@sleep2agi/agent-network 2.3.0-preview.4 → 2.3.0-preview.41

package/dist/src/normalize-runtime.d.ts

@@ -1,9 +1,21 @@
-export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp";
-/** Operator-facing default for any runtime slot that comes in empty / missing / unrecognized. */
+export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp" | "grok-build-cli" | "opencode-cli" | "codex-app-server";
+/** Operator-facing default for a runtime slot that is empty or missing. */
 export declare const DEFAULT_RUNTIME: RuntimeName;
+export declare const SUPPORTED_RUNTIME_NAMES: readonly RuntimeName[];
 type ProfileLike = {
     runtime?: string;
     codexRuntime?: string;
 };
+/**
+ * Legacy normalization used by display and migration code. Missing, empty,
+ * and unknown values all use the safe default for backward compatibility.
+ * Security-sensitive create/start paths must call `normalizeRuntimeStrict`.
+ */
 export declare function normalizeRuntime(profileOrRuntime?: ProfileLike | string): RuntimeName;
+/**
+ * Canonicalize a runtime at an execution boundary. Missing/empty still means
+ * the documented default, but any non-empty unknown value is rejected so a
+ * typo or future runtime cannot silently execute as Claude.
+ */
+export declare function normalizeRuntimeStrict(profileOrRuntime?: ProfileLike | string): RuntimeName;
 export {};

package/dist/src/opencode-agent-node-pair.d.ts

@@ -0,0 +1,14 @@
+export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.41";
+export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.32";
+export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.32";
+export declare function opencodeExactPairInstallCommand(): string;
+/** Runtime capability advertised by agent-node's operator-facing help. */
+export declare function agentNodeHelpSupportsOpencode(help: string): boolean;
+/**
+ * Resolve a package-owned agent-node entrypoint and verify its immutable
+ * release identity before it can receive `opencode-cli`. Capability text is
+ * not a security boundary: an older preview already advertised the runtime.
+ */
+export declare function validateAgentNodePackageEntrypoint(rawEntrypoint: string, packageSpec: string, expectedVersion?: string, forbiddenRoots?: readonly string[]): string;
+/** Skip invalid/local PATH shims and return the first exact trusted package. */
+export declare function resolveAgentNodePackageEntrypointFromPath(searchPath: string, packageSpec: string, expectedVersion: string, forbiddenRoots?: readonly string[]): string;

package/dist/src/opencode-auth-login.d.ts

@@ -0,0 +1,43 @@
+import type { OpencodePresetId } from "./opencode-preset";
+export declare const OPENCODE_AUTH_LOGIN_ROOT_PREFIX = "opencode-auth-login-";
+export declare const OPENCODE_AUTH_LOGIN_OWNER_FILE = ".owner.json";
+export declare const OPENCODE_AUTH_LOGIN_CLEANUP_PREFIX = ".anet-opencode-auth-cleanup-";
+export interface OpencodeAuthLoginSandbox {
+    readonly nodeWorkDir: string;
+    readonly provider: OpencodePresetId;
+    readonly root: string;
+    readonly cwd: string;
+    readonly authPath: string;
+    readonly env: Readonly<NodeJS.ProcessEnv>;
+}
+export interface CreateOpencodeAuthLoginSandboxOptions {
+    nodeWorkDir: string;
+    provider: OpencodePresetId | string;
+    parentEnv?: NodeJS.ProcessEnv;
+    /** Internal/test-only trusted external base override. */
+    launchBase?: string;
+}
+export interface OpencodeAuthLoginCredential {
+    provider: OpencodePresetId;
+    type: "api";
+    key: string;
+}
+/** Deterministic exact-1.18.1 login argv for the selected API-key flow. */
+export declare function buildOpencodeAuthLoginArgs(provider: OpencodePresetId | string): string[];
+/** Prepare a fresh, node-scoped environment for one interactive login. */
+export declare function createOpencodeAuthLoginSandbox(options: CreateOpencodeAuthLoginSandboxOptions): OpencodeAuthLoginSandbox;
+/** Repeat external-root ancestor and inode validation immediately before the
+ * vetted upstream binary is spawned. */
+export declare function revalidateOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Read only the selected provider's exact API-key shape from the fresh root.
+ * OAuth/browser-login records and mixed/multi-provider documents are refused.
+ */
+export declare function readOpencodeAuthLoginCredential(sandbox: OpencodeAuthLoginSandbox): OpencodeAuthLoginCredential;
+/** Safely remove a sandbox created by this process. Idempotent after removal. */
+export declare function cleanupOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Lifecycle helper for CLI integration. Spawn/wait/read the credential inside
+ * `action`; the fresh tree is cleaned on success, child failure, or throw.
+ */
+export declare function withOpencodeAuthLoginSandbox<T>(options: CreateOpencodeAuthLoginSandboxOptions, action: (sandbox: OpencodeAuthLoginSandbox) => T | Promise<T>): Promise<T>;

package/dist/src/opencode-launch-env.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Process-loader hooks that must never cross the opencode-cli launcher
+ * boundary. The exact agent-node package/entrypoint check happens before the
+ * node profile env is merged; allowing that profile to supply one of these
+ * variables would let code run before the verified entrypoint's first line.
+ */
+export declare const OPENCODE_AGENT_NODE_LOADER_ENV_KEYS: readonly ["NODE_OPTIONS", "NODE_PATH", "NODE_V8_COVERAGE", "NODE_REDIRECT_WARNINGS", "NODE_COMPILE_CACHE", "BUN_OPTIONS", "BUN_PRELOAD", "LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT", "LD_DEBUG_OUTPUT", "DYLD_INSERT_LIBRARIES", "DYLD_LIBRARY_PATH", "DYLD_FRAMEWORK_PATH", "DYLD_FALLBACK_LIBRARY_PATH", "OPENSSL_CONF", "OPENSSL_ENGINES", "OPENSSL_MODULES"];
+/**
+ * Return a child env that preserves the launcher's original executable search
+ * path and removes pre-entrypoint loader/write hooks. Other operator settings
+ * (locale, proxy, custom CA, channel integration) remain backward-compatible.
+ */
+export declare function hardenOpencodeAgentNodeEnv(source: NodeJS.ProcessEnv, launcherPath: string | undefined): NodeJS.ProcessEnv;

package/dist/src/opencode-owner-mode.d.ts

@@ -0,0 +1,6 @@
+/** Linux user-private-group compatibility for ordinary umask 0002 installs. */
+export declare function opencodeOwnedPathModeIsSafe(stat: {
+    uid: number;
+    gid: number;
+    mode: number | bigint;
+}, runtimeUid?: number | undefined, runtimeGid?: number | undefined): boolean;

package/dist/src/opencode-package-binary.d.ts

@@ -0,0 +1,21 @@
+export interface ValidateOpencodePackageBinaryOptions {
+    expectedVersion: string;
+    /** A package payload may not be inside, or contain, the current project or
+     * node state tree. This rejects project-local same-version impersonators. */
+    forbiddenRoots?: readonly string[];
+}
+/** Current cwd plus every enclosing source-workspace boundary. This catches a
+ * monorepo root's node_modules when anet is invoked from packages/app. */
+export declare function discoverOpencodeForbiddenRoots(cwd?: string): string[];
+/**
+ * Bind an executable to the exact npm `opencode-ai` payload identity.
+ *
+ * `--version` output alone is not an identity boundary: a checkout can put a
+ * same-version credential-stealing shim first on PATH. Only the canonical
+ * package entrypoint with matching package metadata and trusted path modes is
+ * admitted. The returned path is the one callers must spawn verbatim.
+ */
+export declare function validateOpencodePackageBinary(rawBinary: string, options: ValidateOpencodePackageBinaryOptions): string;
+/** Resolve the first *valid package-owned* OpenCode entry on PATH. Invalid
+ * project-local shims are skipped so a later trusted global install can win. */
+export declare function resolveOpencodePackageBinaryFromPath(searchPath: string, options: ValidateOpencodePackageBinaryOptions): string;

package/dist/src/opencode-pin.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Version this branch was validated against by the maintainers.
+ * Bumped when a new opencode-ai release passes the full Docker/E2E gate.
+ */
+export declare const OPENCODE_BUILTIN_PIN = "1.18.1";
+/** Exact upstream remediation shared by every CLI failure path. */
+export declare function opencodeExactInstallCommand(version?: string): string;
+/** Preserve package-identity diagnostics while always leaving a missing or
+ * untrusted install with an actionable exact-pin command. */
+export declare function formatOpencodePackageIdentityFailure(expectedVersion: string, detail: string): string;
+/** Where the per-machine override lives. Kept under `~/.anet/` so
+ *  it sits next to the other anet-local state. */
+export declare function opencodePinFilePath(homeDirOverride?: string): string;
+/** Shape of the override file written by `upgrade-pin`. */
+export interface OpencodePinOverride {
+    version: string;
+    /** ISO timestamp when the smoke test passed. Presence of this
+     *  field is REQUIRED for `readEffectivePin()` to trust the file —
+     *  a hand-edited version without a smoke marker is refused. */
+    smokePassedAt: string;
+    /** Free-form note about what the smoke checked (initialize +
+     *  session/new by default). Kept so a future review can tell what
+     *  bar the pin actually cleared. */
+    smokeNote?: string;
+}
+export interface EffectivePin {
+    version: string;
+    source: "override-file" | "builtin";
+    smokePassedAt?: string;
+}
+/**
+ * Recognize a validated override only when it records the exact built-in
+ * release pin. A different locally-smoked version is deliberately ignored:
+ * the lightweight ACP smoke does not replace the maintainer's full security
+ * and reply-path gate. Malformed/stale files also fall back to the built-in.
+ */
+export declare function readEffectivePin(homeDirOverride?: string): EffectivePin;
+/**
+ * Write the override — SHOULD ONLY be called after the smoke test
+ * has actually passed. The command layer in `bin/cli.ts` is
+ * responsible for gating this; this function does no
+ * verification of its own beyond shape.
+ */
+export declare function writePinOverride(version: string, smokePassedAt: string, smokeNote?: string, homeDirOverride?: string): void;

package/dist/src/opencode-preset.d.ts

@@ -0,0 +1,73 @@
+export type OpencodePresetId = "anthropic" | "openai";
+export interface OpencodePreset {
+    id: OpencodePresetId;
+    displayName: string;
+    envKey: string;
+    signupUrl: string;
+    /** How opencode's provider config identifies this vendor in the
+     *  `provider.<id>.options.baseUrl` config. Left null when we don't
+     *  need to override the built-in default. */
+    configProviderId: "anthropic" | "openai";
+}
+export declare const OPENCODE_PRESETS: OpencodePreset[];
+/**
+ * OpenCode tools disabled for the default `opencode-cli` profile.
+ *
+ * This policy reduces the model's ambient filesystem/shell surface. It is
+ * deliberately represented in the generated opencode.json so operators can
+ * inspect the default, but it is not an OS security boundary: a same-uid
+ * OpenCode process can still read files allowed by normal filesystem ACLs.
+ */
+export declare const OPENCODE_DEFAULT_DISABLED_TOOLS: readonly ["bash", "read", "glob", "grep", "edit", "write", "list", "task", "skill", "webfetch", "websearch", "question"];
+export declare function buildOpencodeDefaultToolsPolicy(): Record<string, false>;
+export declare function buildOpencodeDefaultPermissionPolicy(): Record<string, "deny">;
+export declare function findOpencodePreset(id: string): OpencodePreset | null;
+/**
+ * Look up the API key for a preset from the current process env.
+ * Callers MUST handle the `null` case (per RFC v0.3 D3 + 通信龙 PR③
+ * flag: "从 env 读, 别 prompt"). Returns null so the wizard can
+ * emit a clear message telling the operator to export the env var
+ * and re-run — rather than silently continuing without a key.
+ */
+export declare function readPresetKeyFromEnv(preset: OpencodePreset, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * opencode.ai's auth.json shape:
+ *   { "<providerId>": { "type": "api", "key": "..." } }
+ * Same shape verified against the release pin opencode-ai@1.18.1.
+ */
+export declare function buildAuthJsonBody(preset: OpencodePreset, apiKey: string): string;
+export type OpencodePrivateProfileFilename = "config.json" | ".env";
+/**
+ * Establish the boundary before saveProfile/rewritePlainSecrets writes the
+ * node token or dotenv key. The expected shape is exactly
+ * `<project>/.anet/nodes/<node>`. Every existing path is inspected with
+ * lstat + O_NOFOLLOW and inode checks; absent private directories are created
+ * one component at a time. A pre-planted node-root/config/.env symlink is a
+ * hard error before any secret-bearing write.
+ */
+export declare function prepareOpencodeNodeForProfileWrite(nodeWorkDir: string): string;
+export declare function readOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename): string | undefined;
+export declare function writeOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename, body: string): string;
+/**
+ * Write auth.json into the opencode config root that lives under
+ * `nodeWorkDir` (the per-node OpenCode data root). mode 0o600 limits
+ * filesystem access to the owning OS account; it does not prevent a
+ * same-uid OpenCode child from opening the file directly. Directory is
+ * created if missing.
+ *
+ * Returns the absolute path we wrote for logging.
+ */
+export declare function writeOpencodeAuthJson(nodeWorkDir: string, preset: OpencodePreset, apiKey: string): string;
+/**
+ * New keyless nodes must not inherit a private-but-preplanted credential.
+ * Keep the file present as an explicit empty object so the creation log's
+ * "auth not configured" statement matches the state OpenCode will consume.
+ */
+export declare function clearOpencodeAuthJson(nodeWorkDir: string): string;
+/**
+ * Companion opencode.json: records only the selected blessed provider
+ * identity and safe-by-default tool policy. Pre-existing model routing and
+ * arbitrary OpenCode integrations are stripped; operators may explicitly set
+ * a model after creation, which the runtime's separate safe renderer retains.
+ */
+export declare function writeOpencodeConfigJson(nodeWorkDir: string, preset: OpencodePreset): string;

package/dist/src/opencode-runtime-binding.d.ts

@@ -0,0 +1,30 @@
+export declare const OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION: 1;
+export declare const OPENCODE_RUNTIME_BINDING_RUNTIME: "opencode-cli";
+export declare const OPENCODE_RUNTIME_BINDINGS_DIRECTORY = "opencode-runtime-bindings";
+export interface OpencodeRuntimeBinding {
+    schemaVersion: typeof OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION;
+    runtime: typeof OPENCODE_RUNTIME_BINDING_RUNTIME;
+    projectRoot: string;
+    nodeId: string;
+}
+/** Windows reports synthetic POSIX permission bits; retain all other checks there. */
+export declare function isOpencodeRuntimeBindingModeSecure(mode: number, exactMode?: number, platform?: NodeJS.Platform): boolean;
+/** Resolve the deterministic binding path without creating HOME state. */
+export declare function opencodeRuntimeBindingPath(nodeWorkDir: string, homeDirectory?: string): string;
+/** Persist an external, immutable-by-config record that this node was created as OpenCode. */
+export declare function writeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): string;
+/** Read and validate a binding. Missing bindings return undefined; unsafe or tampered state throws. */
+export declare function readOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding | undefined;
+/**
+ * Remove only the exact, validated binding for this node. Missing exact state is
+ * idempotent; malformed, replaced, or unsafe state always fails closed.
+ */
+export declare function removeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): boolean;
+/** Assert that the external record exists and exactly identifies this node as opencode-cli. */
+export declare function assertExactOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding;
+/**
+ * Refuse OpenCode node state committed to a surrounding Git index. A normal
+ * non-Git project is allowed. Git is always invoked directly with argv and a
+ * literal pathspec; no shell or command interpolation is used.
+ */
+export declare function assertOpencodeNodeStateUntracked(nodeWorkDir: string): void;

package/dist/src/opencode-safe-root.d.ts

@@ -0,0 +1,27 @@
+/** Exact 1.18.1 project/instruction discovery surface plus project-root
+ * redirects. Any existing entry, including a broken symlink, is a refusal. */
+export declare const OPENCODE_SAFE_ANCESTOR_CANDIDATES: readonly ["opencode.jsonc", "opencode.json", ".opencode", "AGENTS.md", "CLAUDE.md", "CONTEXT.md", ".claude", ".agents", ".git"];
+interface PathIdentity {
+    path: string;
+    dev: number | bigint;
+    ino: number | bigint;
+}
+export interface OpencodeSafeExternalRoot {
+    readonly base: string;
+    readonly root: string;
+    readonly cwd: string;
+    readonly dev: number | bigint;
+    readonly ino: number | bigint;
+    readonly baseDev: number | bigint;
+    readonly baseIno: number | bigint;
+    readonly ancestors: readonly PathIdentity[];
+}
+export declare function resolveOpencodeTrustedRuntimeBase(explicit?: string): PathIdentity;
+export declare function createOpencodeSafeExternalRoot(options: {
+    prefix: string;
+    boundaries?: readonly string[];
+    base?: string;
+}): OpencodeSafeExternalRoot;
+export declare function revalidateOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export declare function cleanupOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export {};

package/dist/src/opencode-smoke-env.d.ts

@@ -0,0 +1 @@
+export declare function buildOpencodeSmokeEnv(parentEnv: NodeJS.ProcessEnv, smokeRoot: string, cwd?: string): NodeJS.ProcessEnv;

package/dist/src/outbound-tool-names.d.ts

@@ -0,0 +1 @@
+export declare const OUTBOUND_TOOL_NAMES: Set<string>;

package/dist/src/owner-env-file.d.ts

@@ -0,0 +1,2 @@
+/** Load a reviewed owner-only env file without following a planted link. */
+export declare function loadOwnerOnlyEnvFile(path: string | undefined, env?: NodeJS.ProcessEnv): void;

package/dist/src/package-mode-preflight.d.ts

@@ -0,0 +1,31 @@
+export interface UmaskVerdict {
+    /** Will a freshly npm-extracted payload fail the (mode & 0o022) === 0 check? */
+    willProduceUnsafeModes: boolean;
+    /** Octal umask string as an operator would type it. */
+    umaskOctal: string;
+    /** Which write bits this umask fails to mask off. */
+    leaks: Array<"group" | "other">;
+}
+/**
+ * Read a umask value the way the package check will experience it.
+ *
+ * A umask bit SET means "withhold this permission". So group-write is withheld
+ * only when 0o020 is set in the umask; umask 0002 withholds other-write and
+ * nothing else, which is exactly the failing case.
+ */
+export declare function judgeUmask(umask: number): UmaskVerdict;
+/** One line for `anet doctor`, or null when there is nothing to say. */
+export declare function describeUmaskRisk(verdict: UmaskVerdict): string | null;
+export interface ExtractedPayload {
+    path: string;
+    uid: number;
+    mode: number;
+}
+/**
+ * Which already-extracted payloads would be rejected right now.
+ *
+ * Reports facts about copies that exist on disk; it never fetches. An empty
+ * result means "nothing extracted yet", which is not the same as "safe" — the
+ * umask verdict is what speaks to the next fetch.
+ */
+export declare function rejectedPayloads(payloads: ExtractedPayload[], processUid: number): ExtractedPayload[];

package/dist/src/primary-network.d.ts

@@ -0,0 +1,23 @@
+export interface PrimaryNetworkResponse {
+    ok?: boolean;
+    current_network?: unknown;
+    networks?: unknown;
+}
+export type PrimaryNetworkFetch = (input: string, init: {
+    headers: Record<string, string>;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<PrimaryNetworkResponse>;
+}>;
+export declare class PrimaryNetworkResolutionError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Resolve the authenticated user's active network from the server's explicit
+ * `/api/auth/me.current_network` field.
+ *
+ * Do not fall back to a network name or list position: both are presentation
+ * details, and guessing either can silently run a command in the wrong network.
+ */
+export declare function resolvePrimaryNetwork(hub: string, headers: Record<string, string>, fetchImpl?: PrimaryNetworkFetch): Promise<string>;

package/dist/src/private-state.d.ts

@@ -0,0 +1,10 @@
+export declare function ensurePrivateDirectory(path: string): void;
+/**
+ * Write secret-bearing state without ever publishing an umask-derived file.
+ * The 0600 temporary file is complete and fsynced before the atomic rename,
+ * so replacing a legacy 0644/0664 target also repairs it with no chmod gap.
+ */
+export declare function atomicWritePrivateFile(path: string, body: string): void;
+export declare function atomicWritePrivateJson(path: string, value: unknown): void;
+/** Repair a legacy umask-derived private file before reading its secret. */
+export declare function repairPrivateFilePermissions(path: string): void;

package/dist/src/project-key.d.ts

@@ -0,0 +1 @@
+export declare function encodeCwd(cwd: string): string;

package/dist/src/secret-shell-guidance.d.ts

@@ -0,0 +1,3 @@
+export declare function formatSecretAssignment(platform: string, name: string, value: string): string;
+export declare function secretPersistenceHeading(platform: string): string;
+export declare function secretShellAction(platform: string): "set" | "export";

package/dist/src/task-trace.d.ts

@@ -0,0 +1,33 @@
+export type TaskTraceTransport = "mcp_http" | "sdk_mcp_proxy" | "channel_mcp_proxy";
+export type TaskTraceStatus = "sending" | "delivered" | "failed" | "acked" | "started" | "replied" | "expired";
+export interface TaskTraceEvent {
+    event: string;
+    from_alias: string;
+    to_alias: string;
+    task_id: string | null;
+    parent_task_id: string | null;
+    network_id: string | null;
+    transport: TaskTraceTransport;
+    status: TaskTraceStatus;
+    duration_ms: number;
+    lifecycle_tracking: "tracked" | "not_tracked";
+    error_code?: string;
+    error_message?: string;
+}
+export declare function safeTaskTraceError(value: unknown): string;
+export declare function renderTaskTrace(event: TaskTraceEvent, json?: boolean): string;
+export declare function taskTraceEvent(input: Omit<TaskTraceEvent, "event">): TaskTraceEvent;
+export interface SendTaskTraceInput {
+    fromAlias: string;
+    toAlias: string;
+    parentTaskId: string | null;
+    networkId: string | null;
+    transport: TaskTraceTransport;
+    lifecycleTracking: "tracked" | "not_tracked";
+}
+export interface SendTaskTraceDependencies {
+    send: () => Promise<any>;
+    log: (line: string) => void;
+    now?: () => number;
+}
+export declare function sendTaskWithTrace(input: SendTaskTraceInput, dependencies: SendTaskTraceDependencies): Promise<any>;

package/dist/src/tmux-attach.d.ts

@@ -0,0 +1,8 @@
+export type TmuxSession = {
+    id: string;
+    name: string;
+};
+export declare function parseTmuxSessions(output: string): TmuxSession[];
+/** Resolve by exact decoded session name, then attach by tmux's opaque ID.
+ * This avoids tmux target prefix matching and works for Unicode names. */
+export declare function findExactTmuxSession(output: string, expectedName: string): TmuxSession | null;

package/dist/src/tmux-capability.d.ts

@@ -0,0 +1,58 @@
+/** Lowest tmux version whose `new-session` understands `-e KEY=VALUE`. */
+export declare const MIN_TMUX_MAJOR = 3;
+export declare const MIN_TMUX_MINOR = 2;
+export interface TmuxVersion {
+    major: number;
+    minor: number;
+    /** Trailing letter suffix, e.g. the "a" of "3.0a". Not used for ordering. */
+    suffix: string;
+    raw: string;
+}
+/**
+ * Parse the output of `tmux -V`, e.g.:
+ *   "tmux 3.2a"        → { major: 3, minor: 2,  suffix: "a" }
+ *   "tmux 3.0a"        → { major: 3, minor: 0,  suffix: "a" }
+ *   "tmux 3.4"         → { major: 3, minor: 4,  suffix: ""  }
+ *   "tmux next-3.4"    → { major: 3, minor: 4,  suffix: ""  }
+ *   "tmux 2.9"         → { major: 2, minor: 9,  suffix: ""  }
+ *
+ * Returns null when no version can be extracted (unknown build, empty
+ * output, `tmux master` with no numbers). Callers must treat null as
+ * "unknown" and NOT as "too old" — refusing to start on an unparseable
+ * version string would break hosts whose tmux is perfectly capable.
+ */
+export declare function parseTmuxVersion(raw: string): TmuxVersion | null;
+/**
+ * True when this version's `new-session` supports `-e KEY=VALUE` (>= 3.2).
+ * Note 3.0a / 3.1c sort BELOW 3.2 — the letter suffix is a patch marker,
+ * never a minor bump, so it must not participate in the comparison.
+ */
+export declare function tmuxSupportsSessionEnv(v: TmuxVersion): boolean;
+export type TmuxCapabilityVerdict = {
+    kind: "ok";
+    version: TmuxVersion;
+} | {
+    kind: "unknown";
+    detail: string;
+} | {
+    kind: "too_old";
+    version: TmuxVersion;
+    detail: string;
+    remedy: string[];
+} | {
+    kind: "missing";
+    detail: string;
+    remedy: string[];
+};
+/**
+ * Pure decision function — `runVersionCmd` returns `tmux -V` output, or
+ * throws if tmux is absent/unrunnable. Split from the printing/exiting
+ * wrapper so tests drive every branch without a tmux binary.
+ */
+export declare function checkTmuxCapability(runVersionCmd: () => string): TmuxCapabilityVerdict;
+/**
+ * cli.ts wrapper: run the check, print an actionable message, and exit
+ * non-zero when tmux cannot carry the marker. `unknown` is deliberately
+ * permissive — we log and continue.
+ */
+export declare function assertTmuxSupportsSessionEnv(runVersionCmd: () => string, log: (msg: string) => void, fail: (msg: string) => never): void;

package/dist/src/tmux-exact-target.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Exact-match tmux target for a session name.
+ *
+ * tmux treats a leading `=` as "this exact name, no prefix matching". Names are
+ * passed to tmux as argv entries, never through a shell, so no quoting belongs
+ * here — callers that build a copy-pasteable command for a human should shell-
+ * quote the result themselves.
+ */
+export declare function exactSession(name: string): string;
+/**
+ * True when this target is already pinned to an exact session.
+ *
+ * Applying the prefix twice would look for a session literally named `=x`.
+ */
+export declare function isExactTarget(target: string): boolean;
+/** Idempotent form, for call sites that may receive either shape. */
+export declare function ensureExactSession(nameOrTarget: string): string;
+/** One row of `tmux list-panes -a -F '#{session_name}\t#{window_index}.#{pane_index}'`. */
+export interface PaneRow {
+    session: string;
+    /** `window.pane`, e.g. `0.0`. */
+    coord: string;
+}
+export declare function parsePaneRows(listOutput: string): PaneRow[];
+/**
+ * Pane target for a session, or null when that exact session has no pane.
+ *
+ * Matching is exact string equality on the session name — the whole point is to
+ * not hand tmux a name it might prefix-match, and to not hand it a `=` form it
+ * cannot resolve for non-ASCII names.
+ */
+export declare function paneTargetFor(listOutput: string, sessionName: string): string | null;
+/** The format string the two functions above expect. */
+export declare const PANE_LIST_FORMAT = "#{session_name}\t#{window_index}.#{pane_index}";

package/dist/src/tmux-pane-prompt.d.ts

@@ -0,0 +1,22 @@
+/** A prompt the watcher knows how to answer, or null. */
+export type PanePrompt = "dev-channels" | "folder-trust";
+/**
+ * Which known prompt (if any) the pane is currently blocking on.
+ *
+ * Dev-channels is checked FIRST, even though it appears second in time. The two
+ * prompts are sequential — trust, then channels — so a capture showing both
+ * means the trust prompt is already answered and only its text is still sitting
+ * in the pane. Classifying that as "folder-trust" would make a watcher that has
+ * already answered trust ignore the prompt it was waiting for, and the node
+ * would hang exactly as if the fix had never been made. Preferring the later
+ * prompt keeps a stale line of scrollback from outranking the live prompt.
+ */
+export declare function classifyPanePrompt(pane: string): PanePrompt | null;
+/**
+ * Best-effort one-line explanation of why a detached start died, taken from the
+ * dead pane's own output.
+ *
+ * Returns null when the pane holds nothing that looks like a refusal — the
+ * caller must then fall back to a generic message rather than inventing one.
+ */
+export declare function extractStartFailureReason(pane: string): string | null;

package/dist/src/token-cli.d.ts

@@ -0,0 +1,13 @@
+export type TokenCreateNameResult = {
+    ok: true;
+    name: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** Parse only `anet token create` operands.
+ *
+ * The legacy positional form stays supported, while flag parsing is strict so
+ * a typo cannot become the name of a newly issued credential.
+ */
+export declare function parseTokenCreateName(argv: readonly string[]): TokenCreateNameResult;

package/dist/src/unsafe-package-path-reason.d.ts

@@ -0,0 +1,17 @@
+export interface PathModeFacts {
+    /** Owner uid of the path. */
+    uid: number;
+    /** Permission bits (st_mode & 0o777). */
+    mode: number;
+    /** uid of the process doing the check. */
+    processUid: number;
+}
+export type UnsafePathReason = "owner" | "group-writable" | "world-writable" | null;
+/** Which condition makes this path unsafe to execute from, if any. */
+export declare function classifyUnsafePath(facts: PathModeFacts): UnsafePathReason;
+/**
+ * Operator-facing explanation. Names the path, the offending bits, and the
+ * command that fixes it — a message that says only "unsafe" leaves the reader
+ * guessing between four different conditions.
+ */
+export declare function describeUnsafePath(path: string, facts: PathModeFacts): string;