@tangle-network/sdk-provider-cli-base 0.12.0 → 0.13.0

package/dist/index.d.mts

@@ -1,12 +1,16 @@
 import { a as partitionImageAttachments, i as PreparedAttachment, n as MAX_TOTAL_INLINE_IMAGE_BYTES, o as preparePromptInputParts, r as PROMPT_SECTION_SEPARATOR, s as prependPromptSection, t as MAX_INLINE_IMAGE_BYTES } from "./prompt-input-BHn_1z69.mjs";
 import { AskUserBridge, DEFAULT_INTERACTION_DECISION_TIMEOUT_MS as PERMISSION_DECISION_TIMEOUT_MS, InteractionBroker, InteractionBroker as InteractionBroker$1, InteractionHttpBridge, PermissionPromptBridge, RequestPermissionBridge, RequestPlanBridge, brokerInteractionTools } from "@tangle-network/agent-core/interactions";
+import * as _$_tangle_network_agent_profile_materialize0 from "@tangle-network/agent-profile-materialize";
+import { BindableLaunchControl, CODEX_DISABLED_FEATURE_ARGS, HarnessId, HarnessId as HarnessId$1, WorkspacePlanApplication, WorkspacePlanApplication as WorkspacePlanApplication$1, WorkspacePlanReceipt, codexDeveloperInstructionArgs } from "@tangle-network/agent-profile-materialize";
 import { CliExecResult, CliExitResult, CliLauncher, CliProcess, CliSpawnConfig, InvalidAttachmentError, JsonRpcError, RpcBridge, StreamParserConfig } from "@tangle-network/sdk-cli-runner";
 import { AgentExecutionInput, AgentExecutionOutcome, AgentExecutionResult, AgentProfile, AgentProfileSecretProvider, AgentRuntimeAttachments, BackendCapabilities, BackendMessage, CliAuthFile, DurablePlan, GetMessagesOptions, HarnessType, InputPart, InteractionExecutionBinding, InteractionResponse, LocalMcpConfig, McpConfig, McpStatusResponse, PlanProviderState, ProviderConfig, ReasoningEffort, RequestedInteractions, SdkHostServices, SdkPlanHost, SdkProviderAdapter, StreamEvent, TokenUsage, ToolPart } from "@tangle-network/agent-interface";
-import { BindableLaunchControl, HarnessId, HarnessId as HarnessId$1, WorkspacePlanApplication, WorkspacePlanApplication as WorkspacePlanApplication$1, WorkspacePlanReceipt } from "@tangle-network/agent-profile-materialize";
 import { HarnessSessionContract } from "@tangle-network/cli-agent-registry/session-contract";
+import * as _$_tangle_network_sdk_session_persistence0 from "@tangle-network/sdk-session-persistence";
 import { MessagePart, MessageStore, PersistedMessage, PersistedSession, SessionStore, readProviderMessageIds } from "@tangle-network/sdk-session-persistence";
 import { ProviderLogger } from "@tangle-network/cli-agent-registry";
+import { NATIVE_SESSION_CONTRACTS } from "@tangle-network/cli-agent-registry/native-session-contracts";
 import { DEFAULT_INTERACTION_MCP_SERVER_NAME, InteractionMcpServer as InteractionMcpServer$1, InteractionMcpServerConfig as InteractionMcpServerConfig$1, interactionMcpToolName } from "@tangle-network/agent-core/interactions/mcp";
+import { isRecord as isPlainRecord } from "@tangle-network/agent-core";
 
 //#region src/acp-process-launch.d.ts
 /** How to start the agent process for a session. */
@@ -27,76 +31,75 @@ interface AcpBridgeSpawn {
   uid?: number;
   gid?: number;
 }
-/** Spawn an ACP agent over NDJSON stdio. The adapter owns abort, so no signal. */
+/** Spawn an ACP agent over NDJSON stdio from `env` alone, never the sidecar's own environment. The adapter owns abort, so no signal. */
 declare function spawnAcpBridge(request: AcpBridgeSpawn): RpcBridge;
 //#endregion
+//#region src/secret-profile-mcp.d.ts
+/** Executor-held MCP credentials shared by native private-profile adapters. */
+declare const SECRET_REFERENCE_PREFIX = "TANGLE_PROFILE_SECRET_";
+declare const SECRET_REFERENCE: RegExp;
+declare function requireRecord(raw: unknown, message: string): Record<string, unknown>;
+/** One MCP server the executor serves for a secret launch. */
+type SecretProfileMcpServer = {
+  name: string; /** The server's own upstream URL. */
+  url: string; /** Every header the upstream needs, credentials included. */
+  headers: Readonly<Record<string, string>>;
+} | {
+  name: string; /** A stdio server whose environment names a secret: the executor runs this command outside the session's UID and serves it over loopback. */
+  command: readonly string[]; /** Its environment with every secret reference resolved. */
+  environment: Readonly<Record<string, string>>; /** Every secret value its environment references, whatever its length. */
+  secrets: readonly string[];
+};
+/** The executor's loopback proxy for a secret launch's MCP servers. */
+type SecretProfileMcpCredentialProxy = {
+  /** The scope's placeholder and one loopback URL per server name. */endpoint(scope: string, names: readonly string[]): Promise<{
+    placeholder: string;
+    urls: Readonly<Record<string, string>>;
+  }>; /** Serve `servers` before resolving; release acknowledges lease termination before the turn settles or its scope is reused. */
+  lease(scope: string, servers: ReadonlyArray<SecretProfileMcpServer>): Promise<() => void | Promise<void>>; /** The scope's session ended: its placeholder is refused from now on and its stdio servers are stopped. */
+  forget(scope: string): Promise<void>;
+};
+/** A config value with its secret references resolved, or undefined. */
+declare function resolveReferences(value: string, references: Readonly<Record<string, string>>): string | undefined;
+/** A stdio server the executor can run: its command and its environment with every secret reference resolved. */
+declare function servableStdioServer(name: string, entry: Record<string, unknown>, references: Readonly<Record<string, string>>): SecretProfileMcpServer | string;
+/** A remote server the executor can serve: its fixed upstream URL and every header with its secret references resolved. */
+declare function servableMcpServer(name: string, entry: Record<string, unknown>, references: Readonly<Record<string, string>>): SecretProfileMcpServer | string;
+/** Join the queue at `key`; `previous` settles when earlier holders release. */
+declare function joinQueue(queues: Map<string, Promise<void>>, key: string): {
+  previous: Promise<void>;
+  release: () => void;
+};
+declare function untilSettledOrAborted(previous: Promise<void>, signal: AbortSignal): Promise<void>;
+/** Every native discovery ancestor is sealed and free of ambient configuration. */
+declare function assertSealedNativeSearchPath(cwd: string, configNames: readonly string[]): void;
+declare function secretSessionTurnQueue(view: string): {
+  previous: Promise<void>;
+  release: () => void;
+};
+/** An HTTP URL on loopback with an explicit port and no URL credentials. */
+declare function isLoopbackEndpoint(value: unknown): boolean;
+//#endregion
 //#region src/types.d.ts
 type InteractionToggleKind = keyof RequestedInteractions;
 type InteractionToggleConfig = boolean | RequestedInteractions;
 declare function interactionToggleEnabled(config: InteractionToggleConfig | undefined, kind: InteractionToggleKind): boolean;
 declare function enabledInteractionKinds<TKind extends InteractionToggleKind>(config: InteractionToggleConfig | undefined, supported: readonly TKind[]): TKind[];
-/**
- * Per-turn interaction toggle carried on the execution input. Native harnesses
- * treat plan mode as a per-turn property (toggle build/plan on any message), so
- * the sidecar sends this turn's interactions on the execution input.
- *
- * The shared execution contract owns this field. Adapter initialization still
- * accepts `true` as shorthand, but each turn carries an exact kind map.
- */
+/** Per-turn interaction toggle carried on the execution input. */
 type PerTurnInteractionInput = Pick<AgentExecutionInput, "interactions">;
-/**
- * Host-composed context for THIS turn only (e.g. the sidecar's container
- * runtime snapshot): it must reach the model and nothing else. The caller's
- * `parts`/`message` stay untouched, so recorders and message stores keep a
- * transcript of exactly what the user sent.
- *
- * Optional for the same reason as `PerTurnInteractionInput.interactions`: the
- * published `AgentExecutionInput` does not declare the field, and `systemPrompt`
- * anchors the weak-type check.
- */
+/** Host-composed context for THIS turn only (e.g. */
 type EphemeralContextInput = {
   ephemeralContext?: string;
   systemPrompt?: unknown;
 };
-/**
- * Read a turn's ephemeral context, rejecting a wrong-typed value loudly.
- *
- * The published `AgentExecutionInput` does not declare the field, so nothing
- * type-checks it at the process boundary. Left unchecked, a caller passing a
- * non-string gets it stringified into the model prompt (`[object Object]`) —
- * a corrupted turn with no error anywhere. `undefined`/`null` mean "no context
- * this turn"; an empty string is likewise nothing to append.
- */
 declare function readEphemeralContext(input: EphemeralContextInput): string | undefined;
-/**
- * Compose the model-facing prompt for a turn: the caller's own text, then this
- * turn's ephemeral context. Call it at the point the prompt is handed to the
- * provider — NEVER on the parts handed to `recordUserMessage` or the message
- * store.
- */
+/** Compose the model-facing prompt for a turn: the caller's own text, then this turn's ephemeral context. */
 declare function withEphemeralContext(promptText: string, input: EphemeralContextInput): string;
-/**
- * Resolve whether an interaction kind is active for THIS turn. When the turn
- * carries `interactions` it is authoritative — a complete set that can also
- * turn a kind OFF mid-session; otherwise the adapter falls back to its latched
- * config (the initialize-time wiring, or a direct non-sidecar caller's option).
- */
 declare function turnInteractionEnabled(input: PerTurnInteractionInput, latched: InteractionToggleConfig | undefined, kind: InteractionToggleKind): boolean;
-/**
- * Overlay this turn's interactions onto a latched config, returning a NEW
- * object (no shared mutation — safe when one adapter instance serves concurrent
- * turns from different sessions). When the turn omits `interactions` the config
- * is returned unchanged, preserving behavior for direct non-sidecar callers.
- * Adapters read plan/permission/question posture off the returned config so a
- * mid-session toggle takes effect and can turn a kind off (which the latched
- * config, only ever merged by updateConfig, cannot).
- */
+/** Overlay this turn's interactions onto a latched config, returning a NEW object (no shared mutation — safe when. */
 declare function withTurnInteractions<TConfig extends {
   interactions?: InteractionToggleConfig;
 }>(config: TConfig, input: PerTurnInteractionInput): TConfig;
-/**
- * Logger interface for CLI providers.
- */
 interface CliProviderLogger {
   observePhase?: ProviderLogger["observePhase"];
   debug(message: string, meta?: Record<string, unknown>): void;
@@ -104,167 +107,74 @@ interface CliProviderLogger {
   warn(message: string, meta?: Record<string, unknown>): void;
   error(message: string, meta?: Record<string, unknown>): void;
 }
-/**
- * Base configuration shared by all CLI providers.
- */
 interface CliProviderConfig {
   /** Trusted native auth projection resolved by the owning execution host. */
   nativeAuthEnv?: Record<string, string>;
   nativeAuthSecretEnv?: string;
-  /** Sidecar-owned credential HOME for this adapter instance. */
   runtimeHome?: string;
-  /**
-   * Shared, persistent agent HOME. With `runtimeHome`, a harness whose
-   * contract can move its native stores off HOME runs with this HOME and keeps
-   * those stores in `runtimeHome` (configDirHomeEnv). Absent for an
-   * isolated-profile identity, which keeps the private HOME.
-   */
+  /** Shared, persistent agent HOME. */
   agentHome?: string;
   /** Trusted, adapter-wide native process identity supplied by the executor. */
   subprocessUser?: {
     uid: number;
     gid: number;
   };
-  /**
-   * The executor keeps this subprocess identity for later backends of the
-   * same session, principal and profile authority: the session's secret MCP
-   * scope and its warm native server outlive this adapter, so the next turn's
-   * backend reuses its running stdio servers and native server. Session end
-   * and their idle TTLs still stop them.
-   */
+  /** The executor keeps this subprocess identity for later backends of the same session, principal and profile authority: the. */
   stableIsolatedIdentity?: boolean;
-  /** Executor-owned base for public, per-revision native profile controls. */
   publicProfileRevisionRoot?: string;
   /** Executor-owned base for UID-restricted secret profile revisions. */
   secretProfileRevisionRoot?: string;
   /** Root-only 32-byte HMAC key; never copied into a turn result. */
   secretProfileNamingKeyPath?: string;
-  /**
-   * True when the CLI runs inside a sandbox container or VM, where the OS
-   * boundary already confines file access. False or absent means the CLI may
-   * run on a developer's host, so harness path guards stay in force.
-   */
   sandboxedRuntime?: boolean;
-  /** Portable profile applied to this provider execution. */
   profile?: AgentProfile;
   runtimeAttachments?: AgentRuntimeAttachments;
-  /**
-   * Per-turn credential values resolved by secret references in this
-   * execution's runtime MCP attachments. The materialization secret provider
-   * checks this map before the host box environment; values are launch
-   * state only and never enter the CLI's inherited environment or logs.
-   */
+  /** Per-turn credential values resolved by secret references in this execution's runtime MCP attachments. */
   runtimeSecrets?: Record<string, string>;
-  /** Path to the CLI executable */
   cliPath?: string;
-  /** Default model to use */
   model?: string;
-  /** Model provider selected by the caller. */
   provider?: string;
-  /** API key (provider-specific env var name) */
   apiKey?: string;
-  /** OpenAI-compatible or provider-native base URL. */
   baseUrl?: string;
-  /** Optional auth files to materialize under the runtime home directory. */
   authFiles?: Array<{
     path: string;
     content: string;
     mode?: number;
   }>;
-  /** Extra flags to pass to the CLI */
   extraFlags?: string[];
-  /**
-   * Bypass all permission checks for fully autonomous operation.
-   * Each CLI has its own flag:
-   * - Claude Code: --dangerously-skip-permissions
-   * - Codex: --dangerously-bypass-approvals-and-sandbox
-   * - Factory Droids: --autonomy-level skip-permissions-unsafe
-   * Default: true (for headless/automated use)
-   */
   bypassPermissions?: boolean;
-  /**
-   * Enable structured human interactions by kind. `true` means "all supported
-   * kinds for this adapter"; object form is the precise public surface:
-   * `{ question: true }`, `{ permission: true }`, `{ plan: true }`.
-   *
-   * Each adapter maps these requested kinds onto its native transport (MCP,
-   * reverse RPC, or extension hook) while all responses flow through the same
-   * `/interactions` API.
-   */
   interactions?: InteractionToggleConfig;
 }
-/**
- * Options for CLI provider adapter constructors.
- */
 interface CliProviderOptions<TConfig extends CliProviderConfig = CliProviderConfig> {
-  /** Provider configuration */
   config?: TConfig;
-  /** Logger instance */
   logger?: CliProviderLogger;
-  /** Base storage path for session persistence */
   storagePath?: string;
-  /** Storage subdirectory name (e.g., ".claude-code", ".codex") */
   storageDir?: string;
   /** Resolve opaque AgentProfile secret references at the private spawn boundary. */
   profileSecretProvider?: AgentProfileSecretProvider;
-  /**
-   * For a secret profile revision: the keys the runtime itself manages (the
-   * box's TANGLE_API_KEY), which a turn may not deliver as runtimeSecrets.
-   * Their values reach only the executor's own MCP serving, never the launch.
-   * Anything else a secret revision references comes from runtimeSecrets.
-   */
+  /** For a secret profile revision: the keys the runtime itself manages (the box's TANGLE_API_KEY), which a turn may not deliver as runtimeSecrets. */
   secretProfileRuntimeKeyProvider?: AgentProfileSecretProvider;
-  /**
-   * Environment every CLI child gets in place of the inherited one for these
-   * keys: in a sandbox, the agent user's own HOME, PATH and cache paths, so a
-   * child never inherits the supervisor's cache paths it cannot write. The
-   * adapter's own environment still wins for any key it sets.
-   */
-  agentEnvironment?: () => Record<string, string | undefined>;
-  /**
-   * Start each turn's CLI through the consumer's own executor (a container
-   * slot, a jail) instead of a local spawn. It receives the assembled argv,
-   * cwd and environment; the adapter still parses, times and stops the turn.
-   */
+  /** Serves native private-profile MCP servers without giving their keys to the CLI. */
+  mcpCredentialProxy?: SecretProfileMcpCredentialProxy;
+  /** Environment every CLI child gets in place of the inherited one for these keys: in a sandbox, the. */
+  agentEnvironment?: (launch: {
+    secretProfile: boolean;
+  }) => Record<string, string | undefined>;
   launcher?: CliLauncher;
-  /**
-   * Stop what a turn's CLI leaves running in its process group when it exits.
-   * Off by default: a sandbox turn may start a process meant to outlive it.
-   */
   ownProcessGroup?: boolean;
 }
-/**
- * Per-turn input a CLI adapter reads beyond AgentExecutionInput: text added
- * after the harness's own system prompt (a chat caller's system messages),
- * kept apart from `systemPrompt`, which replaces it.
- */
+/** Per-turn input a CLI adapter reads beyond AgentExecutionInput: text added after the harness's own system prompt (a chat. */
 type CliExecutionInput = AgentExecutionInput & {
   appendSystemPrompt?: string;
 };
-/**
- * CLI execution arguments.
- */
 interface CliExecArgs {
-  /** CLI command */
   command: string;
-  /** Command arguments */
   args: string[];
-  /** Whether to send message via stdin */
   useStdin: boolean;
-  /** Stdin prompt text before provider formatting. Defaults to the prepared user prompt. */
   stdin?: string;
-  /**
-   * Working directory for the spawned process. Defaults to the execution
-   * workspaceRoot when omitted. Set when the CLI must run from a different root
-   * than the session workspace — e.g. nanoclaw's chat script derives its data
-   * dir (the daemon's Unix socket) from cwd, so it must run from the runtime
-   * root, not the sandbox workspace.
-   */
+  /** Working directory for the spawned process. */
   cwd?: string;
 }
-/**
- * Internal state for tracking tool calls during execution.
- */
 interface ToolCallState {
   id: string;
   name: string;
@@ -273,42 +183,33 @@ interface ToolCallState {
   status: "pending" | "running" | "completed" | "failed";
   output?: unknown;
 }
+/** How a turn ended: the closed set every harness names its end in (#16404). */
+type TurnEndReason = "success" | "abort" | "timeout" | "gateway_disconnect" | "harness_exit" | "memory_limit" | "repeated_tool_failure" | "failed";
 /**
- * Internal state for an execution run.
+ * The one precedence every engine names a failed turn's end with (#16404): an
+ * end the abort, the timeout or the harness named is theirs; only an
+ * unexplained death is the link's, the memory limit's or the harness's.
  */
+declare function turnEndReason(end: {
+  aborted?: boolean;
+  timedOut?: boolean;
+  harnessFailed?: boolean;
+  linkLost?: boolean;
+  memoryKilled?: boolean;
+  signal?: string | null;
+}): TurnEndReason;
 interface ExecutionState {
-  /** Session ID (from provider or our persistence layer) */
   sessionId?: string;
-  /** Message ID for part correlation */
   messageId?: string;
-  /**
-   * Absolute root the CLI process ran with as its cwd. Used by
-   * `trackFilePart` to resolve a relative path it observes into the same
-   * absolute path a sibling observation reports absolutely, so the two unify
-   * on one dedupe key/url instead of minting divergent parts.
-   */
   workspaceRoot?: string;
-  /** Text part ID (reused for streaming updates) */
   textPartId?: string;
-  /** Active tool calls */
   toolCalls: Map<string, ToolCallState>;
-  /** Accumulated text content */
   textBuffer: string;
-  /** Accumulated reasoning/thinking blocks */
   reasoningBuffer: string[];
-  /**
-   * Reasoning parts emitted so far — one entry per distinct reasoning block,
-   * carrying the stable part id downstream consumers key on. Maintained by
-   * `trackReasoningBlock`.
-   */
   reasoningParts?: Array<{
     id: string;
     text: string;
   }>;
-  /**
-   * File parts announced this reply, deduped by normalized path/data-URI key.
-   * Maintained by `trackFilePart`.
-   */
   fileParts?: Array<{
     id: string;
     key: string;
@@ -316,17 +217,17 @@ interface ExecutionState {
     mediaType?: string;
     url: string;
   }>;
-  /** Structured native failure retained through process exit. */
   failure?: {
     message: string;
     code?: string;
     statusCode?: number;
+    resetAt?: string;
   };
-  /** Latest provider warning emitted before process exit. */
   lastDiagnostic?: string;
-  /** Latest terminal status emitted by the provider stream. */
   terminalStatus?: "completed" | "failed";
-  /** Observed usage; absent channels were not reported by the provider. */
+  endReason?: TurnEndReason;
+  /** The sandbox's OOM-kill count when the turn started; a later count is this turn's kill. */
+  oomKillsAtStart?: number;
   tokenUsage?: Partial<TokenUsage>;
 }
 //#endregion
@@ -441,11 +342,6 @@ interface AcpTurn<TConfig extends AcpBridgeConfig> {
 }
 /** Text carried by ACP content blocks, including tool-call content. */
 declare function acpContentText(content: AcpContentBlock | AcpContentBlock[] | undefined): string;
-/** Map an ACP stop reason onto a turn status. */
-declare function mapAcpStopReason(reason: string | undefined): {
-  status: "completed" | "failed";
-  detail?: string;
-};
 //#endregion
 //#region src/turn-process.d.ts
 /** A turn transport may finish while its provider server remains alive. */
@@ -483,11 +379,7 @@ type PreparedCliLaunch = {
 declare abstract class CliAdapterLifecycle<TConfig extends CliProviderConfig = CliProviderConfig> {
   abstract readonly provider: string;
   protected abstract readonly defaultCliPath: string;
-  /**
-   * The message log directory when the caller names none. Unset, it is the
-   * registry spec's `messageStorageDir` for `provider`, the one source; only
-   * an adapter for a provider the registry does not know sets it.
-   */
+  /** The message log directory when the caller names none. */
   protected readonly defaultStorageDir?: string;
   protected readonly inheritProcessEnv: boolean;
   protected config: TConfig;
@@ -506,23 +398,10 @@ declare abstract class CliAdapterLifecycle<TConfig extends CliProviderConfig = C
   protected readonly activeProcesses: Set<CliTurnProcess>;
   private readonly initialization;
   constructor(options?: CliProviderOptions<TConfig>);
-  /**
-   * Get the storage directory. Uses provided storageDir or falls back to defaultStorageDir.
-   */
   protected get storageDir(): string;
   /** Bind a live interaction to the exact provider execution that originated it. */
   protected interactionExecutionBinding(input: AgentExecutionInput, sessionId: string): InteractionExecutionBinding;
-  /**
-   * The uid/gid every CLI process this adapter spawns runs as, or undefined
-   * when the host process is already unprivileged.
-   *
-   * This is an adapter-wide invariant, not a per-callsite option, because
-   * these CLIs seed their own state on first use — a sqlite database, a log
-   * directory, a downloaded-binary cache under the harness HOME. An auxiliary
-   * invocation left at root (`mcp add`, `mcp list`, `--version`) creates that
-   * tree root-owned, and the streamed run, which does drop privileges, then
-   * cannot open its own log and exits before emitting a single event.
-   */
+  /** The uid/gid every CLI process this adapter spawns runs as, or undefined when the host process is already unprivileged. */
   protected subprocessIdentity(): {
     uid: number;
     gid: number;
@@ -532,51 +411,26 @@ declare abstract class CliAdapterLifecycle<TConfig extends CliProviderConfig = C
     uid?: number;
     gid?: number;
   };
-  /**
-   * Run a one-shot CLI command under this adapter's subprocess identity.
-   *
-   * Every auxiliary invocation an adapter makes goes through here so the
-   * identity cannot be forgotten at a call site. Auxiliary output stays out
-   * of the streamed turn's raw evidence.
-   */
+  /** Run a one-shot CLI command under this adapter's subprocess identity. */
   protected runCli(config: Omit<CliSpawnConfig, "rawCapturePath">): Promise<CliExecResult<unknown>>;
-  /**
-   * Run a builtin-only Node script under this adapter's subprocess identity
-   * and return its stdout. File work inside a directory the CLI user owns goes
-   * through here, so a root sidecar never creates, reads or writes there with
-   * its own rights: a link the agent plants reaches only what the agent could
-   * already reach. The script reads `args` from argv after `--` and `input`
-   * from stdin. A failure carries the script's stderr, not the script text.
-   */
+  /** Run a builtin-only Node script under this adapter's subprocess identity and return its stdout. */
   protected runNodeAsSubprocess(script: string, args: readonly string[], input?: string): Promise<string>;
   getCapabilities(): BackendCapabilities;
   initialize(config: ProviderConfig & Pick<CliProviderConfig, "runtimeAttachments">): Promise<void>;
   private initializeAtGeneration;
-  /**
-   * Auth/config files the adapter needs on disk that do NOT arrive through
-   * `config.model.authFiles` — e.g. a synthesized `~/.openclaw/openclaw.json`
-   * pointing at the managed router. The sidecar materializes these through the
-   * hardened `materializeCliAuthFiles` path AFTER `initialize()`, so an adapter
-   * can derive them from the resolved config/env. Default: none.
-   */
+  /** Auth/config files the adapter needs on disk that do NOT arrive through `config.model.authFiles` — e.g. */
   getManagedAuthFiles(): CliAuthFile[];
   /** Provider-specific initialization runs inside the tracked lifecycle. */
   protected afterInitialize(_config: ProviderConfig): Promise<void>;
-  /**
-   * The harness session contract this adapter honours (cli-agent-registry
-   * NATIVE_SESSION_CONTRACTS), or null for a provider that declares none.
-   * Registration refuses a harness spec without one; ACP overrides this per
-   * sub-agent.
-   */
+  /** The harness session contract this adapter honours (cli-agent-registry NATIVE_SESSION_CONTRACTS), or null for a provider that declares none. */
   protected sessionContract(): HarnessSessionContract | null;
+  protected withExecution<T>(signal: AbortSignal | undefined, run: (signal: AbortSignal) => Promise<T>): Promise<T>;
   shutdown(): Promise<void>;
   healthCheck(): Promise<boolean>;
   /** Run this CLI's own one-shot command (version, MCP) in the workspace. */
   protected runAuxiliaryCli(args: string[], timeoutMs: number): Promise<CliExecResult<unknown>>;
   updateConfig(config: Partial<TConfig>): Promise<TConfig>;
-  /**
-   * Build environment variables for CLI execution.
-   */
+  /** Build environment variables for CLI execution. */
   protected abstract buildExecEnv(config: TConfig): Record<string, string | undefined>;
   /** Apply private native credentials to every CLI subprocess through one path. */
   protected buildNativeExecutionEnvironment(config: TConfig): Record<string, string | undefined>;
@@ -598,91 +452,45 @@ declare abstract class CliAdapterProfile<TConfig extends CliProviderConfig = Cli
   protected readonly supportsSecretProfileRevisions: boolean;
   private readonly profileSecretProvider;
   private readonly secretProfileRuntimeKeyProvider;
-  /**
-   * The materialized digest behind each secret revision. It stays here: the
-   * executor receipt is all a caller sees of a revision's resolved contents.
-   */
-  private readonly secretProfileMaterializedDigests;
-  /**
-   * The value behind each `{env:NAME}` reference in a secret revision's
-   * config, by that revision's application. Executor memory only: no launch
-   * environment, argv or file ever carries them.
-   */
-  private readonly secretProfileReferenceValues;
+  /** Private native preparation state; never part of a returned receipt. */
+  private readonly secretProfileRevisions;
   constructor(options?: CliProviderOptions<TConfig>);
-  /** Apply captured diagnostic identity to this spawn, after profile composition. */
   /** The exact child environment a turn uses; shared with prewarm paths. */
   protected buildTurnEnvironment(executionConfig: TConfig, profilePlan: WorkspacePlanApplication$1 | undefined, workspaceRoot: string, correlationHeaders: Readonly<Record<string, string>> | undefined): Record<string, string | undefined>;
-  /**
-   * A profile's declared executable tools, sealed in its revision, stand in
-   * for the app's own tool dirs on this launch's PATH tail. A secret profile's
-   * env no longer names the app's dirs (app env is scrubbed), so the sidecar's
-   * own SANDBOX_TOOL_BIN_DIRS says which inherited PATH entries they are.
-   */
+  /** A profile's declared executable tools, sealed in its revision, stand in for the app's own tool dirs on this launch's PATH tail. */
   private bindProfileToolBinDirs;
   protected bindExecutionCorrelation(environment: Record<string, string | undefined>, correlationHeaders: Readonly<Record<string, string>> | undefined): Record<string, string | undefined>;
-  /**
-   * Provision the inline profile's files and native execution controls with the
-   * shared materializer used by cli-bridge. Unsupported portable controls fail
-   * before spawn unless the profile is explicitly best-effort
-   * (resources.failOnError: false), which materializes the supported subset
-   * and warns about the rest.
-   */
-  /**
-   * Launcher controls this adapter OWNS on the spawn it starts — see
-   * `BINDABLE_LAUNCH_CONTROLS` in the materializer. Empty by default: a plan
-   * whose intent needs a launcher binding then fails closed instead of being
-   * silently dropped. An adapter that really applies the plan's launch flags
-   * to its own spawn (sdk-provider-opencode selecting the plan's primary
-   * agent via `--agent`) overrides this with the controls it honors.
-   */
+  /** Launcher controls this adapter OWNS on the spawn it starts — see `BINDABLE_LAUNCH_CONTROLS` in the materializer. */
   protected profileMaterializationBinds(): readonly BindableLaunchControl[];
-  /** Optional native instruction root. The adapter owns how its runtime locates this directory. */
+  /** Optional native instruction root. */
   protected profileAgentDirectory(_workspaceRoot: string): string | undefined;
   /** Provider transport bound into the private immutable revision and receipt. */
   protected secretProfileProviderConfig(): Record<string, unknown> | undefined;
-  /**
-   * The values behind a secret revision's `{env:NAME}` config references, for
-   * an executor that serves those references itself. Never pass them to the
-   * native process.
-   */
+  /** The values behind a secret revision's `{env:NAME}` config references, for an executor that serves those references itself. */
   protected secretProfileReferences(application: WorkspacePlanApplication$1 | undefined): Readonly<Record<string, string>> | undefined;
+  /** The one sealed session view repointed only while its native turn owns the queue. */
+  protected secretProfileSessionView(sessionId: string): {
+    launchRoot: string;
+    view: string;
+    subprocessUid: number;
+  };
+  /** Bind the private revision into the session's stable native cwd. */
+  protected bindSecretProfileSessionView(revisionWorkspaceDir: string, sessionId: string): string;
   protected materializeProfileResources(inputProfile: AgentProfile | undefined, workspaceRoot: string, ownerId?: string, sessionId?: string, scope?: "turn" | "prewarm"): Promise<WorkspacePlanApplication$1 | undefined>;
   private applyProfileResources;
-  /**
-   * Publish the profile as an executor-sealed revision for this session's
-   * subprocess identity, and record the receipt that binds it to the turn.
-   */
+  /** Publish the profile as an executor-sealed revision for this session's subprocess identity, and record the receipt that binds it to the turn. */
   private applySecretProfileRevision;
-  /**
-   * Prepare the same provider-composed native plan that execute() will check.
-   * This may publish an immutable public revision, but never starts a model turn.
-   */
-  preparePublicProfileRevision(input: AgentExecutionInput): Promise<{
-    workspacePlanDigest: string;
-    materializedDigest: string;
+  /** Prepare the same provider-composed native plan that execute() will check. */
+  preparePublicProfileRevision(input: AgentExecutionInput): Promise<Pick<_$_tangle_network_agent_profile_materialize0.ManagedWorkspaceManifest, "workspacePlanDigest" | "materializedDigest" | "conflicts"> & {
     launchDigest: string;
-    conflicts: Array<{
-      relPath: string;
-      copyRelPath: string;
-      reason: "existing" | "symlink";
-    }>;
   }>;
   /** Prepare the private native plan and return only an opaque executor receipt. */
-  prepareSecretProfileRevision(input: AgentExecutionInput): Promise<{
-    workspacePlanDigest: string;
+  prepareSecretProfileRevision(input: AgentExecutionInput): Promise<Omit<Pick<_$_tangle_network_agent_profile_materialize0.ManagedWorkspaceManifest, "workspacePlanDigest" | "materializedDigest" | "conflicts"> & {
+    launchDigest: string;
+  }, "materializedDigest" | "launchDigest"> & {
     executorReceipt: string;
-    conflicts: Array<{
-      relPath: string;
-      copyRelPath: string;
-      reason: "existing" | "symlink";
-    }>;
   }>;
-  /**
-   * What the native health check's verdict depends on besides a revision's
-   * bytes: the executable that loads them. A provider whose check runs
-   * through a configurable binary names it here.
-   */
+  /** What the native health check's verdict depends on besides a revision's bytes: the executable that loads them. */
   protected secretProfileVerificationScope(): string;
   /** A secret receipt is issued only after the provider can load this revision. */
   protected verifyPreparedSecretProfileRevision(_input: AgentExecutionInput, _application: WorkspacePlanApplication$1): Promise<void>;
@@ -693,38 +501,22 @@ declare abstract class CliAdapterProfile<TConfig extends CliProviderConfig = Cli
   /** Compose the provider's user-message channel for this exact turn. */
   protected composePromptText(promptText: string, input: AgentExecutionInput): string;
   protected withProfilePlan(config: TConfig, profilePlan: WorkspacePlanApplication$1 | undefined): TConfig;
+  /** A profile's addition precedes host context while preserving its harness prompt. */
+  protected resolveProfilePrompts(input: CliExecutionInput, plan: WorkspacePlanApplication$1 | undefined, profile?: AgentProfile | undefined): {
+    systemPrompt: string | undefined;
+    appendSystemPrompt: string | undefined;
+  };
   protected resolveProfileSystemPrompt(requestPrompt: string | undefined, profilePlan: WorkspacePlanApplication$1 | undefined): string | undefined;
-  /**
-   * The plan's additive prompt intent for this spawn. No request-level
-   * counterpart exists (`AgentExecutionInput` carries only the replacement),
-   * so unlike {@link resolveProfileSystemPrompt} there is nothing to
-   * conflict-check against.
-   */
-  protected resolveProfileAppendSystemPrompt(profilePlan: WorkspacePlanApplication$1 | undefined): string | undefined;
   protected resolveProfileModel(requestModel: string | undefined): string | undefined;
   protected mergeProfilePlanEnvironment(environment: Record<string, string | undefined>, profilePlan: WorkspacePlanApplication$1 | undefined, preserveClearedVariables?: boolean): Record<string, string | undefined>;
   /** Provider-owned allowlist for a generated revision control after env scrub. */
   protected profilePlanMayFillClearedEnvironmentVariable(_name: string, _value: string): boolean;
-  protected preparePromptInput(parts: InputPart[], workspaceRoot: string, sessionId: string, options?: {
-    /** Override of the per-request inline-image budget — pass 0 on paths
-     *  that deliver markers only and would discard the base64. */
-    inlineImageBudgetBytes?: number;
-    /** Override of the adapter's nativeAttachmentKinds() for this call —
-     *  pass [] on paths that cannot forward any kind natively, so every
-     *  attachment keeps its canonical text marker. */
-    nativeAttachmentKinds?: ReadonlyArray<"image" | "file">;
-  }): Promise<{
+  protected preparePromptInput(parts: InputPart[], workspaceRoot: string, sessionId: string, options?: Parameters<typeof preparePromptInputParts>[3]): Promise<{
     promptText: string;
-    persistedParts: MessagePart[];
+    persistedParts: _$_tangle_network_sdk_session_persistence0.MessagePart[];
     attachments: PreparedAttachment[];
   }>;
-  /**
-   * Attachment kinds this adapter forwards natively via buildExecArgs (argv
-   * flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]`
-   * text marker. The base adapter omits those kinds' markers from the prompt
-   * text — an adapter that opts a kind in MUST deliver every attachment of
-   * that kind itself, or the model never sees it.
-   */
+  /** Attachment kinds this adapter forwards natively via buildExecArgs (argv flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]` text marker. */
   protected nativeAttachmentKinds(): ReadonlyArray<"image" | "file">;
 }
 //#endregion
@@ -881,7 +673,6 @@ declare class TurnObserver {
   private readonly options;
   providerSessionPersistence: Promise<void>;
   providerSessionPersistenceError: unknown;
-  repeatedToolFailureTripped: boolean;
   nativeSessionObserved: boolean;
   private readonly partUpdates;
   private readonly liveness;
@@ -897,9 +688,7 @@ declare class TurnObserver {
 }
 //#endregion
 //#region src/execution-state.d.ts
-/**
- * Creates a new execution state.
- */
+/** Creates a new execution state. */
 declare function createExecutionState(sessionId?: string, messageId?: string, workspaceRoot?: string): ExecutionState;
 //#endregion
 //#region src/profile-config.d.ts
@@ -912,34 +701,11 @@ declare function createExecutionState(sessionId?: string, messageId?: string, wo
 declare function runtimeSecretsOverlay(runtimeSecrets: Record<string, string> | undefined, fallback: AgentProfileSecretProvider): AgentProfileSecretProvider;
 //#endregion
 //#region src/base-adapter.d.ts
-/**
- * Base adapter for CLI-based AI agent providers.
- *
- * Subclasses must implement:
- * - provider: string identifier
- * - defaultCliPath: default CLI executable name
- * - buildExecArgs(): build CLI execution arguments
- * - buildExecEnv(): build environment variables
- * - createEventParser(): create JSONL event parser
- * - mapEventToStreamEvents(): map parsed events to StreamEvents
- *
- * The message log directory is the registry spec's `messageStorageDir` for
- * `provider` (cli-agent-registry `messageStorageDirOf`); only an adapter for
- * a provider the registry does not know sets `defaultStorageDir`.
- *
- * Optional overrides:
- * - buildMcpAddArgs(): MCP add command arguments
- * - buildMcpListArgs(): MCP list command arguments (if supported)
- * - parseMcpListOutput(): parse MCP list output
- */
+/** Base adapter for CLI-based AI agent providers. */
 declare abstract class CliProviderAdapterBase<TConfig extends CliProviderConfig = CliProviderConfig, TEvent = unknown> extends CliAdapterMcp<TConfig> implements SdkProviderAdapter {
   protected readonly supportsManagedQuote: boolean;
   execute(input: AgentExecutionInput, services: SdkHostServices, onEvent?: (event: StreamEvent) => void): Promise<AgentExecutionResult>;
   private executeInternal;
-  /**
-   * Record a successful turn: the provider session id, the assistant message,
-   * and the result, cached for a same-turnId retry.
-   */
   protected completeTurn(params: {
     input: AgentExecutionInput;
     sessionId: string;
@@ -953,39 +719,34 @@ declare abstract class CliProviderAdapterBase<TConfig extends CliProviderConfig
   }): Promise<AgentExecutionResult>;
   /** Report and record a failed turn, then throw its error. */
   private failCliTurn;
-  /**
-   * Open the turn's session (sidecar/provider persistence only; native CLI
-   * startup is measured separately). A same-turnId retry of a completed turn
-   * gets that turn's cached result instead of running again.
-   */
   protected openTurnSession(input: AgentExecutionInput, recorder: SdkHostServices["recorder"], onEvent: ((event: StreamEvent) => void) | undefined): Promise<{
-    providerMessageIds: any;
+    providerMessageIds: _$_tangle_network_sdk_session_persistence0.ProviderMessageIds | undefined;
     cached: AgentExecutionResult;
     sessionId: string;
     providerSessionId: string | undefined;
     transcriptReplay: "fork" | "restored" | undefined;
   } | {
-    providerMessageIds: any;
+    providerMessageIds: _$_tangle_network_sdk_session_persistence0.ProviderMessageIds | undefined;
     cached: undefined;
     sessionId: string;
     providerSessionId: string | undefined;
     transcriptReplay: "fork" | "restored" | undefined;
   }>;
-  /** Provision the profile's cwd-native dimensions for this turn. */
-  private materializeTurnProfile;
-  /**
-   * Prepare the prompt and record the caller's own parts. `promptText`
-   * additionally carries the replayed transcript and this turn's ephemeral
-   * context, which are execution-only and stay out of both stores.
-   */
+  protected materializeTurnProfile(input: AgentExecutionInput, sessionId: string): Promise<{
+    executionProfile: AgentProfile | undefined;
+    profilePlan: WorkspacePlanApplication$1 | undefined;
+  }>;
   protected recordTurnPrompt(input: AgentExecutionInput, session: {
     sessionId: string;
     transcriptReplay: "fork" | "restored" | undefined;
     providerMessageIds: ReturnType<typeof readProviderMessageIds>;
-  }, recorder: SdkHostServices["recorder"]): Promise<{
+  }, recorder: SdkHostServices["recorder"], attachmentOptions?: {
+    nativeAttachmentKinds?: ReadonlyArray<"image" | "file">;
+    inlineImageBudgetBytes?: number;
+  }): Promise<{
     preparedInput: {
       promptText: string;
-      persistedParts: readProviderMessageIds[];
+      persistedParts: _$_tangle_network_sdk_session_persistence0.MessagePart[];
       attachments: PreparedAttachment[];
     };
     promptText: string;
@@ -994,163 +755,74 @@ declare abstract class CliProviderAdapterBase<TConfig extends CliProviderConfig
   private planLaunch;
   /** Reserve and announce the native session id a pre-minted harness already has. */
   private bindNativeSession;
-  /** Spawn the turn's process, feed its input, and wait for it to exit. */
   private runCliTurn;
-  /**
-   * Build CLI execution arguments for the exec command.
-   */
   protected abstract buildExecArgs(params: {
     message: string;
     config: TConfig; /** Canonical identity for providers whose native config binds HTTP headers. */
     correlationHeaders?: Readonly<Record<string, string>>;
     model?: string;
-    sessionId?: string;
-    /**
-     * Set on a new session of a harness whose contract pre-mints its id: the
-     * adapter MUST start the native session under this id with the contract's
-     * identity args (e.g. `--session-id <id>`). The base checks the argv.
-     */
+    sessionId?: string; /** Set on a new session of a harness whose contract pre-mints its id: the adapter MUST start the native session under this id with the contract's identity args (e.g. */
     mintedSessionId?: string;
     workspaceRoot: string;
-    systemPrompt?: string;
-    /**
-     * The plan's ADDITIVE prompt intent: the harness's own prompt stays in
-     * force and this text is added after it. NEVER the same channel as
-     * `systemPrompt` (a replacement) — an adapter must bind it to its
-     * harness's additive control, not substitute one for the other.
-     *
-     * The materializer sets it only for harnesses whose addition control is a
-     * launch argument (claude-code, pi and prime `--append-system-prompt`); an
-     * adapter for such a harness MUST bind it, or the intent the plan asserted
-     * supported is silently dropped. A profile that keeps the harness prompt
-     * (keepsHarnessSystemPrompt) also receives the host prompt here; codex
-     * binds it to `developer_instructions`, and opencode already carries it in
-     * its materialized addition file.
-     */
+    systemPrompt?: string; /** The plan's ADDITIVE prompt intent: the harness's own prompt stays in force and this text is added after it. */
     appendSystemPrompt?: string;
     attachments?: PreparedAttachment[]; /** Preserve the origin of launch flags when a CLI needs one selected agent. */
     profilePlan?: WorkspacePlanApplication$1;
   }): CliExecArgs;
-  /** Create the provider event parser for CLI output. */
   protected abstract createEventParser(state: ExecutionState, onEvent?: (event: StreamEvent) => void): StreamParserConfig<TEvent>;
   /** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
   private turnSpawnConfig;
-  /**
-   * The launch one turn would make, without starting it: the spawn config
-   * (argv, cwd, environment, identity or launcher), the stdin payload, and
-   * the profile files written into the workspace. Session and message
-   * stores are untouched and no held process is reserved, so a caller that
-   * runs the process itself (`execCli`) owns its output and lifecycle.
-   */
+  /** The launch one turn would make, without starting it: the spawn config (argv, cwd, environment, identity or launcher). */
   prepareLaunch(input: CliExecutionInput, options?: {
     providerSessionId?: string;
   }): Promise<PreparedCliLaunch>;
-  /** Override only when the provider has a turn transport besides a CLI child. */
   protected spawnExecutionProcess(request: CliTurnSpawn<TConfig, TEvent>): CliTurnProcess | Promise<CliTurnProcess>;
 }
 //#endregion
 //#region src/acp-session-adapter.d.ts
-/**
- * Shared lifecycle of a provider that drives an Agent Client Protocol agent
- * over a JSON-RPC stdio bridge: one cached process and native ACP session per
- * Tangle session, `initialize` then `session/new` (or `session/load` for a
- * provider that resumes), serialized `session/prompt` turns, the cancel
- * sequence (`session/cancel`, grace, close), `session/update` translation,
- * idle reaping and eviction on process exit or turn failure.
- *
- * A provider supplies only its translation: how a turn resolves its config,
- * how the process starts, the prompt blocks, and its own failure signals.
- */
 declare abstract class AcpProviderAdapterBase<TConfig extends AcpBridgeConfig, TTurn extends AcpTurn<TConfig> = AcpTurn<TConfig>> extends CliProviderAdapterBase<TConfig> {
-  /** True when the agent supports `session/load` for a recorded native session. */
   protected abstract readonly loadsNativeSessions: boolean;
   private readonly acpSessions;
-  /** Resolve the turn's effective config. Throws before any session work. */
   protected abstract resolveTurn(input: AgentExecutionInput): TTurn;
-  /**
-   * How to start the agent process. Runs only when no live process matches.
-   * May be async for a provider that must hand files it wrote to the agent user.
-   */
   protected abstract processSpec(turn: TTurn, context: {
     sessionId: string;
     workspaceRoot: string;
   }): AcpProcessSpec | Promise<AcpProcessSpec>;
-  /** The error a failed spawn surfaces; `missingBinary` when the command was not found. */
   protected abstract spawnFailureMessage(failure: {
     message: string;
     missingBinary: boolean;
   }, turn: TTurn): string;
-  /** The `session/prompt` blocks for a turn. */
   protected abstract promptBlocks(input: AgentExecutionInput, prepared: {
     promptText: string;
     persistedParts: MessagePart[];
     attachments: PreparedAttachment[];
   }, turn: TTurn): AcpContentBlock[];
-  /** Spawn the bridge. Tests override it to swap the child process. */
   protected spawnBridge(request: AcpBridgeSpawn): RpcBridge;
-  /** Refuse an agent version beyond the provider's own floor. */
   protected checkAgentProtocolVersion(_advertised: number, _turn: TTurn): void;
-  /**
-   * Configure a native session the process just opened or loaded, before its
-   * first prompt (e.g. `session/set_model`). A failure fails the acquire.
-   */
+  protected resumeSessionId(): string | undefined;
   protected onSessionOpened(_bridge: RpcBridge, _acpSessionId: string, _turn: TTurn, _options: {
     timeoutMs: number;
   }): Promise<void>;
-  /** Install reverse-call handlers on a new bridge, before `initialize`. */
   protected onBridgeSpawned(_bridge: RpcBridge, _sessionId: string, _turn: TTurn): void;
-  /** Start per-turn state; the returned function ends it on every exit. */
   protected beginTurn(_sessionId: string, _input: AgentExecutionInput, _onEvent: ((event: StreamEvent) => void) | undefined): () => void;
-  /** Inspect a failed tool's output; returned events precede its part update. */
   protected onToolFailed(_sessionId: string, _failureText: string | undefined): StreamEvent[];
-  /**
-   * A failure the provider recorded for this session during the turn,
-   * cleared on read. It outranks the error the turn surfaced as.
-   */
   protected takeTurnFailure(_sessionId: string): Error | undefined;
-  /** Release provider state tied to a session's process. */
   protected onSessionEvicted(_sessionId: string): void;
-  /** Extra fields for the turn-failure log line. */
   protected turnLogContext(_turn: TTurn): Record<string, unknown>;
-  /**
-   * One turn through the base turn pipeline: session open with transcript
-   * replay and cached-turn replay, then input and result recording around the
-   * bridge's `session/prompt`. The agent owns its profile, so the base's
-   * profile materialization does not run.
-   */
   execute(input: AgentExecutionInput, services: SdkHostServices, onEvent?: (event: StreamEvent) => void): Promise<AgentExecutionResult>;
-  /** Report a failed turn, retire its process, and throw its error. */
-  private failAcpTurn;
+  protected interruptStuckTurn(): void;
+  protected acknowledgeLostTurn(_detail: string): Promise<boolean>;
   private acquireAcpSession;
   private checkProtocolVersion;
-  /**
-   * Open the native ACP session. A recorded session is loaded when the agent
-   * can; an agent that refuses the load starts a new native session, and the
-   * Tangle transcript stays the record of the earlier turns.
-   */
   private openNativeSession;
-  /**
-   * One `session/prompt` turn. Abort sends `session/cancel` before closing so
-   * the agent can settle the turn; the bridge's own signal handling would
-   * close first and lose the notify.
-   */
   private promptAcpSession;
   private scheduleIdleReap;
   private cancelIdleReap;
-  /** Close a session's agent process and drop it. Idempotent. */
   protected evictAcpSession(sessionId: string, reason: string): void;
-  /** Evict every cached session whose process key matches. */
   protected evictAcpSessionsWhere(matches: (processKey: string) => boolean, reason: string): void;
-  /** Translate one `session/update` notification into stream events. */
   private mapAcpUpdate;
   private mapToolStatus;
   private formatBridgeError;
-  /**
-   * The error a failed process start surfaces. An agent that exits before its
-   * session opens reports why only on stderr, and an agent's JSON-RPC error
-   * carries its cause in `data`; a bare "process-exit" or "Internal error"
-   * hides both from the caller.
-   */
   private sessionSetupError;
   healthCheck(): Promise<boolean>;
   shutdown(): Promise<void>;
@@ -1208,7 +880,7 @@ interface PlaintextResponse {
 }
 /**
  * Parser for harnesses that print their reply as plain stdout lines (hermes,
- * nanoclaw, forge). Lines classify into provider events; the reply is
+ * nanoclaw). Lines classify into provider events; the reply is
  * emitted as one text part when stdout closes. A turn that printed errors
  * but no reply ends `failed` with the last error instead of an empty
  * `completed`.
@@ -1250,23 +922,6 @@ declare function buildFileUrl(input: {
 }): string;
 /** Deterministic, stable part id for a file announced within one message. */
 declare function deterministicFilePartId(messageId: string, key: string): string;
-/**
- * Stateless derivation of the canonical file-part fields for one observed
- * path: resolve-once (normalize, then anchor a relative path to
- * `workspaceRoot`), and from that single resolved path derive the dedupe
- * `key`, the deterministic `id`, the `filename`, the inferred `mediaType`,
- * and the percent-encoded `file://` `url` — so every consumer that surfaces
- * the same file agrees on all five.
- *
- * Returns `null` for a relative path with no `workspaceRoot` to anchor it:
- * detection is opportunistic and a fabricated location is worse than a
- * missing part (see `trackFilePart` for the full rationale).
- *
- * This is the ONE derivation chain. `trackFilePart` (exec path, with
- * ExecutionState memoization) and stateless mappers that own no
- * ExecutionState (codex's app-server item mapper) both call it — never
- * re-implement the chain, or the two paths drift.
- */
 declare function deriveFilePart(input: {
   path: string;
   messageId: string;
@@ -1278,33 +933,6 @@ declare function deriveFilePart(input: {
   mediaType?: string;
   url: string;
 } | null;
-/**
- * Tracks a file an adapter observed being created/modified (e.g. from a
- * write-tool call) and returns the canonical `FilePart` fields to stream,
- * deduping by resolved-absolute-path or data-URI content so repeated writes
- * to the same file update one part instead of appending duplicates.
- *
- * The path is normalized and resolved to an absolute form ONCE, and that same
- * resolved value drives both the dedupe key and the `file://` url — so two
- * observations of the same file that differ only in spelling (`./chart.png`
- * vs `/workspace/chart.png`, or `/workspace/sub/../chart.png` vs
- * `/workspace/chart.png`) unify on one part with one stable url, satisfying
- * the stream invariant that a given part id keeps a stable url.
- *
- * A relative path can only be resolved against `state.workspaceRoot` (set by
- * the adapter from the CLI's cwd). Detection here is opportunistic — a
- * tool-call observation, not a guarantee of an absolute path — so when no
- * workspaceRoot is available to anchor a relative path, we drop the
- * observation (`null`) rather than fabricate an anchor (e.g. resolving
- * against "/"): a wrong url is worse than a missing part, and a caller that
- * genuinely lost the file would get a wrong, permanent url once it's on the
- * stream.
- *
- * Detection is opportunistic for other reasons too: a delete, or an
- * observation carrying neither a path nor a data URI, also yields no part
- * (`null`) rather than an error — callers are not required to have a file
- * signal on every tool result.
- */
 declare function trackFilePart(state: ExecutionState, args: {
   path?: string;
   dataUri?: string;
@@ -1331,22 +959,6 @@ declare class InteractionMcpServer extends InteractionMcpServer$1 {
 }
 //#endregion
 //#region src/interaction-support.d.ts
-/**
- * Per-execution lifecycle wrapper for an MCP-capable harness. Permission and
- * question tools use the live {@link InteractionBroker}; plan tools commit
- * through {@link TerminalPlanSupport} and end the provider turn.
- *
- * Mirrors the claude-code permission-server pattern, but for the GENERIC
- * `request_permission` / `ask_user` / `request_plan` tools the agent calls
- * itself — there is no harness-specific reply contract, so any MCP-capable CLI
- * (factory-droids, …) composes this with ~10 lines: declare the capability
- * kinds, start/stop around the spawn, inject the server via the CLI's MCP
- * mechanism, and forward `respondToInteraction` here.
- *
- * Unlike claude-code's `--permission-prompt-tool`, these generic tools fire
- * only when the model chooses to call them. Permission is therefore advisory,
- * while plan-capable adapters separately prove the terminal turn boundary.
- */
 declare class McpInteractionSupport {
   /** MCP server name; tool names become `mcp__<name>__<tool>`. */
   private readonly serverName;
@@ -1432,6 +1044,34 @@ declare function recordCliTokenUsage(state: ExecutionState, ...sources: unknown[
 declare function accumulateCliTokenUsage(state: ExecutionState, ...sources: unknown[]): boolean;
 declare function parseCliUsageLine(line: string): Record<string, unknown> | undefined;
 //#endregion
+//#region src/secret-native-proof.d.ts
+type BinaryLaunch = Pick<CliSpawnConfig, "command" | "cwd" | "env" | "signal" | "isolatedIdentity"> & {
+  inheritEnv: boolean;
+};
+/** Prove an immutable executable, under the launch's own identity and environment. */
+declare function provenStoreBinary(expected: string, config: BinaryLaunch): Promise<string>;
+/** A reported version alone cannot establish an immutable executable. */
+declare function isTrustedStoreBinary(realpath: string): boolean;
+/** The real file a launch of `command` executes under `pathEnv`. */
+declare function resolveExecutableRealpath(command: string, pathEnv: string | undefined): string | undefined;
+type SealedEntry = readonly [relative: string, mode: number, directory: boolean];
+declare const SEALED_NATIVE_HOME_LAYOUT: {
+  readonly codex: readonly [readonly [".", 1016, true], readonly [".codex", 1016, true], readonly [".agents", 360, true], readonly [".codex/skills", 360, true], readonly [".codex/rules", 360, true], readonly [".codex/config.toml", 288, false], readonly [".codex/AGENTS.md", 288, false], readonly [".codex/AGENTS.override.md", 288, false], readonly [".codex/hooks.json", 288, false]];
+  readonly opencode: readonly [readonly [".", 456, true], readonly [".opencode", 360, true]];
+};
+declare function assertSealedNativeHome(home: string, gid: number, layout: readonly SealedEntry[]): void;
+type RefusalDetail = {
+  path?: string;
+  exitCode?: number | null;
+} & Partial<Record<"expected" | "actual", string | number | boolean>>;
+/** Only selected structural facts enter a refusal; payloads and causes never do. */
+declare function refuseSecretLaunch(reason: string, {
+  path,
+  expected,
+  actual,
+  exitCode
+}?: RefusalDetail): never;
+//#endregion
 //#region src/reasoning-effort.d.ts
 /** The argv carrying `nativeReasoningControl` for a profile effort, or none. */
 declare function nativeEffortArgs(harness: HarnessType, effort: ReasoningEffort | undefined): string[];
@@ -1465,27 +1105,6 @@ declare function trackReasoningBlock(state: ExecutionState, blockText: string):
 } | null;
 //#endregion
 //#region src/repeated-tool-failure.d.ts
-/**
- * Guard against a turn that keeps sending a tool call the tool keeps
- * rejecting.
- *
- * A CLI hands a rejected call back to the model and asks it to try again. It
- * puts no bound on how often it does that. A model that cannot form a valid
- * input therefore bills one round trip per attempt until an unrelated limit
- * runs out, and the user is told about that limit rather than about the call.
- * Staging measured 76 such attempts in 24.5 minutes, ending on a spent key
- * budget.
- *
- * The bound has to sit here, not in the CLI. OpenCode drives the turn with
- * `while (true)` in `session/prompt.ts`. Its per-agent `steps` bound defaults
- * to `Infinity`, and reaching that bound only appends a message that asks the
- * model to stop. Every tool stays enabled.
- *
- * The guard counts identical rejections in a row and nothing else. Any tool
- * call that produces a result clears the count. A retry after a transient
- * error is untouched, because it either succeeds or its error text moves. Only
- * a model that cannot change its input reaches the limit.
- */
 /** What a tripped guard reports to the caller. */
 interface RepeatedToolFailure {
   /** The tool the model meant to call. */
@@ -1509,16 +1128,30 @@ interface RepeatedToolFailureGuardOptions {
    */
   repairToolNames?: ReadonlySet<string>;
 }
-interface RepeatedToolFailureGuard {
+declare function createRepeatedToolFailureGuard(options: RepeatedToolFailureGuardOptions): {
   /**
    * Feed one tool part. Returns the trip on the call that reaches the limit,
    * and `undefined` every other time. A tripped guard stays tripped and
    * reports once, so a caller can kill the turn without racing the events
    * still in flight behind it.
    */
-  observe(part: Pick<ToolPart, "id" | "tool" | "state">): RepeatedToolFailure | undefined;
-}
-declare function createRepeatedToolFailureGuard(options: RepeatedToolFailureGuardOptions): RepeatedToolFailureGuard;
+  observe(part: Pick<ToolPart, "id" | "tool" | "state">): {
+    count: number;
+    tool: string;
+    detail: string;
+  } | undefined;
+};
+//#endregion
+//#region src/secret-profile-scope.d.ts
+type ScopeOwner = {
+  readonly proxy?: SecretProfileMcpCredentialProxy;
+};
+declare function secretMcpScope(sessionId: string, uid: number | undefined, owner?: ScopeOwner): string;
+declare function forgetSessionScopes(target: {
+  sessionId: string;
+} | {
+  owner: ScopeOwner;
+}): Promise<void>;
 //#endregion
 //#region src/stream-parts.d.ts
 /**
@@ -1612,5 +1245,5 @@ declare function homeXdgEnv(home: string): {
   XDG_STATE_HOME: string;
 };
 //#endregion
-export { ACP_MIN_PROTOCOL_VERSION, ACP_PROTOCOL_VERSION, type AcpBridgeConfig, type AcpBridgeSpawn, type AcpContentBlock, type AcpInitializeParams, type AcpInitializeResult, type AcpNewSessionResult, type AcpProcessSpec, type AcpPromptResult, AcpProviderAdapterBase, type AcpSessionUpdateParams, type AcpTurn, type AskUserBridge, type CliExecArgs, type CliExecutionInput, CliProviderAdapterBase, type CliProviderConfig, type CliProviderLogger, type CliProviderOptions, type CliTurnProcess, type CliTurnSpawn, DEFAULT_INTERACTION_MCP_SERVER_NAME, EXECUTION_TRACE_HEADER, type EphemeralContextInput, type ExecutionState, type HarnessId, InteractionBroker, InteractionHttpBridge, InteractionMcpServer, type InteractionMcpServerConfig, type InteractionToggleConfig, type InteractionToggleKind, InvalidAttachmentError, MANAGED_QUOTE_VERSION_HEADER, MAX_INLINE_IMAGE_BYTES, MAX_TOTAL_INLINE_IMAGE_BYTES, McpInteractionSupport, PERMISSION_DECISION_TIMEOUT_MS, PROMPT_SECTION_SEPARATOR, type PerTurnInteractionInput, type PermissionPromptBridge, type PlaintextResponse, type PreparedAttachment, type PreparedCliLaunch, type RepeatedToolFailure, type RepeatedToolFailureGuard, type RepeatedToolFailureGuardOptions, type RequestPermissionBridge, type RequestPlanBridge, SessionRehydrationError, TerminalPlanSupport, type TerminalPlanSupportOptions, type ToolCallState, type WorkspacePlanApplication, accumulateCliTokenUsage, acpContentText, brokerInteractionTools, buildFileUrl, createExecutionState, createRepeatedToolFailureGuard, deriveFilePart, deterministicFilePartId, enabledInteractionKinds, executionCorrelationHeaders, finalTextEvent, homeXdgEnv, inferMediaType, interactionMcpToolName, interactionToggleEnabled, isLocalMcpConfig, jsonEventParser, kimiThinkingArgs, localMcpArgv, localMcpEnv, mapAcpStopReason, nativeEffortArgs, parseCliUsageLine, partitionImageAttachments, plaintextResponseParser, preparePromptInputParts, prependPromptSection, readCliTokenUsage, readEphemeralContext, reasoningEvents, recordCliTokenUsage, rejectNotLaunched, runtimeSecretsOverlay, sessionObservedEvents, spawnAcpBridge, streamPartBase, textDeltaEvents, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, trackReasoningBlock, turnInteractionEnabled, wasNeverLaunched, withEphemeralContext, withTurnInteractions };
+export { ACP_MIN_PROTOCOL_VERSION, ACP_PROTOCOL_VERSION, AcpBridgeConfig, type AcpBridgeSpawn, AcpContentBlock, AcpInitializeParams, AcpInitializeResult, AcpNewSessionResult, type AcpProcessSpec, AcpPromptResult, AcpProviderAdapterBase, AcpSessionUpdateParams, AcpTurn, type AskUserBridge, CODEX_DISABLED_FEATURE_ARGS, CliExecArgs, CliExecutionInput, CliProviderAdapterBase, CliProviderConfig, CliProviderLogger, CliProviderOptions, type CliTurnProcess, type CliTurnSpawn, DEFAULT_INTERACTION_MCP_SERVER_NAME, EXECUTION_TRACE_HEADER, EphemeralContextInput, ExecutionState, type HarnessId, InteractionBroker, InteractionHttpBridge, InteractionMcpServer, InteractionMcpServerConfig, InteractionToggleConfig, InteractionToggleKind, InvalidAttachmentError, MANAGED_QUOTE_VERSION_HEADER, MAX_INLINE_IMAGE_BYTES, MAX_TOTAL_INLINE_IMAGE_BYTES, McpInteractionSupport, NATIVE_SESSION_CONTRACTS, PERMISSION_DECISION_TIMEOUT_MS, PROMPT_SECTION_SEPARATOR, PerTurnInteractionInput, type PermissionPromptBridge, PlaintextResponse, PreparedAttachment, type PreparedCliLaunch, RepeatedToolFailure, RepeatedToolFailureGuardOptions, type RequestPermissionBridge, type RequestPlanBridge, SEALED_NATIVE_HOME_LAYOUT, SECRET_REFERENCE, SECRET_REFERENCE_PREFIX, SecretProfileMcpCredentialProxy, SecretProfileMcpServer, SessionRehydrationError, TerminalPlanSupport, TerminalPlanSupportOptions, ToolCallState, TurnEndReason, type WorkspacePlanApplication, accumulateCliTokenUsage, acpContentText, assertSealedNativeHome, assertSealedNativeSearchPath, brokerInteractionTools, buildFileUrl, codexDeveloperInstructionArgs, createExecutionState, createRepeatedToolFailureGuard, deriveFilePart, deterministicFilePartId, enabledInteractionKinds, executionCorrelationHeaders, finalTextEvent, forgetSessionScopes, homeXdgEnv, inferMediaType, interactionMcpToolName, interactionToggleEnabled, isLocalMcpConfig, isLoopbackEndpoint, isPlainRecord, isTrustedStoreBinary, joinQueue, jsonEventParser, kimiThinkingArgs, localMcpArgv, localMcpEnv, nativeEffortArgs, parseCliUsageLine, partitionImageAttachments, plaintextResponseParser, preparePromptInputParts, prependPromptSection, provenStoreBinary, readCliTokenUsage, readEphemeralContext, reasoningEvents, recordCliTokenUsage, refuseSecretLaunch, rejectNotLaunched, requireRecord, resolveExecutableRealpath, resolveReferences, runtimeSecretsOverlay, secretMcpScope, secretSessionTurnQueue, servableMcpServer, servableStdioServer, sessionObservedEvents, spawnAcpBridge, streamPartBase, textDeltaEvents, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, trackReasoningBlock, turnEndReason, turnInteractionEnabled, untilSettledOrAborted, wasNeverLaunched, withEphemeralContext, withTurnInteractions };
 //# sourceMappingURL=index.d.mts.map