@rynx-ai/runtime 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @rynx-ai/runtime — runtime host that drives local coding-agent CLIs (codex / traex
+ * / claude) as live co-drive sessions behind the `@rynx-ai/core` contracts
+ * (`AgentCapabilities` + `LiveExecutor`). Depends only on `@rynx-ai/core`; knows
+ * nothing about any channel.
+ */
+export { LocalAgentHost, CodexRuntimeError, SpawnCodexCommandRunner, FileCodexSessionStore, resolveCodexSessionStorePath, } from "./host.js";
+export type { CodexCapabilities, CapabilityResult, CodexRuntimeStatus, } from "./host.js";
+export type { CodexSessionStore, CodexSessionRecord } from "./codex-session-store.js";
+export { ensureCodexResumeRollout } from "./codex/rollout-synth.js";
+export { RunnerManager } from "./runner/manager.js";
+export type { RunnerManagerOptions, OpenTerminalOptions, ParentTerminal, } from "./runner/manager.js";
+export type { InjectOutcome, TerminalRole } from "./runner/protocol.js";
+export { probeRuntimeStatus } from "./runtime-status.js";
+export { listRuntimeModels } from "./models-catalog.js";
+export { TmuxTerminal, isTmuxAvailable } from "./terminal/tmux.js";
+export type { TerminalAttachment, TmuxTerminalOptions } from "./terminal/tmux.js";
+export { TerminalRegistry } from "./terminal/registry.js";

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * @rynx-ai/runtime — runtime host that drives local coding-agent CLIs (codex / traex
+ * / claude) as live co-drive sessions behind the `@rynx-ai/core` contracts
+ * (`AgentCapabilities` + `LiveExecutor`). Depends only on `@rynx-ai/core`; knows
+ * nothing about any channel.
+ */
+export { LocalAgentHost, CodexRuntimeError, SpawnCodexCommandRunner, FileCodexSessionStore, resolveCodexSessionStorePath, } from "./host.js";
+export { ensureCodexResumeRollout } from "./codex/rollout-synth.js";
+// Runner subprocess layer: the parent-side manager (an `AgentExecutor` +
+// `AgentCapabilities` that spawns per-session runner children) plus the wire
+// types. The composition root uses `RunnerManager` in place of `LocalAgentHost`.
+export { RunnerManager } from "./runner/manager.js";
+export { probeRuntimeStatus } from "./runtime-status.js";
+export { listRuntimeModels } from "./models-catalog.js";
+// Live-terminal subsystem (Phase C): tmux-backed terminals + per-runner registry.
+export { TmuxTerminal, isTmuxAvailable } from "./terminal/tmux.js";
+export { TerminalRegistry } from "./terminal/registry.js";

package/dist/models-catalog.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Backend-free model listing for codex/traex.
+ *
+ * The parent control plane no longer holds an app-server, so `/models` can't be
+ * a live `model/list` RPC anymore. Following omnigent's static-catalog model, we
+ * serve a config-derived list: the runtime's configured default model (the one
+ * `resolveRuntimeModel` would pick), marked `isDefault`. This is intentionally
+ * minimal — a fuller curated catalogue can be added here later without touching
+ * any caller. claude already has its own static list ({@link listClaudeModels}).
+ */
+import { type AgentRuntimeId, type AppConfig } from "@rynx-ai/core";
+import type { ModelListResponse } from "./codex-app-server/protocol.js";
+/**
+ * The model list for a runtime, without an execution backend.
+ * Returns `null` when the runtime exposes no resolvable model (e.g. traex with
+ * no `TRAEX_MODEL`), matching the prior "unsupported" semantics of `listModels`.
+ */
+export declare function listRuntimeModels(config: AppConfig, runtime: AgentRuntimeId): ModelListResponse | null;

package/dist/models-catalog.js

@@ -0,0 +1,27 @@
+/**
+ * Backend-free model listing for codex/traex.
+ *
+ * The parent control plane no longer holds an app-server, so `/models` can't be
+ * a live `model/list` RPC anymore. Following omnigent's static-catalog model, we
+ * serve a config-derived list: the runtime's configured default model (the one
+ * `resolveRuntimeModel` would pick), marked `isDefault`. This is intentionally
+ * minimal — a fuller curated catalogue can be added here later without touching
+ * any caller. claude already has its own static list ({@link listClaudeModels}).
+ */
+import { resolveRuntimeModel, } from "@rynx-ai/core";
+import { listClaudeModels } from "./claude/models.js";
+/**
+ * The model list for a runtime, without an execution backend.
+ * Returns `null` when the runtime exposes no resolvable model (e.g. traex with
+ * no `TRAEX_MODEL`), matching the prior "unsupported" semantics of `listModels`.
+ */
+export function listRuntimeModels(config, runtime) {
+    if (runtime === "claude") {
+        return listClaudeModels();
+    }
+    const model = resolveRuntimeModel(config, runtime).trim();
+    if (!model) {
+        return null;
+    }
+    return { data: [{ id: model, model, isDefault: true }] };
+}

package/dist/runner/child.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Child-side runner session. One per runner process (i.e. per session); owns the
+ * single execution backend via the injected executor (a {@link LocalAgentHost}
+ * in production, which in a per-session process holds exactly one backend). It
+ * translates inbound {@link ToChild} control messages into the live co-drive
+ * surface (bring up the session's forwarder + TUI, inject / interrupt turns) and
+ * per-thread capabilities, answered against the same backend so the parent never
+ * needs an app-server of its own.
+ */
+import { type AgentCapabilities } from "@rynx-ai/core";
+import type { ChildTransport } from "./transport.js";
+export interface RunnerSessionDeps {
+    transport: ChildTransport;
+    /** The single-backend capability + live co-drive surface (a `LocalAgentHost`). */
+    executor: AgentCapabilities;
+    /** Invoked on a `shutdown` message (default: close transport). */
+    onShutdown?: () => void;
+}
+export declare class RunnerSession {
+    private readonly transport;
+    private readonly executor;
+    private readonly onShutdown;
+    /** Live terminals hosted by this session, and per-attach client handles. */
+    private readonly terminals;
+    private readonly attachments;
+    /** Session ids with a live codex forwarder started here (stopped on shutdown). */
+    private readonly liveIds;
+    constructor({ transport, executor, onShutdown }: RunnerSessionDeps);
+    private handle;
+    private get liveProvider();
+    /** The mirror channel for a session: an `emit` that forwards every canonical
+     *  event to the parent under the CURRENT session id (mutable), plus a `retarget`
+     *  the host calls on a `/clear`·`/fork` rotation — it re-points the mirror to the
+     *  new session AND tells the daemon to alias the runner (terminal transfer) so
+     *  the new session stays injectable. */
+    private mirrorChannel;
+    /**
+     * Eagerly bring up a session's codex-native live view: start the persistent
+     * forwarder connection (which resume-subscribes to mirror every turn) and
+     * launch the detached `codex --remote` TUI, which CREATES the codex thread. The
+     * forwarder's connection sees the TUI's broadcast `thread/started`, binds, and
+     * subscribes — so the TUI is usable immediately (a fresh `--remote` needs no
+     * rollout) and its turns mirror to chat (omnigent's model).
+     */
+    private ensureLive;
+    private inject;
+    private interruptLive;
+    /** Launch (idempotently) the session's codex TUI pane from the executor's
+     *  `codexTerminalSpec`. Shares the `${id}-main` terminal id with `term.open`,
+     *  so the web attach reuses the same detached pane. */
+    private launchCodexPane;
+    private stopLive;
+    private openTerminal;
+    /** Attach an already-created terminal and forward its data/exit to the parent. */
+    private attachExisting;
+    private runCap;
+    private dispatchCap;
+}

package/dist/runner/child.js

@@ -0,0 +1,268 @@
+import { TerminalRegistry } from "../terminal/registry.js";
+import { toWireError } from "./protocol.js";
+export class RunnerSession {
+    transport;
+    executor;
+    onShutdown;
+    /** Live terminals hosted by this session, and per-attach client handles. */
+    terminals = new TerminalRegistry();
+    attachments = new Map();
+    /** Session ids with a live codex forwarder started here (stopped on shutdown). */
+    liveIds = new Set();
+    constructor({ transport, executor, onShutdown }) {
+        this.transport = transport;
+        this.executor = executor;
+        this.onShutdown =
+            onShutdown ??
+                (() => {
+                    this.terminals.closeAll();
+                    transport.close();
+                });
+        this.transport.onMessage((msg) => this.handle(msg));
+        this.transport.send({ t: "ready" });
+    }
+    handle(msg) {
+        switch (msg.t) {
+            case "cap":
+                void this.runCap(msg.capId, msg.name, msg.args);
+                return;
+            case "term.open":
+                void this.openTerminal(msg);
+                return;
+            case "term.input":
+                this.attachments.get(msg.attachId)?.write(Buffer.from(msg.dataB64, "base64").toString("utf8"));
+                return;
+            case "term.resize":
+                this.attachments.get(msg.attachId)?.resize(msg.cols, msg.rows);
+                return;
+            case "term.close": {
+                const attachment = this.attachments.get(msg.attachId);
+                this.attachments.delete(msg.attachId);
+                attachment?.kill();
+                return;
+            }
+            case "approval.resolve": {
+                const provider = this.executor;
+                void provider.resolveApproval?.(msg.localThreadId, msg.approvalId, msg.decision);
+                return;
+            }
+            case "live.ensure":
+                void this.ensureLive(msg);
+                return;
+            case "inject":
+                void this.inject(msg);
+                return;
+            case "live.interrupt":
+                void this.interruptLive(msg);
+                return;
+            case "shutdown":
+                this.stopLive();
+                this.terminals.closeAll();
+                this.onShutdown();
+                return;
+        }
+    }
+    get liveProvider() {
+        return this.executor;
+    }
+    /** The mirror channel for a session: an `emit` that forwards every canonical
+     *  event to the parent under the CURRENT session id (mutable), plus a `retarget`
+     *  the host calls on a `/clear`·`/fork` rotation — it re-points the mirror to the
+     *  new session AND tells the daemon to alias the runner (terminal transfer) so
+     *  the new session stays injectable. */
+    mirrorChannel(localThreadId) {
+        const target = { id: localThreadId };
+        const emit = (event) => this.transport.send({ t: "mirror", sessionId: target.id, event });
+        const retarget = (newId, meta) => {
+            target.id = newId;
+            this.transport.send({
+                t: "rotate",
+                from: localThreadId,
+                to: newId,
+                kind: meta.kind,
+                ...(meta.agent ? { agent: meta.agent } : {}),
+                ...(meta.model ? { model: meta.model } : {}),
+                ...(meta.cwd ? { cwd: meta.cwd } : {}),
+                ...(meta.parentSessionId ? { parentSessionId: meta.parentSessionId } : {}),
+            });
+        };
+        return { emit, retarget };
+    }
+    /**
+     * Eagerly bring up a session's codex-native live view: start the persistent
+     * forwarder connection (which resume-subscribes to mirror every turn) and
+     * launch the detached `codex --remote` TUI, which CREATES the codex thread. The
+     * forwarder's connection sees the TUI's broadcast `thread/started`, binds, and
+     * subscribes — so the TUI is usable immediately (a fresh `--remote` needs no
+     * rollout) and its turns mirror to chat (omnigent's model).
+     */
+    async ensureLive(msg) {
+        const provider = this.liveProvider;
+        try {
+            const { emit, retarget } = this.mirrorChannel(msg.localThreadId);
+            const started = await provider.ensureLiveCodexSession?.(msg.localThreadId, emit, {
+                ...(msg.runtime ? { runtime: msg.runtime } : {}),
+                ...(msg.agentName ? { agentName: msg.agentName } : {}),
+                ...(msg.agentSpec ? { agentSpec: msg.agentSpec } : {}),
+                retargetMirror: retarget,
+            });
+            if (!started) {
+                this.transport.send({ t: "live.ready", reqId: msg.reqId, localThreadId: msg.localThreadId, ok: false });
+                return;
+            }
+            this.liveIds.add(msg.localThreadId);
+            // Launch the TUI (fresh `--remote` → it creates the thread) so the forwarder
+            // captures the broadcast `thread/started` and binds. Re-launch when the pane
+            // is absent OR its process has died (`isAlive` probes `#{pane_dead}`) — so a
+            // reconnect after the TUI exited restarts it instead of skipping (a
+            // launched-once guard would leave a dead "Pane is dead" husk forever).
+            if (!this.terminals.get(`${msg.localThreadId}-main`)?.isAlive()) {
+                await this.launchCodexPane(msg.localThreadId, msg.cols, msg.rows);
+            }
+            const ready = provider.waitLiveReady
+                ? await provider.waitLiveReady(msg.localThreadId)
+                : true;
+            this.transport.send({ t: "live.ready", reqId: msg.reqId, localThreadId: msg.localThreadId, ok: ready });
+        }
+        catch (error) {
+            this.transport.send({
+                t: "live.ready",
+                reqId: msg.reqId,
+                localThreadId: msg.localThreadId,
+                ok: false,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async inject(msg) {
+        const provider = this.liveProvider;
+        try {
+            const outcome = (await provider.injectMessage?.(msg.localThreadId, msg.text)) ?? "notLive";
+            this.transport.send({ t: "injected", reqId: msg.reqId, localThreadId: msg.localThreadId, outcome });
+        }
+        catch (error) {
+            this.transport.send({
+                t: "injected",
+                reqId: msg.reqId,
+                localThreadId: msg.localThreadId,
+                outcome: "failed",
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async interruptLive(msg) {
+        const provider = this.liveProvider;
+        let ok = false;
+        let error;
+        try {
+            ok = (await provider.interruptLive?.(msg.localThreadId)) ?? false;
+        }
+        catch (e) {
+            error = e instanceof Error ? e.message : String(e);
+        }
+        this.transport.send({
+            t: "interrupted",
+            reqId: msg.reqId,
+            localThreadId: msg.localThreadId,
+            ok,
+            ...(error ? { error } : {}),
+        });
+    }
+    /** Launch (idempotently) the session's codex TUI pane from the executor's
+     *  `codexTerminalSpec`. Shares the `${id}-main` terminal id with `term.open`,
+     *  so the web attach reuses the same detached pane. */
+    async launchCodexPane(localThreadId, cols, rows) {
+        const spec = await this.liveProvider.codexTerminalSpec?.(localThreadId);
+        if (!spec)
+            return;
+        const term = this.terminals.getOrCreate(`${localThreadId}-main`, {
+            cwd: spec.cwd,
+            command: spec.command,
+            args: spec.args,
+            cols: cols ?? 120,
+            rows: rows ?? 40,
+            ...(spec.env ? { env: spec.env } : {}),
+        });
+        this.liveProvider.attachTerminalInjector?.(localThreadId, term);
+    }
+    stopLive() {
+        for (const id of this.liveIds)
+            this.liveProvider.stopLiveCodexSession?.(id);
+        this.liveIds.clear();
+    }
+    async openTerminal(msg) {
+        try {
+            // codex/claude-native session (no explicit command): DUMB ATTACH — omnigent's
+            // reattach (codex_native.py:905-942, `app_server=None`). A tab switch ONLY
+            // attaches an already-live pane; it NEVER ensures the forwarder or relaunches a
+            // dead pane. Creation/relaunch happens on message-send (`live.ensure`) or an
+            // explicit restart. A missing/dead pane → `term.error`, so the web shows the
+            // dead-pane overlay + restart button instead of silently respawning the codex
+            // TUI (and re-ensuring the forwarder) on every tab switch.
+            if (!msg.command && msg.localThreadId) {
+                const existing = this.terminals.get(msg.terminalId);
+                if (!existing || !existing.isAlive()) {
+                    this.transport.send({ t: "term.error", attachId: msg.attachId, message: "terminal not live" });
+                    return;
+                }
+                await this.attachExisting(msg);
+                return;
+            }
+            // Login-shell terminal (explicit command): create-or-reuse as before.
+            this.terminals.getOrCreate(msg.terminalId, {
+                cwd: msg.cwd,
+                command: msg.command,
+                args: msg.args,
+                cols: msg.cols,
+                rows: msg.rows,
+            });
+            await this.attachExisting(msg);
+        }
+        catch (error) {
+            this.transport.send({
+                t: "term.error",
+                attachId: msg.attachId,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    /** Attach an already-created terminal and forward its data/exit to the parent. */
+    async attachExisting(msg) {
+        const { attachment, role } = await this.terminals.attach(msg.terminalId, msg.role, {
+            cols: msg.cols,
+            rows: msg.rows,
+        });
+        this.attachments.set(msg.attachId, attachment);
+        attachment.onData((chunk) => this.transport.send({
+            t: "term.data",
+            attachId: msg.attachId,
+            dataB64: Buffer.from(chunk, "utf8").toString("base64"),
+        }));
+        attachment.onExit((info) => {
+            this.attachments.delete(msg.attachId);
+            this.transport.send({ t: "term.exit", attachId: msg.attachId, exitCode: info.exitCode });
+        });
+        this.transport.send({ t: "term.opened", attachId: msg.attachId, role });
+    }
+    async runCap(capId, name, args) {
+        try {
+            const data = await this.dispatchCap(name, args);
+            this.transport.send({ t: "capResult", capId, ok: true, data });
+        }
+        catch (error) {
+            this.transport.send({ t: "capResult", capId, ok: false, error: toWireError(error) });
+        }
+    }
+    dispatchCap(name, args) {
+        switch (name) {
+            case "getGoal":
+                return this.executor.getGoal(args[0]);
+            case "setGoal":
+                return this.executor.setGoal(args[0], args[1]);
+            case "clearGoal":
+                return this.executor.clearGoal(args[0]);
+            case "forkSession":
+                return this.executor.forkSession(args[0], args[1]);
+        }
+    }
+}

package/dist/runner/manager.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Parent-side runner orchestrator. Replaces {@link LocalAgentHost} at the
+ * composition root as the live co-drive + capability surface, but holds **no
+ * execution backend** of its own: it spawns one runner child per session
+ * (`localThreadId`) that brings up the session's live forwarder + vendor TUI,
+ * forwards per-thread capabilities to a shared capability runner, and answers
+ * status / model-list locally without a backend.
+ *
+ * The process boundary carries no live objects: the parent drives a session over
+ * the runner transport (`live.ensure` / `inject` / `live.interrupt` + terminal
+ * attach), and the child mirrors that session's canonical events back as
+ * {@link SessionEvent}s.
+ *
+ * Today the only transport is local stdio (a spawned child); a remote tunnel
+ * transport drops in here later without touching `ConversationRuntime` or any
+ * channel.
+ */
+import { spawn as nodeSpawn } from "node:child_process";
+import { type AgentCapabilities, type AgentRuntimeId, type AgentSpec, type AppConfig, type CapabilityResult, type ModelListResponse, type SessionEvent, type ThreadGoal } from "@rynx-ai/core";
+import { type CodexSessionStore } from "../host.js";
+import { type InjectOutcome, type TerminalRole } from "./protocol.js";
+export interface RunnerManagerOptions {
+    config: AppConfig;
+    /** Shared session store (used by the backend-free status probe). */
+    sessionStore: CodexSessionStore;
+    /** Path to the runner entry; defaults to the built `dist/runner-main.js`. */
+    runnerEntry?: string;
+    /** Idle TTL (ms) after which an unused runner is reaped. */
+    idleTtlMs?: number;
+    /** Background reap sweep interval (ms); `0` disables the timer (tests). */
+    reapIntervalMs?: number;
+    /** Injected for tests. */
+    spawn?: typeof nodeSpawn;
+    now?: () => number;
+    /** Extra env merged into every spawned runner child — e.g. the control-plane
+     *  URL + token so a claude-native PermissionRequest hook can POST back. */
+    childEnv?: Record<string, string>;
+}
+/** A session rotation reported by a runner child (claude `/clear`·`/fork`): the
+ *  new session `to` is now aliased to `from`'s runner; carries meta to carry over. */
+export interface RotateInfo {
+    from: string;
+    to: string;
+    kind: "clear" | "fork";
+    agent?: string;
+    model?: string;
+    cwd?: string;
+    parentSessionId?: string;
+}
+/** Options for {@link RunnerManager.openTerminal}. */
+export interface OpenTerminalOptions {
+    role: TerminalRole;
+    cwd: string;
+    cols: number;
+    rows: number;
+    /** Inner command for the pane (defaults child-side to the login shell). */
+    command?: string;
+    args?: string[];
+}
+/**
+ * Parent-side handle to a live terminal on a runner child. Bytes flow through
+ * {@link onData} / {@link write} (decoded from the base64 wire frames); resize
+ * and close are forwarded as control messages. {@link ready} resolves with the
+ * granted role once the child attaches (an `owner` request is downgraded to
+ * read-only when the owner slot is taken).
+ */
+export interface ParentTerminal {
+    readonly attachId: string;
+    readonly ready: Promise<{
+        role: TerminalRole;
+    }>;
+    onData(listener: (chunk: string) => void): void;
+    onExit(listener: (info: {
+        exitCode: number;
+    }) => void): void;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    close(): void;
+}
+export declare class RunnerManager implements AgentCapabilities {
+    private readonly config;
+    private readonly sessionStore;
+    private readonly runnerEntry;
+    private readonly idleTtlMs;
+    private readonly spawn;
+    private readonly childEnv;
+    private readonly now;
+    private readonly defaultRuntime;
+    private readonly handles;
+    private readonly reapTimer;
+    /** Sink for mirrored {@link SessionEvent}s from every session's forwarder. */
+    private mirrorListener;
+    /** Sink for session rotations (claude `/clear`·`/fork`) — server records meta. */
+    private rotateListener;
+    /** Session keys with a live codex forwarder — never reaped while present. */
+    private readonly liveSessionKeys;
+    constructor(opts: RunnerManagerOptions);
+    /**
+     * Open a live terminal on the session's runner child (spawning it if needed).
+     * Phase C hosts one terminal ("main") per session; the returned handle is a
+     * single attach client — `owner` (read-write) or a downgraded `read-only`
+     * viewer per the child's ownership rule. Not part of `AgentExecutor`; the WS
+     * bridge calls it directly.
+     */
+    openTerminal(localThreadId: string, opts: OpenTerminalOptions): ParentTerminal;
+    /**
+     * Register the sink for mirrored {@link SessionEvent}s produced by every
+     * session's persistent codex forwarder (web- AND TUI-initiated turns). The
+     * server wires this to `persistSessionEvent` (bus + canonical log).
+     */
+    onMirror(listener: (sessionId: string, event: SessionEvent) => void): void;
+    /** Register the sink for session rotations (claude `/clear`·`/fork`): the server
+     *  records the new session's meta (carry-over agent/model/title). */
+    onRotate(listener: (rotation: RotateInfo) => void): void;
+    /**
+     * Eagerly bring up a session's codex-native live view (persistent forwarder +
+     * detached `codex --remote` TUI) in its runner child, spawning the runner if
+     * needed. Idempotent. Resolves true once the codex thread is bound; false for a
+     * non-codex / non-live session (the caller then uses the normal run path).
+     */
+    ensureLiveSession(localThreadId: string, opts?: {
+        cwd?: string;
+        cols?: number;
+        rows?: number;
+        runtime?: AgentRuntimeId;
+        agentName?: string;
+        agentSpec?: AgentSpec;
+    }): Promise<boolean>;
+    /**
+     * Inject a user turn into a session's live codex thread — omnigent's
+     * single-writer web send (`turn/start` / `turn/steer`); the forwarder mirrors
+     * all output. Resolves true when the app-server accepted the turn, false when
+     * the session has no live forwarder (caller falls back to the run path).
+     */
+    injectMessage(localThreadId: string, text: string): Promise<InjectOutcome>;
+    /**
+     * Interrupt a session's active live turn — the web Stop button (codex
+     * `turn/interrupt`, claude Escape). Best-effort: resolves false with NO spawn
+     * when the session has no live runner (nothing to interrupt).
+     */
+    interruptLiveSession(localThreadId: string): Promise<boolean>;
+    /**
+     * Deliver a user's interactive-approval decision to the session's runner
+     * child (Phase D). Best-effort: no-op if the runner isn't live (the pending
+     * approval would have died with it). The child routes it to its codex client.
+     */
+    resolveApproval(localThreadId: string, approvalId: string, decision: "acceptForSession" | "accept" | "decline" | "cancel"): void;
+    listModels(runtime?: AgentRuntimeId): Promise<ModelListResponse | null>;
+    getGoal(localThreadId: string): Promise<CapabilityResult<ThreadGoal | null>>;
+    setGoal(localThreadId: string, objective: string): Promise<CapabilityResult>;
+    clearGoal(localThreadId: string): Promise<CapabilityResult>;
+    forkSession(currentLocalThreadId: string, newLocalThreadId: string): Promise<CapabilityResult>;
+    /**
+     * Backend-free runtime readiness (not part of `AgentCapabilities`; surfaced for
+     * the control console). Never spawns a runner.
+     */
+    getStatus(options?: {
+        force?: boolean;
+        runtime?: AgentRuntimeId;
+    }): Promise<import("../host.js").CodexRuntimeStatus>;
+    /** Stop the runner bound to one session (if any), rejecting its in-flight work. */
+    stopRunner(localThreadId: string): void;
+    /** Kill every runner. Call on server shutdown. */
+    stop(): Promise<void>;
+    /** Forward a capability to a runner child. Session-less caps (listModels/status)
+     *  use the shared `CAP_KEY` child; per-thread caps pass the session's key so they
+     *  run on that session's child (which owns its private CODEX_HOME). */
+    private forwardCap;
+    private getOrSpawn;
+    private spawnHandle;
+    private onChildMessage;
+    /** Mark a handle dead and reject every pending run/cap with the exit reason. */
+    private failHandle;
+    private reapIdle;
+}