget;
-    /** Declared sibling checkouts, fenced like `target` while the PTY is busy. */
-    additionalTargets: readonly WorkerSessionTarget[];
-    foregroundBusy: boolean;
-    lastInputAt: number;
-    releaseWorkspaceMutation?: () => void;
-};
-type StagedPtyEnvFiles = {
-    paths: string[];
-    resolvedByRequestedPath: Map<string, string>;
-};
-declare function resolvePtyEnvFilePath(requestedPath: string, temporaryRoot?: string): string;
-declare function removePtyEnvFiles(paths: readonly string[]): void;
-declare function stagePtyEnvFiles(envFiles: readonly {
-    path: string;
-    content: string;
-    mode?: number;
-}[] | undefined, temporaryRoot?: string): StagedPtyEnvFiles;
-declare function resolvePtyEnvFileReferences(env: Record<string, string>, staged: StagedPtyEnvFiles): Record<string, string>;
-declare function workerCommandHasWorkspaceEffect(message: {
-    workspaceEffect?: "none";
-}): boolean;
-declare function workerPtyIsWorkspaceBusy(pty: Pick<ActiveWorkerPty, "foregroundBusy" | "lastInputAt">, now?: number, foregroundIdleEnabled?: boolean): boolean;
-declare function parseLinuxPtyForegroundBusy(stat: string): boolean | null;
-export declare const workerPtyTestHarness: {
-    temporaryPathPrefix: string;
-    inputBusyGraceMs: number;
-    resolveEnvFilePath: typeof resolvePtyEnvFilePath;
-    stageEnvFiles: typeof stagePtyEnvFiles;
-    removeEnvFiles: typeof removePtyEnvFiles;
-    resolveEnvFileReferences: typeof resolvePtyEnvFileReferences;
-    commandHasWorkspaceEffect: typeof workerCommandHasWorkspaceEffect;
-    targetProcessEnv: typeof targetProcessEnv;
-    canonicalSyncTerminalHead: typeof canonicalSyncTerminalHead;
-    ptyIsWorkspaceBusy: typeof workerPtyIsWorkspaceBusy;
-    parseLinuxForegroundBusy: typeof parseLinuxPtyForegroundBusy;
-};
-export type WorkerBuiltInToolPaths = {
-    rootDir?: string;
-    sessionId?: string;
-    projectId?: string;
-    branchName?: string;
-    activePlanId?: string;
-};
-export declare function isArtifactEnvPath(filePath: string): boolean;
-export declare function syncSessionArtifacts(input: {
-    baseUrl: string;
-    token: string;
-    sessionId: string;
-    artifactRoot: string;
-}): Promise<string>;
-export declare function prepareArtifactEnvForShell(input: {
-    baseUrl: string;
-    token: string;
-    sessionId?: string;
-    rootDir: string;
-}): Promise<Record<string, string>>;
-export declare function preparePlanEnvForShell(input: {
-    target: WorkerSessionTarget;
-    rootDir: string;
-    activePlanId?: string;
-}): Record<string, string>;
-type ResolvedWorkerFilePath = {
-    absolutePath: string;
-    displayPath: string;
-    repoRelativePath: string;
-    scope: "project";
-} | {
-    absolutePath: string;
-    displayPath: string;
-    repoRelativePath: null;
-    scope: "host";
-} | {
-    absolutePath: string;
-    displayPath: string;
-    repoRelativePath: null;
-    scope: "virtual";
-    virtualRootPath: string;
-};
-export declare function resolveWorkerFilePath(branchPath: string, inputPath: string, builtInPaths?: WorkerBuiltInToolPaths): ResolvedWorkerFilePath;
-declare function readOnlyCredentialStoreHelper(storePath: string): string;
-declare function credentialGenerationReceiptPath(directoryPath?: string): string;
-declare function pendingCredentialGenerationPath(directoryPath?: string): string;
-declare function bootstrapCredentialGenerationPath(directoryPath?: string): string;
-type PendingCredentialGenerationBoundary = {
-    kind: "systemd";
-    machineId: string | null;
-    invocationId: string;
-} | {
-    kind: "boot";
-    machineId: string | null;
-    bootSessionId: string | null;
-};
-type PendingCredentialGenerationIntent = {
-    fingerprint: string;
-    boundary: PendingCredentialGenerationBoundary;
-};
-declare function pendingCredentialGenerationIntentContent(intent: PendingCredentialGenerationIntent): string;
-declare function readPendingCredentialGenerationIntent(intentPath?: string): PendingCredentialGenerationIntent | null;
-type BootSessionIdentifierProbe = {
-    platform: NodeJS.Platform;
-    kernelValue: string;
-};
-declare function readBootSessionIdentifier(probe?: BootSessionIdentifierProbe): string | null;
-type MachineIdentifierProbe = {
-    platform: NodeJS.Platform;
-    kernelValue: string;
-};
-declare function readMachineIdentifier(probe?: MachineIdentifierProbe): string | null;
-type CredentialAuthorityLockHandle = {
-    lockPath: string;
-    database: Database;
-};
-declare function credentialAuthorityLockPath(rootPath?: string): string;
-declare function acquireCredentialAuthorityLock(input: {
-    rootPath?: string;
-    machineId: string | null;
-}): CredentialAuthorityLockHandle;
-declare function releaseCredentialAuthorityLockHandle(handle: CredentialAuthorityLockHandle): void;
-declare function legacySharedCredentialStorePath(): string;
-declare function credentialStorePathForProject(projectId: string): string;
-declare function credentialStorePathForWorkspace(remoteUrl: string): string;
-declare function removeLegacySharedCredentialStore(storePath?: string): void;
-declare function resetCredentialStoreDirectory(directoryPath?: string): void;
-declare function readCredentialGenerationReceipt(receiptPath?: string): string | null;
-declare function pruneCredentialStoreFiles(requiredStorePaths: ReadonlySet<string>, directoryPath?: string): string[];
-declare function replaceCredentialStoreFile(storePath: string, content: string): void;
-declare function credentialHelperForRemotes(remotes: readonly {
-    remoteUrl: string;
-    authHeader: string | null | undefined;
-}[], storePath: string, desiredFiles?: Map<string, string | null>): string | null;
-type CredentialGenerationConfiguration = {
-    workerBaseUrl: string;
-    workerAuthHeader: string;
-    workspaceRemoteUrl: string;
-    githubCredential: WorkerGitHubCredential | null;
-    projects: readonly Pick<WorkerProjectConfig, "projectId" | "repoHttpUrl" | "repoAuthHeader">[];
-};
-declare function credentialGenerationFingerprint(config: CredentialGenerationConfiguration): string;
-type CredentialGenerationTransitionPhase = "current" | "stage_pending_restart" | "publish_from_clean_restart";
-declare function credentialGenerationTransitionPhase(input: {
-    committedFingerprint: string | null;
-    pendingFingerprintAtProcessStart: string | null;
-    incomingFingerprint: string;
-}): CredentialGenerationTransitionPhase;
-declare function initialCredentialBootstrapIsSafe(input: {
-    transitionPhase: CredentialGenerationTransitionPhase;
-    committedFingerprint: string | null;
-    pendingFingerprintAtProcessStart: string | null;
-    bootstrapFingerprintAtProcessStart: string | null;
-    incomingFingerprint: string;
-    credentialArtifactsProvenAbsentAtProcessStart: boolean;
-    trackedChildTerminationProven: boolean;
-    activeProcessCount: number;
-    credentialProcessGroupCount: number;
-    activePtyCount: number;
-}): boolean;
-declare function fenceCredentialGenerationAtConfigureEntry(input: {
-    currentFingerprint: string | null;
-    incomingFingerprint: string;
-    revokeInMemory: () => void;
-    terminatePreviousGeneration: () => Promise<void>;
-}): Promise<boolean>;
-declare function requireCredentialGenerationRestart(required: boolean, fatalExit?: (exitCode: number) => void, exitCode?: number): void;
-declare function pendingCredentialGenerationBoundary(input: {
-    systemdContract: boolean;
-    systemdInvocationId: string | null;
-    bootSessionId: string | null;
-    machineId: string | null;
-}): PendingCredentialGenerationBoundary;
-declare function credentialGenerationBoundaryIsComplete(boundary: PendingCredentialGenerationBoundary): boolean;
-declare function credentialGenerationRestartIsContained(input: {
-    systemdContract: boolean;
-    pendingBoundary: PendingCredentialGenerationBoundary | null;
-    currentSystemdInvocationId: string | null;
-    currentBootSessionId: string | null;
-    currentMachineId: string | null;
-}): boolean;
-type CredentialReapContractProbe = {
-    platform: NodeJS.Platform;
-    invocationId: string | undefined;
-    cgroupText: string;
-    unitProperties: string;
-};
-type CredentialReapContractStatus = "direct" | "systemd_unverified" | "verified_systemd";
-declare function credentialReapContractStatus(probe?: CredentialReapContractProbe): CredentialReapContractStatus;
-declare function verifiedCredentialReapContract(probe?: CredentialReapContractProbe): boolean;
-declare function workspaceConfigurationIncidentDeferral(input: {
-    requestedIncidentId: string | undefined;
-    activeIncidentId: string | null;
-}): {
-    incidentId: string | null;
-    error?: Error;
-};
-type DeferredWorkspaceConfiguration = {
-    incidentId: string;
-    serverRefreshExpected: boolean;
-};
-declare function workspaceIncidentTerminalClearDisposition(input: {
-    deferredConfiguration: DeferredWorkspaceConfiguration | null;
-    clearedIncidentId: string;
-}): "await_server_refresh" | "reconnect_for_refresh";
-declare function workspaceIncidentTerminalRefreshFence(input: {
-    deferredConfiguration: DeferredWorkspaceConfiguration | null;
-    clearedIncidentId: string;
-}): {
-    disposition: "await_server_refresh" | "reconnect_for_refresh";
-    deferredConfiguration: DeferredWorkspaceConfiguration;
-};
-declare function workspaceAutomaticSyncIsAdmitted(input: {
-    workspaceConfigured: boolean;
-    activeIncidentId: string | null;
-    deferredConfiguration: DeferredWorkspaceConfiguration | null;
-}): boolean;
-declare function deferredWorkspaceTargetIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, target: WorkerSessionTarget): boolean;
-declare function deferredWorkspaceSyncTriggerIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, trigger: WorkspaceSyncTrigger): boolean;
-declare function workspaceOperationsAreFenced(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null): boolean;
-declare function workspaceCommandTransportIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, transport: "exec" | "exec_start"): boolean;
-declare function deferredCredentialTransitionMustWait(input: {
-    incidentId: string | null;
-    transitionPhase: CredentialGenerationTransitionPhase;
-    canonicalRemediationActive: boolean;
-}): boolean;
-declare function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId: string | null, activeIncidentId: string | null): boolean;
-declare function workspaceConfigurationResetToCanonicalIsAllowed(requested: boolean | undefined, incidentId: string | null): boolean;
-declare function deferredWorkspaceRefreshWatchdogIsCurrent(input: {
-    capturedIncidentId: string;
-    deferredConfiguration: DeferredWorkspaceConfiguration | null;
-    activeIncidentId: string | null;
-}): boolean;
-declare function incidentDeferredProjectCheckouts(projects: readonly WorkerProjectConfig[]): Array<{
-    projectId: string;
-    branchName: string;
-}>;
-declare function deferredIncidentWorkspaceConfigurationResult(input: {
-    attemptId: string;
-    workerLabel: string;
-    head: string | null;
-    skippedMountIds: string[];
-}): WorkspaceSyncResult;
-declare function workspaceSyncFailureHydrationIsSafe(input: {
-    error: unknown;
-    resetToCanonical: boolean;
-    inspectRecoverableHydration: () => boolean;
-}): boolean;
-declare function unsafeWorkspaceSyncRecoveryBounceDelayMs(attempt: number): number;
-type UnsafeWorkspaceSyncFailureResponse = "fatal_exit" | "recovery_bounce" | "recovery_pending";
-declare function unsafeWorkspaceSyncFailureResponse(input: {
-    resetToCanonical: boolean;
-    recoveryAttempts: number;
-    maxRecoveryAttempts: number;
-    hasRetainableWork: boolean;
-    bouncePending: boolean;
-}): UnsafeWorkspaceSyncFailureResponse;
-declare function fenceUnsafeWorkspaceSyncFailure(input: {
-    hydrationRecoverable: boolean;
-    resetToCanonical: boolean;
-    recoveryAttempts: number;
-    maxRecoveryAttempts: number;
-    hasRetainableWork: boolean;
-    bouncePending: boolean;
-    invalidateExecution: () => void;
-    scheduleRecoveryBounce: () => void;
-    fatalExit?: (exitCode: number) => void;
-    exitCode?: number;
-}): "none" | "recovery_bounce" | "recovery_pending";
-export declare const workerGitSecurityTestHarness: {
-    commandArgs: (args: string[]) => string[];
-    credentialHelperForRemotes: typeof credentialHelperForRemotes;
-    credentialStorePathForProject: typeof credentialStorePathForProject;
-    credentialStorePathForWorkspace: typeof credentialStorePathForWorkspace;
-    legacySharedCredentialStorePath: typeof legacySharedCredentialStorePath;
-    removeLegacySharedCredentialStore: typeof removeLegacySharedCredentialStore;
-    pruneCredentialStoreFiles: typeof pruneCredentialStoreFiles;
-    readOnlyCredentialStoreHelper: typeof readOnlyCredentialStoreHelper;
-    resetCredentialStoreDirectory: typeof resetCredentialStoreDirectory;
-    replaceCredentialStoreFile: typeof replaceCredentialStoreFile;
-    configureGitHubAuth(credential: WorkerGitHubCredential | null, filePaths: readonly string[], configureFiles?: typeof configureGitHubRegistryAuthFiles): void;
-    githubCredential: () => WorkerGitHubCredential | null;
-    credentialGenerationFingerprint: typeof credentialGenerationFingerprint;
-    credentialGenerationTransitionPhase: typeof credentialGenerationTransitionPhase;
-    initialCredentialBootstrapIsSafe: typeof initialCredentialBootstrapIsSafe;
-    fenceCredentialGenerationAtConfigureEntry: typeof fenceCredentialGenerationAtConfigureEntry;
-    requireCredentialGenerationRestart: typeof requireCredentialGenerationRestart;
-    pendingCredentialGenerationBoundary: typeof pendingCredentialGenerationBoundary;
-    credentialGenerationBoundaryIsComplete: typeof credentialGenerationBoundaryIsComplete;
-    credentialGenerationRestartIsContained: typeof credentialGenerationRestartIsContained;
-    credentialReapContractStatus: typeof credentialReapContractStatus;
-    verifiedCredentialReapContract: typeof verifiedCredentialReapContract;
-    fenceUnsafeWorkspaceSyncFailure: typeof fenceUnsafeWorkspaceSyncFailure;
-    unsafeWorkspaceSyncFailureResponse: typeof unsafeWorkspaceSyncFailureResponse;
-    unsafeWorkspaceSyncRecoveryBounceDelayMs: typeof unsafeWorkspaceSyncRecoveryBounceDelayMs;
-    WORKSPACE_UNSAFE_SYNC_MAX_RECOVERY_ATTEMPTS: number;
-    WORKSPACE_UNSAFE_SYNC_RECOVERY_CLOSE_CODE: number;
-    WorkspaceSyncAdmissionChangedError: typeof WorkspaceSyncAdmissionChangedError;
-    workspaceConfigurationIncidentDeferral: typeof workspaceConfigurationIncidentDeferral;
-    workspaceIncidentTerminalClearDisposition: typeof workspaceIncidentTerminalClearDisposition;
-    workspaceIncidentTerminalRefreshFence: typeof workspaceIncidentTerminalRefreshFence;
-    workspaceAutomaticSyncIsAdmitted: typeof workspaceAutomaticSyncIsAdmitted;
-    deferredWorkspaceTargetIsAllowed: typeof deferredWorkspaceTargetIsAllowed;
-    deferredWorkspaceSyncTriggerIsAllowed: typeof deferredWorkspaceSyncTriggerIsAllowed;
-    workspaceOperationsAreFenced: typeof workspaceOperationsAreFenced;
-    workspaceCommandTransportIsAllowed: typeof workspaceCommandTransportIsAllowed;
-    deferredCredentialTransitionMustWait: typeof deferredCredentialTransitionMustWait;
-    workspaceConfigurationIncidentSnapshotIsCurrent: typeof workspaceConfigurationIncidentSnapshotIsCurrent;
-    workspaceConfigurationResetToCanonicalIsAllowed: typeof workspaceConfigurationResetToCanonicalIsAllowed;
-    deferredWorkspaceRefreshWatchdogIsCurrent: typeof deferredWorkspaceRefreshWatchdogIsCurrent;
-    incidentDeferredProjectCheckouts: typeof incidentDeferredProjectCheckouts;
-    deferredIncidentWorkspaceConfigurationResult: typeof deferredIncidentWorkspaceConfigurationResult;
-    workspaceSyncFailureHydrationIsSafe: typeof workspaceSyncFailureHydrationIsSafe;
-    assertWorkerChildAdmission: typeof assertWorkerChildAdmission;
-    executeWriteFileOperation: typeof executeWriteFileOperation;
-    executeOperation: typeof executeOperation;
-    executeEditFileOperation: typeof executeEditFileOperation;
-    terminateCredentialBearingChildren: typeof terminateCredentialBearingChildren;
-    terminateCredentialBearingChildrenWithRetention: typeof terminateCredentialBearingChildrenWithRetention;
-    commitCredentialGeneration(prepared: PreparedPrivateAuthFileGeneration, credential: WorkerGitHubCredential | null, options: {
-        children: readonly {
-            label: string;
-            terminate: () => void | Promise<void>;
-        }[];
-        secretMaterialChanged: boolean;
-        beforeMutation?: (filePath: string, index: number) => void;
-        previousGenerationFenced?: boolean;
-    }): Promise<boolean>;
-    credentialGenerationReceiptPath: typeof credentialGenerationReceiptPath;
-    credentialAuthorityLockPath: typeof credentialAuthorityLockPath;
-    acquireCredentialAuthorityLock: typeof acquireCredentialAuthorityLock;
-    releaseCredentialAuthorityLockHandle: typeof releaseCredentialAuthorityLockHandle;
-    pendingCredentialGenerationPath: typeof pendingCredentialGenerationPath;
-    pendingCredentialGenerationIntentContent: typeof pendingCredentialGenerationIntentContent;
-    readPendingCredentialGenerationIntent: typeof readPendingCredentialGenerationIntent;
-    readBootSessionIdentifier: typeof readBootSessionIdentifier;
-    readMachineIdentifier: typeof readMachineIdentifier;
-    bootstrapCredentialGenerationPath: typeof bootstrapCredentialGenerationPath;
-    readCredentialGenerationReceipt: typeof readCredentialGenerationReceipt;
-};
-export declare function githubCliEnv(token: string | null | undefined): Record<string, string>;
-/**
- * Build an agent-command environment without inheriting credentials that were
- * supplied to bootstrap or authenticate the worker itself. Later layers are
- * explicit server-issued per-run credentials or the currently committed GitHub
- * generation and are intentionally allowed to use the same public variable
- * names.
- */
-export declare function workerChildProcessEnvironment(layers: readonly NodeJS.ProcessEnv[], inherited?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
-type ResolvedWorkerSessionTarget = {
-    target: WorkerSessionTarget;
-    rootPath: string;
-    config?: WorkerProjectConfig;
-};
-declare function canonicalSyncTerminalHead(resolvedTarget: Pick<ResolvedWorkerSessionTarget, "target" | "rootPath">, readHead?: (rootPath: string) => string): string | undefined;
-export declare function describeWorkerSessionTarget(target: WorkerSessionTarget): string;
-export declare function resolveWorkerSessionTarget(input: {
-    target: WorkerSessionTarget;
-    projectsRoot: string;
-    workspaceShadowRoot: string;
-    projectConfigById: Map<string, WorkerProjectConfig>;
-}): ResolvedWorkerSessionTarget;
-export declare function prepareBuiltInToolPathsForTarget(input: {
-    target: WorkerSessionTarget;
-    filePath: string;
-    baseUrl: string;
-    token: string;
-    sessionId?: string;
-    activePlanId?: string;
-    rootDir: string;
-    access: "read" | "write";
-}): Promise<WorkerBuiltInToolPaths | undefined>;
-export declare function readWorkerTextFile(branchPath: string, filePath: string, offset?: number, limit?: number, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerReadFileResult>;
-export declare function writeWorkerTextFile(branchPath: string, filePath: string, content: string, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerWriteFileResult>;
-export declare function editWorkerTextFile(branchPath: string, filePath: string, edits: Array<{
-    oldText: string;
-    newText: string;
-}>, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerEditFileResult>;
-declare function executeWriteFileOperation(input: {
-    message: Extract<WorkerServerMessage, {
-        type: "write";
-    }>;
-    resolvedTarget: ResolvedWorkerSessionTarget;
-    baseUrl: string;
-    token: string;
-    rootDir: string;
-    assertAdmission: () => void;
-}): Promise<WorkerWriteFileResult>;
-declare function executeEditFileOperation(input: {
-    message: Extract<WorkerServerMessage, {
-        type: "edit";
-    }>;
-    resolvedTarget: ResolvedWorkerSessionTarget;
-    baseUrl: string;
-    token: string;
-    rootDir: string;
-    assertAdmission: () => void;
-}): Promise<WorkerEditFileResult>;
-export declare function grepWorkerFiles(branchPath: string, input: {
-    pattern: string;
-    path?: string;
-    glob?: string;
-    caseSensitive?: boolean;
-    limit?: number;
-}, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerGrepResult>;
-export declare function findWorkerFiles(branchPath: string, input: {
-    pattern?: string;
-    path?: string;
-    entryType?: string;
-    limit?: number;
-}, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerFindResult>;
-export declare function listWorkerDirectory(branchPath: string, inputPath?: string, inputLimit?: number, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerLsResult>;
-export declare function listWorkerCodeDirectory(branchPath: string, inputPath: string): Promise<WorkerCodeListResult>;
-export declare function readWorkerCodeFile(branchPath: string, inputPath: string): Promise<WorkerCodeReadResult>;
-export declare function readWorkerImageFile(branchPath: string, filePath: string, builtInPaths?: WorkerBuiltInToolPaths): Promise<WorkerViewFileBytesResult>;
-declare function executeOperation(input: {
-    message: WorkerOperationServerMessage;
-    resolvedTarget: ResolvedWorkerSessionTarget;
-    baseUrl: string;
-    token: string;
-    rootDir: string;
-    assertAdmission: () => void;
-}): Promise<WorkerOperationResult>;
-declare function targetProcessEnv(rootDir: string, target: WorkerSessionTarget): Record<string, string>;
-export declare function prepareShellEnvForTarget(input: {
-    target: WorkerSessionTarget;
-    baseUrl: string;
-    token: string;
-    sessionId?: string;
-    activePlanId?: string;
-    rootDir: string;
-}): Promise<Record<string, string>>;
-declare function createNodePtyBridge(options: {
-    file: string;
-    args: string[];
-    ptyOptions: {
-        name: string;
-        cols: number;
-        rows: number;
-        cwd: string;
-        env: Record<string, string | undefined>;
-    };
-    onOpened: (pid: number) => void;
-    onForeground: (busy: boolean) => void;
-    onOutput: (data: string) => void;
-    onExit: (event: {
-        exitCode: number;
-        signal?: number | string;
-    }) => void;
-    onError: (error: Error) => void;
-    onTerminationError: (error: Error) => void;
-}): WorkerPty;
-export declare const workerPtyBridgeTestHarness: {
-    create: typeof createNodePtyBridge;
-    closeAllBestEffort: typeof closePtysBestEffort;
-};
-export declare function resolveHostShell(command?: string, platform?: NodeJS.Platform): {
-    file: string;
-    args: string[];
-    env?: Record<string, string>;
-};
-declare function closePtysBestEffort(ptys: Iterable<readonly [string, {
-    kill: () => void;
-}]>, reportFailure: (ptyId: string, error: unknown) => void): void;
-declare function terminateCredentialBearingChildren(children: readonly {
-    label: string;
-    terminate: () => void | Promise<void>;
-}[]): Promise<void>;
-declare function terminateCredentialBearingChildrenWithRetention(children: readonly {
-    label: string;
-    terminate: () => void | Promise<void>;
-    onTerminated: () => void;
-}[]): Promise<void>;
 export {};