@robota-sdk/agent-cli 3.0.0-beta.85 → 3.0.0-beta.87

package/dist/node/index.d.ts

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import { IncomingMessage, Server, ServerResponse } from "node:http";
+import { Sandbox } from "e2b/dist/index.mjs";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import "@modelcontextprotocol/sdk/shared/auth.js";
 import "@modelcontextprotocol/sdk/types.js";
@@ -91,7 +93,7 @@ interface IOutboundTraceContext {
 /** Claude Code compatible session end reasons. */
 type TSessionEndReason = 'clear' | 'resume' | 'logout' | 'prompt_input_exit' | 'bypass_permissions_disabled' | 'other';
 //#endregion
-//#region ../agent-core/dist/node/index-DQrmrFn9.d.ts
+//#region ../agent-core/dist/node/index-CjyNzgQN.d.ts
 /**
  * Context data type - for execution contexts
  */
@@ -100,6 +102,11 @@ type TContextData = Record<string, TUniversalValue>;
  * Logger data type - for logging contexts
  */
 type TLoggerData = Record<string, TUniversalValue | Date | Error>;
+/**
+ * Configuration types - for agent configuration
+ */
+type TComplexConfigValue = Record<string, TPrimitiveValue | TUniversalArrayValue | IUniversalObjectValue>;
+type TConfigValue = TPrimitiveValue | TUniversalArrayValue | IUniversalObjectValue | Array<TComplexConfigValue> | Array<Record<string, TPrimitiveValue | TUniversalArrayValue | IUniversalObjectValue>> | Array<TComplexConfigValue> | TComplexConfigValue;
 /**
  * Tool parameter value type - specific for tool parameters
  */
@@ -158,7 +165,35 @@ interface IUriImageMessagePart {
   uri: string;
   mimeType?: string;
 }
-type TUniversalMessagePart = ITextMessagePart | IInlineImageMessagePart | IUriImageMessagePart;
+/** An inline audio observation; provider support is determined by the adapter. */
+interface IInlineAudioMessagePart {
+  type: 'audio_inline';
+  mimeType: string;
+  data: string;
+}
+/** An opaque reference, never authority to fetch its URI. */
+interface IResourceLinkMessagePart {
+  type: 'resource_link';
+  uri: string;
+  name: string;
+  mimeType?: string;
+  title?: string;
+  description?: string;
+  size?: number;
+}
+/** Embedded untrusted resource content, tied to the contributor's opaque URI. */
+type TEmbeddedResourceMessagePart = {
+  type: 'resource_embedded';
+  uri: string;
+  mimeType?: string;
+} & ({
+  text: string;
+  blob?: never;
+} | {
+  blob: string;
+  text?: never;
+});
+type TUniversalMessagePart = ITextMessagePart | IInlineImageMessagePart | IUriImageMessagePart | IInlineAudioMessagePart | IResourceLinkMessagePart | TEmbeddedResourceMessagePart;
 /**
  * Tool call (OpenAI tool calling format).
  */
@@ -265,7 +300,7 @@ type TProviderModelCapability = 'tools' | 'vision' |
 'json_object' | 'reasoning' | 'native_web' | 'streaming' |
 /**
  * CLI-1990: the vendor documents a server-side tool search — deferred definitions the API expands
- * on demand. Declaration-only in v1: Robota runs its own client-side catalog on every provider
+ * on demand. Declaration-only in v1: ConversationAgent runs its own client-side catalog on every provider
  * and emits no vendor block. The member exists so a later offload can be capability-gated in this
  * table rather than by provider name.
  */
@@ -908,6 +943,11 @@ type TActionResponse = {
 interface IUserInteraction {
   ask(request: IActionRequest): Promise<TActionResponse>;
 }
+/**
+ * `IAgentConfig.toolSearch`. `'auto'` (the default) engages deferral by threshold —
+ * `resolveToolSearchMode` — so ten resident tools cost nothing; `'on'` / `'off'` force the answer.
+ */
+type TToolSearchSetting = 'auto' | 'on' | 'off';
 /**
  * The catalog a search tool loads through — the port `IToolExecutionContext.deferredTools` carries.
  *
@@ -930,7 +970,22 @@ interface IDeferredToolCatalog {
 //#region src/interfaces/tool.d.ts
 /** Awaited host admission for effective parameters, immediately before a tool body. */
 type TToolEffectAdmission<TParameters = TToolParameters> = (parameters: TParameters) => Promise<void>;
-type TToolContextExtensionValue = TUniversalValue | Date | Error | TLoggerData | TContextData | TToolParameters | TToolMetadata;
+/** Trusted caller scheduling; plugin annotations grant neither authority nor retry permission. */
+interface IToolCallScheduling {
+  dependsOn?: readonly string[];
+  /** Omitted means unknown shared state; an empty array explicitly declares independence. */
+  resources?: readonly {
+    key: string;
+    access: 'read' | 'write';
+  }[];
+}
+interface IToolExecutionPolicy {
+  mode?: 'parallel' | 'sequential';
+  maxConcurrency?: number;
+  continueOnError?: boolean;
+  scheduling?: ReadonlyMap<string, IToolCallScheduling>;
+}
+type TToolContextExtensionValue = TUniversalValue | Date | Error | TLoggerData | TContextData | TToolParameters | TToolMetadata | TUniversalMessagePart[];
 /**
  * Tool metadata structure - specific type definition
  */
@@ -948,6 +1003,8 @@ type TToolMetadata = Record<string, string | number | boolean | string[] | numbe
 interface IToolResult {
   success: boolean;
   data?: TUniversalValue;
+  /** Ordered observations accompanying structured data; images stay typed through history. */
+  parts?: TUniversalMessagePart[];
   error?: string;
   metadata?: TToolMetadata;
   [key: string]: TToolContextExtensionValue | undefined;
@@ -1074,6 +1131,283 @@ interface IParameterValidationResult {
   /** Validation error messages */
   errors: string[];
 }
+/**
+ * Base tool interface
+ */
+/** Host-declared tool attribution. It identifies a source; it never grants execution authority. */
+interface IToolProvenance {
+  readonly sourceId: string;
+  readonly component: string;
+  readonly origin: string;
+  /** A declared source version, not proof of installed bytes. */
+  readonly version?: string;
+  readonly protocolVersion?: string;
+  readonly generation?: string;
+}
+/**
+ * Configuration options for execution caching
+ */
+interface ICacheOptions {
+  /** Whether caching is enabled */
+  enabled: boolean;
+  /** Maximum number of cached entries */
+  maxEntries: number;
+  /** Time-to-live in milliseconds */
+  ttlMs: number;
+}
+//#endregion
+//#region src/interfaces/response-format.d.ts
+/**
+ * Response format configuration
+ */
+interface IResponseFormatConfig {
+  type?: 'text' | 'json_object' | 'json_schema';
+  /** JSON schema payload; required when `type` is `'json_schema'` (CORE-015). */
+  schema?: Record<string, TConfigValue>;
+  /** Schema name forwarded to provider native structured-output surfaces. */
+  name?: string;
+}
+/**
+ * Safety setting configuration
+ */
+interface ISafetySetting {
+  category: string;
+  threshold: string;
+  [key: string]: TConfigValue;
+}
+//#endregion
+//#region src/plugins/event-emitter/types.d.ts
+declare const EXECUTION_EVENT_NAMES: {
+  readonly START: "execution.start";
+  readonly COMPLETE: "execution.complete";
+  readonly ERROR: "execution.error";
+};
+declare const TOOL_EVENT_NAMES: {
+  readonly CALL_START: "tool.call_start";
+  readonly CALL_COMPLETE: "tool.call_complete";
+  readonly CALL_ERROR: "tool.call_error";
+};
+declare const AGENT_EVENT_NAMES: {
+  readonly EXECUTION_START: "agent.execution_start";
+  readonly EXECUTION_COMPLETE: "agent.execution_complete";
+  readonly EXECUTION_ERROR: "agent.execution_error";
+  readonly CREATED: "agent.created";
+};
+type TExecutionEventName = (typeof EXECUTION_EVENT_NAMES)[keyof typeof EXECUTION_EVENT_NAMES];
+type TToolEventName = (typeof TOOL_EVENT_NAMES)[keyof typeof TOOL_EVENT_NAMES];
+type TAgentEventName = (typeof AGENT_EVENT_NAMES)[keyof typeof AGENT_EVENT_NAMES];
+type TEventName = TExecutionEventName | TToolEventName | TAgentEventName | 'tool.beforeExecute' | 'tool.afterExecute' | 'tool.success' | 'conversation.start' | 'conversation.complete' | 'conversation.error' | 'agent.destroyed' | 'plugin.loaded' | 'plugin.unloaded' | 'plugin.error' | 'error.occurred' | 'warning.occurred' | 'module.initialize.start' | 'module.initialize.complete' | 'module.initialize.error' | 'module.execution.start' | 'module.execution.complete' | 'module.execution.error' | 'module.dispose.start' | 'module.dispose.complete' | 'module.dispose.error' | 'module.registered' | 'module.unregistered' | 'execution.hierarchy' | 'execution.realtime' | 'tool.realtime' | 'custom';
+/**
+ * Valid event data value types
+ */
+type TEventDataValue = string | number | boolean | Date | null | undefined | TEventDataValue[] | {
+  [key: string]: TEventDataValue;
+};
+/**
+ * Event data structure
+ */
+interface IEventEmitterEventData {
+  type: TEventName;
+  timestamp: Date;
+  executionId?: string;
+  sessionId?: string;
+  userId?: string;
+  data?: Record<string, TEventDataValue>;
+  error?: Error;
+  metadata?: Record<string, TEventDataValue>;
+}
+/**
+ * Event listener function
+ */
+type TEventEmitterListener = (event: IEventEmitterEventData) => void | Promise<void>;
+/**
+ * Console-like interface for the EventEmitterPlugin.
+ *
+ * Use this interface for typing instead of the concrete EventEmitterPlugin class.
+ */
+interface IEventEmitterPlugin {
+  on(eventType: TEventName, listener: TEventEmitterListener, options?: {
+    once?: boolean;
+    filter?: (event: IEventEmitterEventData) => boolean;
+  }): string;
+  once(eventType: TEventName, listener: TEventEmitterListener, filter?: (event: IEventEmitterEventData) => boolean): string;
+  off(eventType: TEventName, handlerIdOrListener: string | TEventEmitterListener): boolean;
+  emit(eventType: TEventName, eventData?: Partial<IEventEmitterEventData>): Promise<void>;
+}
+//#endregion
+//#region src/abstracts/abstract-module-types.d.ts
+/** Module execution context */
+interface IModuleExecutionContext {
+  executionId?: string;
+  sessionId?: string;
+  userId?: string;
+  agentName?: string;
+  metadata?: Record<string, string | number | boolean | Date>;
+  [key: string]: string | number | boolean | Date | Record<string, string | number | boolean | Date> | undefined;
+}
+/** Module execution result */
+interface IModuleExecutionResult {
+  success: boolean;
+  data?: IModuleResultData;
+  error?: Error;
+  duration?: number;
+  metadata?: Record<string, string | number | boolean | Date>;
+}
+/** Module result data */
+interface IModuleResultData {
+  [key: string]: string | number | boolean | Record<string, string | number | boolean> | undefined;
+}
+/** Base module options */
+interface IBaseModuleOptions {
+  enabled?: boolean;
+  config?: Record<string, string | number | boolean>;
+}
+/** Module capabilities */
+interface IModuleCapabilities {
+  capabilities: string[];
+  dependencies?: string[];
+  optionalDependencies?: string[];
+}
+/** Module type descriptor */
+interface IModuleDescriptor {
+  type: string;
+  category: ModuleCategory;
+  layer: ModuleLayer;
+  dependencies?: string[];
+  capabilities?: string[];
+}
+/** Module categories */
+declare enum ModuleCategory {
+  CORE = "core",
+  STORAGE = "storage",
+  PROCESSING = "processing",
+  INTEGRATION = "integration",
+  INTERFACE = "interface",
+  CAPABILITY = "capability"
+}
+/** Module layers */
+declare enum ModuleLayer {
+  INFRASTRUCTURE = "infrastructure",
+  CORE = "core",
+  APPLICATION = "application",
+  DOMAIN = "domain",
+  PRESENTATION = "presentation"
+}
+/** Module data for introspection */
+interface IModuleData {
+  name: string;
+  version: string;
+  type: string;
+  enabled: boolean;
+  initialized: boolean;
+  capabilities: IModuleCapabilities;
+  metadata?: Record<string, string | number | boolean>;
+}
+/** Module statistics */
+interface IModuleStats {
+  enabled: boolean;
+  initialized: boolean;
+  executionCount: number;
+  errorCount: number;
+  lastActivity?: Date;
+  averageExecutionTime?: number;
+  [key: string]: string | number | boolean | Date | undefined;
+}
+/** Type-safe module interface */
+interface IModule<TOptions extends IBaseModuleOptions = IBaseModuleOptions, TStats = IModuleStats> {
+  name: string;
+  version: string;
+  enabled: boolean;
+  initialize(options?: TOptions, eventEmitter?: IEventEmitterPlugin): Promise<void>;
+  dispose?(): Promise<void>;
+  execute?(context: IModuleExecutionContext): Promise<IModuleExecutionResult>;
+  getModuleType(): IModuleDescriptor;
+  getCapabilities(): IModuleCapabilities;
+  getData?(): IModuleData;
+  getStats?(): TStats;
+  isEnabled(): boolean;
+  isInitialized(): boolean;
+}
+//#endregion
+//#region src/abstracts/abstract-plugin-types.d.ts
+/** Plugin categories for classification */
+declare enum PluginCategory {
+  MONITORING = "monitoring",
+  LOGGING = "logging",
+  STORAGE = "storage",
+  NOTIFICATION = "notification",
+  SECURITY = "security",
+  PERFORMANCE = "performance",
+  ERROR_HANDLING = "error_handling",
+  LIMITS = "limits",
+  EVENT_PROCESSING = "event_processing",
+  CUSTOM = "custom"
+}
+/** Plugin priority levels */
+declare enum PluginPriority {
+  CRITICAL = 1000,
+  HIGH = 800,
+  NORMAL = 500,
+  LOW = 200,
+  MINIMAL = 100
+}
+/** Plugin options that all plugin options should extend */
+interface IPluginOptions {
+  enabled?: boolean;
+  category?: PluginCategory;
+  priority?: PluginPriority | number;
+  moduleEvents?: TEventName[];
+  subscribeToAllModuleEvents?: boolean;
+}
+/** Plugin data interface */
+interface IPluginData {
+  name: string;
+  version: string;
+  enabled: boolean;
+  category: PluginCategory;
+  priority: number;
+  subscribedEvents: TEventName[];
+  metadata?: Record<string, string | number | boolean>;
+}
+/** Type-safe plugin interface with specific type parameters */
+interface IPluginContract<TOptions extends IPluginOptions = IPluginOptions, TStats = IPluginStats> {
+  name: string;
+  version: string;
+  enabled: boolean;
+  category: PluginCategory;
+  priority: number;
+  initialize(options?: TOptions): Promise<void>;
+  /**
+   * CORE-022: the single component-level disposal entry point. The base implementation
+   * unsubscribes module events; overrides release owned resources (timers, sockets,
+   * storage) — always calling `super.dispose()`. Driven by `ConversationAgent.destroy()`.
+   */
+  dispose(): Promise<void>;
+  cleanup?(): Promise<void>;
+  getData?(): IPluginData;
+  getStats?(): TStats;
+  subscribeToModuleEvents?(eventEmitter: IEventEmitterPlugin): Promise<void>;
+  unsubscribeFromModuleEvents?(eventEmitter: IEventEmitterPlugin): Promise<void>;
+  onModuleEvent?(eventName: TEventName, eventData: IEventEmitterEventData): Promise<void> | void;
+}
+/** Plugin statistics base interface with common metrics */
+interface IPluginStats {
+  enabled: boolean;
+  calls: number;
+  errors: number;
+  lastActivity?: Date;
+  moduleEventsReceived?: number;
+  [key: string]: string | number | boolean | Date | string[] | number[] | boolean[] | Record<string, string | number | boolean | Date> | undefined;
+}
+//#endregion
+//#region src/utils/logger.d.ts
+/**
+ * Reusable type definitions for logger utility
+ */
+/**
+ * Log levels for the logger
+ */
+type TUtilLogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent';
 /**
  * Type-safe tool interface with type parameters
  *
@@ -1082,6 +1416,7 @@ interface IParameterValidationResult {
  */
 interface IToolContract<TParameters = TToolParameters, TResult = IToolResult> {
   readonly schema: IToolSchema;
+  readonly provenance?: IToolProvenance;
   execute(parameters: TParameters, context: IToolExecutionContext): Promise<TResult>;
   /**
    * Wrappers await admission exactly once with final canonical arguments after preconditions and before
@@ -1094,15 +1429,147 @@ interface IToolContract<TParameters = TToolParameters, TResult = IToolResult> {
   getName(): string;
 }
 /**
- * Runtime tool instance contract used by Robota internals.
+ * Runtime tool instance contract used by ConversationAgent internals.
  *
  * Tools passed into Agent configuration must support EventService injection
- * so Robota can emit unified tool lifecycle events.
+ * so ConversationAgent can emit unified tool lifecycle events.
  */
 interface IToolWithEventService<TParameters = TToolParameters, TResult = IToolResult> extends IToolContract<TParameters, TResult> {
   setEventService(eventService: IEventService | undefined): void;
 }
 //#endregion
+//#region src/interfaces/agent.d.ts
+/**
+ * IExecutionContextInjection
+ *
+ * Minimal context payload used to inject an existing ownerPath into a new agent instance
+ * (e.g., when a tool creates an agent and must preserve absolute ownerPath semantics).
+ *
+ * NOTE: This is intentionally NOT ToolExecutionContext. ToolExecutionContext is for tool calls
+ * and requires toolName/parameters; agent creation only needs ownerPath and execution linkage.
+ */
+interface IExecutionContextInjection {
+  ownerPath?: IOwnerPathSegment[];
+  parentExecutionId?: string;
+  rootExecutionId?: string;
+  executionLevel?: number;
+  sourceId?: string;
+}
+/**
+ * Provider-specific configuration
+ */
+interface IAgentProviderConfig {
+  openai?: {
+    apiKey?: string;
+    baseURL?: string;
+    organization?: string;
+    [key: string]: TProviderConfigValue | undefined;
+  };
+  anthropic?: {
+    apiKey?: string;
+    baseURL?: string;
+    [key: string]: TProviderConfigValue | undefined;
+  };
+  google?: {
+    apiKey?: string;
+    projectId?: string;
+    location?: string;
+    [key: string]: TProviderConfigValue | undefined;
+  };
+  [provider: string]: Record<string, TProviderConfigValue | undefined> | undefined;
+}
+/**
+ * Agent configuration options - New design with aiProviders array and defaultModel
+ */
+interface IAgentConfig {
+  id?: string;
+  name: string;
+  aiProviders: IAIProvider[];
+  defaultModel: {
+    provider: string;
+    model: string;
+    temperature?: number;
+    maxTokens?: number;
+    topP?: number;
+    /** Reasoning-effort dial threaded to the provider request builder per call. */
+    effort?: TModelEffortSelection;
+    /** Default tool-invocation directive for every run (CORE-017). `IRunOptions.toolChoice` wins. */
+    toolChoice?: TToolChoice;
+  };
+  tools?: Array<IToolWithEventService>;
+  /** Host-owned per-round policy. Absent declarations serialize unknown shared-state operations. */
+  toolExecutionPolicy?: (calls: readonly IToolCall[]) => IToolExecutionPolicy;
+  /**
+   * CLI-1990: whether tools that declare `deferLoading` are withheld from the model until loaded.
+   * `'auto'` (the default) decides by threshold — `resolveToolSearchMode` — so a small tool set is
+   * never deferred; `'on'` and `'off'` force the answer. Read on every round, never snapshotted.
+   */
+  toolSearch?: TToolSearchSetting;
+  /**
+   * Whether a registered tool is shown to the model at all. Read on every projection, so a live
+   * rule change is reflected by the next round; a hidden tool is absent from the offered set and
+   * from the deferred-tool catalogue alike (issue #3081: a bare-name deny removes the tool).
+   */
+  isToolVisible?: (toolName: string) => boolean;
+  plugins?: Array<IPluginContract<IPluginOptions, IPluginStats>>;
+  modules?: IModule[];
+  systemMessage?: string;
+  systemPrompt?: string;
+  /**
+   * Remediation hint appended to the core-emitted context hard-capacity notice. The core
+   * default is product-neutral; a surface tier may inject product-specific wording here
+   * (e.g. its own compaction command). See execution-round-context.
+   */
+  contextCapacityHint?: string;
+  conversationId?: string;
+  sessionId?: string;
+  userId?: string;
+  /**
+   * Run-isolated (stateless) mode (CORE-014). Default `true`: history accumulates for the
+   * instance's lifetime and the FULL history is sent to the provider on EVERY call — token cost
+   * grows every turn. Set `false` to make the conversation store ephemeral per run: a run executes
+   * on whatever is currently in the store (system prompt + any injected context + the prompt), and
+   * the store resets after the run settles, so nothing accumulates across runs (the system prompt
+   * re-applies on the next run). Equivalent to calling `clearHistory()` around every run, but
+   * declared once and immune to a missed clear. `getHistory()` after a run returns empty in this
+   * mode — read the response from the run's return value or execution events.
+   */
+  retainHistory?: boolean;
+  metadata?: TUniversalMessageMetadata;
+  context?: Record<string, TConfigValue>;
+  logging?: {
+    level?: TUtilLogLevel;
+    enabled?: boolean;
+    format?: string;
+    destination?: string;
+  };
+  providerConfig?: IAgentProviderConfig;
+  responseFormat?: IResponseFormatConfig;
+  safetySettings?: ISafetySetting[];
+  timeout?: number;
+  /**
+   * Default maximum execution rounds per run (round = one model call + its requested tool
+   * executions; see `IRunOptions.maxExecutionRounds` for the full semantics). 0 = no cap.
+   */
+  maxExecutionRounds?: number;
+  maxSameToolInputs?: number;
+  retryAttempts?: number;
+  rateLimiting?: {
+    enabled?: boolean;
+    maxRequests?: number;
+    windowMs?: number;
+  };
+  eventService?: IEventService;
+  executionContext?: IExecutionContextInjection;
+  cache?: ICacheOptions;
+  /**
+   * Injected "ask the user" port (CMD-005). When present, tool executions receive it as
+   * `IToolExecutionContext.ask` so a model-invoked tool (AskUserQuestion) can solicit a structured
+   * answer. Absent in headless/automation contexts.
+   */
+  ask?: IUserInteraction['ask'];
+}
+//#endregion
 //#region src/interfaces/provider-definition.d.ts
 interface IProviderDefinitionConfig {
   name: string;
@@ -1291,6 +1758,12 @@ interface IToolResultAdmissionOptions {
  *   when the classifier keeps refusing
  */
 type TPermissionMode = 'plan' | 'default' | 'acceptEdits' | 'bypassPermissions' | 'auto';
+/** Additional host-owned state protection; common repository and shell protection always applies. */
+interface IPathProtectionPolicy {
+  readonly protectedDirectoryNames: readonly string[];
+  readonly protectedPaths: readonly string[];
+  readonly writableWorktreeContainers: readonly string[];
+}
 /** Context window state snapshot */
 interface IContextWindowState {
   /** Max tokens for the current model */
@@ -1380,7 +1853,32 @@ type TCommandSurfaceLocality = 'local' | 'remote';
 type TCommandRunner = 'runtime' | 'client';
 /** A kind of client surface. Names the surfaces a `'client'` command can run on. */
 type TCommandSurface = 'terminal' | 'gui';
-/** A command entry */
+/** A resource identity bound to the host's verified skill manifest. */
+interface ISkillResourceDescriptor {
+  readonly uri: string;
+  readonly digest: string;
+  readonly size: number;
+}
+/** Verified supporting bytes; reading them does not activate another skill. */
+interface ISkillResource extends ISkillResourceDescriptor {
+  readonly text?: string;
+  readonly blob?: string;
+  readonly mimeType?: string;
+}
+/** A host-owned window for verified lazy skill instructions. */
+interface ISkillContentActivation {
+  readonly content: string;
+  readonly resources?: {
+    readonly manifest: readonly ISkillResourceDescriptor[];
+    /** The host verifies membership, bytes and current authority on every read. */
+    read(uri: string, signal?: AbortSignal): Promise<ISkillResource>;
+  };
+  /** Recheck the host's content consent and source before instructions are published. */
+  validate(): Promise<void>;
+  /** Ends this instruction/supporting-file window, including outstanding reads. */
+  close(): void;
+}
+/** A command entry. */
 interface ICommand {
   /** Command name without slash (e.g., "mode") — used for invocation */
   name: string;
@@ -1404,6 +1902,10 @@ interface ICommand {
   execute?: (args: string) => void | Promise<void>;
   /** Full SKILL.md content (only for skill commands) */
   skillContent?: string;
+  /** Metadata remains lazy; the host verifies and admits instructions only at activation. */
+  skillContentLoader?: {
+    acquire(signal?: AbortSignal): Promise<ISkillContentActivation>;
+  };
   /**
    * The absolute directory the skill's file is in, when its source can name one. `${CLAUDE_SKILL_DIR}`
    * in the skill's content expands to it, so the skill can point at files it ships beside SKILL.md.
@@ -1941,7 +2443,7 @@ interface ISubagentJobState extends Pick<IBackgroundTaskState<'agent'>, 'id' | '
   error?: string;
 }
 //#endregion
-//#region ../agent-interface-session/dist/node/session-contracts-C4R5bYiU.d.ts
+//#region ../agent-interface-session/dist/node/session-contracts-CzxeBbD0.d.ts
 //#endregion
 //#region src/session-loop-contracts.d.ts
 /** A self-paced loop's durable lifecycle, independent of its disposable wake timer. */
@@ -2139,6 +2641,136 @@ interface IEgressPolicy {
   /** Redirect hops followed before refusing. Default 5. */
   readonly maxRedirects?: number;
 }
+interface IEgressDeps {
+  /** Trusted owner/test carrier: this override owns connect-time policy and socket lifetime. */
+  readonly fetch?: typeof globalThis.fetch;
+  readonly lookup?: TEgressLookup;
+}
+//#endregion
+//#region ../agent-tools/dist/node/index.d.ts
+//#endregion
+//#region src/sandbox/types.d.ts
+interface ISandboxRunOptions {
+  timeoutMs?: number;
+  workingDirectory?: string;
+}
+interface ISandboxRunResult {
+  stdout: string;
+  stderr?: string;
+  exitCode: number;
+}
+interface IWorkspaceManifestFileEntry {
+  type: 'file';
+  content: string;
+  encoding?: 'utf8';
+}
+interface IWorkspaceManifestDirectoryEntry {
+  type: 'dir';
+}
+interface IWorkspaceManifestLocalFileEntry {
+  type: 'localFile';
+  src: string;
+}
+interface IWorkspaceManifestLocalDirectoryEntry {
+  type: 'localDir';
+  src: string;
+}
+interface IWorkspaceManifestGitRepositoryEntry {
+  type: 'gitRepo';
+  url: string;
+  ref?: string;
+  shallow?: boolean;
+}
+interface IWorkspaceManifestS3MountEntry {
+  type: 's3Mount';
+  bucket: string;
+  prefix?: string;
+  region: string;
+}
+interface IWorkspaceManifestGcsMountEntry {
+  type: 'gcsMount';
+  bucket: string;
+  prefix?: string;
+}
+interface IWorkspaceManifestR2MountEntry {
+  type: 'r2Mount';
+  bucket: string;
+  accountId: string;
+  prefix?: string;
+}
+interface IWorkspaceManifestAzureBlobMountEntry {
+  type: 'azureBlobMount';
+  container: string;
+  account: string;
+  prefix?: string;
+}
+type TWorkspaceManifestEntry = IWorkspaceManifestFileEntry | IWorkspaceManifestDirectoryEntry | IWorkspaceManifestLocalFileEntry | IWorkspaceManifestLocalDirectoryEntry | IWorkspaceManifestGitRepositoryEntry | IWorkspaceManifestS3MountEntry | IWorkspaceManifestGcsMountEntry | IWorkspaceManifestR2MountEntry | IWorkspaceManifestAzureBlobMountEntry;
+interface IWorkspaceManifestPermissions {
+  read?: string[];
+  write?: string[];
+}
+interface IWorkspaceManifest {
+  entries: Record<string, TWorkspaceManifestEntry>;
+  environment?: Record<string, string>;
+  permissions?: IWorkspaceManifestPermissions;
+}
+interface IWorkspaceManifestApplyOptions {
+  targetRoot?: string;
+  hostRoot?: string;
+}
+type TWorkspaceManifestApplyStatus = 'applied' | 'unsupported';
+interface IWorkspaceManifestAppliedEntry {
+  path: string;
+  type: TWorkspaceManifestEntry['type'];
+  status: TWorkspaceManifestApplyStatus;
+  message?: string;
+}
+interface IWorkspaceManifestApplyResult {
+  entries: IWorkspaceManifestAppliedEntry[];
+}
+/**
+ * How a sandbox's filesystem relates to the host's (issue #3081).
+ *
+ * - `shared` — OS-level confinement of commands over the host filesystem (Seatbelt, bubblewrap).
+ *   File tools stay on the host, bounded by the path guard and the permission rules.
+ * - `separate` — a remote or VM filesystem (E2B, in-memory). EVERY file tool must route through the
+ *   sandbox, or a search would read one filesystem while an edit writes another.
+ */
+type TSandboxFilesystem = 'shared' | 'separate';
+/** A process to start: the executable, its arguments, and where it runs. */
+interface ICommandInvocation {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly cwd: string;
+  /** Data handed to the process on descriptors 3, 4, …, each written whole and then closed. */
+  readonly inputDescriptors?: readonly Uint8Array[];
+  /** Runs once the process has exited; a returned note is appended to the command's output. */
+  readonly afterExit?: () => string | undefined;
+}
+interface ISandboxClient {
+  /** Absent means `separate`: every client before this field existed had its own filesystem. */
+  readonly filesystem?: TSandboxFilesystem;
+  /**
+   * A `shared` client that confines a host process in place: the shell tool starts the returned
+   * invocation itself, so timeouts, cancellation, output limits and process-group kill stay the
+   * tool's. Returning the invocation unchanged runs the command unconfined.
+   */
+  wrapCommand?(invocation: ICommandInvocation, shellCommand: string): ICommandInvocation;
+  /**
+   * Whether this client confines `shellCommand` and its settings let a confined command run without
+   * a prompt. The permission gate still refuses or asks first for deny rules, ask rules and the
+   * never-auto set.
+   */
+  autoApproves?(shellCommand: string): boolean;
+  run(command: string, options?: ISandboxRunOptions): Promise<ISandboxRunResult>;
+  readFile(path: string): Promise<string>;
+  writeFile(path: string, content: string): Promise<void>;
+  applyManifest?(manifest: IWorkspaceManifest, options?: IWorkspaceManifestApplyOptions): Promise<IWorkspaceManifestApplyResult>;
+  /** Return a provider-owned resumable workspace reference. */
+  snapshot?(): Promise<string>;
+  /** Hydrate this client from a provider-owned workspace reference. */
+  restore?(snapshotId: string): Promise<void>;
+}
 //#endregion
 //#region ../agent-session/dist/node/index.d.ts
 type TAutoCompactThreshold = number | false;
@@ -2185,7 +2817,8 @@ interface ISessionReplayValidationResult {
  */
 type TWorkspaceRelation = 'same-worktree' | 'same-repo' | 'different-repo' | 'unknown';
 //#endregion
-//#region ../agent-framework/dist/node/createInteractiveRuntime-BhC0t5ec.d.ts
+//#region ../agent-framework/dist/node/createInteractiveRuntime-BMLlR29T.d.ts
+//#endregion
 //#region src/effort/effort-resolution.d.ts
 type TEffortSelection = TModelEffort | 'auto';
 type TEffortSource = 'command' | 'flag' | 'environment' | 'settings' | 'preset' | 'model-default';
@@ -2232,157 +2865,22 @@ interface IEditCheckpointRestoreResult {
   removedCheckpointCount: number;
 }
 //#endregion
-//#region src/command-api/host-context-types.d.ts
-interface ICommandSkillActivationRequest {
-  readonly invocationSource: TCommandInvocationSource;
-  readonly displayInput?: string;
-  readonly rawInput?: string;
-}
-type TAutoCompactThresholdSource = 'default' | 'settings' | 'session';
-/**
- * Live model re-application options (PRESET-013). Carries the model group a preset switch may
- * re-apply to a running session; `maxOutputTokens` maps to the agent's `maxTokens` channel.
- */
-interface IModelReapplyOptions {
-  model?: string;
-  effort?: TModelEffortSelection;
-  temperature?: number;
-  maxOutputTokens?: number;
-}
-/**
- * A preset `enabledCommandModules`/`disabledCommandModules` name that matched no built command
- * module (INFRA-032). Surfaced as a non-fatal notice on both the startup `--preset` path and the
- * in-session `/preset` path instead of being silently dropped. `kind` records which list the
- * unmatched name came from.
- */
-interface IUnknownCommandModuleName {
-  readonly name: string;
-  readonly kind: 'enabled' | 'disabled';
-}
-interface ICommandSessionReplayValidationReport {
-  logFile: string;
-  entryCount: number;
-  validation: ISessionReplayValidationResult;
+//#region src/command-api/session/session-usage.d.ts
+interface ISessionUsageRecord {
+  readonly promptTokens: number;
+  readonly completionTokens: number;
+  /** Present when the usage was priced on the model that produced it. */
+  readonly costUsd?: number;
+  /** Who spent it; absent for the main thread. */
+  readonly source?: IUsageSource;
 }
 //#endregion
-//#region src/command-api/session-roles.d.ts
-/** Reading and clearing the conversation the session holds. */
-interface ICommandSessionHistory {
-  clearHistory(): void;
-  getMessageCount(): number;
-  getFullHistory(): IHistoryEntry[];
-  getHistory(): TUniversalMessage[];
-}
-/** The session's context window and its compaction policy. */
-interface ICommandSessionContextWindow {
-  compact(instructions?: string): Promise<void>;
-  getContextState(): IContextWindowState;
-  getAutoCompactThreshold(): number | false;
-  setAutoCompactThreshold(threshold: TAutoCompactThreshold): void;
-}
-/** What the session is currently permitted to do. */
-interface ICommandSessionPermissions {
-  getPermissionMode(): TPermissionMode;
-  setPermissionMode(mode: TPermissionMode): void;
-  getSessionAllowedTools(): readonly string[];
-  /** The allow/deny/ask rules the gate reads right now, whatever layer or preset supplied them. */
-  getPermissionRules(): {
-    readonly allow: readonly string[];
-    readonly deny: readonly string[];
-    readonly ask: readonly string[];
-  };
-  /** The calls this session refused, most recent first. */
-  getRecentPermissionDenials(): readonly IPermissionDenial[];
-  /** Let the call behind a classifier denial (0-based) run once; `undefined` when there is none. */
-  retryPermissionDenial(index: number): IPermissionDenial | undefined;
+//#region src/command-api/agent-job-roles.d.ts
+/** Starting, steering and ending subagent jobs. */
+interface IAgentJobDispatch {
   /**
-   * ARCH-040 Group C (issue #1934): re-apply a preset's tool lists to the LIVE enforcer.
-   *
-   * REQUIRED, not optional. An optional member would let every consumer invent its own answer for an
-   * absent one, and the answer here governs permissions — a runtime that quietly did nothing would
-   * be the startup/live divergence this seam exists to close, wearing a different hat.
-   *
-   * Without it the startup path could apply a preset's tool lists and `/preset` could not: one
-   * session holding two answers for the same preset depending on WHEN it was chosen.
-   */
-  applyPresetToolLists(preset: {
-    allowedTools?: readonly string[];
-    deniedTools?: readonly string[];
-  }): void;
-}
-/**
- * The tool schemas this session puts in front of the model (CLI-1990).
- *
- * The OFFERED set, not the registered one: with deferral engaged, a withheld tool's schema never
- * reaches the request, and `/context` reports what the request actually costs. Reading it is how the
- * saving deferral produces becomes observable at all — before this, no surface separated the tool
- * schemas from the system prompt they are billed alongside.
- */
-interface ICommandSessionTools {
-  getOfferedToolSchemas(): IToolSchema[];
-  /**
-   * Offer tools that became usable mid-session — an MCP server connected after its sign-in — from
-   * the next turn on (never within a running turn), under the same wrappers and permission gate as
-   * the session's own. A name the session already has is left out, never replaced. Resolves to the
-   * names that will be offered.
-   */
-  addTools(tools: readonly IToolWithEventService[]): Promise<readonly string[]>;
-}
-/** Who this session is, and what it has spent. */
-interface ICommandSessionIdentity {
-  getSessionId(): string;
-  getSessionTokenUsage(): {
-    inputTokens: number;
-    outputTokens: number;
-  } | undefined;
-  getModelId(): string | undefined;
-}
-/** Live model reconfiguration. */
-interface ICommandSessionModel {
-  /**
-   * Re-apply model/effort/temperature/maxOutputTokens to the live session (PRESET-013).
-   * May be async: the runtime ensures the agent is fully initialized before mutating its model
-   * configuration, so callers must await the result.
-   */
-  applyModelOptions(options: IModelReapplyOptions): void | Promise<void>;
-  /** Read the model-effort selection for the next model call. */
-  getModelEffort(): TModelEffortSelection;
-  /**
-   * ARCH-040 — re-apply the preset's `agentName` to the live agent.
-   *
-   * REQUIRED, like every other member of this role port: an optional one would make each consumer
-   * decide what "no rename seam" means, and `/preset` would decide it alone.
-   */
-  applyAgentName(name: string): void | Promise<void>;
-}
-/** Live preset state carried by the session. */
-interface ICommandSessionPreset {
-  /** Read the active preset id (PRESET-011 runtime state). */
-  getActivePresetId(): string;
-  /** Set the active preset id (PRESET-011 runtime state — pure state, no option re-application). */
-  setActivePresetId(id: string): void;
-  /** Toggle subagent dispatch live for the running session (PRESET-016 runtime gate). */
-  setParallelSubagentsEnabled(enabled: boolean): void;
-}
-/** Aggregate: every member remains source-compatible. Declare a role port instead of this. */
-interface ICommandSessionRuntime extends ICommandSessionHistory, ICommandSessionContextWindow, ICommandSessionPermissions, ICommandSessionIdentity, ICommandSessionModel, ICommandSessionPreset, ICommandSessionTools {}
-//#endregion
-//#region src/command-api/session/session-usage.d.ts
-interface ISessionUsageRecord {
-  readonly promptTokens: number;
-  readonly completionTokens: number;
-  /** Present when the usage was priced on the model that produced it. */
-  readonly costUsd?: number;
-  /** Who spent it; absent for the main thread. */
-  readonly source?: IUsageSource;
-}
-//#endregion
-//#region src/command-api/agent-job-roles.d.ts
-/** Starting, steering and ending subagent jobs. */
-interface IAgentJobDispatch {
-  /**
-   * #3282 §4: the agent switcher's roster — `definedIn` is a plain-words location (a discovered
-   * file's path, or "Built-in") a person picking an agent can read.
+   * #3282 §4: the agent switcher's roster — `definedIn` is a plain-words location (a discovered
+   * file's path, or "Built-in") a person picking an agent can read.
    */
   listAgentDefinitions(): Array<{
     name: string;
@@ -2524,6 +3022,146 @@ interface IPresetApplicationOptions {
   selfVerification?: boolean;
 }
 //#endregion
+//#region src/command-api/host-context-types.d.ts
+/** Stable product-facing names commands use when they must suggest a terminal command. */
+interface ICommandProductVocabulary {
+  readonly cliName: string;
+  readonly displayName: string;
+}
+interface ICommandSkillActivationRequest {
+  readonly invocationSource: TCommandInvocationSource;
+  readonly displayInput?: string;
+  readonly rawInput?: string;
+}
+type TAutoCompactThresholdSource = 'default' | 'settings' | 'session';
+/**
+ * Live model re-application options (PRESET-013). Carries the model group a preset switch may
+ * re-apply to a running session; `maxOutputTokens` maps to the agent's `maxTokens` channel.
+ */
+interface IModelReapplyOptions {
+  model?: string;
+  effort?: TModelEffortSelection;
+  temperature?: number;
+  maxOutputTokens?: number;
+}
+/**
+ * A preset `enabledCommandModules`/`disabledCommandModules` name that matched no built command
+ * module (INFRA-032). Surfaced as a non-fatal notice on both the startup `--preset` path and the
+ * in-session `/preset` path instead of being silently dropped. `kind` records which list the
+ * unmatched name came from.
+ */
+interface IUnknownCommandModuleName {
+  readonly name: string;
+  readonly kind: 'enabled' | 'disabled';
+}
+interface ICommandSessionReplayValidationReport {
+  logFile: string;
+  entryCount: number;
+  validation: ISessionReplayValidationResult;
+}
+//#endregion
+//#region src/command-api/session-roles.d.ts
+/** Reading and clearing the conversation the session holds. */
+interface ICommandSessionHistory {
+  clearHistory(): void;
+  getMessageCount(): number;
+  getFullHistory(): IHistoryEntry[];
+  getHistory(): TUniversalMessage[];
+}
+/** The session's context window and its compaction policy. */
+interface ICommandSessionContextWindow {
+  compact(instructions?: string): Promise<void>;
+  getContextState(): IContextWindowState;
+  getAutoCompactThreshold(): number | false;
+  setAutoCompactThreshold(threshold: TAutoCompactThreshold): void;
+}
+/** What the session is currently permitted to do. */
+interface ICommandSessionPermissions {
+  getPermissionMode(): TPermissionMode;
+  setPermissionMode(mode: TPermissionMode): void;
+  getSessionAllowedTools(): readonly string[];
+  /** The allow/deny/ask rules the gate reads right now, whatever layer or preset supplied them. */
+  getPermissionRules(): {
+    readonly allow: readonly string[];
+    readonly deny: readonly string[];
+    readonly ask: readonly string[];
+  };
+  /** The calls this session refused, most recent first. */
+  getRecentPermissionDenials(): readonly IPermissionDenial[];
+  /** Let the call behind a classifier denial (0-based) run once; `undefined` when there is none. */
+  retryPermissionDenial(index: number): IPermissionDenial | undefined;
+  /**
+   * ARCH-040 Group C (issue #1934): re-apply a preset's tool lists to the LIVE enforcer.
+   *
+   * REQUIRED, not optional. An optional member would let every consumer invent its own answer for an
+   * absent one, and the answer here governs permissions — a runtime that quietly did nothing would
+   * be the startup/live divergence this seam exists to close, wearing a different hat.
+   *
+   * Without it the startup path could apply a preset's tool lists and `/preset` could not: one
+   * session holding two answers for the same preset depending on WHEN it was chosen.
+   */
+  applyPresetToolLists(preset: {
+    allowedTools?: readonly string[];
+    deniedTools?: readonly string[];
+  }): void;
+}
+/**
+ * The tool schemas this session puts in front of the model (CLI-1990).
+ *
+ * The OFFERED set, not the registered one: with deferral engaged, a withheld tool's schema never
+ * reaches the request, and `/context` reports what the request actually costs. Reading it is how the
+ * saving deferral produces becomes observable at all — before this, no surface separated the tool
+ * schemas from the system prompt they are billed alongside.
+ */
+interface ICommandSessionTools {
+  getOfferedToolSchemas(): IToolSchema[];
+  /**
+   * Offer tools that became usable mid-session — an MCP server connected after its sign-in — from
+   * the next turn on (never within a running turn), under the same wrappers and permission gate as
+   * the session's own. A name the session already has is left out, never replaced. Resolves to the
+   * names that will be offered.
+   */
+  addTools(tools: readonly IToolWithEventService[]): Promise<readonly string[]>;
+}
+/** Who this session is, and what it has spent. */
+interface ICommandSessionIdentity {
+  getSessionId(): string;
+  getSessionTokenUsage(): {
+    inputTokens: number;
+    outputTokens: number;
+  } | undefined;
+  getModelId(): string | undefined;
+}
+/** Live model reconfiguration. */
+interface ICommandSessionModel {
+  /**
+   * Re-apply model/effort/temperature/maxOutputTokens to the live session (PRESET-013).
+   * May be async: the runtime ensures the agent is fully initialized before mutating its model
+   * configuration, so callers must await the result.
+   */
+  applyModelOptions(options: IModelReapplyOptions): void | Promise<void>;
+  /** Read the model-effort selection for the next model call. */
+  getModelEffort(): TModelEffortSelection;
+  /**
+   * ARCH-040 — re-apply the preset's `agentName` to the live agent.
+   *
+   * REQUIRED, like every other member of this role port: an optional one would make each consumer
+   * decide what "no rename seam" means, and `/preset` would decide it alone.
+   */
+  applyAgentName(name: string): void | Promise<void>;
+}
+/** Live preset state carried by the session. */
+interface ICommandSessionPreset {
+  /** Read the active preset id (PRESET-011 runtime state). */
+  getActivePresetId(): string;
+  /** Set the active preset id (PRESET-011 runtime state — pure state, no option re-application). */
+  setActivePresetId(id: string): void;
+  /** Toggle subagent dispatch live for the running session (PRESET-016 runtime gate). */
+  setParallelSubagentsEnabled(enabled: boolean): void;
+}
+/** Aggregate: every member remains source-compatible. Declare a role port instead of this. */
+interface ICommandSessionRuntime extends ICommandSessionHistory, ICommandSessionContextWindow, ICommandSessionPermissions, ICommandSessionIdentity, ICommandSessionModel, ICommandSessionPreset, ICommandSessionTools {}
+//#endregion
 //#region src/context/output-style-prompt.d.ts
 /** Prompt-only projection of an output style. The preset package's richer value satisfies this shape. */
 interface IOutputStylePrompt {
@@ -2551,6 +3189,9 @@ interface IWorkspaceIdentity {
   readonly displayPath: string;
   readonly worktreeRoot: string;
 }
+type TWorkspaceProjectStateNamespace = 'sessions' | 'session-logs' | 'memory' | 'checkpoints';
+/** Host-selected, project-root-relative directories bound to an issued authority. */
+type TWorkspaceProjectStateDirectories = Readonly<Record<TWorkspaceProjectStateNamespace, string>>;
 type TWorkspaceProjectSettingsTarget = 'project' | 'project-local';
 interface IWorkspaceProjectSettingsWriter {
   readonly [workspaceProjectSettingsWriterType]: true;
@@ -2651,7 +3292,7 @@ interface ICommandPermissionModeAdapter {
 }
 /** The permission rules one settings layer declares, named the way the user would find the file. */
 interface IPermissionRuleLayer {
-  /** The file as the user would find it, e.g. `~/.robota/settings.json`. */
+  /** The file as the user would find it, e.g. `~/.agent/settings.json`. */
   readonly source: string;
   readonly scope: string;
   readonly allow: readonly string[];
@@ -2865,8 +3506,32 @@ interface ICommandMCPOAuthLoginResult {
   /** The tools a newly connected server offers, for the session to add. */
   readonly tools: readonly IToolWithEventService[];
 }
+interface ICommandMCPSkillSummary {
+  readonly serverId: string;
+  readonly uri: string;
+  readonly name: string;
+  readonly description: string;
+  readonly invocationName?: string;
+  readonly unavailableReason?: string;
+}
+interface ICommandMCPSkillPreview extends ICommandMCPSkillSummary {
+  readonly namespace: string;
+  readonly fingerprint: string;
+  readonly frontmatter: TUniversalValue;
+  readonly content: string;
+}
+/** Host-controlled content consent. Discovery does not activate instructions or frontmatter. */
+interface ICommandMCPSkillsAdapter {
+  /** Discovered metadata projected into the host's neutral, lazily admitted skill source. */
+  readonly commandSource?: ICommandSource;
+  list(serverId: string): Promise<readonly ICommandMCPSkillSummary[]>;
+  inspect(serverId: string, uri: string): Promise<ICommandMCPSkillPreview>;
+  approve(serverId: string, uri: string, fingerprint: string, source: TCommandInvocationSource): Promise<ICommandMCPSkillPreview>;
+  withdraw(serverId: string, uri: string, source: TCommandInvocationSource): void;
+}
 /** MCP activation lifecycle port. Implemented by the composition root over the MCP policy service. */
 interface ICommandMCPActivationAdapter {
+  readonly skills?: ICommandMCPSkillsAdapter;
   list(): readonly ICommandMCPActivationSummary[];
   /**
    * Where the user acts on a command the model suggests: `session` when they can type a `/mcp`
@@ -3169,6 +3834,8 @@ interface ICommandCostBudgetAdapter {
   clear(): void;
 }
 interface ICommandHostAdapters {
+  /** Host-selected lazy skill metadata; the framework does not know its transport. */
+  skillCommands?: ICommandSource;
   settings?: ICommandSettingsAdapter;
   effort?: ICommandEffortAdapter;
   /** The live advisor: `/advisor` changes its target without touching the session's tools. */
@@ -3315,7 +3982,16 @@ interface IMemoryCurationQueue {
  * `ISemanticMemoryAdapter`); startup injection, the `/memory` command path, and the post-turn capture
  * controller ALL read/write through it, so an injected store is authoritative everywhere (no split-brain).
  */
-interface IMemoryStore extends IDurableMemoryReader, IMemoryWriter, IMemoryRecaller, IMemoryCurationQueue {}
+interface IMemoryStore extends IDurableMemoryReader, IMemoryWriter, IMemoryRecaller, IMemoryCurationQueue {
+  /** User-only topic replacement/deletion. An unsupported backend must expose neither operation. */
+  replaceTopic?(input: IAppendMemoryInput): Promise<IMemoryTopicMutationResult>;
+  forgetTopic?(topic: string): Promise<IMemoryTopicMutationResult>;
+}
+interface IMemoryTopicMutationResult {
+  topic: string;
+  topicPath: string;
+  indexPath: string;
+}
 //#endregion
 //#region src/command-api/host-roles.d.ts
 /** Reaching the live session, and the whole-conversation operations that sit beside it. */
@@ -3418,11 +4094,15 @@ interface ICommandHostWorkspace {
    * same as `'local'` (allow-by-default, matching the rest of the command layer).
    */
   getCommandSurfaceLocality?(): TCommandSurfaceLocality;
+  /** Raw locality supplied by the carrier; absent is not evidence for granting new authority. */
+  getCommandSurfaceLocalityEvidence?(): TCommandSurfaceLocality | undefined;
 }
 /** What commands and skills this host can dispatch. */
 interface ICommandHostCatalog {
   listCommands(): ICommandListEntry[];
   listSkills(): ICommandSkillListEntry[];
+  /** Read only within an existing host-owned skill activation; never acquire authority here. */
+  readSkillResource?(name: string, uri: string): Promise<ISkillResource>;
   executeSkillCommandByName(name: string, args: string, request: ICommandSkillActivationRequest): Promise<ICommandResult | null>;
 }
 /** The edit-checkpoint tree: inspection, restore, and branching. */
@@ -3499,12 +4179,16 @@ interface ICommandHostTerminalHandoff {
 interface ICommandHostAdapterAccess {
   getCommandHostAdapters?(): ICommandHostAdapters;
 }
+/** Optional product names used only when commands need to suggest a terminal command. */
+interface ICommandHostProductVocabulary {
+  getCommandProductVocabulary?(): ICommandProductVocabulary | undefined;
+}
 /** Aggregate: all 48 members remain source-compatible. Declare a role port instead of this. */
-interface ICommandHostContext extends ICommandHostSessionAccess, ICommandHostAgentJobs, ICommandHostUserInteraction, ICommandHostSetupState, ICommandHostPresetApplication, ICommandHostContextWindow, ICommandHostContextReferences, ICommandHostWorkspace, ICommandHostCatalog, ICommandHostCheckpoints, ICommandHostMemory, ICommandHostBackgroundTasks, ICommandHostGoal, ICommandHostPlan, ICommandHostTerminalHandoff, ICommandHostAdapterAccess {}
+interface ICommandHostContext extends ICommandHostSessionAccess, ICommandHostAgentJobs, ICommandHostUserInteraction, ICommandHostSetupState, ICommandHostPresetApplication, ICommandHostContextWindow, ICommandHostContextReferences, ICommandHostWorkspace, ICommandHostCatalog, ICommandHostCheckpoints, ICommandHostMemory, ICommandHostBackgroundTasks, ICommandHostGoal, ICommandHostPlan, ICommandHostTerminalHandoff, ICommandHostAdapterAccess, ICommandHostProductVocabulary {}
 //#endregion
 //#region src/command-api/contracts.d.ts
 type TSystemCommandLifecycle = 'inline' | 'blocking' | 'background';
-type TSystemCommandSemanticRole = 'skillActivation' | 'contextReduction' | 'subagentSpawn';
+type TSystemCommandSemanticRole = 'skillActivation' | 'skillResourceRead' | 'contextReduction' | 'subagentSpawn';
 /** A user-visible command with descriptor metadata and execute logic. */
 interface ISystemCommand {
   name: string;
@@ -3527,6 +4211,11 @@ interface ISystemCommand {
   /** The surfaces a `'client'` command can run on. See `ICommand.surfaces`. */
   surfaces?: readonly TCommandSurface[];
   lifecycle?: TSystemCommandLifecycle;
+  /**
+   * Host-owned inline control operations that remain reachable during an active turn.
+   * This only relaxes the busy gate for human commands; invocation and host policy still apply.
+   */
+  canRunDuringTurn?: (args: string) => boolean;
   /**
    * Whether executing this command requires explicit user permission/confirmation.
    * - `false`: runs immediately without any approval gate
@@ -3549,10 +4238,10 @@ interface ISystemCommand {
 /**
  * CMD-008: a session requirement is a DEMAND SWITCH, not a registration gate. Declaring one does
  * not gate the module on runtime capability being available; it makes the session projection
- * enable that facility (`'agent-runtime'` → `enableAgentRuntime: true`) so the module's commands
+ * enable that facility (`'runtime'` → `enableAgentRuntime: true`) so the module's commands
  * can rely on it. Pinned by `interactive/__tests__/command-module-session-requirements.test.ts`.
  */
-type TCommandModuleSessionRequirement = 'agent-runtime';
+type TCommandModuleSessionRequirement = 'runtime';
 /** Composable command capability module. */
 interface ICommandModule {
   /** Stable module id for diagnostics and duplicate handling. */
@@ -3569,6 +4258,703 @@ interface ICommandModule {
   readonly shutdown?: (host: ICommandHostWorkspace) => Promise<void>;
 }
 //#endregion
+//#region src/config/settings-source.d.ts
+type TProjectSettingsScope = 'project' | 'project-local';
+interface IProjectSettingsPath {
+  readonly scope: TProjectSettingsScope;
+  readonly relativePath: string;
+}
+/** One host-selected skill or legacy-command directory, ordered by host precedence. */
+interface ISkillRootDescriptor {
+  readonly root: string;
+  readonly kind: 'skills' | 'commands';
+}
+//#endregion
+//#region ../agent-command/dist/node/index.d.ts
+//#endregion
+//#region src/doctor/doctor-render.d.ts
+/** Optional product wording supplied by the host; omission keeps diagnostics product-neutral. */
+interface IDoctorDisplayVocabulary {
+  readonly title?: string;
+  readonly productName?: string;
+  readonly formatRepairCommand?: (checkId: string) => string;
+  readonly repairOffer?: string;
+}
+//#endregion
+//#region ../product-config/dist/resolve-Coemu2e0.d.ts
+//#region src/contract.d.ts
+type TConfigEnvironment = Readonly<Record<string, string | undefined>>;
+type TConfigExposure = 'public' | 'host' | 'private';
+type TConfigPhase = 'identity' | 'operational';
+type TConfigConsumer = 'build' | 'cli' | 'desktop' | 'web' | 'release' | 'deploy';
+interface ISettingMetadata {
+  readonly phase: TConfigPhase;
+  readonly exposure: TConfigExposure;
+  readonly consumers: readonly TConfigConsumer[];
+  readonly path?: boolean;
+  readonly alias?: false;
+  readonly defaultValue?: string;
+}
+interface IProductSetting<T = unknown> extends ISettingMetadata {
+  readonly variable: string;
+  readonly description: string;
+  readonly format: string;
+  readonly required: boolean;
+  readonly parse: (value: string) => T;
+}
+type TParser<T> = (value: string) => T;
+/** The sole contract for variable names, parsing, documentation and exposure. */
+declare const PRODUCT_CONFIG_DESCRIPTORS: Readonly<{
+  identity: Readonly<{
+    id: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    displayName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    cliName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    envPrefix: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & {
+      readonly alias: false;
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    } & {
+      parse: TParser<string>;
+    }>;
+    packageScope: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    repositoryUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    websiteUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    docsUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    blogUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    appId: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    protocolScheme: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    telemetryServiceName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    daemonNamespace: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    desktopExecutableName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    mcpClientName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    modelCommandToolPrefix: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    promptFileReferenceTag: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    editorTemporaryDirectoryPrefix: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+  }>;
+  storage: Readonly<{
+    userRoot: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & {
+      readonly path: true;
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    } & {
+      parse: TParser<string>;
+    }>;
+    projectDirectory: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    cacheRoot: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & {
+      readonly path: true;
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    } & {
+      parse: TParser<string>;
+    }>;
+    logRoot: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & {
+      readonly path: true;
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    } & {
+      parse: TParser<string>;
+    }>;
+    browserNamespace: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    browserCredentialDatabase: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+  }>;
+  credentials: Readonly<{
+    serviceNamespace: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+  }>;
+  crypto: Readonly<{
+    namespace: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: TParser<string>;
+    }>;
+    masterKeyDerivationPath: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "identity";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "cli", "desktop"];
+    }> & {
+      parse: TParser<readonly number[]>;
+    }>;
+  }>;
+  services: Readonly<{
+    analyticsMeasurementId: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    signalingUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    remoteClientUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "public";
+      readonly consumers: readonly ["build", "cli", "desktop", "web"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+  }>;
+  release: Readonly<{
+    artifactPrefix: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & {
+      readonly consumers: readonly ["build", "release"];
+      readonly phase: "identity";
+      readonly exposure: "host";
+    } & {
+      parse: (value: string) => string | undefined;
+    }>;
+    version: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    tagPrefix: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    channel: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    baseUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    updateMetadataUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    installScriptUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    npmRegistryUrl: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    packageAccess: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "release"];
+    }> & {
+      parse: (value: string) => "public" | "restricted" | undefined;
+    }>;
+  }>;
+  deploy: Readonly<{
+    environment: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    projectName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    docsProjectName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    blogProjectName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    workerName: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    accountId: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    domain: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+    route: Readonly<{
+      variable: string;
+      description: string;
+      format: string;
+      required: boolean;
+    } & Readonly<{
+      readonly phase: "operational";
+      readonly exposure: "host";
+      readonly consumers: readonly ["build", "deploy"];
+    }> & {
+      parse: (value: string) => string | undefined;
+    }>;
+  }>;
+}>;
+type TContract = typeof PRODUCT_CONFIG_DESCRIPTORS;
+type IProductConfig = { readonly [S in keyof TContract]: { readonly [F in keyof TContract[S]]: TContract[S][F] extends IProductSetting<infer T> ? T : never; }; };
+//#endregion
+//#region ../agent-remote-pairing/dist/node/index.d.ts
+//#region src/identity/crypto-context.d.ts
+/** Public domain separation data. No keys, environment access, or process-wide selected product. */
+interface IIdentityContext {
+  readonly namespace: string;
+  readonly purposes: Readonly<Record<keyof typeof PURPOSE_SUFFIXES, string>>;
+}
+declare const PURPOSE_SUFFIXES: {
+  readonly signingKeyCert: "signing-key-cert/v1";
+  readonly deviceCert: "device-cert/v1";
+  readonly roster: "roster/v1";
+  readonly revocation: "revocation/v1";
+  readonly signingKeyRevocation: "signing-key-revocation/v1";
+  readonly sessionDesc: "session-desc/v1";
+  readonly handshake: "handshake/v1";
+  readonly enrollProof: "enroll-proof/v1";
+  readonly enrollRequest: "enroll-request/v1";
+  readonly enrollCommit: "enroll-commit/v1";
+  readonly enrollSas: "enroll-sas/v1";
+};
+//#endregion
+//#region src/product/runtime-context.d.ts
+interface ICliProductLayout {
+  readonly userRoot: string;
+  readonly projectDirectory: string;
+  readonly userPaths: {
+    readonly settings: string;
+    readonly sessions: string;
+    readonly onboarded: string;
+    readonly history: string;
+    readonly workspaceTrust: string;
+    readonly orgPolicy: string;
+    readonly mcpApprovals: string;
+  };
+  readonly projectStateDirectories: TWorkspaceProjectStateDirectories;
+  readonly projectSettingsPaths: readonly IProjectSettingsPath[];
+  readonly agentDefinitionRoots: readonly string[];
+  readonly skillRoots: readonly ISkillRootDescriptor[];
+  readonly pluginRelativeDirectory: string;
+  readonly taskContext: {
+    readonly enabled: true;
+    readonly dir: string;
+  };
+  readonly baselinePermissionAllow: readonly string[];
+  readonly projectWorktreesDirectory: string;
+  readonly userQuarantineDirectory: string;
+  readonly pathProtection: IPathProtectionPolicy;
+}
+interface ICliProductVocabulary extends ICommandProductVocabulary {
+  readonly editorTemporaryDirectoryPrefix: string;
+  readonly doctor: IDoctorDisplayVocabulary;
+  readonly doctorSlash: IDoctorDisplayVocabulary;
+  readonly resumeCommand: (sessionId: string) => string;
+}
+/** One host invocation owns its config, path layout and cryptographic domain. */
+interface ICliRuntimeContext {
+  readonly config: IProductConfig;
+  readonly environment: TConfigEnvironment;
+  readonly userHome?: string;
+  readonly layout: ICliProductLayout;
+  readonly vocabulary: ICliProductVocabulary;
+  readonly cryptoContext: IIdentityContext;
+}
+//#endregion
 //#region ../agent-preset/dist/node/index.d.ts
 //#endregion
 //#region src/output-style-types.d.ts
@@ -3639,7 +5025,7 @@ interface IMCPHttpTransportDeps {
   readonly policy?: IEgressPolicy;
   /** Hostname resolver injected so tests never touch DNS. */
   readonly lookup?: TEgressLookup;
-  /** Fetch used by the SDK transport; default is the global one. */
+  /** Trusted owner/test carrier; it owns its connection policy instead of the default's pinning guarantee. */
   readonly fetch?: typeof globalThis.fetch;
 }
 //#endregion
@@ -3662,6 +5048,93 @@ interface IMCPStdioAuthority {
   readonly cleanupMs?: number;
 }
 //#endregion
+//#region src/hosted/hosted-runtime-types.d.ts
+interface IHostedIdentity {
+  readonly tenant: string;
+  readonly task: string;
+  readonly rootTask: string;
+  readonly actor: string;
+  readonly runtime: string;
+}
+interface IHostedBackend {
+  readonly endpoint: string;
+  readonly resource: string;
+  readonly publicKey: string;
+}
+interface IHostedSnapshot {
+  readonly id: string;
+  readonly digest: string;
+}
+/** Operator-owned deployment input; no project settings or model output can supply it. */
+interface IHostedRuntimeConfig {
+  readonly version: 3;
+  readonly identity: IHostedIdentity;
+  readonly epoch: number;
+  readonly worker: IHostedBackend;
+  readonly broker: IHostedBackend;
+  readonly snapshot: IHostedSnapshot | null;
+  readonly lifetimeMs: number;
+  readonly probeTimeoutMs: number;
+  /** Owner-selected supervisory ceilings; broker reservations bound individual requests. */
+  readonly limits: IHostedRuntimeUsage;
+}
+type THostedBackendRole = 'worker' | 'broker';
+/** Signed by the operator's trusted issuer outside the task worker. */
+interface IHostedAdmissionProof {
+  readonly version: 3;
+  readonly identity: IHostedIdentity;
+  readonly role: THostedBackendRole;
+  readonly resource: string;
+  readonly nonce: string;
+  readonly epoch: number;
+  readonly issuedAt: number;
+  readonly expiresAt: number;
+  readonly snapshot: IHostedSnapshot | null;
+  readonly ready: true;
+  readonly limits: IHostedRuntimeUsage;
+  /** Only the broker supplies cumulative current-epoch accounting; worker proofs carry null. */
+  readonly usage: IHostedRuntimeUsage | null;
+  readonly signature: string;
+}
+interface IHostedAdmission {
+  readonly config: IHostedRuntimeConfig;
+  readonly worker: IHostedAdmissionProof;
+  readonly broker: IHostedAdmissionProof;
+  readonly expiresAt: number;
+}
+/** A complete hosted composition must own execution and teardown, not only return a health flag. */
+interface IHostedRuntimeExecutor {
+  run(admission: IHostedAdmission, control: IHostedRuntimeControl): Promise<void>;
+  stop(reason: string): Promise<void>;
+  release(): Promise<void>;
+}
+/** Requested execution data; CLI flags grant no worker or company authority. */
+interface IHostedRuntimeInvocation {
+  readonly mode: 'headless' | 'serve' | 'mcp' | 'interactive' | 'command';
+  /** Validated, immutable CLI arguments; no host environment or state is projected. */
+  readonly argv: readonly string[];
+  readonly resume: boolean;
+}
+/** The operator installs a complete adapter; the CLI never substitutes a local worker. */
+type THostedRuntimeExecutorFactory = (admission: IHostedAdmission, signal: AbortSignal, invocation: IHostedRuntimeInvocation) => Promise<IHostedRuntimeExecutor>;
+interface IHostedRuntimeUsage {
+  readonly sessions: number;
+  readonly modelCalls: number;
+  readonly modelTokens: number;
+  readonly costMicros: number;
+}
+interface IHostedRuntimeControl {
+  readonly signal: AbortSignal;
+  /** Trusted runtime instrumentation reports cumulative observations, not worker-selected budgets. */
+  observe(usage: IHostedRuntimeUsage): void;
+}
+interface IHostedAdmissionOptions {
+  readonly environment: TConfigEnvironment;
+  readonly resume: boolean;
+  readonly signal?: AbortSignal;
+  readonly now?: () => number;
+}
+//#endregion
 //#region src/startup/cli-options-types.d.ts
 /**
  * Leaf type module: holds {@link IStartCliOptions} so it can be imported by both
@@ -3669,6 +5142,16 @@ interface IMCPStdioAuthority {
  * Re-exported from `command-setup.ts` so existing imports keep working.
  */
 interface IStartCliOptions {
+  /** Optional operator override for the installed hosted worker execution owner. */
+  hostedRuntimeExecutorFactory?: THostedRuntimeExecutorFactory;
+  /** Host-owned product configuration resolved once per invocation. */
+  productConfig?: IProductConfig;
+  /** Explicit source/development environment snapshot; never retained across invocations. */
+  environment?: TConfigEnvironment;
+  /** Explicit absolute product environment-file selection. */
+  productConfigFile?: string;
+  /** Already-resolved context shared by this invocation and its mode branches. */
+  productRuntime?: ICliRuntimeContext;
   commandModules?: readonly ICommandModule[];
   providerDefinitions?: readonly IProviderDefinition[];
   /** Initial trusted-or-restricted workspace decision. Absence is Restricted. */
@@ -3687,6 +5170,8 @@ interface IStartCliOptions {
   mcpApprovalStore?: IMCPActivationApprovalStore;
   /** Host-owned HTTP transport policy; never supplied by MCP settings or a remote caller. */
   mcpHttpTransportDeps?: IMCPHttpTransportDeps;
+  /** Local embedding-host policy; worker hosts supply their own, never a serialized host function. */
+  toolExecutionPolicy?: IAgentConfig['toolExecutionPolicy'];
   /** Host-configured character limits; generic admission validates the ordering and ceiling. */
   mcpResultAdmissionLimits?: Pick<IToolResultAdmissionOptions, 'warningChars' | 'hardChars' | 'repositoryMaxChars'>;
   /** Host-composed managed output styles, applied above user/project style sources. */
@@ -3695,7 +5180,779 @@ interface IStartCliOptions {
 //#endregion
 //#region src/cli.d.ts
 /** Full CLI entry: supplies its terminal presentation to the shared serve/bootstrap path. */
-declare function startCli(options?: IStartCliOptions): Promise<void>;
+declare function startCli(initialOptions?: IStartCliOptions): Promise<void>;
+//#endregion
+//#region src/hosted/hosted-runtime-controller.d.ts
+interface IHostedRuntimeControllerOptions extends IHostedAdmissionOptions {
+  /** Own partial allocations until return; rejection must release them or report unresolved cleanup. */
+  readonly createExecutor: (admission: IHostedAdmission, signal: AbortSignal) => Promise<IHostedRuntimeExecutor>;
+}
+type THostedRuntimeState = 'idle' | 'admitting' | 'running' | 'stopping' | 'stopped' | 'failed';
+declare class HostedRuntimeController {
+  private readonly options;
+  private state;
+  private executor?;
+  private provisioning?;
+  private abort?;
+  private stopping?;
+  private limits?;
+  private usage;
+  constructor(options: IHostedRuntimeControllerOptions);
+  status(): {
+    state: THostedRuntimeState;
+    usage: IHostedRuntimeUsage;
+  };
+  private observe;
+  run(): Promise<void>;
+  /** Restart constructs a fresh controller and revalidates current identity, epoch and snapshot. */
+  restart(options: IHostedRuntimeControllerOptions): Promise<HostedRuntimeController>;
+  stop(reason: string): Promise<void>;
+  private cleanup;
+  private cleanupExecutor;
+  private boundedCleanup;
+}
+//#endregion
+//#region src/hosted/hosted-runtime-admission.d.ts
+/** Fixed typed tuple defines the UTF-8 signature domain; object order is not part of the protocol. */
+declare function hostedAdmissionBytes(proof: Omit<IHostedAdmissionProof, 'signature'>): Buffer;
+//#endregion
+//#region ../agent-organization/dist/node/index.d.ts
+//#region src/types.d.ts
+type TOrganizationJson = null | boolean | number | string | TOrganizationJson[] | {
+  [key: string]: TOrganizationJson;
+};
+interface IOrganizationUnits {
+  readonly tokens: number;
+  readonly timeMs: number;
+  readonly costMicros: number;
+}
+interface IOrganizationBudget extends IOrganizationUnits {
+  readonly concurrency: number;
+}
+interface IOrganizationScope {
+  readonly resource: string;
+  readonly operations: readonly string[];
+}
+/** Signed by the external workload issuer; its private key is never accepted by this package. */
+interface IOrganizationGrant {
+  readonly version: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly role: string;
+  readonly audience: string;
+  readonly parent: string | null;
+  readonly epoch: number;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+  readonly publicKey: string;
+  readonly scopes: readonly IOrganizationScope[];
+  readonly budget: IOrganizationBudget;
+}
+interface IOrganizationOperation {
+  readonly idempotencyKey: string;
+  readonly resource: string;
+  readonly operation: string;
+  readonly environment: string;
+  readonly parameters: TOrganizationJson;
+}
+/** Proof of possession by the worker key named in the issued workload grant. */
+interface IOrganizationRequest {
+  readonly version: 1;
+  readonly grantId: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly audience: string;
+  readonly epoch: number;
+  readonly nonce: string;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+  readonly operation: IOrganizationOperation;
+}
+/** Minted through a separate operator channel, not a worker/model/ordinary tool approval. */
+interface IOrganizationApproval {
+  readonly version: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly audience: string;
+  readonly epoch: number;
+  readonly environment: string;
+  readonly operationDigest: string;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+}
+interface IOrganizationEnvelope<T> {
+  readonly claims: T;
+  readonly signature: string;
+}
+interface IOrganizationCall {
+  readonly request: IOrganizationEnvelope<IOrganizationRequest>;
+  readonly approval: IOrganizationEnvelope<IOrganizationApproval> | null;
+}
+interface IOrganizationReceipt {
+  readonly value: TOrganizationJson;
+  /** Trusted instrumentation; the action owner must bound effects to its reservation. */
+  readonly usage: IOrganizationUnits;
+}
+interface IOrganizationAction {
+  readonly resource: string;
+  readonly operation: string;
+  readonly roles: readonly string[];
+  readonly requiresApproval: boolean;
+  /** Trusted server-side validation and upper bound; never accept a worker-selected quota. */
+  reserve(operation: IOrganizationOperation): IOrganizationUnits;
+  execute(operation: IOrganizationOperation, context: {
+    readonly signal: AbortSignal;
+    readonly proof: IOrganizationEnvelope<IOrganizationRequest>;
+    readonly operationDigest: string;
+    readonly identity: IOrganizationGrant;
+    readonly reservation: IOrganizationUnits;
+  }): Promise<IOrganizationReceipt>;
+}
+//#endregion
+//#region src/audit.d.ts
+type TOrganizationAuditPhase = 'dispatch' | 'complete' | 'refused' | 'unknown';
+interface IOrganizationAuditEvent {
+  readonly phase: TOrganizationAuditPhase;
+  readonly operationDigest: string;
+  readonly tenantDigest: string;
+  readonly taskDigest: string;
+  readonly actorDigest: string;
+  readonly grantDigest: string;
+  readonly epoch: number;
+}
+interface IOrganizationAuditHead {
+  readonly version: 1;
+  readonly stream: string;
+  readonly sequence: number;
+  readonly hash: string;
+}
+interface IOrganizationAuditEntry {
+  readonly stream: string;
+  readonly sequence: number;
+  readonly previous: string;
+  readonly event: IOrganizationAuditEvent;
+  readonly hash: string;
+}
+interface IOrganizationAuditPage {
+  readonly entries: readonly IOrganizationAuditEntry[];
+  readonly head: IOrganizationEnvelope<IOrganizationAuditHead>;
+}
+/** Owner-installed external storage; read is consistent and append is an atomic expected-head CAS. */
+interface IOrganizationAuditSink {
+  read(after: IOrganizationAuditHead, signal: AbortSignal): Promise<IOrganizationAuditPage>;
+  append(expected: IOrganizationAuditHead, event: IOrganizationAuditEvent, signal: AbortSignal): Promise<{
+    readonly entry: IOrganizationAuditEntry;
+    readonly head: IOrganizationEnvelope<IOrganizationAuditHead>;
+  }>;
+}
+/** Independently retained checkpoint: consistent reads, monotonic CAS, no reset/delete worker capability. */
+interface IOrganizationAuditAnchor {
+  load(signal: AbortSignal): Promise<IOrganizationEnvelope<IOrganizationAuditHead>>;
+  compareAndSet(expected: IOrganizationAuditHead, next: IOrganizationEnvelope<IOrganizationAuditHead>, signal: AbortSignal): Promise<boolean>;
+}
+interface IOrganizationAuditWriter {
+  record(event: IOrganizationAuditEvent, signal?: AbortSignal): Promise<void>;
+}
+interface IOrganizationAuditOptions {
+  readonly stream: string;
+  readonly publicKey: string;
+  readonly sink: IOrganizationAuditSink;
+  readonly anchor: IOrganizationAuditAnchor;
+  readonly timeoutMs?: number;
+}
+/** Dispatch can proceed only after an exact event and its independently retained checkpoint are confirmed. */
+declare class OrganizationAudit implements IOrganizationAuditWriter {
+  private readonly stream;
+  private readonly key;
+  private readonly sink;
+  private readonly anchor;
+  private readonly timeout;
+  constructor(options: IOrganizationAuditOptions);
+  private bounded;
+  record(value: IOrganizationAuditEvent, signal?: AbortSignal): Promise<void>;
+  /** Owner-only recovery of a valid already-written tail. Does not reset history, refund or retry any effect. */
+  recover(signal?: AbortSignal): Promise<IOrganizationAuditHead>;
+  /** Readiness verifies retained evidence without adopting an unconfirmed tail or resetting history. */
+  verify(signal?: AbortSignal): Promise<IOrganizationAuditHead>;
+}
+//#endregion
+//#region src/git-asset.d.ts
+interface IOrganizationGitIntent {
+  readonly asset: string;
+  readonly digest: string;
+  readonly expectedRevision: number;
+  readonly fence: number;
+  readonly expectedOid: string;
+  readonly candidateOid: string;
+  readonly publishedOid: string;
+}
+interface IOrganizationGitAssetOptions {
+  /** Owner-provisioned private bare repository; workers must not mount or write this directory. */
+  readonly path: string;
+  readonly ref: string;
+  /** Absolute owner-pinned executable. No worker parameters reach the command or environment. */
+  readonly gitPath: string;
+  /** Aggregate subprocess deadline per phase, not a physical worker/OS containment guarantee. */
+  readonly phaseTimeoutMs?: number;
+}
+declare function gitParameters(value: unknown): {
+  expectedRevision: number;
+  fence: number;
+  expectedOid: string;
+  candidateOid: string;
+};
+/** Trusted asset-owner plumbing only. This class never clones/fetches, checks out, merges or runs user code. */
+declare class OrganizationGitAsset {
+  readonly identity: string;
+  readonly phaseTimeoutMs: number;
+  private readonly path;
+  private readonly ino;
+  private readonly dev;
+  private readonly ref;
+  private readonly gitPath;
+  constructor(options: IOrganizationGitAssetOptions);
+  private verify;
+  private phase;
+  private tip;
+  prepare(digest: string, parameters: ReturnType<typeof gitParameters>): IOrganizationGitIntent;
+  publish(intent: IOrganizationGitIntent): void;
+  wasPublished(intent: IOrganizationGitIntent): boolean;
+}
+//#endregion
+//#region src/ledger-anchor.d.ts
+interface IOrganizationLedgerHead {
+  readonly version: 1;
+  readonly ledger: string;
+  readonly revision: number;
+  readonly digest: string;
+}
+/** Trusted owner capability outside the mutable policy store and every worker checkpoint. */
+interface IOrganizationLedgerAnchor {
+  readonly ledger: string;
+  /** Consistent authenticated read of independently retained authority state. */
+  read(): IOrganizationLedgerHead | undefined;
+  /** Atomic, durable CAS; confirmation must be readable before this call returns. */
+  compareAndSet(expected: IOrganizationLedgerHead | undefined, next: IOrganizationLedgerHead): void;
+}
+//#endregion
+//#region src/shared-state.d.ts
+interface IOrganizationStateLease {
+  readonly revision: number;
+  readonly fence: number;
+  readonly expiresAt: number;
+}
+interface IOrganizationStateValue {
+  readonly revision: number;
+  readonly value: TOrganizationJson;
+}
+//#endregion
+//#region src/no-effect.d.ts
+declare const NO_EFFECT_REASONS: readonly ["budget-exhausted", "not-authorized", "invalid-schema", "expired", "revoked", "operation-conflict", "operation-pending"];
+type TOrganizationNoEffectReason = (typeof NO_EFFECT_REASONS)[number];
+//#endregion
+//#region src/sqlite-ledger.d.ts
+interface IOrganizationLedgerOptions {
+  readonly path: string;
+  /** Explicit first-time bootstrap. Reopen/missing/corrupt policy never initializes empty authority. */
+  readonly create?: boolean;
+  /** Owner-controlled v1/v2-to-v3 schema upgrade; close existing brokers first. Preserves all authority/accounting. */
+  readonly upgrade?: boolean;
+  readonly audience: string;
+  readonly workloadPublicKey: string;
+  readonly approvalPublicKey: string;
+  readonly now?: () => number;
+  readonly maxGrantTtlMs?: number;
+  readonly maxRequestTtlMs?: number;
+  /** Independently retained owner checkpoint; hosted organization composition requires it. */
+  readonly anchor?: IOrganizationLedgerAnchor;
+}
+type TOrganizationReservation = {
+  readonly kind: 'reserved';
+  readonly digest: string;
+  readonly grant: IOrganizationGrant;
+  readonly reservation: IOrganizationUnits;
+} | {
+  readonly kind: 'complete';
+  readonly digest: string;
+  readonly receipt: IOrganizationReceipt;
+} | {
+  readonly kind: 'refused';
+  readonly digest: string;
+  readonly reason: TOrganizationNoEffectReason;
+};
+/** Durable policy/budgets live in the operator's domain, never in a worker checkpoint. */
+declare class OrganizationLedger {
+  private readonly db;
+  private readonly state;
+  private readonly path;
+  private readonly inode;
+  private closed;
+  private readonly now;
+  private readonly workloadKey;
+  private readonly approvalKey;
+  private readonly integrity?;
+  readonly audience: string;
+  readonly maxGrantTtlMs: number;
+  readonly maxRequestTtlMs: number;
+  constructor(options: IOrganizationLedgerOptions);
+  private initializeGit;
+  private verifyFile;
+  private transaction;
+  private metadata;
+  private newBudget;
+  /** Trusted administration only; these methods are not present on the HTTP broker ingress. */
+  createGlobalBudget(limits: IOrganizationBudget): void;
+  createTenant(tenant: string, limits: IOrganizationBudget): void;
+  createTask(tenant: string, task: string, limits: IOrganizationBudget): void;
+  registerGrant(envelope: IOrganizationEnvelope<IOrganizationGrant>): void;
+  private chain;
+  currentGrant(grantId: string): IOrganizationGrant;
+  /** Owner inventory inspection, including expired/revoked grants; never grants execution authority. */
+  registeredGrant(grantId: string): IOrganizationGrant;
+  /** Trusted supervisory accounting for an owner-installed single-purpose workload grant. */
+  grantOperationCount(grantId: string): number;
+  /** Owner composition can require integrity rather than silently accepting legacy SDK mode. */
+  verifyAnchoredAuthority(): void;
+  private authenticateInside;
+  authenticate(envelope: IOrganizationEnvelope<IOrganizationRequest>): {
+    request: IOrganizationRequest;
+    grant: IOrganizationGrant;
+  };
+  /** Owner administration only; state creation cannot overwrite an existing resource or its fence. */
+  createStateResource(tenant: string, task: string, resource: string, value: TOrganizationJson): void;
+  private activeOperation;
+  private stateOperation;
+  leaseState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateLease;
+  readState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateValue;
+  writeState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateValue;
+  /** Trusted Git owner only. Persist an unreachable receipt intent before any target ref can change. */
+  prepareGitPublication(envelope: IOrganizationEnvelope<IOrganizationRequest>, asset: OrganizationGitAsset): IOrganizationGitIntent;
+  private gitIntent;
+  /** SQL locking serializes policy/fence checks with dispatch. External Git and SQL are NOT an atomic store. */
+  commitGitPublication(envelope: IOrganizationEnvelope<IOrganizationRequest>, asset: OrganizationGitAsset): IOrganizationStateValue;
+  /** Owner-only proof of a past branch publication. No absent effect is refunded, no workload authority is restored. */
+  reconcileGitPublication(value: IOrganizationRequest, asset: OrganizationGitAsset): IOrganizationReceipt;
+  /** Trusted asset-owner reconciliation only. The atomic state outcome proves this specific effect; no worker route exposes it. */
+  reconcileStateOperation(value: IOrganizationRequest): IOrganizationReceipt;
+  private liveBudget;
+  private storedBudget;
+  private operation;
+  reserve(envelope: IOrganizationEnvelope<IOrganizationRequest>, reservation: IOrganizationUnits, approval: IOrganizationEnvelope<IOrganizationApproval> | null, requiresApproval: boolean): TOrganizationReservation;
+  private key;
+  /** A crash/unknown effect keeps every reservation. No request route can refund or retry it. */
+  markUnknown(request: IOrganizationRequest): void;
+  settle(request: IOrganizationRequest, receipt: IOrganizationReceipt): void;
+  /** External asset owner only: confirm an exact unknown effect, charge its retained bound, never restore authority. */
+  reconcileExternalOperation(value: IOrganizationRequest, confirmedValue: TOrganizationJson): IOrganizationReceipt;
+  /** Trusted asset owner only: a proved no-effect outcome, never a worker-provided refund assertion. */
+  confirmNoEffect(request: IOrganizationRequest, reason: TOrganizationNoEffectReason, usage: IOrganizationUnits): void;
+  private recordReceipt;
+  revokeGrant(grantId: string): void;
+  stopTask(tenant: string, task: string): void;
+  stopTenant(tenant: string): void;
+  emergencyStop(): void;
+  advanceEpoch(epoch: number): void;
+  budgetState(kind: 'global' | 'tenant' | 'task' | 'grant', ...identity: string[]): {
+    limits: IOrganizationBudget;
+    spent: IOrganizationUnits;
+    held: IOrganizationUnits;
+    active: number;
+    stopped: boolean;
+  };
+  close(): void;
+}
+//#endregion
+//#region src/hosted/hosted-organization-control.d.ts
+interface IHostedOrganizationWorker {
+  readonly resource: string;
+  readonly grantId: string;
+  readonly identity: IHostedIdentity;
+  readonly epoch: number;
+}
+/** Owner provider inventory must survive broker restart and exclude resources outside its custody. */
+interface IHostedOrganizationInventory {
+  list(signal: AbortSignal): Promise<readonly IHostedOrganizationWorker[]>;
+  /** Revalidate owner metadata before termination; return only after the provider acknowledges cleanup. */
+  terminate(worker: IHostedOrganizationWorker, signal: AbortSignal): Promise<void>;
+}
+interface IHostedOrganizationIncidentOwners {
+  readonly detection: string;
+  readonly containment: string;
+  readonly assessment: string;
+  readonly recovery: string;
+  /** Owner-installed incident channel; metadata only, no provider errors, credentials or request bodies. */
+  report(event: {
+    readonly kind: 'authority-unavailable' | 'cleanup-unresolved' | 'unknown-effect';
+    readonly resources: readonly string[];
+    readonly operationDigest?: string;
+  }): Promise<void>;
+}
+interface IHostedOrganizationControlOptions {
+  readonly ledger: OrganizationLedger;
+  readonly audit: OrganizationAudit;
+  readonly actions: readonly IOrganizationAction[];
+  readonly inventory: IHostedOrganizationInventory;
+  readonly incidentOwners: IHostedOrganizationIncidentOwners;
+  readonly policyIntervalMs?: number;
+  readonly providerTimeoutMs?: number;
+}
+/** Owner-side company composition. No administrator operations are exposed to workers or model tools. */
+declare class HostedOrganizationControl {
+  private readonly ledger;
+  private readonly audit;
+  private readonly broker;
+  private readonly inventory;
+  private readonly incidents;
+  private readonly timeout;
+  private readonly timer;
+  private readonly calls;
+  private sweepPending?;
+  private closed;
+  private quarantined;
+  constructor(options: IHostedOrganizationControlOptions);
+  private identity;
+  /** Admission uses current policy and retained audit evidence, never checkpoint authority. */
+  admit(worker: IHostedOrganizationWorker, signal?: AbortSignal): Promise<IOrganizationGrant>;
+  apply(call: IOrganizationCall, signal?: AbortSignal, onWithdrawal?: () => void): Promise<IOrganizationReceipt>;
+  /** Owner commands persist policy withdrawal before terminating every affected provider worker. */
+  private afterWithdrawal;
+  stopGrant(grantId: string): Promise<void>;
+  stopTask(tenant: string, task: string): Promise<void>;
+  stopTenant(tenant: string): Promise<void>;
+  emergencyStop(): Promise<void>;
+  /** Owner recovery channel only. A worker cannot supply the asset-owner confirmation capability. */
+  reconcileExternalOperation(request: IOrganizationRequest, assetOwner: {
+    confirm(operationDigest: string, signal?: AbortSignal): Promise<TOrganizationJson>;
+  }, signal?: AbortSignal): Promise<IOrganizationReceipt>;
+  sweep(): Promise<void>;
+  private sweepOnce;
+  close(): Promise<void>;
+}
+//#endregion
+//#region src/hosted/e2b-organization-inventory.d.ts
+/** Provider-backed inventory, including paused workers. Its management capability stays outside every worker. */
+declare function createE2BOrganizationInventory(options: {
+  readonly apiKey: string;
+  readonly controlPlane: string;
+  readonly tenant: string;
+  readonly requestTimeoutMs?: number;
+}): IHostedOrganizationInventory;
+//#endregion
+//#region src/hosted/hosted-organization-payloads.d.ts
+/** Private owner content storage for model wire bytes; the bounded authority journal keeps only digests. */
+declare class HostedOrganizationPayloads {
+  private readonly directory;
+  private constructor();
+  static open(directory: string): Promise<HostedOrganizationPayloads>;
+  private path;
+  put(grantId: string, bytes: Uint8Array): Promise<string>;
+  private persist;
+  /** Owner outbox manifest. Digest addressing survives a broker crash without putting request claims in audit. */
+  recordOperation(request: IOrganizationRequest): Promise<void>;
+  operation(grantId: string, digest: string): Promise<IOrganizationRequest>;
+  get(grantId: string, digest: string): Promise<Buffer>;
+}
+//#endregion
+//#region src/hosted/hosted-organization-gateway.d.ts
+interface IHostedOrganizationBinding {
+  readonly config: IHostedRuntimeConfig;
+  readonly grantId: string;
+  readonly token: string;
+  readonly expiresAt: number;
+  /** External issuer capabilities installed by the owner, never supplied by an HTTP caller. */
+  signAdmission(role: THostedBackendRole, bytes: Uint8Array): string;
+  signRequest(bytes: Uint8Array): string;
+}
+/** Actual stock CLI admission and OpenAI-wire ingress over durable company effects. No owner routes. */
+declare function createHostedOrganizationGateway(options: {
+  readonly control: HostedOrganizationControl;
+  readonly ledger: OrganizationLedger;
+  readonly payloads: HostedOrganizationPayloads;
+  readonly bindings: readonly IHostedOrganizationBinding[];
+  readonly modelResource: string;
+}): (request: IncomingMessage, response: ServerResponse) => void;
+//#endregion
+//#region src/hosted/hosted-organization-model.d.ts
+interface IHostedOrganizationModelOptions {
+  readonly payloads: HostedOrganizationPayloads;
+  readonly endpoint: string;
+  readonly apiKey: string;
+  readonly model: string;
+  readonly roles: readonly string[];
+  readonly resource: string;
+  readonly reservation: IOrganizationUnits;
+  readonly maxInputBytes: number;
+  readonly maxOutputTokens: number;
+  readonly costMicrosPerToken: number;
+  /** Declare only an upstream contract actually supported by the owner-selected provider. */
+  readonly providerIdempotency: boolean;
+  /** Owner-selected pure input counter for the exact immutable provider request, including tools/media. */
+  countInputTokens(surface: 'responses' | 'chat-completions', request: Readonly<Record<string, unknown>>, signal: AbortSignal): Promise<number>;
+}
+/** Actual fixed-provider HTTP effect. No automatic retry; ambiguous outcomes retain the broker hold. */
+declare function createHostedOrganizationModelAction(options: IHostedOrganizationModelOptions): IOrganizationAction;
+//#endregion
+//#region src/hosted/hosted-organization-token-counter.d.ts
+/** Fixed owner counter transport. The owner encoder must preserve the provider's full input-token contract. */
+declare function createHostedOrganizationInputTokenCounter(options: {
+  readonly endpoint: string;
+  readonly apiKey: string;
+  /** Explicit provider mapping: Responses counting accepts input/model/tools, while Chat needs its own verified counter. */
+  encode(surface: 'responses' | 'chat-completions', request: Readonly<Record<string, unknown>>): unknown;
+}): IHostedOrganizationModelOptions['countInputTokens'];
+//#endregion
+//#region src/hosted/e2b-worker-process.d.ts
+interface IE2BWorkerProcessOptions {
+  readonly command: string;
+  readonly cwd: string;
+  readonly environment: Readonly<Record<string, string>>;
+  readonly timeoutMs: number;
+  readonly pty?: {
+    readonly cols: number;
+    readonly rows: number;
+  };
+  readonly onStdout: (data: string | Uint8Array) => void;
+  readonly onStderr: (data: string) => void;
+}
+interface IE2BWorkerProcess {
+  wait(): Promise<number>;
+  sendInput(data: string | Uint8Array): Promise<void>;
+  closeInput(): Promise<void>;
+  resize(cols: number, rows: number): Promise<void>;
+  disconnect(): Promise<void>;
+}
+//#endregion
+//#region src/hosted/e2b-task-worker.d.ts
+/** Control-plane-only inputs. Neither the SDK credential nor its client enters a worker environment. */
+interface IE2BTaskWorkerOptions {
+  readonly admission: IHostedAdmission;
+  readonly templateId: string;
+  readonly apiKey: string;
+  readonly signal: AbortSignal;
+  /** Only the admitted company broker host may be added to the default closed egress policy. */
+  readonly allowBrokerEgress?: boolean;
+}
+interface IE2BOwnedTaskWorker {
+  readonly client: ISandboxClient;
+  startProcess(options: IE2BWorkerProcessOptions): Promise<IE2BWorkerProcess>;
+  /** Withdraw access immediately, then delete the admitted task's provider resource. */
+  release(): Promise<void>;
+}
+/** Connect only the admitted resource after checking its operator-provisioned ownership and network posture. */
+declare function connectE2BTaskWorker(options: IE2BTaskWorkerOptions): Promise<IE2BOwnedTaskWorker>;
+//#endregion
+//#region src/hosted/hosted-worker-execution-config.d.ts
+/** Issued by the admitted broker, never inferred from a provider API key or a worker claim. */
+interface IHostedWorkerAccess {
+  readonly version: 1;
+  readonly identity: IHostedIdentity;
+  readonly worker: string;
+  readonly broker: string;
+  readonly epoch: number;
+  readonly endpoint: string;
+  readonly token: string;
+  readonly issuedAt: number;
+  readonly expiresAt: number;
+  readonly signature: string;
+}
+interface IHostedWorkerResumeSession {
+  readonly id: string;
+  readonly path: string;
+  readonly digest: string;
+}
+/** Private runtime ingress; the worker gets a different, per-launch credential. */
+interface IHostedWorkerServe {
+  readonly port: number;
+  readonly workerPort: number;
+  readonly token: string;
+}
+declare function hostedWorkerAccessBytes(access: Omit<IHostedWorkerAccess, 'signature'>): Buffer;
+//#endregion
+//#region src/hosted/e2b-worker-provisioning.d.ts
+/** Owner-side input. Sign admission only after this operation returns a verified resource receipt. */
+interface IE2BWorkerProvisioningOptions {
+  readonly identity: IHostedIdentity;
+  readonly epoch: number;
+  readonly templateId: string;
+  readonly apiKey: string;
+  readonly brokerEndpoint: string;
+  readonly lifetimeMs: number;
+  readonly requestTimeoutMs: number;
+  readonly signal: AbortSignal;
+  readonly snapshot: IHostedSnapshot | null;
+  /** Owner-issued organization binding retained in the provider inventory across broker restarts. */
+  readonly organization?: {
+    readonly controlPlane: string;
+    readonly grantId: string;
+  };
+  /** Bytes fetched from the owner's checkpoint store; never an E2B memory snapshot/template. */
+  readonly checkpoint?: Uint8Array;
+}
+interface IE2BProvisionedWorker {
+  readonly resource: string;
+  readonly workspaceRoot: string;
+  readonly operationId: string;
+  readonly resumeSession?: IHostedWorkerResumeSession;
+  readonly snapshot: IHostedSnapshot | null;
+  release(): Promise<void>;
+}
+/** Reconciliation identifiers, without provider error text or credentials. */
+declare class E2BWorkerProvisioningError extends Error {
+  readonly outcome: 'allocation-unknown' | 'cleanup-unresolved';
+  readonly operationId: string;
+  readonly resource?: string | undefined;
+  constructor(outcome: 'allocation-unknown' | 'cleanup-unresolved', operationId: string, resource?: string | undefined);
+}
+/** Create from a pinned clean baseline, restoring only bounded task files before issuing any authority. */
+declare function provisionE2BTaskWorker(options: IE2BWorkerProvisioningOptions): Promise<IE2BProvisionedWorker>;
+//#endregion
+//#region ../agent-transport/dist/node/node.d.ts
+//#endregion
+//#region src/node/access-token-verifier.d.ts
+/** What the verifier reaches outward through. Injected in tests; defaults to the real network. */
+interface IAccessTokenVerifierDeps {
+  readonly fetch?: IEgressDeps['fetch'];
+  readonly lookup?: IEgressDeps['lookup'];
+  /** Wall-clock milliseconds since the epoch, for `exp`/`nbf`. Defaults to `Date.now`. */
+  readonly now?: () => number;
+  /** Monotonic milliseconds, for cache age and refetch intervals. Defaults to `performance.now`. */
+  readonly monotonicNow?: () => number;
+}
+//#endregion
+//#region src/hosted/desktop/authorization.d.ts
+interface IDesktopBinding {
+  readonly id: string;
+  readonly user: string;
+  readonly client: string;
+  readonly session: string;
+  readonly worker: IHostedOrganizationWorker;
+}
+interface IDesktopProof {
+  readonly binding: IDesktopBinding;
+  readonly jti: string;
+  readonly expiresAt: number;
+  readonly credentialExpiresAt: number;
+}
+interface IDesktopAuthorizationOptions {
+  readonly publicUrl: string;
+  readonly issuer: string;
+  readonly control: HostedOrganizationControl;
+  /** Owner-selected identities and sessions, never a caller's registry. */
+  readonly bindings: readonly IDesktopBinding[];
+  readonly verifierDeps?: IAccessTokenVerifierDeps;
+  readonly now?: () => number;
+}
+/** A freshly verified issuer credential still needs current company authority and exact session ownership. */
+declare class HostedDesktopAuthorization {
+  private readonly options;
+  readonly url: URL;
+  private readonly now;
+  private readonly bindings;
+  constructor(options: IDesktopAuthorizationOptions);
+  binding(id: string): IDesktopBinding;
+  verify(token: string, binding: IDesktopBinding, operator?: boolean, signal?: AbortSignal): Promise<IDesktopProof>;
+  current(binding: IDesktopBinding, signal?: AbortSignal): Promise<void>;
+}
+//#endregion
+//#region src/hosted/desktop/authority-store.d.ts
+interface IDesktopAccess {
+  readonly key: string;
+  readonly generation: number;
+  readonly token: string;
+  readonly approvalToken: string | null;
+  readonly expiresAt: number;
+}
+/** Replay and connection replacement survive restart; independent custody rejects restored authority. */
+declare class HostedDesktopAuthorityStore {
+  private readonly now;
+  private readonly directory;
+  private readonly file;
+  private readonly lock;
+  constructor(options: {
+    directory: string;
+    anchor: IOrganizationLedgerAnchor;
+    create?: boolean;
+  }, now?: () => number);
+  private readonly anchor;
+  private head;
+  private read;
+  private locked;
+  private write;
+  private change;
+  pair(key: string, proofs: readonly {
+    readonly id: string;
+    readonly expiresAt: number;
+  }[], expiresAt: number, operator: boolean): IDesktopAccess;
+  authorize(key: string, generation: number, token: string, operator?: boolean): void;
+  connect(key: string, generation: number, token: string): void;
+  approveOnce(key: string, generation: number, token: string, prompt: string): void;
+  revoke(key: string): void;
+}
+//#endregion
+//#region src/hosted/desktop/worker-port.d.ts
+/** One owner-held carrier connection pins the worker's session across desktop reconnects. */
+declare class HostedDesktopWorkerPort {
+  private readonly socket;
+  readonly worker: IHostedOrganizationWorker;
+  readonly session: string;
+  private readonly listeners;
+  private readonly ended;
+  private readonly pending;
+  private constructor();
+  static connect(options: {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly worker: IHostedOrganizationWorker;
+    readonly control: HostedOrganizationControl;
+    readonly session?: string;
+    readonly signal?: AbortSignal;
+  }): Promise<HostedDesktopWorkerPort>;
+  onFrame(listener: (frame: Record<string, unknown>) => void): () => void;
+  onClose(listener: () => void): () => void;
+  ready(): void;
+  send(frame: Record<string, unknown>): Record<string, unknown> | undefined;
+  prompt(id: string, digest: string): void;
+  approve(id: string, digest: string, allow: boolean): void;
+  close(): void;
+}
+//#endregion
+//#region src/hosted/desktop/gateway.d.ts
+/** Outside workers: owns scoped ingress and a separate operator channel to one pinned task session. */
+declare class HostedDesktopGateway {
+  private readonly options;
+  private readonly wss;
+  private readonly paired;
+  private readonly active;
+  private readonly names;
+  private readonly proxies;
+  private readonly interval;
+  private closed;
+  private readonly upgrades;
+  constructor(options: {
+    readonly server: Server;
+    readonly authorization: HostedDesktopAuthorization;
+    readonly store: HostedDesktopAuthorityStore;
+    readonly ports: ReadonlyMap<string, HostedDesktopWorkerPort>;
+    readonly trustedProxies?: readonly string[];
+    readonly policyIntervalMs?: number;
+  });
+  private boundary;
+  private bounded;
+  private body;
+  private readonly request;
+  private handle;
+  private readonly upgrade;
+  private connect;
+  private attach;
+  /** Owner-only withdrawal; no administrator route is exposed. */
+  revoke(binding: string): void;
+  close(): Promise<void>;
+}
 //#endregion
-export { type IStartCliOptions, startCli };
+export { E2BWorkerProvisioningError, HostedDesktopAuthorityStore, HostedDesktopAuthorization, HostedDesktopGateway, HostedDesktopWorkerPort, HostedOrganizationControl, HostedOrganizationPayloads, HostedRuntimeController, type IDesktopAuthorizationOptions, type IDesktopBinding, type IE2BOwnedTaskWorker, type IE2BProvisionedWorker, type IE2BTaskWorkerOptions, type IE2BWorkerProvisioningOptions, type IHostedAdmission, type IHostedAdmissionProof, type IHostedOrganizationBinding, type IHostedOrganizationControlOptions, type IHostedOrganizationIncidentOwners, type IHostedOrganizationInventory, type IHostedOrganizationModelOptions, type IHostedOrganizationWorker, type IHostedRuntimeConfig, type IHostedRuntimeControl, type IHostedRuntimeControllerOptions, type IHostedRuntimeExecutor, type IHostedRuntimeInvocation, type IHostedRuntimeUsage, type IHostedWorkerAccess, type IHostedWorkerResumeSession, type IHostedWorkerServe, type IStartCliOptions, type THostedRuntimeExecutorFactory, type THostedRuntimeState, connectE2BTaskWorker, createE2BOrganizationInventory, createHostedOrganizationGateway, createHostedOrganizationInputTokenCounter, createHostedOrganizationModelAction, hostedAdmissionBytes, hostedWorkerAccessBytes, provisionE2BTaskWorker, startCli };
 //# sourceMappingURL=index.d.ts.map