@tangle-network/agent-runtime 0.209.0 → 0.211.0

package/dist/{stream-agent-turn-BaKYHbHg.d.ts → stream-agent-turn-B7YnjmXV.d.ts}

@@ -28,6 +28,30 @@ interface ReservationTicket {
     readonly usdBudgeted?: boolean;
   };
 }
+/** Where in the spawn lifecycle a reservation was last seen. `admitted` is the window between
+ *  `reserve` and the hand-off to the child's execution, which the spawning code owns; `executing`
+ *  means the child owns the ticket and only its settlement can close it. */
+type ReservationStage = 'admitted' | 'executing';
+/** Who holds a reservation. Recorded at `reserve` and refined through `attribute` once admission
+ *  mints a node id, so a ticket stranded at the join barrier names the work that holds it instead
+ *  of a bare counter. Every field except `stage` is optional: a pool used directly (no `Scope`)
+ *  names nothing, and an unattributable leak must still be reportable. */
+interface ReservationHolder {
+  /** The manager-scoped assignment identity the caller declared (`SpawnOpts.assignmentId`, else
+   *  its `key`), when it declared one. */
+  readonly assignment?: string;
+  /** The spawn label — the name an operator recognizes in a journal. */
+  readonly label?: string;
+  /** The spawned node's id, once admission minted one. Absent for a reservation that escaped
+   *  before its child had an identity. */
+  readonly childId?: string;
+  readonly stage: ReservationStage;
+}
+/** One reservation still open when a run reached its join barrier — a conserved-pool leak,
+ *  reported with the holder that can be chased rather than only its ticket id. */
+interface LeakedReservation extends ReservationHolder {
+  readonly ticketId: number;
+}
 /** Post-reservation pool readout — the shape `Scope.budget` exposes. `tokensLeft`,
  *  `usdLeft`, and `reservedTokens` reflect committed-but-unsettled reservations;
  *  `deadlineMs` is the ABSOLUTE wall-clock deadline (0 when the root set none).
@@ -88,13 +112,20 @@ interface BudgetPool {
    * ({ ok: false }) when the pool can't cover standard or named channels — the
    * caller inspects `ok` before `ticket`.
    */
-  reserve(b: Budget): {
+  reserve(b: Budget, holder?: ReservationHolder): {
     ok: true;
     ticket: ReservationTicket;
   } | {
     ok: false;
     reason: ReservationRejection;
   };
+  /**
+   * Name (or rename) who holds an open reservation. Merges into what `reserve` recorded, so a
+   * caller states only what it just learned — the node id admission minted, or the stage the
+   * ticket moved to. A settled or unknown ticket is ignored: attribution is leak EVIDENCE, never
+   * a lifecycle guard, and must not be able to fail a run that is otherwise healthy.
+   */
+  attribute(ticket: ReservationTicket, holder: ReservationHolder): void;
   /**
    * Release a reservation: commit the actual `spent`, refund the unspent remainder
    * to the free pool. Throws on an unknown or already-reconciled ticket (fail loud —
@@ -124,6 +155,9 @@ interface BudgetPool {
    *  supervisor's join barrier: once every child has settled, no ticket may remain (a leaked
    *  reservation would silently break `total ≡ free + reserved + committed`). */
   assertNoOpenTickets(): void;
+  /** Every reservation still open, with its holder. Empty on a healthy pool. Read at the join
+   *  barrier so a run that failed can REPORT a leak it must not also be destroyed by. */
+  openReservations(): ReadonlyArray<LeakedReservation>;
 }
 /** Fold a normalized `UsageEvent` array into a `Spend`. Tokens and usd are separate
  *  channels; iterations come from `'iteration'` events. Pure; `ms` stays zero (the
@@ -1219,6 +1253,10 @@ interface Agent<Task, Out> {
    * path; returning `true` means the message was accepted for the current manager session.
    */
   deliver?(msg: unknown): void | boolean;
+  /** Optional live tool evidence exposed by executors that can observe it. */
+  traceSource?(): TraceSource | undefined;
+  /** Optional live execution progress exposed by executors that can observe it. */
+  progress?(): ExecutorProgress | undefined;
 }
 /**
  * The leaf runtime — ONE open interface, not a closed union. `execute` returns a
@@ -1572,11 +1610,12 @@ type UsageEvent = {
   usdKnown: false;
   usd: number;
   /**
-   * The part of `usd` this runtime priced from a model catalog because no provider receipt
-   * covered the work. A catalog price approximates what a provider would bill and never
-   * measures what it did.
+   * The part of `usd` that is a PRICE rather than a charge: a model catalog's own number, or
+   * a figure a provider stated with no billing receipt behind it. Either way it approximates
+   * what a provider would bill and never measures what it did, so `usd - usdEstimated` stays
+   * the amount a provider is known to have billed.
    *
-   * Absence means this runtime priced nothing here, NOT that `usd` is a receipt.
+   * Absence means nothing here was priced, NOT that `usd` is a receipt.
    */
   usdEstimated?: number;
   /**
@@ -1833,10 +1872,10 @@ interface Spend {
    *  when enforcing a dollar-denominated comparison or limit. */
   usdKnown?: boolean;
   usd: number;
-  /** The part of `usd` priced from a model catalog because no provider receipt covered the work.
+  /** The part of `usd` that is a PRICE rather than a charge, because no provider receipt covered
+   *  the work: a model catalog's own number, or a figure a provider stated but did not bill.
    *  `usd - usdEstimated` is what a provider is known to have billed. Present only with
-   *  `usdKnown: false`; absence means nothing here was catalog-priced, not that `usd` is
-   *  measured. */
+   *  `usdKnown: false`; absence means nothing here was priced, not that `usd` is measured. */
   usdEstimated?: number;
   ms: number;
   /**
@@ -2715,6 +2754,12 @@ type SupervisedResult<Out> = {
    *  each is journaled as a `teardown-unconfirmed` event. Present exactly when non-empty; a
    *  healthy run never carries it. */
   teardownUnconfirmed?: ReadonlyArray<UnconfirmedTeardown>;
+  /** Budget reservations still open when the run reached its join barrier, each named by the
+   *  assignment, child id, and lifecycle stage that holds it. The conserved-pool identity
+   *  `total ≡ free + reserved + committed` does not hold, so `spentTotal` is a floor rather
+   *  than a measurement — the run still settles with the tree and the spend the journal
+   *  recorded. Present exactly when non-empty; a healthy run never carries it. */
+  leakedReservations?: ReadonlyArray<LeakedReservation>;
   /** The journaled nodes whose usage accounting is incomplete — the named gaps behind a
    *  `false` `tokensKnown`/`usdKnown` on `spentTotal`. Present exactly when non-empty. */
   spendGaps?: ReadonlyArray<SpendGap>;
@@ -2754,6 +2799,12 @@ type SupervisedResult<Out> = {
    *  each is journaled as a `teardown-unconfirmed` event. Present exactly when non-empty; a
    *  healthy run never carries it. */
   teardownUnconfirmed?: ReadonlyArray<UnconfirmedTeardown>;
+  /** Budget reservations still open when the run reached its join barrier, each named by the
+   *  assignment, child id, and lifecycle stage that holds it. The conserved-pool identity
+   *  `total ≡ free + reserved + committed` does not hold, so `spentTotal` is a floor rather
+   *  than a measurement — the run still settles with the tree and the spend the journal
+   *  recorded. Present exactly when non-empty; a healthy run never carries it. */
+  leakedReservations?: ReadonlyArray<LeakedReservation>;
   /** The journaled nodes whose usage accounting is incomplete — the named gaps behind a
    *  `false` `tokensKnown`/`usdKnown` on `spentTotal`. Present exactly when non-empty. */
   spendGaps?: ReadonlyArray<SpendGap>;
@@ -3587,177 +3638,6 @@ interface InPlaceHarnessResult {
   harness: WorktreeHarnessResult['harness'];
 }
 //#endregion
-//#region src/runtime/harness-usage.d.ts
-/**
- * One harness's own token-usage report for one turn, in the runtime's field names.
- *
- * `input` is the provider's TOTAL prompt count and `output` is its TOTAL completion count.
- * The other three counters CLASSIFY a part of one of those totals; none of them adds to it.
- * `cachedInput` and `cacheWriteInput` classify `input`, which is the convention
- * `promptCacheTokenClasses` (`util.ts`) folds: `freshInput = input - cacheRead - cacheWrite`.
- * `reasoningOutput` classifies `output`.
- *
- * A counter the harness does not report stays absent, because a zero would claim the harness
- * measured none.
- */
-interface HarnessUsage {
-  /** The harness family whose adapter produced this report. */
-  readonly harness: HarnessType;
-  /** Total prompt tokens the provider charged for the turn, the cached ones included. */
-  readonly input: number;
-  /** Total completion tokens the provider charged for the turn, the reasoning ones included. */
-  readonly output: number;
-  /** The part of `input` the provider served from its prompt cache. */
-  readonly cachedInput?: number;
-  /** The part of `input` the provider wrote into its prompt cache. */
-  readonly cacheWriteInput?: number;
-  /** The part of `output` the model spent on reasoning. Never added to `output`. */
-  readonly reasoningOutput?: number;
-}
-/**
- * Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
- * harness-native usage.
- *
- * A NAMED harness reads with that harness's adapter only, and a named harness with no adapter
- * reports nothing. It never falls through to another harness's adapter: a different harness's
- * `turn.completed` decoded as codex would either drop the counters codex does not name or fail on
- * a field codex requires, and both answers would be about the wrong harness. The composite over
- * every registered adapter runs only when the caller cannot name the harness.
- *
- * Throws `ValidationError` when an adapter recognizes the event as its harness's usage carrier and
- * cannot read the numbers.
- */
-declare function decodeHarnessUsage(event: SandboxEvent, harness?: HarnessType): HarnessUsage | undefined;
-//#endregion
-//#region src/runtime/codex-rollout-store.d.ts
-/** Who wrote one rollout, exactly as its own `session_meta` states it. Nothing here is inferred. */
-interface CodexRolloutIdentity {
-  /** The rollout's own thread id (`session_meta.payload.id`). */
-  readonly sessionId: string;
-  /** The thread this one was spawned or forked from, when it was. */
-  readonly parentThreadId?: string;
-  /** The thread whose rows are prepended into this file, when this file is a fork. */
-  readonly forkedFromId?: string;
-  /** True when `thread_source` reads `subagent`: a harness-native child, invisible to the journal. */
-  readonly nativeChild: boolean;
-  /** The child's own path in the harness's agent tree (`/root/c1_b_grid`), when it has one. */
-  readonly agentPath?: string;
-  /** The harness's own nickname for the child ("Turing"), when it has one. */
-  readonly agentNickname?: string;
-  /** Spawn depth the harness recorded. `1` is a direct child of the seat. */
-  readonly depth?: number;
-  /** The working directory the session ran in, used to attribute a store to a workspace. */
-  readonly cwd?: string;
-  /** The codex build that wrote it. */
-  readonly cliVersion?: string;
-  /** When the session itself started, from its own `session_meta` timestamp. */
-  readonly startedAtMs?: number;
-}
-/** How this reader isolated the session's own rows from the parent rows prepended to its file. */
-type CodexForkBoundary =
-/** Not a fork: every row in the file belongs to this session. */
-{
-  readonly kind: 'whole-file';
-} |
-/** A fork whose own first turn was isolated, and by which rule. */
-{
-  readonly kind: 'resolved';
-  readonly rule: 'history-start-ordinal' | 'turn-is-session' | 'turn-uuid-v7' | 'turn-start-time';
-  /** The `turn_id` of the session's own first turn. */
-  readonly turnId?: string;
-  /** Rows credited to the parent and excluded from `own`. */
-  readonly inheritedTurns: number;
-} |
-/** A fork this reader could not isolate. `own` is absent; nothing may be charged. */
-{
-  readonly kind: 'unresolved';
-  readonly reason: string;
-};
-/** One turn of one session, with the counters it added to the session's cumulative total. */
-interface CodexRolloutTurn {
-  readonly turnId?: string;
-  readonly startedAtMs?: number;
-  readonly usage: HarnessUsage;
-}
-/** One rollout file, read. */
-interface CodexRolloutSession {
-  readonly identity: CodexRolloutIdentity;
-  readonly boundary: CodexForkBoundary;
-  /**
-   * The session's OWN spend — the cumulative delta from its fork boundary to its last report.
-   * ABSENT when the boundary is unresolved: an unattributable number must not be charged.
-   */
-  readonly own?: HarnessUsage;
-  /** The session's own turns, newest last. Empty when the file reported no usage. */
-  readonly turns: readonly CodexRolloutTurn[];
-  /**
-   * The file's final cumulative `total_token_usage`, kept ONLY as the diagnostic that shows how
-   * far a naive file total is from the truth. Never charge this.
-   */
-  readonly fileCumulativeInput: number;
-  readonly fileCumulativeOutput: number;
-}
-/** What one incremental read of a store observed. */
-interface CodexStoreDelta {
-  /** Spend by sessions that are NOT native children — the seat's own turns. */
-  readonly seat: HarnessUsage;
-  /** Spend by `thread_source: subagent` sessions — the harness-native children. */
-  readonly native: HarnessUsage;
-  /** Sessions whose fork boundary could not be isolated, so their spend is absent, not zero. */
-  readonly unresolved: ReadonlyArray<{
-    readonly sessionId: string;
-    readonly reason: string;
-  }>;
-  /**
-   * Every session this read touched, for evidence. Each one states its WHOLE own spend and turn
-   * list, which is not the same number as `seat` / `native`: those two carry only what this read
-   * newly observed.
-   */
-  readonly sessions: readonly CodexRolloutSession[];
-}
-/** A store reader that credits each turn once: it tails only the bytes appended since the last read. */
-interface CodexRolloutStoreReader {
-  /**
-   * Read everything appended since the previous call and attribute it.
-   *
-   * The FIRST call establishes the baseline. Call it before the first turn so pre-existing rows are
-   * consumed and credited to nothing; every later call returns exactly that turn's spend.
-   */
-  read(): Promise<CodexStoreDelta>;
-}
-/** Where a harness keeps its own session store, and which workspace may be credited from it. */
-interface CodexRolloutStoreRef {
-  /**
-   * Absolute path to the harness home the CLI writes into — `CODEX_HOME`, or `$HOME/.codex`.
-   * This MUST be the run's own isolated store. Pointing it at an ambient host store credits one
-   * run with another run's files, which is the exact defect this reader exists to end.
-   */
-  readonly root: string;
-  /**
-   * Credit only sessions whose recorded `cwd` is this path or below it. Absent credits every
-   * session under `root`, which is correct only for a store no other run writes to.
-   */
-  readonly workspaceRoot?: string;
-}
-/**
- * Read one rollout's rows into a session record.
- *
- * `rows` is the file's JSON values in file order. Pass the whole file to read a completed session;
- * the store reader passes appended slices and carries the identity forward itself.
- */
-declare function readCodexRolloutSession(rows: Iterable<unknown>): CodexRolloutSession | undefined;
-/**
- * Open an incremental reader over a codex store.
- *
- * Nothing is read until `read()` is called, and every read is bounded by the bytes appended since
- * the previous one, so a 695MB rollout is scanned once rather than once per turn.
- */
-declare function createCodexRolloutStoreReader(ref: CodexRolloutStoreRef): CodexRolloutStoreReader;
-/** Sum two usage reports on every counter both of them state. */
-declare function addHarnessUsage(left: HarnessUsage, right: HarnessUsage): HarnessUsage;
-/** True when a report states any spend at all. */
-declare function harnessUsageIsEmpty(usage: HarnessUsage): boolean;
-//#endregion
 //#region src/runtime/provider-placement.d.ts
 /** Caller-declared execution placement. Matching never changes the authored profile.
  * @experimental */
@@ -3915,56 +3795,6 @@ interface ProviderExecutorOptions {
  * @experimental */
 declare function providerAsExecutor(provider: AgentEnvironmentProvider, options?: ProviderExecutorOptions): ExecutorFactory<unknown>;
 //#endregion
-//#region src/runtime/key-provider.d.ts
-/** Resolve named secrets. The ONE seam every secret store adapts to. */
-interface KeyProvider {
-  /** The value for `name`, or `undefined` when this provider does not hold it. */
-  get(name: string): Promise<string | undefined>;
-}
-/** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
- *  whitespace-only values count as absent — fail loud, not with a blank key. */
-declare function envKeyProvider(env?: Record<string, string | undefined>): KeyProvider;
-/** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
- *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
- *  are resolved at materialize time and never stored. */
-declare const mcpSecretEnvMetadataKey = "secretEnv";
-/** Read (and validate) a server entry's declared secret-env map, if any.
- *  Malformed metadata throws — a half-declared secret must never half-boot. */
-declare function secretEnvOfMcpServer(server: AgentProfileMcpServer): Record<string, string> | undefined;
-/**
- * Resolve a declared secret-env map into the real env entries for a server
- * spawn. Fail-closed: no provider or a missing key throws, naming the KEY
- * NAME only (the value never appears in any message). `label` names the
- * server for the error (e.g. `profile.mcp['exa']`).
- */
-declare function resolveSecretEnv(secretEnv: Record<string, string>, keys: KeyProvider | undefined, label: string): Promise<Record<string, string>>;
-/** The spawn-ready strings for one stdio MCP server: profile config values
- *  resolved, secrets separated so the client can redact them. */
-interface ResolvedMcpServerLaunch {
-  args?: string[];
-  /** Public env, safe to appear in diagnostics. */
-  env?: Record<string, string>;
-  /** Resolved secret env. Reaches only the child process; redacted everywhere else. */
-  protectedEnv?: Record<string, string>;
-}
-/**
- * Resolve a profile MCP server's `args`/`env` config values (interface ≥0.40
- * `AgentProfileConfigValue`) plus the legacy `metadata.secretEnv` channel into
- * the plain strings a spawn needs.
- *
- * Rules, all fail-closed:
- * - `args` must be public values. A secret-ref in argv is refused: argv is
- *   readable by every host process (/proc/PID/cmdline) and outside the
- *   protected-value redaction channel, so a secret there cannot be contained.
- * - `env` secret-refs resolve through the KeyProvider (missing provider or key
- *   throws, naming the KEY NAME only) and land in `protectedEnv`.
- * - An env var declared secret on BOTH channels (env secret-ref and
- *   metadata.secretEnv) is ambiguous configuration and throws.
- * - A public `env` entry shadowed by a legacy metadata secret keeps the
- *   pre-0.40 spawn precedence: the secret value wins in the child env.
- */
-declare function resolveMcpServerLaunch(server: AgentProfileMcpServer, keys: KeyProvider | undefined, label: string): Promise<ResolvedMcpServerLaunch>;
-//#endregion
 //#region src/runtime/sandbox-events.d.ts
 /** The provider/model the platform reports it actually bound to a turn, when it reports one.
  *  `source` is the platform's own account of where that choice came from — `environment` means
@@ -4208,34 +4038,362 @@ interface SandboxLeafOut {
   outcome?: AgentRunOutcome;
 }
 //#endregion
-//#region src/runtime/supervise/inbox.d.ts
-/** A message from the run's AUTHORITY — the parent driver. These two kinds carry instruction. */
-interface AuthorityInboxMessage {
-  readonly kind: 'steer' | 'answer';
-  readonly text: string;
-  /** Forceful messages abort the in-flight turn; queued ones wait for the boundary flush. */
-  readonly interrupt: boolean;
-  /** Present for an `answer` — the question id it resolves. */
-  readonly questionId?: string;
-}
-/** A message from a SIBLING worker. Information, never instruction — the parent stays the only
- *  authority over this worker's task. */
-interface PeerInboxMessage {
-  readonly kind: 'mail';
-  readonly text: string;
-  /** Always false. Peer mail is queued by construction; see this file's header. */
-  readonly interrupt: false;
-  readonly envelope: PeerMailEnvelope;
-}
-type InboxMessage = AuthorityInboxMessage | PeerInboxMessage;
-interface Inbox {
-  /** The `Executor.deliver` implementation. Returns false when the raw message is malformed and
-   * therefore was not queued; callers must not acknowledge a message this inbox discarded. */
-  deliver(msg: unknown): boolean;
-  /** Remove and return all pending messages (the flush). */
-  drain(): InboxMessage[];
-  pending(): number;
-  /** Pending messages from the run's AUTHORITY only. This is what the pre-settle fence counts:
+//#region src/runtime/harness-usage.d.ts
+/**
+ * One harness's own token-usage report for one turn, in the runtime's field names.
+ *
+ * `input` is the provider's TOTAL prompt count and `output` is its TOTAL completion count.
+ * The other three counters CLASSIFY a part of one of those totals; none of them adds to it.
+ * `cachedInput` and `cacheWriteInput` classify `input`, which is the convention
+ * `promptCacheTokenClasses` (`util.ts`) folds: `freshInput = input - cacheRead - cacheWrite`.
+ * `reasoningOutput` classifies `output`.
+ *
+ * A counter the harness does not report stays absent, because a zero would claim the harness
+ * measured none.
+ */
+interface HarnessUsage {
+  /** The harness family whose adapter produced this report. */
+  readonly harness: HarnessType;
+  /** Total prompt tokens the provider charged for the turn, the cached ones included. */
+  readonly input: number;
+  /** Total completion tokens the provider charged for the turn, the reasoning ones included. */
+  readonly output: number;
+  /** The part of `input` the provider served from its prompt cache. */
+  readonly cachedInput?: number;
+  /** The part of `input` the provider wrote into its prompt cache. */
+  readonly cacheWriteInput?: number;
+  /** The part of `output` the model spent on reasoning. Never added to `output`. */
+  readonly reasoningOutput?: number;
+}
+/**
+ * Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
+ * harness-native usage.
+ *
+ * A NAMED harness reads with that harness's adapter only, and a named harness with no adapter
+ * reports nothing. It never falls through to another harness's adapter: a different harness's
+ * `turn.completed` decoded as codex would either drop the counters codex does not name or fail on
+ * a field codex requires, and both answers would be about the wrong harness. The composite over
+ * every registered adapter runs only when the caller cannot name the harness.
+ *
+ * Throws `ValidationError` when an adapter recognizes the event as its harness's usage carrier and
+ * cannot read the numbers.
+ */
+declare function decodeHarnessUsage(event: SandboxEvent, harness?: HarnessType): HarnessUsage | undefined;
+//#endregion
+//#region src/runtime/codex-rollout-store.d.ts
+/** Who wrote one rollout, exactly as its own `session_meta` states it. Nothing here is inferred. */
+interface CodexRolloutIdentity {
+  /** The rollout's own thread id (`session_meta.payload.id`). */
+  readonly sessionId: string;
+  /** The thread this one was spawned or forked from, when it was. */
+  readonly parentThreadId?: string;
+  /** The thread whose rows are prepended into this file, when this file is a fork. */
+  readonly forkedFromId?: string;
+  /** True when `thread_source` reads `subagent`: a harness-native child, invisible to the journal. */
+  readonly nativeChild: boolean;
+  /** The child's own path in the harness's agent tree (`/root/c1_b_grid`), when it has one. */
+  readonly agentPath?: string;
+  /** The harness's own nickname for the child ("Turing"), when it has one. */
+  readonly agentNickname?: string;
+  /** Spawn depth the harness recorded. `1` is a direct child of the seat. */
+  readonly depth?: number;
+  /** The working directory the session ran in, used to attribute a store to a workspace. */
+  readonly cwd?: string;
+  /** The codex build that wrote it. */
+  readonly cliVersion?: string;
+  /** When the session itself started, from its own `session_meta` timestamp. */
+  readonly startedAtMs?: number;
+}
+/** How this reader isolated the session's own rows from the parent rows prepended to its file. */
+type CodexForkBoundary =
+/** Not a fork: every row in the file belongs to this session. */
+{
+  readonly kind: 'whole-file';
+} |
+/** A fork whose own first turn was isolated, and by which rule. */
+{
+  readonly kind: 'resolved';
+  readonly rule: 'history-start-ordinal' | 'turn-is-session' | 'turn-uuid-v7' | 'turn-start-time';
+  /** The `turn_id` of the session's own first turn. */
+  readonly turnId?: string;
+  /** Rows credited to the parent and excluded from `own`. */
+  readonly inheritedTurns: number;
+} |
+/** A fork this reader could not isolate. `own` is absent; nothing may be charged. */
+{
+  readonly kind: 'unresolved';
+  readonly reason: string;
+};
+/** One turn of one session, with the counters it added to the session's cumulative total. */
+interface CodexRolloutTurn {
+  readonly turnId?: string;
+  readonly startedAtMs?: number;
+  readonly usage: HarnessUsage;
+}
+/** One rollout file, read. */
+interface CodexRolloutSession {
+  readonly identity: CodexRolloutIdentity;
+  readonly boundary: CodexForkBoundary;
+  /**
+   * The session's OWN spend — the cumulative delta from its fork boundary to its last report.
+   * ABSENT when the boundary is unresolved: an unattributable number must not be charged.
+   */
+  readonly own?: HarnessUsage;
+  /** The session's own turns, newest last. Empty when the file reported no usage. */
+  readonly turns: readonly CodexRolloutTurn[];
+  /**
+   * The file's final cumulative `total_token_usage`, kept ONLY as the diagnostic that shows how
+   * far a naive file total is from the truth. Never charge this.
+   */
+  readonly fileCumulativeInput: number;
+  readonly fileCumulativeOutput: number;
+}
+/** What one incremental read of a store observed. */
+interface CodexStoreDelta {
+  /** Spend by sessions that are NOT native children — the seat's own turns. */
+  readonly seat: HarnessUsage;
+  /** Spend by `thread_source: subagent` sessions — the harness-native children. */
+  readonly native: HarnessUsage;
+  /** Sessions whose fork boundary could not be isolated, so their spend is absent, not zero. */
+  readonly unresolved: ReadonlyArray<{
+    readonly sessionId: string;
+    readonly reason: string;
+  }>;
+  /**
+   * Every session this read touched, for evidence. Each one states its WHOLE own spend and turn
+   * list, which is not the same number as `seat` / `native`: those two carry only what this read
+   * newly observed.
+   */
+  readonly sessions: readonly CodexRolloutSession[];
+}
+/** A store reader that credits each turn once: it tails only the bytes appended since the last read. */
+interface CodexRolloutStoreReader {
+  /**
+   * Read everything appended since the previous call and attribute it.
+   *
+   * The FIRST call establishes the baseline. Call it before the first turn so pre-existing rows are
+   * consumed and credited to nothing; every later call returns exactly that turn's spend.
+   */
+  read(): Promise<CodexStoreDelta>;
+}
+/** Where a harness keeps its own session store, and which workspace may be credited from it. */
+interface CodexRolloutStoreRef {
+  /**
+   * Absolute path to the harness home the CLI writes into — `CODEX_HOME`, or `$HOME/.codex`.
+   * This MUST be the run's own isolated store. Pointing it at an ambient host store credits one
+   * run with another run's files, which is the exact defect this reader exists to end.
+   */
+  readonly root: string;
+  /**
+   * Credit only sessions whose recorded `cwd` is this path or below it. Absent credits every
+   * session under `root`, which is correct only for a store no other run writes to.
+   */
+  readonly workspaceRoot?: string;
+}
+/**
+ * Read one rollout's rows into a session record.
+ *
+ * `rows` is the file's JSON values in file order. Pass the whole file to read a completed session;
+ * the store reader passes appended slices and carries the identity forward itself.
+ */
+declare function readCodexRolloutSession(rows: Iterable<unknown>): CodexRolloutSession | undefined;
+/**
+ * Open an incremental reader over a codex store.
+ *
+ * Nothing is read until `read()` is called, and every read is bounded by the bytes appended since
+ * the previous one, so a 695MB rollout is scanned once rather than once per turn.
+ */
+declare function createCodexRolloutStoreReader(ref: CodexRolloutStoreRef): CodexRolloutStoreReader;
+/** Sum two usage reports on every counter both of them state. */
+declare function addHarnessUsage(left: HarnessUsage, right: HarnessUsage): HarnessUsage;
+/** True when a report states any spend at all. */
+declare function harnessUsageIsEmpty(usage: HarnessUsage): boolean;
+//#endregion
+//#region src/runtime/key-provider.d.ts
+/** Resolve named secrets. The ONE seam every secret store adapts to. */
+interface KeyProvider {
+  /** The value for `name`, or `undefined` when this provider does not hold it. */
+  get(name: string): Promise<string | undefined>;
+}
+/** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
+ *  whitespace-only values count as absent — fail loud, not with a blank key. */
+declare function envKeyProvider(env?: Record<string, string | undefined>): KeyProvider;
+/** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
+ *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
+ *  are resolved at materialize time and never stored. */
+declare const mcpSecretEnvMetadataKey = "secretEnv";
+/** Read (and validate) a server entry's declared secret-env map, if any.
+ *  Malformed metadata throws — a half-declared secret must never half-boot. */
+declare function secretEnvOfMcpServer(server: AgentProfileMcpServer): Record<string, string> | undefined;
+/**
+ * Resolve a declared secret-env map into the real env entries for a server
+ * spawn. Fail-closed: no provider or a missing key throws, naming the KEY
+ * NAME only (the value never appears in any message). `label` names the
+ * server for the error (e.g. `profile.mcp['exa']`).
+ */
+declare function resolveSecretEnv(secretEnv: Record<string, string>, keys: KeyProvider | undefined, label: string): Promise<Record<string, string>>;
+/** The spawn-ready strings for one stdio MCP server: profile config values
+ *  resolved, secrets separated so the client can redact them. */
+interface ResolvedMcpServerLaunch {
+  args?: string[];
+  /** Public env, safe to appear in diagnostics. */
+  env?: Record<string, string>;
+  /** Resolved secret env. Reaches only the child process; redacted everywhere else. */
+  protectedEnv?: Record<string, string>;
+}
+/**
+ * Resolve a profile MCP server's `args`/`env` config values (interface ≥0.40
+ * `AgentProfileConfigValue`) plus the legacy `metadata.secretEnv` channel into
+ * the plain strings a spawn needs.
+ *
+ * Rules, all fail-closed:
+ * - `args` must be public values. A secret-ref in argv is refused: argv is
+ *   readable by every host process (/proc/PID/cmdline) and outside the
+ *   protected-value redaction channel, so a secret there cannot be contained.
+ * - `env` secret-refs resolve through the KeyProvider (missing provider or key
+ *   throws, naming the KEY NAME only) and land in `protectedEnv`.
+ * - An env var declared secret on BOTH channels (env secret-ref and
+ *   metadata.secretEnv) is ambiguous configuration and throws.
+ * - A public `env` entry shadowed by a legacy metadata secret keeps the
+ *   pre-0.40 spawn precedence: the secret value wins in the child env.
+ */
+declare function resolveMcpServerLaunch(server: AgentProfileMcpServer, keys: KeyProvider | undefined, label: string): Promise<ResolvedMcpServerLaunch>;
+//#endregion
+//#region src/runtime/supervise/bridge-config.d.ts
+/**
+ * cli-bridge seam. A local OpenAI-compatible bridge that fronts harness CLIs
+ * (claude-code / opencode / kimi / pi) behind one HTTP surface. The spawned
+ * `AgentProfile` is the sole harness/provider/model and behavioral authority and
+ * is forwarded verbatim per request; this seam carries transport data only.
+ *
+ * The executor opens a resumable cli-bridge session. `sessionId` identifies the
+ * harness conversation across turns; each turn also receives its own durable run id.
+ * A dropped HTTP reader reattaches to that exact run and explicit cancel is the only
+ * operation allowed to stop it. Omit `sessionId` and the executor mints one per spawn.
+ *
+ * ── HOW TO CONTROL WHAT THE HARNESS LOADS (there is no argv field, by design) ──
+ *
+ * A worker often needs the harness started in a KNOWN state — no ambient extensions, skills,
+ * context files, or prompt templates — because ambient state is how a paired experiment silently
+ * loses its pairing: an installed extension that persists memory across runs carries arm A's state
+ * into arm B, and nothing reports it.
+ *
+ * That is what the spawned `AgentProfile` is FOR. `agent_profile`
+ * rides every request verbatim, and cli-bridge maps it onto each harness's own native controls:
+ *
+ *   - Materializing any profile at all already starts the harness isolated from ambient
+ *     workspace state — for pi that is `--no-context-files --no-skills --no-prompt-templates`,
+ *     applied to every request that carries an `agent_profile`.
+ *   - `AgentProfile.extensions.<harness>` is the named, per-harness control channel. An explicit
+ *     `extensions: { pi: { load: [] } }` disables ambient extension discovery outright
+ *     (pi's `--no-extensions`); listing package names loads exactly those and nothing else.
+ *   - `permissions` / `tools` / `mcp` map onto the harness's native tool and server controls.
+ *
+ * A caller therefore does NOT need to hand-roll an `Executor` to isolate a harness run, and the
+ * profile expressing it stays portable: the same declaration means the same thing on a different
+ * harness, whereas an argv string means nothing anywhere else.
+ *
+ * WHY NOT A GENERAL ARGV PASSTHROUGH. `bridgeUrl` addresses a process-spawning server. Forwarding
+ * an arbitrary argv array to it would let any caller holding a bearer token choose the flags of a
+ * process on the bridge host — which for real harness CLIs includes flags that load code from a
+ * path, read a file into the prompt, redirect the working directory, or turn off the isolation the
+ * bridge applies. cli-bridge deliberately confines workers (a filesystem jail and deny-by-default
+ * network egress), and every one of those confinements is expressed as spawn configuration, so an
+ * argv channel is a channel for unwinding them. It would also break this executor's own contract:
+ * the durable-run replay protocol, session pinning, and streaming mode are all argv the bridge
+ * owns, and a caller-supplied duplicate silently wins or corrupts the parse. The structured profile
+ * channel is validated, per-harness, portable, and refuses controls it does not understand — keep
+ * new harness capability there.
+ */
+interface BridgeSeam {
+  bridgeUrl: string;
+  bridgeBearer: string;
+  /**
+   * Optional request-scoped model credential.
+   *
+   * The key name is portable configuration. The provider is a live service and is intentionally
+   * not serialised. Runtime resolves both values immediately before every bridge POST and sends
+   * them only to a loopback bridge through private request headers.
+   */
+  modelCredential?: BridgeModelCredential;
+  /** Optional working directory forwarded to cli-bridge and persisted with the session. */
+  cwd?: string;
+  /**
+   * The harness's OWN on-disk session store, read as a spend receipt.
+   *
+   * cli-bridge forwards no token usage for a codex worker, so a turn whose provider counters exist
+   * only in codex's rollout meters `{0, 0}` with `tokensKnown: false`. Measured on one live seat
+   * (discovery#80): 9 of 9 `metered` events read zero while 27,320,482 codex tokens sat in the same
+   * run directory, 1,453,948 of them belonging to harness-native children the journal never saw.
+   *
+   * Naming the store here turns those rows into evidence. The executor tails it once per turn and
+   * credits the DELTA, so each turn is charged once, and it reports the counters with
+   * `provenance: 'harness-store'` so a reader can tell a disk receipt from a stream receipt.
+   *
+   * The path must be the run's OWN isolated store. An ambient host store credits this run with
+   * another run's files, and `workspaceRoot` is the structural guard against it.
+   */
+  harnessStore?: BridgeHarnessStore;
+  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
+   *  same value in `execution.timeoutMs` so the bridge-owned process follows the same policy. */
+  timeoutMs?: number;
+  /** Stable, caller-owned cli-bridge session id for harness-side resume. Defaults
+   *  to a freshly minted per-spawn id so each worker is its own resumable session. */
+  sessionId?: string;
+  /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
+  maxReconnects?: number;
+  /** Newest-last activity window `progress()` reports. Default 12. */
+  activityWindow?: number;
+}
+/**
+ * A harness's own session store on the bridge host, named so the runtime may read it.
+ *
+ * Only `codex` has a reader today. Any other harness is REFUSED rather than read with codex's
+ * decoder: a different harness's file decoded as a codex rollout would either drop counters it does
+ * not name or credit a number that is about the wrong wire shape.
+ */
+interface BridgeHarnessStore extends CodexRolloutStoreRef {
+  /** The harness family that wrote the store. */
+  readonly harness: HarnessType;
+}
+/** A live, request-scoped model credential reference for a local cli-bridge. */
+interface BridgeModelCredential {
+  /** Provider key name for the scoped model token. */
+  key: string;
+  /** Provider key name for the exact scoped HTTPS model gateway URL. */
+  baseUrlKey: string;
+  /** Live credential service. Runtime retains this reference through reusable captures. */
+  provider: KeyProvider;
+}
+//#endregion
+//#region src/runtime/supervise/inbox.d.ts
+/** A message from the run's AUTHORITY — the parent driver. These two kinds carry instruction. */
+interface AuthorityInboxMessage {
+  readonly kind: 'steer' | 'answer';
+  readonly text: string;
+  /** Forceful messages abort the in-flight turn; queued ones wait for the boundary flush. */
+  readonly interrupt: boolean;
+  /** Present for an `answer` — the question id it resolves. */
+  readonly questionId?: string;
+}
+/** A message from a SIBLING worker. Information, never instruction — the parent stays the only
+ *  authority over this worker's task. */
+interface PeerInboxMessage {
+  readonly kind: 'mail';
+  readonly text: string;
+  /** Always false. Peer mail is queued by construction; see this file's header. */
+  readonly interrupt: false;
+  readonly envelope: PeerMailEnvelope;
+}
+type InboxMessage = AuthorityInboxMessage | PeerInboxMessage;
+interface Inbox {
+  /** The `Executor.deliver` implementation. Returns false when the raw message is malformed and
+   * therefore was not queued; callers must not acknowledge a message this inbox discarded. */
+  deliver(msg: unknown): boolean;
+  /** Remove and return all pending messages (the flush). */
+  drain(): InboxMessage[];
+  pending(): number;
+  /** Pending messages from the run's AUTHORITY only. This is what the pre-settle fence counts:
    *  a worker may not finish while a steer or answer it never read is queued, but peer mail must
    *  never be able to hold a finished worker open. */
   pendingAuthority(): number;
@@ -4462,111 +4620,6 @@ interface CliWorktreeBridgeSeam {
   /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
   maxReconnects?: number;
 }
-/**
- * cli-bridge seam. A local OpenAI-compatible bridge that fronts harness CLIs
- * (claude-code / opencode / kimi / pi) behind one HTTP surface. The spawned
- * `AgentProfile` is the sole harness/provider/model and behavioral authority and
- * is forwarded verbatim per request; this seam carries transport data only.
- *
- * The executor opens a resumable cli-bridge session. `sessionId` identifies the
- * harness conversation across turns; each turn also receives its own durable run id.
- * A dropped HTTP reader reattaches to that exact run and explicit cancel is the only
- * operation allowed to stop it. Omit `sessionId` and the executor mints one per spawn.
- *
- * ── HOW TO CONTROL WHAT THE HARNESS LOADS (there is no argv field, by design) ──
- *
- * A worker often needs the harness started in a KNOWN state — no ambient extensions, skills,
- * context files, or prompt templates — because ambient state is how a paired experiment silently
- * loses its pairing: an installed extension that persists memory across runs carries arm A's state
- * into arm B, and nothing reports it.
- *
- * That is what the spawned `AgentProfile` is FOR. `agent_profile`
- * rides every request verbatim, and cli-bridge maps it onto each harness's own native controls:
- *
- *   - Materializing any profile at all already starts the harness isolated from ambient
- *     workspace state — for pi that is `--no-context-files --no-skills --no-prompt-templates`,
- *     applied to every request that carries an `agent_profile`.
- *   - `AgentProfile.extensions.<harness>` is the named, per-harness control channel. An explicit
- *     `extensions: { pi: { load: [] } }` disables ambient extension discovery outright
- *     (pi's `--no-extensions`); listing package names loads exactly those and nothing else.
- *   - `permissions` / `tools` / `mcp` map onto the harness's native tool and server controls.
- *
- * A caller therefore does NOT need to hand-roll an `Executor` to isolate a harness run, and the
- * profile expressing it stays portable: the same declaration means the same thing on a different
- * harness, whereas an argv string means nothing anywhere else.
- *
- * WHY NOT A GENERAL ARGV PASSTHROUGH. `bridgeUrl` addresses a process-spawning server. Forwarding
- * an arbitrary argv array to it would let any caller holding a bearer token choose the flags of a
- * process on the bridge host — which for real harness CLIs includes flags that load code from a
- * path, read a file into the prompt, redirect the working directory, or turn off the isolation the
- * bridge applies. cli-bridge deliberately confines workers (a filesystem jail and deny-by-default
- * network egress), and every one of those confinements is expressed as spawn configuration, so an
- * argv channel is a channel for unwinding them. It would also break this executor's own contract:
- * the durable-run replay protocol, session pinning, and streaming mode are all argv the bridge
- * owns, and a caller-supplied duplicate silently wins or corrupts the parse. The structured profile
- * channel is validated, per-harness, portable, and refuses controls it does not understand — keep
- * new harness capability there.
- */
-interface BridgeSeam {
-  bridgeUrl: string;
-  bridgeBearer: string;
-  /**
-   * Optional request-scoped model credential.
-   *
-   * The key name is portable configuration. The provider is a live service and is intentionally
-   * not serialised. Runtime resolves both values immediately before every bridge POST and sends
-   * them only to a loopback bridge through private request headers.
-   */
-  modelCredential?: BridgeModelCredential;
-  /** Optional working directory forwarded to cli-bridge and persisted with the session. */
-  cwd?: string;
-  /**
-   * The harness's OWN on-disk session store, read as a spend receipt.
-   *
-   * cli-bridge forwards no token usage for a codex worker, so a turn whose provider counters exist
-   * only in codex's rollout meters `{0, 0}` with `tokensKnown: false`. Measured on one live seat
-   * (discovery#80): 9 of 9 `metered` events read zero while 27,320,482 codex tokens sat in the same
-   * run directory, 1,453,948 of them belonging to harness-native children the journal never saw.
-   *
-   * Naming the store here turns those rows into evidence. The executor tails it once per turn and
-   * credits the DELTA, so each turn is charged once, and it reports the counters with
-   * `provenance: 'harness-store'` so a reader can tell a disk receipt from a stream receipt.
-   *
-   * The path must be the run's OWN isolated store. An ambient host store credits this run with
-   * another run's files, and `workspaceRoot` is the structural guard against it.
-   */
-  harnessStore?: BridgeHarnessStore;
-  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
-   *  same value in `execution.timeoutMs` so the bridge-owned process follows the same policy. */
-  timeoutMs?: number;
-  /** Stable, caller-owned cli-bridge session id for harness-side resume. Defaults
-   *  to a freshly minted per-spawn id so each worker is its own resumable session. */
-  sessionId?: string;
-  /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
-  maxReconnects?: number;
-  /** Newest-last activity window `progress()` reports. Default 12. */
-  activityWindow?: number;
-}
-/**
- * A harness's own session store on the bridge host, named so the runtime may read it.
- *
- * Only `codex` has a reader today. Any other harness is REFUSED rather than read with codex's
- * decoder: a different harness's file decoded as a codex rollout would either drop counters it does
- * not name or credit a number that is about the wrong wire shape.
- */
-interface BridgeHarnessStore extends CodexRolloutStoreRef {
-  /** The harness family that wrote the store. */
-  readonly harness: HarnessType;
-}
-/** A live, request-scoped model credential reference for a local cli-bridge. */
-interface BridgeModelCredential {
-  /** Provider key name for the scoped model token. */
-  key: string;
-  /** Provider key name for the exact scoped HTTPS model gateway URL. */
-  baseUrlKey: string;
-  /** Live credential service. Runtime retains this reference through reusable captures. */
-  provider: KeyProvider;
-}
 /**
  * Generic environment provider executor config. External packages implement
  * `AgentEnvironmentProvider`; this built-in wrapper lets `createExecutor` consume them as backend
@@ -4806,5 +4859,5 @@ declare function streamAgentTurn(backend: AgentTurnBackend, input: AgentTurnInpu
  */
 declare function collectAgentTurn(stream: AsyncIterable<RuntimeStreamEvent>): Promise<CollectedAgentTurn>;
 //#endregion
-export { resolveSecretEnv as $, RetainedRunCancellation as $a, SanitizedKnowledgeRequirement as $i, Redactor as $n, SteerableRootHandle as $r, WorktreeCommandResult as $t, Inbox as A, createActivityLog as Aa, LoopSpanNode as Ai, ToolLoopToolCall as An, ProfileMaterializationReceipt as Ar, providerAsExecutor as At, createSandboxToolPartState as B, NativeContextContinuationHandle as Ba, createOtelExporter as Bi, PeerMailRefusal as Bn, RootProviderModelEvidence as Br, CodexRolloutSession as Bt, createExecutorRegistry as C, sandboxSessionTraceSource as Ca, readTraceContextFromEnv as Ci, RouterTransportConfig as Cn, MaterializedExecutionIdentity as Cr, ProviderExecutorOptions as Ct, SteerableSandboxSession as D, ExecutorProgress as Da, EvalRunsExportConfig as Di, ToolLoopCompaction as Dn, NodeId as Dr, SandboxClientProviderOptions as Dt, SteerableSandboxArgs as E, DEFAULT_STALL_AFTER_MS as Ea, EvalRunGeneration as Ei, ToolLoopChat as En, NodeExecutionIdentity as Er, ResourceRequest as Et, SandboxOutputMarker as F, RetainedInteractiveEnvironmentInput as Fa, RuntimeEventOtelOptions as Fi, PeerMailEvent as Fn, ResultBlobStore as Fr, SandboxControlClient as Ft, sandboxEventServedBackend as G, RecoverRetainedRunResult as Ga, padTraceId as Gi, createPeerMailbox as Gn, SpawnEvent as Gr, addHarnessUsage as Gt, extractLlmCallEvent as H, ReconnectRetainedRunOptions as Ha, generateSpanId as Hi, PeerMailbox as Hn, Runtime as Hr, CodexRolloutStoreRef as Ht, SandboxServedBackend as I, RetainedInteractiveRunHandle as Ia, buildLoopOtelSpans as Ii, PeerMailKind as In, ResumedKeyState as Ir, createTangleSandboxExactProcessProvider as It, KeyProvider as J, RetainedInteractiveIntentAdmission as Ja, RuntimeStreamEventCollector as Ji, peerMailVerbNames as Jn, SpawnPrior as Jr, readCodexRolloutSession as Jt, sandboxProgressEvents as K, RetainedInteractiveAdmission as Ka, toOtelAttributes as Ki, isPeerMailEnvelope as Kn, SpawnJournal as Kr, createCodexRolloutStoreReader as Kt, SandboxToolPartState as L, RetainedInteractiveStartMaterial as La, buildLoopSpanNodes as Li, PeerMailLimits as Ln, ResumedWork as Lr, ProviderPlacement as Lt, PeerInboxMessage as M, ReconnectRetainedInteractiveRunOptions as Ma, OtelExportConfig as Mi, DEFAULT_PEER_MAIL_LIMITS as Mn, ProviderModelExecutionEvidence as Mr, resolveAgentEnvironmentProvider as Mt, createInbox as N, RecoverRetainedInteractiveRunOptions as Na, OtelExporter as Ni, PEER_MAIL_WIRE_KEY as Nn, ResourceLimit as Nr, sandboxClientAsProvider as Nt, createSteerableSandboxSession as O, ScopeProgressInput as Oa, EvalRunsExportResult as Oi, ToolLoopCompactionOptions as On, NodeSnapshot as Or, WorkspaceRequest as Ot, SandboxLeafOut as P, RetainedInteractiveAdmissionHook as Pa, OtelSpan as Pi, PeerMailEnvelope as Pn, ResourceSpend as Pr, CreateTangleSandboxExactProcessProviderOptions as Pt, resolveMcpServerLaunch as Q, RetainedRunCancelOptions as Qa, SanitizedKnowledgeReadinessReport as Qi, McpTransport as Qn, SpendGap as Qr, WorktreeCheckRunner as Qt, SandboxUsageLedger as R, StartRetainedInteractiveRunOptions as Ra, buildRuntimeEventOtelSpans as Ri, PeerMailOutcome as Rn, RootHandle as Rr, CodexForkBoundary as Rt, createExecutor as S, decodeToolPart as Sa, mergeTraceEnv as Si, runLocalHarness as Sn, Handle as Sr, ProviderAsSandboxClientOptions as St, SandboxSteeringOptions as T, ActivityNote as Ta, EvalRunEvent as Ti, ToolLoopCallContext as Tn, NoWinnerError as Tr, ProviderPromptOptions as Tt, mapSandboxEvent as U, RecoverRetainedRunIntentOptions as Ua, loopEventToOtelSpan as Ui, PeerMailboxOptions as Un, Scope as Ur, CodexRolloutTurn as Ut, createSandboxUsageLedger as V, NativeContextContinuationInput as Va, exportEvalRuns as Vi, PeerMailSendInput as Vn, RootSignal as Vr, CodexRolloutStoreReader as Vt, mapSandboxToolEvent as W, RecoverRetainedRunOptions as Wa, padSpanId as Wi, claimsAuthority as Wn, Settled as Wr, CodexStoreDelta as Wt, envKeyProvider as X, RetainedRunAdmission as Xa, RuntimeStreamEventSummary as Xi, JsonRpcResponse as Xn, Spend as Xr, decodeHarnessUsage as Xt, ResolvedMcpServerLaunch as Y, RetainedInteractiveStartedAdmission as Ya, RuntimeStreamEventSink as Yi, JsonRpcMessage as Yn, SpawnRejection as Yr, HarnessUsage as Yt, mcpSecretEnvMetadataKey as Z, RetainedRunAdmissionHook as Za, RuntimeTelemetryOptions as Zi, McpToolDescriptor as Zn, SpendChannel as Zr, InPlaceHarnessResult as Zt, RouterSeam as _, SessionMessageLike as _a, workerTraceEnv as _i, LocalHarnessResult as _n, createBudgetPool as _o, ExecutorProgressEvent as _r, CreateAgentEnvironmentInput$1 as _t, StreamAgentTurnOptions as a, PendingWait as aa, UnconfirmedTeardown as ai, GitRunner as an, RetainedRunIntentAdmission as ao, Budget as ar, AgentEnvironmentProviderRef as at, cliInPlaceExecutor as b, TraceSource as ba, TraceContext as bi, localHarnessExecutable as bn, ExecutorTeardownWarning as br, ForkRequest as bt, BridgeHarnessStore as c, WaitProbeRegistry as ca, WaitOpts as ci, captureWorktreeDiff as cn, RetainedRunStartMaterial as co, Executor as cr, AgentEnvironmentStatus as ct, CliInPlaceSeam as d, createWaitProbes as da, WorkerInteractiveUnavailableReason as di, CodexExecutionEvidence as dn, StartRetainedRunOptions as do, ExecutorCancellationRequest as dr, AgentSession as dt, createRuntimeEventCollector as ea, SupervisedResult as ei, WorktreeHarnessResult as en, RetainedRunDispatchedAdmission as eo, defaultRedactor as er, secretEnvOfMcpServer as et, CliSeam as f, isWaitOutcome as fa, WorkerTraceEvidence as fi, CodexExecutionPolicy as fn, BudgetPool as fo, ExecutorContext as fr, AgentSessionRef as ft, ProviderSeam as g, waitUntil as ga, readWorkerTraceContext as gi, LocalHarness as gn, ReservationTicket as go, ExecutorNodeContext as gr, CheckpointRequest as gt, ExecutorConfig as h, validateWaitSpec as ha, WorkerTraceSeamCarrier as hi, LOCAL_HARNESSES as hn, ReservationRejection as ho, ExecutorMaterialization as hr, CheckpointRef as ht, CollectedAgentTurn as i, sanitizeRuntimeStreamEvent as ia, TreeView as ii, DiffResult as in, RetainedRunHandle as io, AgentSpec as ir, AgentEnvironmentProvider$1 as it, InboxMessage as j, readWorkerProgress as ja, OtelAttribute as ji, AUTHORITY_MARKERS as jn, ProviderModelAttemptEvidence as jr, providerAsSandboxClient as jt, AuthorityInboxMessage as k, WorkerProgress as ka, INTELLIGENCE_WIRE_VERSION as ki, ToolLoopMessageRecord as kn, NodeStatus as kr, createAgentEnvironmentProviderRegistry as kt, BridgeModelCredential as l, WaitRejection as la, WidenGate as li, createWorktree as ln, RetainedRunTurnInput as lo, ExecutorAccounting as lr, AgentEnvironmentSummary as lt, CliWorktreeSeam as m, timerAt as ma, WorkerTraceResolver as mi, DEFAULT_LOCAL_HARNESS as mn, BudgetReadout as mo, ExecutorFactory as mr, AgentTurnResult$2 as mt, AgentTurnInput$1 as n, sanitizeAgentRuntimeEvent as na, SupervisorOpts as ni, CreateWorktreeOptions as nn, RetainedRunEnvironmentAdmission as no, Agent as nr, AgentEnvironmentCapabilities$1 as nt, collectAgentTurn as o, WaitOutcome as oa, UnknownMaterializationReason as oi, RemoveWorktreeOptions as on, RetainedRunReplayPoint as oo, DefaultVerdict as or, AgentEnvironmentProviderRegistry as ot, CliWorktreeBridgeSeam as p, pollFor as pa, WorkerTraceUnavailableReason as pi, CodexTokenUsage as pn, BudgetPoolRestore as po, ExecutorExecutionBinding as pr, AgentSessionStatus$1 as pt, sumSandboxUsage as q, RetainedInteractiveEnvironmentAdmission as qa, RuntimeEventCollector as qi, peerMailTools as qn, SpawnOpts as qr, harnessUsageIsEmpty as qt, AgentTurnUsage as r, sanitizeKnowledgeReadinessReport as ra, TokenUsageProvenance as ri, DiffOptions as rn, RetainedRunEventOptions as ro, AgentExecutionRef as rr, AgentEnvironmentEvent$1 as rt, streamAgentTurn as s, WaitProbe as sa, UsageEvent as si, WorktreeHandle as sn, RetainedRunSnapshot as so, ExecutionBindingReceipt as sr, AgentEnvironmentQuery as st, AgentTurnBackend as t, createRuntimeStreamEventCollector as ta, Supervisor as ti, WorktreeProfileMaterializationReceipt as tn, RetainedRunEffect as to, resolveRedactor as tr, AgentEnvironment$1 as tt, BridgeSeam as u, WaitSpec as ua, WorkerInteractiveSession as ui, removeWorktree as un, StartRetainedRunInEnvironmentOptions as uo, ExecutorCancellation as ur, AgentProfileRef$1 as ut, RouterToolsSeam as v, SessionTraceBox as va, workerTraceHeaders as vi, RunLocalHarnessOptions as vn, spendFromUsageEvents as vo, ExecutorRegistry as vr, ExecRequest as vt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as w, ActivityLog as wa, traceContextToEnv as wi, ToolSpec as wn, MaterializedModelIdentity as wr, ProviderLeafOut as wt, cliWorktreeExecutor as x, createPushTraceSource as xa, createPropagatingTraceEmitter as xi, parseCodexTokenUsage as xn, ExecutorToolCall as xr, PlacementInfo as xt, SandboxSeam as y, ToolStepInput as ya, workerTraceSeamKey as yi, harnessSupportsReasoningEffort as yn, ExecutorResult as yr, ExecResult as yt, assertSandboxServedModel as z, NativeContextContinuationExecution as za, createOpenInferenceFileExporter as zi, PeerMailReadout as zn, RootMaterialization as zr, CodexRolloutIdentity as zt };
-//# sourceMappingURL=stream-agent-turn-BaKYHbHg.d.ts.map
+export { decodeHarnessUsage as $, RetainedRunCancellation as $a, SanitizedKnowledgeRequirement as $i, Redactor as $n, SteerableRootHandle as $r, WorktreeCommandResult as $t, createInbox as A, createActivityLog as Aa, LoopSpanNode as Ai, ToolLoopToolCall as An, ProfileMaterializationReceipt as Ar, CreateAgentEnvironmentInput$1 as At, secretEnvOfMcpServer as B, NativeContextContinuationHandle as Ba, createOtelExporter as Bi, PeerMailRefusal as Bn, RootProviderModelEvidence as Br, SandboxClientProviderOptions as Bt, SteerableSandboxArgs as C, sandboxSessionTraceSource as Ca, readTraceContextFromEnv as Ci, RouterTransportConfig as Cn, MaterializedExecutionIdentity as Cr, AgentProfileRef$1 as Ct, Inbox as D, ExecutorProgress as Da, EvalRunsExportConfig as Di, ToolLoopCompaction as Dn, NodeId as Dr, AgentTurnResult$2 as Dt, AuthorityInboxMessage as E, DEFAULT_STALL_AFTER_MS as Ea, EvalRunGeneration as Ei, ToolLoopChat as En, NodeExecutionIdentity as Er, AgentSessionStatus$1 as Et, ResolvedMcpServerLaunch as F, RetainedInteractiveEnvironmentInput as Fa, RuntimeEventOtelOptions as Fi, PeerMailEvent as Fn, ResultBlobStore as Fr, ProviderAsSandboxClientOptions as Ft, CodexRolloutStoreRef as G, RecoverRetainedRunResult as Ga, padTraceId as Gi, createPeerMailbox as Gn, SpawnEvent as Gr, resolveAgentEnvironmentProvider as Gt, CodexRolloutIdentity as H, ReconnectRetainedRunOptions as Ha, generateSpanId as Hi, PeerMailbox as Hn, Runtime as Hr, createAgentEnvironmentProviderRegistry as Ht, envKeyProvider as I, RetainedInteractiveRunHandle as Ia, buildLoopOtelSpans as Ii, PeerMailKind as In, ResumedKeyState as Ir, ProviderExecutorOptions as It, addHarnessUsage as J, RetainedInteractiveIntentAdmission as Ja, RuntimeStreamEventCollector as Ji, peerMailVerbNames as Jn, SpawnPrior as Jr, SandboxControlClient as Jt, CodexRolloutTurn as K, RetainedInteractiveAdmission as Ka, toOtelAttributes as Ki, isPeerMailEnvelope as Kn, SpawnJournal as Kr, sandboxClientAsProvider as Kt, mcpSecretEnvMetadataKey as L, RetainedInteractiveStartMaterial as La, buildLoopSpanNodes as Li, PeerMailLimits as Ln, ResumedWork as Lr, ProviderLeafOut as Lt, BridgeModelCredential as M, ReconnectRetainedInteractiveRunOptions as Ma, OtelExportConfig as Mi, DEFAULT_PEER_MAIL_LIMITS as Mn, ProviderModelExecutionEvidence as Mr, ExecResult as Mt, BridgeSeam as N, RecoverRetainedInteractiveRunOptions as Na, OtelExporter as Ni, PEER_MAIL_WIRE_KEY as Nn, ResourceLimit as Nr, ForkRequest as Nt, InboxMessage as O, ScopeProgressInput as Oa, EvalRunsExportResult as Oi, ToolLoopCompactionOptions as On, NodeSnapshot as Or, CheckpointRef as Ot, KeyProvider as P, RetainedInteractiveAdmissionHook as Pa, OtelSpan as Pi, PeerMailEnvelope as Pn, ResourceSpend as Pr, PlacementInfo as Pt, HarnessUsage as Q, RetainedRunCancelOptions as Qa, SanitizedKnowledgeReadinessReport as Qi, McpTransport as Qn, SpendGap as Qr, WorktreeCheckRunner as Qt, resolveMcpServerLaunch as R, StartRetainedInteractiveRunOptions as Ra, buildRuntimeEventOtelSpans as Ri, PeerMailOutcome as Rn, RootHandle as Rr, ProviderPromptOptions as Rt, SandboxSteeringOptions as S, decodeToolPart as Sa, mergeTraceEnv as Si, runLocalHarness as Sn, Handle as Sr, AgentEnvironmentSummary as St, createSteerableSandboxSession as T, ActivityNote as Ta, EvalRunEvent as Ti, ToolLoopCallContext as Tn, NoWinnerError as Tr, AgentSessionRef as Tt, CodexRolloutSession as U, RecoverRetainedRunIntentOptions as Ua, loopEventToOtelSpan as Ui, PeerMailboxOptions as Un, Scope as Ur, providerAsExecutor as Ut, CodexForkBoundary as V, NativeContextContinuationInput as Va, exportEvalRuns as Vi, PeerMailSendInput as Vn, RootSignal as Vr, WorkspaceRequest as Vt, CodexRolloutStoreReader as W, RecoverRetainedRunOptions as Wa, padSpanId as Wi, claimsAuthority as Wn, Settled as Wr, providerAsSandboxClient as Wt, harnessUsageIsEmpty as X, RetainedRunAdmission as Xa, RuntimeStreamEventSummary as Xi, JsonRpcResponse as Xn, Spend as Xr, ProviderPlacement as Xt, createCodexRolloutStoreReader as Y, RetainedInteractiveStartedAdmission as Ya, RuntimeStreamEventSink as Yi, JsonRpcMessage as Yn, SpawnRejection as Yr, createTangleSandboxExactProcessProvider as Yt, readCodexRolloutSession as Z, RetainedRunAdmissionHook as Za, RuntimeTelemetryOptions as Zi, McpToolDescriptor as Zn, SpendChannel as Zr, InPlaceHarnessResult as Zt, cliInPlaceExecutor as _, SessionMessageLike as _a, workerTraceEnv as _i, LocalHarnessResult as _n, ReservationRejection as _o, ExecutorProgressEvent as _r, AgentEnvironmentProvider$1 as _t, StreamAgentTurnOptions as a, PendingWait as aa, UnconfirmedTeardown as ai, GitRunner as an, RetainedRunIntentAdmission as ao, Budget as ar, assertSandboxServedModel as at, createExecutorRegistry as b, TraceSource as ba, TraceContext as bi, localHarnessExecutable as bn, createBudgetPool as bo, ExecutorTeardownWarning as br, AgentEnvironmentQuery as bt, CliInPlaceSeam as c, WaitProbeRegistry as ca, WaitOpts as ci, captureWorktreeDiff as cn, RetainedRunStartMaterial as co, Executor as cr, extractLlmCallEvent as ct, CliWorktreeSeam as d, createWaitProbes as da, WorkerInteractiveUnavailableReason as di, CodexExecutionEvidence as dn, StartRetainedRunOptions as do, ExecutorCancellationRequest as dr, sandboxEventServedBackend as dt, createRuntimeEventCollector as ea, SupervisedResult as ei, WorktreeHarnessResult as en, RetainedRunDispatchedAdmission as eo, defaultRedactor as er, SandboxLeafOut as et, ExecutorConfig as f, isWaitOutcome as fa, WorkerTraceEvidence as fi, CodexExecutionPolicy as fn, BudgetPool as fo, ExecutorContext as fr, sandboxProgressEvents as ft, SandboxSeam as g, waitUntil as ga, readWorkerTraceContext as gi, LocalHarness as gn, ReservationHolder as go, ExecutorNodeContext as gr, AgentEnvironmentEvent$1 as gt, RouterToolsSeam as h, validateWaitSpec as ha, WorkerTraceSeamCarrier as hi, LOCAL_HARNESSES as hn, LeakedReservation as ho, ExecutorMaterialization as hr, AgentEnvironmentCapabilities$1 as ht, CollectedAgentTurn as i, sanitizeRuntimeStreamEvent as ia, TreeView as ii, DiffResult as in, RetainedRunHandle as io, AgentSpec as ir, SandboxUsageLedger as it, BridgeHarnessStore as j, readWorkerProgress as ja, OtelAttribute as ji, AUTHORITY_MARKERS as jn, ProviderModelAttemptEvidence as jr, ExecRequest as jt, PeerInboxMessage as k, WorkerProgress as ka, INTELLIGENCE_WIRE_VERSION as ki, ToolLoopMessageRecord as kn, NodeStatus as kr, CheckpointRequest as kt, CliSeam as l, WaitRejection as la, WidenGate as li, createWorktree as ln, RetainedRunTurnInput as lo, ExecutorAccounting as lr, mapSandboxEvent as lt, RouterSeam as m, timerAt as ma, WorkerTraceResolver as mi, DEFAULT_LOCAL_HARNESS as mn, BudgetReadout as mo, ExecutorFactory as mr, AgentEnvironment$1 as mt, AgentTurnInput$1 as n, sanitizeAgentRuntimeEvent as na, SupervisorOpts as ni, CreateWorktreeOptions as nn, RetainedRunEnvironmentAdmission as no, Agent as nr, SandboxServedBackend as nt, collectAgentTurn as o, WaitOutcome as oa, UnknownMaterializationReason as oi, RemoveWorktreeOptions as on, RetainedRunReplayPoint as oo, DefaultVerdict as or, createSandboxToolPartState as ot, ProviderSeam as p, pollFor as pa, WorkerTraceUnavailableReason as pi, CodexTokenUsage as pn, BudgetPoolRestore as po, ExecutorExecutionBinding as pr, sumSandboxUsage as pt, CodexStoreDelta as q, RetainedInteractiveEnvironmentAdmission as qa, RuntimeEventCollector as qi, peerMailTools as qn, SpawnOpts as qr, CreateTangleSandboxExactProcessProviderOptions as qt, AgentTurnUsage as r, sanitizeKnowledgeReadinessReport as ra, TokenUsageProvenance as ri, DiffOptions as rn, RetainedRunEventOptions as ro, AgentExecutionRef as rr, SandboxToolPartState as rt, streamAgentTurn as s, WaitProbe as sa, UsageEvent as si, WorktreeHandle as sn, RetainedRunSnapshot as so, ExecutionBindingReceipt as sr, createSandboxUsageLedger as st, AgentTurnBackend as t, createRuntimeStreamEventCollector as ta, Supervisor as ti, WorktreeProfileMaterializationReceipt as tn, RetainedRunEffect as to, resolveRedactor as tr, SandboxOutputMarker as tt, CliWorktreeBridgeSeam as u, WaitSpec as ua, WorkerInteractiveSession as ui, removeWorktree as un, StartRetainedRunInEnvironmentOptions as uo, ExecutorCancellation as ur, mapSandboxToolEvent as ut, cliWorktreeExecutor as v, SessionTraceBox as va, workerTraceHeaders as vi, RunLocalHarnessOptions as vn, ReservationStage as vo, ExecutorRegistry as vr, AgentEnvironmentProviderRef as vt, SteerableSandboxSession as w, ActivityLog as wa, traceContextToEnv as wi, ToolSpec as wn, MaterializedModelIdentity as wr, AgentSession as wt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as x, createPushTraceSource as xa, createPropagatingTraceEmitter as xi, parseCodexTokenUsage as xn, spendFromUsageEvents as xo, ExecutorToolCall as xr, AgentEnvironmentStatus as xt, createExecutor as y, ToolStepInput as ya, workerTraceSeamKey as yi, harnessSupportsReasoningEffort as yn, ReservationTicket as yo, ExecutorResult as yr, AgentEnvironmentProviderRegistry as yt, resolveSecretEnv as z, NativeContextContinuationExecution as za, createOpenInferenceFileExporter as zi, PeerMailReadout as zn, RootMaterialization as zr, ResourceRequest as zt };
+//# sourceMappingURL=stream-agent-turn-B7YnjmXV.d.ts.map