@rynx-ai/runtime 0.1.11-beta.1 → 0.1.11-beta.3

package/dist/index.d.ts

@@ -6,14 +6,13 @@
  */
 export { LocalAgentHost, CodexRuntimeError, SpawnCodexCommandRunner, FileCodexSessionStore, resolveCodexSessionStorePath, } from "./host.js";
 export type { CodexCapabilities, CapabilityResult, CodexRuntimeStatus, } from "./host.js";
-export type { CodexSessionStore, CodexSessionRecord } from "./codex-session-store.js";
-export { ensureCodexResumeRollout } from "./codex/rollout-synth.js";
+export type { ClaudeForkIntent, CodexSessionStore, CodexSessionRecord, } from "./codex-session-store.js";
 export { RunnerManager, TerminalOpenError } from "./runner/manager.js";
 export type { RunnerManagerOptions, RunnerSessionContext, RunnerSessionContextProvider, OpenTerminalOptions, ParentTerminal, } from "./runner/manager.js";
 export type { InjectOutcome, TerminalOpenErrorCode, TerminalRole } from "./runner/protocol.js";
 export type { ResolveInteractionResult, RuntimeInteractionEvent, RuntimeInteractionListener, } from "./interactions.js";
 export { probeRuntimeStatus } from "./runtime-status.js";
 export { listRuntimeModels } from "./models-catalog.js";
-export { TmuxTerminal, isTmuxAvailable } from "./terminal/tmux.js";
+export { TmuxTerminal, isTmuxAvailable, terminateTmuxServer, tmuxSocketPath, } from "./terminal/tmux.js";
 export type { TerminalAttachment, TmuxTerminalOptions } from "./terminal/tmux.js";
 export { TerminalRegistry } from "./terminal/registry.js";

package/dist/index.js

@@ -5,7 +5,6 @@
  * nothing about any channel.
  */
 export { LocalAgentHost, CodexRuntimeError, SpawnCodexCommandRunner, FileCodexSessionStore, resolveCodexSessionStorePath, } from "./host.js";
-export { ensureCodexResumeRollout } from "./codex/rollout-synth.js";
 // Runner subprocess layer: the parent-side manager (an `AgentExecutor` +
 // `AgentCapabilities` that spawns per-session runner children) plus the wire
 // types. The composition root uses `RunnerManager` in place of `LocalAgentHost`.
@@ -13,5 +12,5 @@ export { RunnerManager, TerminalOpenError } from "./runner/manager.js";
 export { probeRuntimeStatus } from "./runtime-status.js";
 export { listRuntimeModels } from "./models-catalog.js";
 // Live-terminal subsystem (Phase C): tmux-backed terminals + per-runner registry.
-export { TmuxTerminal, isTmuxAvailable } from "./terminal/tmux.js";
+export { TmuxTerminal, isTmuxAvailable, terminateTmuxServer, tmuxSocketPath, } from "./terminal/tmux.js";
 export { TerminalRegistry } from "./terminal/registry.js";

package/dist/models-catalog.d.ts

@@ -2,6 +2,7 @@ import { type AgentRuntimeId, type AppConfig } from "@rynx-ai/core";
 import type { ModelListResponse } from "./codex-app-server/protocol.js";
 export interface RuntimeModelCatalogDeps {
     readTraexModels?: () => Promise<unknown>;
+    readTraexDebugModels?: () => Promise<unknown>;
 }
 /**
  * The model list for a runtime, without an execution backend.

package/dist/models-catalog.js

@@ -24,7 +24,17 @@ export async function listRuntimeModels(config, runtime, deps = {}) {
     if (runtime === "traex") {
         try {
             const value = await (deps.readTraexModels ?? readTraexModels)();
-            const models = normalizeTraexModels(value, resolveRuntimeModel(config, runtime).trim());
+            const configuredDefault = resolveRuntimeModel(config, runtime).trim();
+            const defaultModel = configuredDefault || resolveTraexNativeDefault(await (deps.readTraexDebugModels ?? readTraexDebugModels)());
+            if (!configuredDefault &&
+                (!Array.isArray(value) ||
+                    !value.some((item) => item &&
+                        typeof item === "object" &&
+                        !Array.isArray(item) &&
+                        item.name === defaultModel))) {
+                throw new Error(`Traex native default is missing from the public catalog: ${defaultModel}`);
+            }
+            const models = normalizeTraexModels(value, defaultModel);
             if (models.length > 0)
                 return { data: models };
         }
@@ -46,6 +56,38 @@ async function readTraexModels() {
     });
     return JSON.parse(stdout);
 }
+async function readTraexDebugModels() {
+    const { stdout } = await execFileAsync(resolveRuntimeBinary("traex"), ["debug", "models"], {
+        encoding: "utf8",
+        timeout: TRAEX_MODELS_TIMEOUT_MS,
+        maxBuffer: TRAEX_MODELS_MAX_BYTES,
+    });
+    return JSON.parse(stdout);
+}
+function resolveTraexNativeDefault(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Traex debug model catalog is invalid");
+    }
+    const models = value.models;
+    if (!Array.isArray(models)) {
+        throw new Error("Traex debug model catalog is invalid");
+    }
+    const defaults = models.filter((item) => item &&
+        typeof item === "object" &&
+        !Array.isArray(item) &&
+        item.business_metadata &&
+        typeof item.business_metadata === "object" &&
+        item.business_metadata
+            .backend_is_default === true);
+    if (defaults.length !== 1) {
+        throw new Error(`Traex debug model catalog has ${defaults.length} native defaults`);
+    }
+    const name = defaults[0].config_name;
+    if (typeof name !== "string" || !name.trim()) {
+        throw new Error("Traex native default has no config_name");
+    }
+    return name.trim();
+}
 function normalizeTraexModels(value, configuredDefault) {
     if (!Array.isArray(value))
         return [];

package/dist/provider-workspace.d.ts

@@ -0,0 +1,56 @@
+import type { AgentRuntimeId, SandboxMode } from "@rynx-ai/core";
+import type { PermissionProfileSelectionParams, SandboxPolicy } from "./codex-app-server/protocol.js";
+/** Structural view of the immutable Session workspace snapshot. The canonical
+ * type lives in core; keeping the adapter input structural avoids inventing a
+ * second domain model in the Provider layer. */
+export interface ProviderWorkspace {
+    readonly cwd: string;
+    readonly allowedDirs: readonly string[];
+}
+/** Canonical roots projected without mutating the Session snapshot, with the
+ * primary working directory first for every Provider. */
+export declare function providerWorkspaceRoots(workspace: ProviderWorkspace): string[];
+export declare function providerAdditionalDirs(workspace: ProviderWorkspace): string[];
+export declare function sandboxPolicyForWorkspace(mode: SandboxMode, workspace: ProviderWorkspace): SandboxPolicy;
+export declare function codexThreadWorkspaceParams(workspace: ProviderWorkspace): {
+    cwd: string;
+    runtimeWorkspaceRoots: string[];
+};
+export declare function codexTurnWorkspaceParams(workspace: ProviderWorkspace, mode: SandboxMode): {
+    cwd: string;
+    runtimeWorkspaceRoots: string[];
+    sandboxPolicy: SandboxPolicy;
+};
+/** Traex has no runtimeWorkspaceRoots field. For a multi-root writable
+ * workspace, use the bounded named-profile modification supported by Traex
+ * 0.200; never combine it with the legacy sandbox field. */
+export declare function traexThreadWorkspaceParams(workspace: ProviderWorkspace, mode: SandboxMode): {
+    cwd: string;
+    permissions: PermissionProfileSelectionParams;
+} | {
+    cwd: string;
+    sandbox: SandboxMode;
+};
+/** Turn equivalent of {@link traexThreadWorkspaceParams}; `permissions` and
+ * `sandboxPolicy` are intentionally mutually exclusive. */
+export declare function traexTurnWorkspaceParams(workspace: ProviderWorkspace, mode: SandboxMode): {
+    cwd: string;
+    permissions: PermissionProfileSelectionParams;
+} | {
+    cwd: string;
+    sandboxPolicy: SandboxPolicy;
+};
+export declare function threadWorkspaceParams(runtime: Exclude<AgentRuntimeId, "claude">, workspace: ProviderWorkspace, mode: SandboxMode): {
+    cwd: string;
+    permissions: PermissionProfileSelectionParams;
+} | {
+    cwd: string;
+    sandbox: SandboxMode;
+};
+export declare function turnWorkspaceParams(runtime: Exclude<AgentRuntimeId, "claude">, workspace: ProviderWorkspace, mode: SandboxMode): {
+    cwd: string;
+    permissions: PermissionProfileSelectionParams;
+} | {
+    cwd: string;
+    sandboxPolicy: SandboxPolicy;
+};

package/dist/provider-workspace.js

@@ -0,0 +1,83 @@
+/** Canonical roots projected without mutating the Session snapshot, with the
+ * primary working directory first for every Provider. */
+export function providerWorkspaceRoots(workspace) {
+    return [...new Set([workspace.cwd, ...workspace.allowedDirs])];
+}
+export function providerAdditionalDirs(workspace) {
+    return providerWorkspaceRoots(workspace).filter((dir) => dir !== workspace.cwd);
+}
+export function sandboxPolicyForWorkspace(mode, workspace) {
+    switch (mode) {
+        case "read-only":
+            return { type: "readOnly", networkAccess: false };
+        case "workspace-write":
+            return {
+                type: "workspaceWrite",
+                writableRoots: providerWorkspaceRoots(workspace),
+                networkAccess: true,
+                excludeTmpdirEnvVar: false,
+                excludeSlashTmp: false,
+            };
+        case "danger-full-access":
+            return { type: "dangerFullAccess" };
+    }
+}
+export function codexThreadWorkspaceParams(workspace) {
+    return {
+        cwd: workspace.cwd,
+        runtimeWorkspaceRoots: providerWorkspaceRoots(workspace),
+    };
+}
+export function codexTurnWorkspaceParams(workspace, mode) {
+    return {
+        ...codexThreadWorkspaceParams(workspace),
+        sandboxPolicy: sandboxPolicyForWorkspace(mode, workspace),
+    };
+}
+function traexWorkspacePermissions(workspace) {
+    const additionalDirs = providerAdditionalDirs(workspace);
+    if (additionalDirs.length === 0)
+        return undefined;
+    return {
+        type: "profile",
+        id: ":workspace",
+        modifications: additionalDirs.map((path) => ({
+            type: "additionalWritableRoot",
+            path,
+        })),
+    };
+}
+/** Traex has no runtimeWorkspaceRoots field. For a multi-root writable
+ * workspace, use the bounded named-profile modification supported by Traex
+ * 0.200; never combine it with the legacy sandbox field. */
+export function traexThreadWorkspaceParams(workspace, mode) {
+    const permissions = mode === "workspace-write"
+        ? traexWorkspacePermissions(workspace)
+        : undefined;
+    return permissions
+        ? { cwd: workspace.cwd, permissions }
+        : { cwd: workspace.cwd, sandbox: mode };
+}
+/** Turn equivalent of {@link traexThreadWorkspaceParams}; `permissions` and
+ * `sandboxPolicy` are intentionally mutually exclusive. */
+export function traexTurnWorkspaceParams(workspace, mode) {
+    const permissions = mode === "workspace-write"
+        ? traexWorkspacePermissions(workspace)
+        : undefined;
+    return permissions
+        ? { cwd: workspace.cwd, permissions }
+        : {
+            cwd: workspace.cwd,
+            sandboxPolicy: sandboxPolicyForWorkspace(mode, workspace),
+        };
+}
+export function threadWorkspaceParams(runtime, workspace, mode) {
+    return runtime === "traex"
+        ? traexThreadWorkspaceParams(workspace, mode)
+        : { ...codexThreadWorkspaceParams(workspace), sandbox: mode };
+}
+export function turnWorkspaceParams(runtime, workspace, mode) {
+    return runtime === "traex"
+        ? traexTurnWorkspaceParams(workspace, mode)
+        : codexTurnWorkspaceParams(workspace, mode);
+}

package/dist/runner/child.d.ts

@@ -7,12 +7,60 @@
  * per-thread capabilities, answered against the same backend so the parent never
  * needs an app-server of its own.
  */
-import { type AgentCapabilities } from "@rynx-ai/core";
+import { type AgentCapabilities, type ResolvedExecutionSnapshot, type RuntimeUserInput, type SessionInteractionResolution, type SessionWorkspaceSnapshot } from "@rynx-ai/core";
+import type { SessionEvent } from "@rynx-ai/core";
+import type { TerminalInjector } from "../claude/native-integration.js";
+import type { ResolveInteractionResult } from "../interactions.js";
+import { type InjectOutcome } from "./protocol.js";
 import type { ChildTransport } from "./transport.js";
+/** Re-target the mirror to a freshly minted rynx session (claude `/clear`·`/fork`)
+ *  + record the terminal transfer with the daemon. The child owns the transport,
+ *  so it supplies this to the host. */
+type RetargetMirror = (newSessionId: string, meta: {
+    kind: "clear" | "fork";
+    workspace: SessionWorkspaceSnapshot;
+    execution: ResolvedExecutionSnapshot;
+    parentSessionId?: string;
+}) => void;
+/** Codex-native live-session methods the executor (a `LocalAgentHost`) exposes
+ *  beyond the `AgentExecutor`/`AgentCapabilities` contract. Duck-typed so the
+ *  runner works with any executor (a claude-only host simply lacks them). */
+interface LiveCodexProvider {
+    codexTerminalSpec?(localThreadId: string): Promise<{
+        command: string;
+        args: string[];
+        cwd: string;
+        env?: Record<string, string>;
+    } | null>;
+    ensureLiveCodexSession?(localThreadId: string, emit: (event: SessionEvent) => void, opts: {
+        workspace: SessionWorkspaceSnapshot;
+        execution: ResolvedExecutionSnapshot;
+        retargetMirror?: RetargetMirror;
+    }): Promise<boolean>;
+    waitLiveReady?(localThreadId: string, timeoutMs?: number): Promise<boolean>;
+    waitTerminalReady?(localThreadId: string, timeoutMs?: number): Promise<boolean>;
+    liveSessionError?(localThreadId: string): string | undefined;
+    injectMessage?(localThreadId: string, input: RuntimeUserInput | string): Promise<InjectOutcome>;
+    interruptLive?(localThreadId: string): Promise<boolean>;
+    stopLiveCodexSession?(localThreadId: string, opts?: {
+        deferClaudeInteractionCleanup?: boolean;
+    }): void;
+    finalizeStoppedLiveSessions?(): void;
+    resolveInteraction?(localThreadId: string, interactionId: string, resolution: SessionInteractionResolution): Promise<ResolveInteractionResult>;
+    /** claude-native: hand the session's tmux pane injector to the host (which
+     *  doesn't own tmux). No-op for codex sessions (they inject via app-server). */
+    attachTerminalInjector?(localThreadId: string, injector: TerminalInjector): void;
+    /** Internal Provider operation used only by MachineSessionService through
+     * RunnerManager. It is deliberately absent from public AgentCapabilities. */
+    forkSession?(currentLocalThreadId: string, newLocalThreadId: string, options: {
+        workspace: SessionWorkspaceSnapshot;
+        execution: ResolvedExecutionSnapshot;
+    }): Promise<import("@rynx-ai/core").CapabilityResult>;
+}
 export interface RunnerSessionDeps {
     transport: ChildTransport;
     /** The single-backend capability + live co-drive surface (a `LocalAgentHost`). */
-    executor: AgentCapabilities;
+    executor: AgentCapabilities & LiveCodexProvider;
     /** Invoked on a `shutdown` message (default: close transport). */
     onShutdown?: () => void;
 }
@@ -42,10 +90,9 @@ export declare class RunnerSession {
     /**
      * Eagerly bring up a session's codex-native live view: start the persistent
      * forwarder connection (which resume-subscribes to mirror every turn) and
-     * launch the detached `codex --remote` TUI, which CREATES the codex thread. The
-     * forwarder's connection sees the TUI's broadcast `thread/started`, binds, and
-     * subscribes — so the TUI is usable immediately (a fresh `--remote` needs no
-     * rollout) and its turns mirror to chat (reference implementation's model).
+     * launch the detached `codex --remote resume` TUI against the thread the
+     * structured runtime created. The forwarder subscribes to that same thread,
+     * so the TUI is usable immediately and its turns mirror to chat.
      */
     private ensureLive;
     private inject;
@@ -64,3 +111,4 @@ export declare class RunnerSession {
     private runCap;
     private dispatchCap;
 }
+export {};

package/dist/runner/child.js

@@ -114,9 +114,8 @@ export class RunnerSession {
                 from: localThreadId,
                 to: newId,
                 kind: meta.kind,
-                ...(meta.agent ? { agent: meta.agent } : {}),
-                ...(meta.model ? { model: meta.model } : {}),
-                ...(meta.cwd ? { cwd: meta.cwd } : {}),
+                workspace: meta.workspace,
+                execution: meta.execution,
                 ...(meta.parentSessionId ? { parentSessionId: meta.parentSessionId } : {}),
             });
         };
@@ -125,21 +124,17 @@ export class RunnerSession {
     /**
      * Eagerly bring up a session's codex-native live view: start the persistent
      * forwarder connection (which resume-subscribes to mirror every turn) and
-     * launch the detached `codex --remote` TUI, which CREATES the codex thread. The
-     * forwarder's connection sees the TUI's broadcast `thread/started`, binds, and
-     * subscribes — so the TUI is usable immediately (a fresh `--remote` needs no
-     * rollout) and its turns mirror to chat (reference implementation's model).
+     * launch the detached `codex --remote resume` TUI against the thread the
+     * structured runtime created. The forwarder subscribes to that same thread,
+     * so the TUI is usable immediately and its turns mirror to chat.
      */
     async ensureLive(msg) {
         const provider = this.liveProvider;
         try {
             const { emit, retarget } = this.mirrorChannel(msg.localThreadId);
             const started = await provider.ensureLiveCodexSession?.(msg.localThreadId, emit, {
-                ...(msg.cwd ? { cwd: msg.cwd } : {}),
-                ...(msg.runtime ? { runtime: msg.runtime } : {}),
-                ...(msg.reasoningEffort ? { reasoningEffort: msg.reasoningEffort } : {}),
-                ...(msg.agentName ? { agentName: msg.agentName } : {}),
-                ...(msg.agentSpec ? { agentSpec: msg.agentSpec } : {}),
+                workspace: msg.workspace,
+                execution: msg.execution,
                 retargetMirror: retarget,
             });
             if (!started) {
@@ -153,12 +148,24 @@ export class RunnerSession {
                 return;
             }
             this.liveIds.add(msg.localThreadId);
-            // Launch the TUI (fresh `--remote` → it creates the thread) so the forwarder
-            // captures the broadcast `thread/started` and binds. Re-launch when the pane
-            // is absent OR its process has died (`isAlive` probes `#{pane_dead}`) — so a
+            // Launch the TUI attached to the already-bound thread. Re-launch when the
+            // pane is absent OR its process has died (`isAlive` probes `#{pane_dead}`) — so a
             // reconnect after the TUI exited restarts it instead of skipping (a
             // launched-once guard would leave a dead "Pane is dead" husk forever).
             if (!this.terminals.get(`${msg.localThreadId}-main`)?.isAlive()) {
+                const terminalReady = provider.waitTerminalReady
+                    ? await provider.waitTerminalReady(msg.localThreadId)
+                    : true;
+                if (!terminalReady) {
+                    this.transport.send({
+                        t: "live.ready",
+                        reqId: msg.reqId,
+                        localThreadId: msg.localThreadId,
+                        ok: false,
+                        error: "Provider thread was not ready for Terminal resume",
+                    });
+                    return;
+                }
                 await this.launchCodexPane(msg.localThreadId, msg.cols, msg.rows);
             }
             const ready = msg.waitForReady === false
@@ -166,12 +173,27 @@ export class RunnerSession {
                 : provider.waitLiveReady
                     ? await provider.waitLiveReady(msg.localThreadId)
                     : true;
+            const terminal = this.terminals.get(`${msg.localThreadId}-main`);
+            const paneFailure = !ready && terminal && !terminal.isAlive()
+                ? terminal
+                    .capturePane()
+                    .split("\n")
+                    .map((line) => line.trim())
+                    .filter(Boolean)
+                    .slice(-6)
+                    .join(" ")
+                    .slice(-1_000)
+                : "";
+            const readinessError = provider.liveSessionError?.(msg.localThreadId)
+                ?? (paneFailure
+                    ? `Provider terminal exited before session discovery: ${paneFailure}`
+                    : "live session was not ready before timeout");
             this.transport.send({
                 t: "live.ready",
                 reqId: msg.reqId,
                 localThreadId: msg.localThreadId,
                 ok: ready,
-                ...(ready ? {} : { error: "live session was not ready before timeout" }),
+                ...(ready ? {} : { error: readinessError }),
             });
         }
         catch (error) {
@@ -343,7 +365,10 @@ export class RunnerSession {
             case "clearGoal":
                 return this.executor.clearGoal(args[0]);
             case "forkSession":
-                return this.executor.forkSession(args[0], args[1]);
+                if (!this.executor.forkSession) {
+                    throw new Error("Provider fork is unavailable");
+                }
+                return this.executor.forkSession(args[0], args[1], args[2]);
         }
     }
 }

package/dist/runner/manager.d.ts

@@ -15,8 +15,8 @@
  * transport drops in here later without touching `ConversationRuntime` or any
  * channel.
  */
-import { spawn as nodeSpawn } from "node:child_process";
-import { type AgentCapabilities, type AgentRuntimeId, type AgentSpec, type AppConfig, type CapabilityResult, type ModelListResponse, type ReasoningEffort, type RuntimeUserInput, type SessionInteractionResolution, type SessionEvent, type ThreadGoal } from "@rynx-ai/core";
+import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import { type AdmissionReservation, type AgentCapabilities, type AgentRuntimeId, type AppConfig, type CapabilityResult, type ModelListResponse, type ResolvedExecutionSnapshot, type RuntimeUserInput, type SessionInteractionResolution, type SessionEvent, type SessionWorkspaceSnapshot, type ThreadGoal } from "@rynx-ai/core";
 import { type CodexSessionStore } from "../host.js";
 import type { ResolveInteractionResult } from "../interactions.js";
 import { type InjectOutcome, type TerminalOpenErrorCode, type TerminalRole } from "./protocol.js";
@@ -53,8 +53,22 @@ export interface RunnerManagerOptions {
     liveStartTimeoutMs?: number;
     /** Max wait for a Provider-native thread to become ready. */
     liveReadyTimeoutMs?: number;
+    /** Max wait for a native interrupt acknowledgement before reporting it
+     * unproven. Callers may then use the explicit force-stop path. */
+    liveInterruptTimeoutMs?: number;
+    /** Max wait for an accepted owner TUI submission to become observable as a
+     * mirrored response or a published native rotation. */
+    terminalInputHandoffTimeoutMs?: number;
+    /** Initial exponential backoff for retrying unproven terminal cleanup. */
+    terminalInputCleanupRetryMs?: number;
     /** Injected for tests. */
     spawn?: typeof nodeSpawn;
+    /** Injected for tests. Defaults to signaling the whole POSIX process group
+     * created for the runner child, with direct-child fallback. */
+    signalChild?: (child: ChildProcess, signal: NodeJS.Signals, processGroup: boolean) => void;
+    /** Injected for tests. Kills and verifies the deterministic private tmux
+     * server owned by a Session runner. */
+    terminateTerminalServer?: (terminalName: string) => boolean | Promise<boolean>;
     now?: () => number;
     /** Extra env merged into every spawned runner child — e.g. the control-plane
      *  URL + token so a claude-native PermissionRequest hook can POST back. */
@@ -62,6 +76,13 @@ export interface RunnerManagerOptions {
     /** Optional lifecycle context for Session runners. The shared `__cap__`
      * runner never opens one. */
     sessionContextProvider?: RunnerSessionContextProvider;
+    /** Dynamic process-wide admission fence. Existing cancellation and read-only
+     * inspection remain available; every path that may spawn or attach execution
+     * checks this immediately before admission. */
+    admissionOpen?: () => boolean;
+    /** Atomically reserves one work-producing admission while it crosses the
+     * asynchronous boundary into an observable live runner/turn. */
+    admissionReserve?: () => AdmissionReservation | undefined;
 }
 /** A session rotation reported by a runner child (claude `/clear`·`/fork`): the
  *  new session `to` is now aliased to `from`'s runner; carries meta to carry over. */
@@ -69,9 +90,8 @@ export interface RotateInfo {
     from: string;
     to: string;
     kind: "clear" | "fork";
-    agent?: string;
-    model?: string;
-    cwd?: string;
+    workspace: SessionWorkspaceSnapshot;
+    execution: ResolvedExecutionSnapshot;
     parentSessionId?: string;
 }
 /** Options for {@link RunnerManager.openTerminal}. */
@@ -119,6 +139,8 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly spawn;
     private readonly childEnv;
     private readonly sessionContextProvider;
+    private readonly admissionOpen;
+    private readonly admissionReserve;
     private readonly now;
     private readonly defaultRuntime;
     private readonly handles;
@@ -128,8 +150,13 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly reapTimer;
     private readonly shutdownGraceMs;
     private readonly shutdownKillGraceMs;
+    private readonly signalChild;
+    private readonly terminateTerminalServer;
     private readonly liveStartTimeoutMs;
     private readonly liveReadyTimeoutMs;
+    private readonly liveInterruptTimeoutMs;
+    private readonly terminalInputHandoffTimeoutMs;
+    private readonly terminalInputCleanupRetryMs;
     private stopping;
     private stopPromise;
     /** Sink for mirrored {@link SessionEvent}s from every session's forwarder. */
@@ -140,6 +167,24 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly liveSessionKeys;
     /** Last live-start error per local session, surfaced by the control API. */
     private readonly liveErrors;
+    /** Last immutable launch snapshots seen for a Session. Used only to restore a
+     * target request that crossed a fork reservation boundary. */
+    private readonly liveOptions;
+    /** A fork reserves its target before the first asynchronous store read. This
+     * prevents another entry point from starting the target against an
+     * uncommitted Provider binding. */
+    private readonly forkReservations;
+    /** A native fork temporarily makes the source read-only so its canonical
+     * snapshot and Provider context are captured at the same boundary. */
+    private readonly sourceForkReservations;
+    /** Manager-wide fork de-duplication. LocalAgentHost only sees one source
+     * runner, so the fence must live here to cover concurrent source runners. */
+    private readonly forkOperations;
+    private readonly forkBufferedMessages;
+    private readonly forkBufferedTerminalInputs;
+    /** Owner TUI submissions accepted by the parent but not yet represented by a
+     * mirrored response or a durably published native rotation. */
+    private readonly terminalInputHandoffs;
     constructor(opts: RunnerManagerOptions);
     /**
      * Open a live terminal on the session's runner child (spawning it if needed).
@@ -166,33 +211,39 @@ export declare class RunnerManager implements AgentCapabilities {
     onMirror(listener: (sessionId: string, event: SessionEvent) => void): void;
     /** Register the sink for session rotations (claude `/clear`·`/fork`): the server
      *  records the new session's meta (carry-over agent/model/title). */
-    onRotate(listener: (rotation: RotateInfo) => void): void;
+    onRotate(listener: (rotation: RotateInfo) => void | Promise<void>): void;
+    /** Accepted TUI submissions that have not crossed into an observable runtime
+     * state. The daemon folds this into runningTurns after closing admission. */
+    pendingTerminalInputCount(): number;
+    private beginTerminalInputHandoffs;
+    private settleTerminalInputHandoff;
+    private settleTerminalRotationHandoff;
+    private currentTerminalSessionId;
+    private finishTerminalInputHandoff;
+    private finishAllTerminalInputHandoffs;
+    private preserveTerminalInputHandoffsAsActivity;
+    private scheduleTerminalInputCleanupRetry;
+    private expireTerminalInputHandoffs;
     /**
      * Eagerly bring up a session's codex-native live view (persistent forwarder +
      * detached `codex --remote` TUI) in its runner child, spawning the runner if
      * needed. Idempotent. Resolves true once the codex thread is bound; false for a
      * non-codex / non-live session (the caller then uses the normal run path).
      */
-    ensureLiveSession(localThreadId: string, opts?: {
-        cwd?: string;
+    ensureLiveSession(localThreadId: string, opts: {
+        workspace: SessionWorkspaceSnapshot;
+        execution: ResolvedExecutionSnapshot;
         cols?: number;
         rows?: number;
-        runtime?: AgentRuntimeId;
-        reasoningEffort?: ReasoningEffort;
-        agentName?: string;
-        agentSpec?: AgentSpec;
     }): Promise<boolean>;
     /** Start the Provider pane without waiting for login/onboarding to create a
      * native thread. This is the setup-terminal gate; callers may attach as soon
      * as it resolves, while normal message delivery still uses ensureLiveSession. */
-    startLiveSession(localThreadId: string, opts?: {
-        cwd?: string;
+    startLiveSession(localThreadId: string, opts: {
+        workspace: SessionWorkspaceSnapshot;
+        execution: ResolvedExecutionSnapshot;
         cols?: number;
         rows?: number;
-        runtime?: AgentRuntimeId;
-        reasoningEffort?: ReasoningEffort;
-        agentName?: string;
-        agentSpec?: AgentSpec;
     }): Promise<boolean>;
     private requestLiveSession;
     lastLiveSessionError(localThreadId: string): string | undefined;
@@ -203,6 +254,7 @@ export declare class RunnerManager implements AgentCapabilities {
      * the session has no live forwarder (caller falls back to the run path).
      */
     injectMessage(localThreadId: string, input: RuntimeUserInput | string): Promise<InjectOutcome>;
+    private injectMessageAdmitted;
     /**
      * Interrupt a session's active live turn — the web Stop button (codex
      * `turn/interrupt`, claude Escape). Best-effort: resolves false with NO spawn
@@ -215,7 +267,16 @@ export declare class RunnerManager implements AgentCapabilities {
     getGoal(localThreadId: string): Promise<CapabilityResult<ThreadGoal | null>>;
     setGoal(localThreadId: string, objective: string): Promise<CapabilityResult>;
     clearGoal(localThreadId: string): Promise<CapabilityResult>;
-    forkSession(currentLocalThreadId: string, newLocalThreadId: string): Promise<CapabilityResult>;
+    forkSession(currentLocalThreadId: string, newLocalThreadId: string, options: {
+        workspace: SessionWorkspaceSnapshot;
+        execution: ResolvedExecutionSnapshot;
+        beforeProviderFork: () => Promise<void>;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        message: string;
+    }>;
     /**
      * Backend-free runtime readiness (not part of `AgentCapabilities`; surfaced for
      * the control console). Never spawns a runner.
@@ -226,13 +287,25 @@ export declare class RunnerManager implements AgentCapabilities {
     }): Promise<import("../host.js").CodexRuntimeStatus>;
     /** Stop the runner bound to one session (if any), rejecting its in-flight work. */
     stopRunner(localThreadId: string): void;
+    /** Force-stop and join the runner bound to one Session. Unlike stopRunner,
+     * completion proves that the child process has exited. */
+    terminateLiveSession(localThreadId: string): Promise<boolean>;
     /** Stop every runner and join all child exits. Idempotent across concurrent calls. */
     stop(): Promise<void>;
+    private handleForCleanup;
     /** Forward a capability to a runner child. Session-less caps (listModels/status)
      *  use the shared `CAP_KEY` child; per-thread caps pass the session's key so they
      *  run on that session's child (which owns its private CODEX_HOME). */
     private forwardCap;
     private getOrSpawn;
+    private assertAdmissionOpen;
+    private reserveAdmission;
+    private performManagedFork;
+    private performClaudeManagedFork;
+    private bufferForkTargetMessage;
+    private reservedForkTarget;
+    private deliverForkBufferedMessage;
+    private deliverRotateMessage;
     private spawnHandle;
     private onChildMessage;
     /** Mark a handle dead and reject every pending run/cap with the exit reason. */