@tangle-network/sdk-provider-cli-base 0.13.16 → 0.13.18

package/dist/index-BpO3fvbf.d.mts

@@ -0,0 +1,1254 @@
+import { i as PreparedAttachment, o as preparePromptInputParts } from "./prompt-input-CD7okX8T.mjs";
+import { AskUserBridge, DEFAULT_INTERACTION_DECISION_TIMEOUT_MS as PERMISSION_DECISION_TIMEOUT_MS, InteractionBroker, InteractionBroker as InteractionBroker$1, InteractionHttpBridge, PermissionPromptBridge, RequestPermissionBridge, RequestPlanBridge, brokerInteractionTools as brokerInteractionTools$1 } from "@tangle-network/agent-core/interactions";
+import * as _$_tangle_network_agent_profile_materialize0 from "@tangle-network/agent-profile-materialize";
+import { BindableLaunchControl, CODEX_DISABLED_FEATURE_ARGS, HarnessId, HarnessId as HarnessId$1, WorkspacePlan, WorkspacePlanApplication, WorkspacePlanApplication as WorkspacePlanApplication$1, WorkspacePlanReceipt, codexDeveloperInstructionArgs } from "@tangle-network/agent-profile-materialize";
+import { CliExecResult, CliExitResult, CliLauncher, CliProcess, CliSpawnConfig, InvalidAttachmentError, JsonRpcError, RpcBridge, StreamParserConfig } from "@tangle-network/sdk-cli-runner";
+import { AgentExecutionInput, AgentExecutionOutcome, AgentExecutionResult, AgentProfile, AgentProfileSecretProvider, AgentRuntimeAttachments, BackendCapabilities, BackendMessage, CliAuthFile, DurablePlan, GetMessagesOptions, HarnessType, InputPart, InteractionExecutionBinding, InteractionResponse, LocalMcpConfig, McpConfig, McpStatusResponse, PlanProviderState, ProviderConfig, ReasoningEffort, RequestedInteractions, SdkHostServices, SdkPlanHost, SdkProviderAdapter, StreamEvent, TokenUsage, ToolPart } from "@tangle-network/agent-interface";
+import { HarnessSessionContract } from "@tangle-network/cli-agent-registry/session-contract";
+import * as _$_tangle_network_sdk_session_persistence0 from "@tangle-network/sdk-session-persistence";
+import { MessagePart, MessageStore, PersistedMessage, PersistedSession, SessionStore, readProviderMessageIds } from "@tangle-network/sdk-session-persistence";
+import { ProviderLogger } from "@tangle-network/cli-agent-registry";
+import { NATIVE_SESSION_CONTRACTS as NATIVE_SESSION_CONTRACTS$1 } from "@tangle-network/cli-agent-registry/native-session-contracts";
+import { DEFAULT_INTERACTION_MCP_SERVER_NAME, InteractionMcpServer, InteractionMcpServerConfig, interactionMcpToolName } from "@tangle-network/agent-core/interactions/mcp";
+import { isRecord as isPlainRecord } from "@tangle-network/agent-core";
+
+//#region src/acp-process-launch.d.ts
+/** How to start the agent process for a session. */
+interface AcpProcessSpec {
+  command: string;
+  args: string[];
+  env?: Record<string, string>;
+  /** Status detail shown while the process starts. */
+  statusDetail: string;
+}
+/** The spawn request a bridge factory receives. */
+interface AcpBridgeSpawn {
+  command: string;
+  args: string[];
+  cwd: string;
+  env?: Record<string, string>;
+  rawCapturePath?: string;
+  uid?: number;
+  gid?: number;
+}
+/** Spawn an ACP agent over NDJSON stdio from `env` alone, never the sidecar's own environment. The adapter owns abort, so no signal. */
+declare function spawnAcpBridge(request: AcpBridgeSpawn): RpcBridge;
+//#endregion
+//#region src/secret-profile-mcp.d.ts
+/** Executor-held MCP credentials shared by native private-profile adapters. */
+declare const SECRET_REFERENCE_PREFIX = "TANGLE_PROFILE_SECRET_";
+declare const SECRET_REFERENCE: RegExp;
+declare function requireRecord(raw: unknown, message: string): Record<string, unknown>;
+/** One MCP server the executor serves for a secret launch. */
+type SecretProfileMcpServer = {
+  name: string; /** The server's own upstream URL. */
+  url: string; /** Every header the upstream needs, credentials included. */
+  headers: Readonly<Record<string, string>>;
+} | {
+  name: string; /** A stdio server whose environment names a secret: the executor runs this command outside the session's UID and serves it over loopback. */
+  command: readonly string[]; /** Its environment with every secret reference resolved. */
+  environment: Readonly<Record<string, string>>; /** Every secret value its environment references, whatever its length. */
+  secrets: readonly string[];
+};
+/** The executor's loopback proxy for a secret launch's MCP servers. */
+type SecretProfileMcpCredentialProxy = {
+  /** The scope's placeholder and one loopback URL per server name. */endpoint(scope: string, names: readonly string[]): Promise<{
+    placeholder: string;
+    urls: Readonly<Record<string, string>>;
+  }>; /** Serve `servers` before resolving; release acknowledges lease termination before the turn settles or its scope is reused. */
+  lease(scope: string, servers: ReadonlyArray<SecretProfileMcpServer>): Promise<() => void | Promise<void>>; /** The scope's session ended: its placeholder is refused from now on and its stdio servers are stopped. */
+  forget(scope: string): Promise<void>;
+};
+/** A config value with its secret references resolved, or undefined. */
+declare function resolveReferences(value: string, references: Readonly<Record<string, string>>): string | undefined;
+/** A stdio server the executor can run: its command and its environment with every secret reference resolved. */
+declare function servableStdioServer(name: string, entry: Record<string, unknown>, references: Readonly<Record<string, string>>): SecretProfileMcpServer | string;
+/** A remote server the executor can serve: its fixed upstream URL and every header with its secret references resolved. */
+declare function servableMcpServer(name: string, entry: Record<string, unknown>, references: Readonly<Record<string, string>>): SecretProfileMcpServer | string;
+/** Join the queue at `key`; `previous` settles when earlier holders release. */
+declare function joinQueue(queues: Map<string, Promise<void>>, key: string): {
+  previous: Promise<void>;
+  release: () => void;
+};
+declare function untilSettledOrAborted(previous: Promise<void>, signal: AbortSignal): Promise<void>;
+/** Every native discovery ancestor is sealed and free of ambient configuration. */
+declare function assertSealedNativeSearchPath(cwd: string, configNames: readonly string[]): void;
+declare function secretSessionTurnQueue(view: string): {
+  previous: Promise<void>;
+  release: () => void;
+};
+/** An HTTP URL on loopback with an explicit port and no URL credentials. */
+declare function isLoopbackEndpoint(value: unknown): boolean;
+//#endregion
+//#region src/types.d.ts
+type InteractionToggleKind = keyof RequestedInteractions;
+type InteractionToggleConfig = boolean | RequestedInteractions;
+declare function interactionToggleEnabled(config: InteractionToggleConfig | undefined, kind: InteractionToggleKind): boolean;
+declare function enabledInteractionKinds<TKind extends InteractionToggleKind>(config: InteractionToggleConfig | undefined, supported: readonly TKind[]): TKind[];
+/** Per-turn interaction toggle carried on the execution input. */
+type PerTurnInteractionInput = Pick<AgentExecutionInput, "interactions">;
+/** Host-composed context for THIS turn only (e.g. */
+type EphemeralContextInput = {
+  ephemeralContext?: string;
+  systemPrompt?: unknown;
+};
+declare function readEphemeralContext(input: EphemeralContextInput): string | undefined;
+/** Compose the model-facing prompt for a turn: the caller's own text, then this turn's ephemeral context. */
+declare function withEphemeralContext(promptText: string, input: EphemeralContextInput): string;
+declare function turnInteractionEnabled(input: PerTurnInteractionInput, latched: InteractionToggleConfig | undefined, kind: InteractionToggleKind): boolean;
+/** Overlay this turn's interactions onto a latched config, returning a NEW object (no shared mutation — safe when. */
+declare function withTurnInteractions<TConfig extends {
+  interactions?: InteractionToggleConfig;
+}>(config: TConfig, input: PerTurnInteractionInput): TConfig;
+interface CliProviderLogger {
+  observePhase?: ProviderLogger["observePhase"];
+  debug(message: string, meta?: Record<string, unknown>): void;
+  info(message: string, meta?: Record<string, unknown>): void;
+  warn(message: string, meta?: Record<string, unknown>): void;
+  error(message: string, meta?: Record<string, unknown>): void;
+}
+interface CliProviderConfig {
+  /** Trusted native auth projection resolved by the owning execution host. */
+  nativeAuthEnv?: Record<string, string>;
+  nativeAuthSecretEnv?: string;
+  runtimeHome?: string;
+  /** Shared, persistent agent HOME. */
+  agentHome?: string;
+  /** Trusted, adapter-wide native process identity supplied by the executor. */
+  subprocessUser?: {
+    uid: number;
+    gid: number;
+  };
+  /** The executor keeps this subprocess identity for later backends of the same session, principal and profile authority: the. */
+  stableIsolatedIdentity?: boolean;
+  publicProfileRevisionRoot?: string;
+  /** Executor-owned base for UID-restricted secret profile revisions. */
+  secretProfileRevisionRoot?: string;
+  /** Root-only 32-byte HMAC key; never copied into a turn result. */
+  secretProfileNamingKeyPath?: string;
+  sandboxedRuntime?: boolean;
+  profile?: AgentProfile;
+  runtimeAttachments?: AgentRuntimeAttachments;
+  /** Per-turn credential values resolved by secret references in this execution's runtime MCP attachments. */
+  runtimeSecrets?: Record<string, string>;
+  cliPath?: string;
+  model?: string;
+  provider?: string;
+  apiKey?: string;
+  baseUrl?: string;
+  authFiles?: Array<{
+    path: string;
+    content: string;
+    mode?: number;
+  }>;
+  extraFlags?: string[];
+  bypassPermissions?: boolean;
+  interactions?: InteractionToggleConfig;
+}
+interface CliProviderOptions<TConfig extends CliProviderConfig = CliProviderConfig> {
+  config?: TConfig;
+  logger?: CliProviderLogger;
+  storagePath?: string;
+  storageDir?: string;
+  /** Resolve opaque AgentProfile secret references at the private spawn boundary. */
+  profileSecretProvider?: AgentProfileSecretProvider;
+  /** For a secret profile revision: the keys the runtime itself manages (the box's TANGLE_API_KEY), which a turn may not deliver as runtimeSecrets. */
+  secretProfileRuntimeKeyProvider?: AgentProfileSecretProvider;
+  /** Serves native private-profile MCP servers without giving their keys to the CLI. */
+  mcpCredentialProxy?: SecretProfileMcpCredentialProxy;
+  /** Environment every CLI child gets in place of the inherited one for these keys: in a sandbox, the. */
+  agentEnvironment?: (launch: {
+    secretProfile: boolean;
+  }) => Record<string, string | undefined>;
+  launcher?: CliLauncher;
+  ownProcessGroup?: boolean;
+}
+/** Per-turn input a CLI adapter reads beyond AgentExecutionInput: text added after the harness's own system prompt (a chat. */
+type CliExecutionInput = AgentExecutionInput & {
+  appendSystemPrompt?: string;
+};
+interface CliExecArgs {
+  command: string;
+  args: string[];
+  useStdin: boolean;
+  stdin?: string;
+  /** Working directory for the spawned process. */
+  cwd?: string;
+}
+interface ToolCallState {
+  id: string;
+  name: string;
+  input: unknown;
+  startTime: number;
+  status: "pending" | "running" | "completed" | "failed";
+  output?: unknown;
+}
+/** How a turn ended: the closed set every harness names its end in (#16404). */
+type TurnEndReason = "success" | "abort" | "timeout" | "gateway_disconnect" | "harness_exit" | "memory_limit" | "repeated_tool_failure" | "failed";
+/**
+ * The one precedence every engine names a failed turn's end with (#16404): an
+ * end the abort, the timeout or the harness named is theirs; only an
+ * unexplained death is the link's, the memory limit's or the harness's.
+ */
+declare function turnEndReason(end: {
+  aborted?: boolean;
+  timedOut?: boolean;
+  harnessFailed?: boolean;
+  linkLost?: boolean;
+  memoryKilled?: boolean;
+  signal?: string | null;
+}): TurnEndReason;
+interface ExecutionState {
+  sessionId?: string;
+  messageId?: string;
+  workspaceRoot?: string;
+  textPartId?: string;
+  toolCalls: Map<string, ToolCallState>;
+  textBuffer: string;
+  reasoningBuffer: string[];
+  reasoningParts?: Array<{
+    id: string;
+    text: string;
+  }>;
+  fileParts?: Array<{
+    id: string;
+    key: string;
+    filename?: string;
+    mediaType?: string;
+    url: string;
+  }>;
+  failure?: {
+    message: string;
+    code?: string;
+    statusCode?: number;
+    resetAt?: string;
+  };
+  lastDiagnostic?: string;
+  terminalStatus?: "completed" | "failed";
+  endReason?: TurnEndReason;
+  /** The sandbox's OOM-kill count when the turn started; a later count is this turn's kill. */
+  oomKillsAtStart?: number;
+  tokenUsage?: Partial<TokenUsage>;
+}
+//#endregion
+//#region src/acp-protocol.d.ts
+/** The ACP protocol version this client speaks, and the oldest it accepts. */
+declare const ACP_PROTOCOL_VERSION = 1;
+declare const ACP_MIN_PROTOCOL_VERSION = 1;
+/** Settings every ACP agent process takes. */
+interface AcpBridgeConfig extends CliProviderConfig {
+  /** Protocol version requested in `initialize` (default 1). */
+  protocolVersion?: number;
+  /** Timeout for one `session/prompt` turn (default 10 min). */
+  promptTimeoutMs?: number;
+  /** Timeout for `initialize` and `session/new|load` (default 2 min). */
+  bootstrapTimeoutMs?: number;
+  /**
+   * How long an idle session keeps its agent process (default 5 min).
+   * 0 closes the process after every turn.
+   */
+  bridgeIdleMs?: number;
+}
+/** ACP content blocks this client reads or sends. */
+type AcpContentBlock = {
+  type: "text";
+  text: string;
+} | {
+  type: "image";
+  data?: string;
+  mimeType?: string;
+  uri?: string;
+} | {
+  type: "resource";
+  uri: string;
+  mimeType?: string;
+} /** Tool-call content: one content block wrapped one level deeper. */ | {
+  type: "content";
+  content: {
+    type: "text";
+    text: string;
+  };
+};
+interface AcpInitializeParams {
+  protocolVersion: number;
+  clientCapabilities: {
+    fs?: {
+      readTextFile?: boolean;
+      writeTextFile?: boolean;
+    };
+    terminal?: boolean;
+  };
+}
+interface AcpInitializeResult {
+  protocolVersion: number;
+  agentCapabilities?: Record<string, unknown>;
+  agentInfo?: {
+    name?: string;
+    title?: string;
+    version?: string;
+  };
+  authMethods?: Array<{
+    id: string;
+    name?: string;
+    description?: string;
+  }>;
+}
+interface AcpNewSessionResult {
+  sessionId: string;
+}
+interface AcpPromptResult {
+  stopReason: "end_turn" | "max_tokens" | "max_turn_requests" | "refusal" | "cancelled" | string;
+}
+/** `session/update` notification params; only the mapped kinds are typed. */
+interface AcpSessionUpdateParams {
+  sessionId: string;
+  update: {
+    sessionUpdate: "agent_message_chunk" | "agent_thought_chunk";
+    content: AcpContentBlock | AcpContentBlock[];
+  } | {
+    sessionUpdate: "tool_call";
+    toolCallId: string;
+    title?: string;
+    kind?: string;
+    status?: "pending" | "in_progress" | "completed" | "failed";
+    rawInput?: unknown;
+  } | {
+    sessionUpdate: "tool_call_update";
+    toolCallId: string;
+    status?: "pending" | "in_progress" | "completed" | "failed";
+    content?: AcpContentBlock[];
+    rawOutput?: unknown;
+  } | {
+    sessionUpdate: "plan";
+    entries: Array<{
+      content: string;
+      priority?: string;
+      status?: string;
+    }>;
+  } | {
+    sessionUpdate: string;
+    [key: string]: unknown;
+  };
+}
+/** One turn's inputs, resolved before any session or process work. */
+interface AcpTurn<TConfig extends AcpBridgeConfig> {
+  readonly config: TConfig;
+  /**
+   * The process configuration a cached session was started with. A turn
+   * with a different key gets a new process: an ACP agent reads its model
+   * and backing agent once, at startup.
+   */
+  readonly processKey: string;
+}
+/** Text carried by ACP content blocks, including tool-call content. */
+declare function acpContentText(content: AcpContentBlock | AcpContentBlock[] | undefined): string;
+//#endregion
+//#region src/turn-process.d.ts
+/** A turn transport may finish while its provider server remains alive. */
+type CliTurnProcess = Pick<CliProcess, "pid" | "write" | "closeInput" | "kill" | "exitPromise" | "beginRawCapture"> & {
+  stderr?: NodeJS.ReadableStream;
+};
+type CliTurnSpawn<TConfig, TEvent> = {
+  input: AgentExecutionInput;
+  sessionId: string;
+  providerSessionId?: string;
+  config: TConfig;
+  execArgs: CliExecArgs;
+  workspaceRoot: string;
+  env: Record<string, string | undefined>;
+  signal: AbortSignal;
+  timeoutMs?: number;
+  parser: StreamParserConfig<TEvent>;
+  /**
+   * A process started before the turn it serves (a held spare): its raw
+   * capture opens when a turn adopts it (`beginRawCapture`), inside that
+   * turn's attempt, not at spawn.
+   */
+  deferRawCapture?: boolean;
+};
+/** One turn's launch, prepared for a caller that runs the process itself. */
+type PreparedCliLaunch = {
+  /** Pass to `execCli` or `launchCliProcess`, adding `signal` and `timeoutMs`. */spawn: CliSpawnConfig; /** Write to the child's stdin and close it; absent when the prompt is in argv. */
+  stdin?: string; /** The native session id the argv names, for a harness that pre-mints it. */
+  nativeSessionId?: string; /** The profile's workspace files and spawn inputs that were applied. */
+  workspacePlan?: WorkspacePlanReceipt;
+};
+//#endregion
+//#region src/adapter-lifecycle.d.ts
+/** Owns configuration, initialization, cancellation, and subprocess identity. */
+declare abstract class CliAdapterLifecycle<TConfig extends CliProviderConfig = CliProviderConfig> {
+  abstract readonly provider: string;
+  protected abstract readonly defaultCliPath: string;
+  /** The message log directory when the caller names none. */
+  protected readonly defaultStorageDir?: string;
+  protected readonly inheritProcessEnv: boolean;
+  protected config: TConfig;
+  private readonly initialConfig;
+  protected logger: CliProviderLogger;
+  protected sessionStore: SessionStore | null;
+  protected messageStore: MessageStore | null;
+  protected storagePath: string;
+  private _storageDir;
+  private readonly agentEnvironment;
+  /** The consumer's executor for turn processes; a local spawn when absent. */
+  protected readonly launcher: CliLauncher | undefined;
+  /** Whether a turn's leftover process-group members are stopped at exit. */
+  protected readonly ownProcessGroup: boolean;
+  protected initialized: boolean;
+  protected readonly activeProcesses: Set<CliTurnProcess>;
+  private readonly initialization;
+  constructor(options?: CliProviderOptions<TConfig>);
+  protected get storageDir(): string;
+  /** Bind a live interaction to the exact provider execution that originated it. */
+  protected interactionExecutionBinding(input: AgentExecutionInput, sessionId: string): InteractionExecutionBinding;
+  /** The uid/gid every CLI process this adapter spawns runs as, or undefined when the host process is already unprivileged. */
+  protected subprocessIdentity(): {
+    uid: number;
+    gid: number;
+  } | undefined;
+  /** `subprocessIdentity` shaped for `spawn`'s options bag. */
+  protected subprocessSpawnOptions(): {
+    uid?: number;
+    gid?: number;
+  };
+  /** Run a one-shot CLI command under this adapter's subprocess identity. */
+  protected runCli(config: Omit<CliSpawnConfig, "rawCapturePath">): Promise<CliExecResult<unknown>>;
+  /** Run a builtin-only Node script under this adapter's subprocess identity and return its stdout. */
+  protected runNodeAsSubprocess(script: string, args: readonly string[], input?: string): Promise<string>;
+  getCapabilities(): BackendCapabilities;
+  initialize(config: ProviderConfig & Pick<CliProviderConfig, "runtimeAttachments">): Promise<void>;
+  private initializeAtGeneration;
+  /** Auth/config files the adapter needs on disk that do NOT arrive through `config.model.authFiles` — e.g. */
+  getManagedAuthFiles(): CliAuthFile[];
+  /** Provider-specific initialization runs inside the tracked lifecycle. */
+  protected afterInitialize(_config: ProviderConfig): Promise<void>;
+  /** The harness session contract this adapter honours (cli-agent-registry NATIVE_SESSION_CONTRACTS), or null for a provider that declares none. */
+  protected sessionContract(): HarnessSessionContract | null;
+  protected withExecution<T>(signal: AbortSignal | undefined, run: (signal: AbortSignal) => Promise<T>): Promise<T>;
+  shutdown(): Promise<void>;
+  healthCheck(): Promise<boolean>;
+  /** Run this CLI's own one-shot command (version, MCP) in the workspace. */
+  protected runAuxiliaryCli(args: string[], timeoutMs: number): Promise<CliExecResult<unknown>>;
+  updateConfig(config: Partial<TConfig>): Promise<TConfig>;
+  /** Build environment variables for CLI execution. */
+  protected abstract buildExecEnv(config: TConfig): Record<string, string | undefined>;
+  /** Apply private native credentials to every CLI subprocess through one path. */
+  protected buildNativeExecutionEnvironment(config: TConfig): Record<string, string | undefined>;
+  protected getCliPath(): string;
+  protected ensureInitialized(): void;
+  protected getSessionStore(): SessionStore;
+  protected getMessageStore(): MessageStore;
+  /** The agent environment the host supplied (CliProviderOptions.agentEnvironment). */
+  protected agentEnvironmentValues(): Record<string, string | undefined>;
+  protected applyWritableHomeDefaults(adapterEnv: Record<string, string | undefined>, workspaceRoot: string): Record<string, string | undefined>;
+}
+//#endregion
+//#region src/adapter-profile.d.ts
+/** Owns native profile revisions, launch controls, and prompt composition. */
+declare abstract class CliAdapterProfile<TConfig extends CliProviderConfig = CliProviderConfig> extends CliAdapterLifecycle<TConfig> {
+  /** Native profile lowering explicitly owned by this adapter, never inferred from a path. */
+  protected readonly profileHarness: HarnessId | undefined;
+  /** Trusted implementation capabilities; never read from caller-owned configuration. */
+  protected readonly supportsSecretProfileRevisions: boolean;
+  private readonly profileSecretProvider;
+  private readonly secretProfileRuntimeKeyProvider;
+  /** Private native preparation state; never part of a returned receipt. */
+  private readonly secretProfileRevisions;
+  constructor(options?: CliProviderOptions<TConfig>);
+  /** The exact child environment a turn uses; shared with prewarm paths. */
+  protected buildTurnEnvironment(executionConfig: TConfig, profilePlan: WorkspacePlanApplication | undefined, workspaceRoot: string, correlationHeaders: Readonly<Record<string, string>> | undefined): Record<string, string | undefined>;
+  /** A profile's declared executable tools, sealed in its revision, stand in for the app's own tool dirs on this launch's PATH tail. */
+  private bindProfileToolBinDirs;
+  protected bindExecutionCorrelation(environment: Record<string, string | undefined>, correlationHeaders: Readonly<Record<string, string>> | undefined): Record<string, string | undefined>;
+  /** Launcher controls this adapter OWNS on the spawn it starts; the pre-box verdict reads the same table. */
+  protected profileMaterializationBinds(): readonly BindableLaunchControl[];
+  /** Optional native instruction root. */
+  protected profileAgentDirectory(_workspaceRoot: string): string | undefined;
+  /** Provider transport bound into the private immutable revision and receipt. */
+  protected secretProfileProviderConfig(): Record<string, unknown> | undefined;
+  /** The values behind a secret revision's `{env:NAME}` config references, for an executor that serves those references itself. */
+  protected secretProfileReferences(application: WorkspacePlanApplication | undefined): Readonly<Record<string, string>> | undefined;
+  /** The one sealed session view repointed only while its native turn owns the queue. */
+  protected secretProfileSessionView(sessionId: string): {
+    launchRoot: string;
+    view: string;
+    subprocessUid: number;
+  };
+  /** Bind the private revision into the session's stable native cwd. */
+  protected bindSecretProfileSessionView(revisionWorkspaceDir: string, sessionId: string): string;
+  protected materializeProfileResources(inputProfile: AgentProfile | undefined, workspaceRoot: string, ownerId?: string, sessionId?: string, scope?: "turn" | "prewarm"): Promise<WorkspacePlanApplication | undefined>;
+  /** This spawn's plan: a strict refusal throws, a best-effort one is logged. */
+  protected planProfile(profile: AgentProfile, harness: HarnessId, agentInstructions?: boolean): WorkspacePlan;
+  private applyProfileResources;
+  /** Publish the profile as an executor-sealed revision for this session's subprocess identity, and record the receipt that binds it to the turn. */
+  private applySecretProfileRevision;
+  /** Prepare the same provider-composed native plan that execute() will check. */
+  preparePublicProfileRevision(input: AgentExecutionInput): Promise<Pick<_$_tangle_network_agent_profile_materialize0.ManagedWorkspaceManifest, "workspacePlanDigest" | "materializedDigest" | "conflicts"> & {
+    launchDigest: string;
+  }>;
+  /** Prepare the private native plan and return only an opaque executor receipt. */
+  prepareSecretProfileRevision(input: AgentExecutionInput): Promise<Omit<Pick<_$_tangle_network_agent_profile_materialize0.ManagedWorkspaceManifest, "workspacePlanDigest" | "materializedDigest" | "conflicts"> & {
+    launchDigest: string;
+  }, "materializedDigest" | "launchDigest"> & {
+    executorReceipt: string;
+  }>;
+  /** What the native health check's verdict depends on besides a revision's bytes: the executable that loads them. */
+  protected secretProfileVerificationScope(): string;
+  /** A secret receipt is issued only after the provider can load this revision. */
+  protected verifyPreparedSecretProfileRevision(_input: AgentExecutionInput, _application: WorkspacePlanApplication): Promise<void>;
+  /** Resolve the canonical profile used for this execution. */
+  protected resolveExecutionProfile(requestPrompt: string | undefined): AgentProfile | undefined;
+  /** Select the profile materialized for this exact turn. */
+  protected resolveExecutionProfileForInput(input: AgentExecutionInput): AgentProfile | undefined;
+  /** Compose the provider's user-message channel for this exact turn. */
+  protected composePromptText(promptText: string, input: AgentExecutionInput): string;
+  protected withProfilePlan(config: TConfig, profilePlan: WorkspacePlanApplication | undefined): TConfig;
+  /** A profile's addition precedes host context while preserving its harness prompt. */
+  protected resolveProfilePrompts(input: CliExecutionInput, plan: WorkspacePlanApplication | undefined, profile?: AgentProfile | undefined): {
+    systemPrompt: string | undefined;
+    appendSystemPrompt: string | undefined;
+  };
+  protected resolveProfileSystemPrompt(requestPrompt: string | undefined, profilePlan: WorkspacePlanApplication | undefined): string | undefined;
+  protected resolveProfileModel(requestModel: string | undefined): string | undefined;
+  protected mergeProfilePlanEnvironment(environment: Record<string, string | undefined>, profilePlan: WorkspacePlanApplication | undefined, preserveClearedVariables?: boolean): Record<string, string | undefined>;
+  /** Provider-owned allowlist for a generated revision control after env scrub. */
+  protected profilePlanMayFillClearedEnvironmentVariable(_name: string, _value: string): boolean;
+  protected preparePromptInput(parts: InputPart[], workspaceRoot: string, sessionId: string, options?: Parameters<typeof preparePromptInputParts>[3]): Promise<{
+    promptText: string;
+    persistedParts: _$_tangle_network_sdk_session_persistence0.MessagePart[];
+    attachments: PreparedAttachment[];
+  }>;
+  /** Attachment kinds this adapter forwards natively via buildExecArgs (argv flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]` text marker. */
+  protected nativeAttachmentKinds(): ReadonlyArray<"image" | "file">;
+}
+//#endregion
+//#region src/adapter-sessions.d.ts
+/** Owns durable transcripts, provider-native session bindings and the turn hooks providers override. */
+declare abstract class CliAdapterSessions<TConfig extends CliProviderConfig = CliProviderConfig> extends CliAdapterProfile<TConfig> {
+  createSession(options?: {
+    workspaceRoot?: string;
+  }): Promise<string>;
+  deleteSession(sessionId: string): Promise<boolean>;
+  /**
+   * Choose the native ID before its argv check, durable binding, and
+   * reservation. `input` and `timeoutMs` are the turn's, for a harness that
+   * decides here whether a process started earlier can serve it.
+   */
+  protected mintNativeSessionId(_context: {
+    sessionId: string;
+    workspaceRoot: string;
+    config: TConfig;
+    model?: string;
+    env: Record<string, string | undefined>;
+    signal: AbortSignal;
+    buildExecArgs: (nativeSessionId: string) => CliExecArgs;
+    input: AgentExecutionInput;
+    timeoutMs?: number;
+  }): string | Promise<string>;
+  /**
+   * Make a pre-minted native session durable before the CLI starts, for a
+   * harness that would otherwise write nothing until its first model reply
+   * (Pi). Called after the argv check and before spawn.
+   */
+  protected reserveNativeSession(_nativeSessionId: string, _context: {
+    workspaceRoot: string;
+  }): void | Promise<void>;
+  /**
+   * Verify that the provider can resume the native session binding. By
+   * default a session in a per-session store is resumable only when one of
+   * its declared files exists under the runtime HOME; a pre-minted id whose
+   * first turn died before the CLI wrote anything is not.
+   */
+  protected providerSessionIsResumable(runtimeHome: string, providerSessionId: string): boolean | Promise<boolean>;
+  /**
+   * Resolve the provider-native session id the next turn can resume, or
+   * undefined when no usable binding exists. Provider session data lives
+   * under the runtime home that minted it. A different home or missing
+   * provider storage cannot resume that session. A record without a home
+   * stamp predates the field, so treat it as same-home.
+   */
+  protected resumableProviderSessionId(session: PersistedSession): Promise<string | undefined>;
+  /** Bind a checkpoint-proven native session to this provider identity before execution. */
+  protected seedNativeSessionForResume(input: AgentExecutionInput, nativeSessionId: string): Promise<void>;
+  /**
+   * Forks the persisted session and copies its messages up to `messageId`.
+   * The forked record carries no provider session id, so its first turn
+   * starts a fresh CLI session and receives the copied transcript as
+   * execution-only context. Callers that address turns by their own session
+   * id (the sidecar) pass that id as `targetSessionId` so later turns find
+   * the forked record.
+   */
+  forkSession(options: {
+    sessionId: string;
+    messageId?: string;
+    workspaceRoot?: string;
+    targetSessionId?: string;
+  }): Promise<string>;
+  getMessages(options: GetMessagesOptions): Promise<BackendMessage[]>;
+  protected toBackendMessage(msg: PersistedMessage): BackendMessage;
+  protected buildAssistantParts(state: ExecutionState): MessagePart[];
+  protected extractToolInvocations(state: ExecutionState): AgentExecutionResult["toolInvocations"];
+  /**
+   * Names of tools this provider substitutes for a model tool call it could
+   * not parse into any real tool.
+   *
+   * Default: none. A provider that has one must say so, because these calls
+   * do not present as failures. OpenCode's `invalid` reports the parse error
+   * as its output and completes, so the repeated-failure guard reads a run of
+   * them as progress and clears its count on every one.
+   */
+  protected toolCallRepairToolNames(): ReadonlySet<string>;
+  /**
+   * Decide whether a non-zero exit should be treated as success.
+   *
+   * Default: no — any non-zero exit is a failure.
+   *
+   * Providers override this when their CLI has a known "exits non-zero
+   * on a successful run" quirk (e.g. kimi writes its resume trailer to
+   * stderr and exits non-zero even when the task completed cleanly).
+   *
+   * The decision is made AFTER the stream has drained and the exit
+   * code is known, so `state` reflects the full set of events the
+   * parser emitted (including any terminal `result` / `done` event).
+   * A safe heuristic is: "non-zero exit + stderr matches known trailer
+   * pattern + at least one assistant part was recorded".
+   */
+  protected isBenignNonZeroExit(_params: {
+    exitCode: number | null;
+    stderr: string;
+    state: ExecutionState;
+  }): boolean;
+  /** Observe settled process output before success/failure classification. */
+  protected afterCliProcessExit(_params: {
+    state: ExecutionState;
+    stderr: string;
+    exit: CliExitResult;
+    workspaceRoot: string;
+    env: Record<string, string | undefined>;
+    onEvent?: (event: StreamEvent) => void;
+  }): Promise<void>;
+  protected executionOutcome(_state: ExecutionState, _input: AgentExecutionInput): AgentExecutionOutcome | Promise<AgentExecutionOutcome>;
+  /**
+   * Format a message for stdin input.
+   */
+  protected formatStdinMessage(message: string): string;
+}
+//#endregion
+//#region src/adapter-mcp.d.ts
+/** Owns serialized MCP mutations and provider-native MCP status commands. */
+declare abstract class CliAdapterMcp<TConfig extends CliProviderConfig = CliProviderConfig> extends CliAdapterSessions<TConfig> {
+  /** Budget for one `mcp list` run, CLI startup and every server's handshake. */
+  protected readonly mcpStatusTimeoutMs: number;
+  private mcpMutationChain;
+  addMcp(name: string, config: McpConfig): Promise<void>;
+  private addMcpSerialized;
+  getMcpStatus(): Promise<McpStatusResponse>;
+  ensureMcps(required: Record<string, McpConfig>): Promise<void>;
+  /** Build MCP add command arguments. Override for CLI-specific syntax. */
+  protected buildMcpAddArgs(name: string, config: McpConfig): string[];
+  /**
+   * Build MCP list command arguments. Return null if not supported.
+   */
+  protected buildMcpListArgs(): string[] | null;
+  /** Parse MCP list output. Override for CLI-specific output format. */
+  protected parseMcpListOutput(output: string): McpStatusResponse;
+}
+//#endregion
+//#region src/turn-observer.d.ts
+interface TurnObserverOptions {
+  provider: string;
+  state: ExecutionState;
+  sessionId: string;
+  getRuntimeHome: () => string | undefined;
+  recorder: SdkHostServices["recorder"];
+  getSessionStore: () => SessionStore;
+  logger: CliProviderLogger;
+  repairToolNames: ReadonlySet<string>;
+  onEvent: ((event: StreamEvent) => void) | undefined;
+}
+/**
+ * Observes one turn's provider stream: keeps the execution state current,
+ * persists parts and the provider session id as they arrive, stops a turn
+ * that repeats a rejected tool call, and pings while the stream is quiet.
+ */
+declare class TurnObserver {
+  private readonly options;
+  providerSessionPersistence: Promise<void>;
+  providerSessionPersistenceError: unknown;
+  nativeSessionObserved: boolean;
+  private readonly partUpdates;
+  private readonly liveness;
+  private readonly repeatedToolFailureGuard;
+  private killForRepeatedToolFailure;
+  constructor(options: TurnObserverOptions);
+  flushPartUpdates(): Promise<void>;
+  attachProcess(process: CliTurnProcess): void;
+  startLiveness(executionSignal: AbortSignal, startTime: number): NodeJS.Timeout;
+  readonly onEvent: (event: StreamEvent) => void;
+  private observeToolPart;
+  private persistProviderSession;
+}
+//#endregion
+//#region src/execution-state.d.ts
+/** Creates a new execution state. */
+declare function createExecutionState(sessionId?: string, messageId?: string, workspaceRoot?: string): ExecutionState;
+//#endregion
+//#region src/profile-config.d.ts
+/**
+ * Per-turn credential delivery wins over host-env resolution; the host box
+ * environment stays the fallback for references the turn did not deliver.
+ * With no turn secrets the host provider is returned unchanged, so the
+ * overlay adds no behavior to executions that never asked for it.
+ */
+declare function runtimeSecretsOverlay(runtimeSecrets: Record<string, string> | undefined, fallback: AgentProfileSecretProvider): AgentProfileSecretProvider;
+//#endregion
+//#region src/base-adapter.d.ts
+/** Base adapter for CLI-based AI agent providers. */
+declare abstract class CliProviderAdapterBase<TConfig extends CliProviderConfig = CliProviderConfig, TEvent = unknown> extends CliAdapterMcp<TConfig> implements SdkProviderAdapter {
+  protected readonly supportsManagedQuote: boolean;
+  execute(input: AgentExecutionInput, services: SdkHostServices, onEvent?: (event: StreamEvent) => void): Promise<AgentExecutionResult>;
+  private executeInternal;
+  protected completeTurn(params: {
+    input: AgentExecutionInput;
+    sessionId: string;
+    state: ExecutionState; /** The CLI turn's observer, whose coalesced part updates drain first. */
+    observer?: TurnObserver;
+    recorder: SdkHostServices["recorder"];
+    providerMessageIds: ReturnType<typeof readProviderMessageIds>;
+    profilePlan?: WorkspacePlanApplication;
+    startTime: number;
+    endTime: number;
+  }): Promise<AgentExecutionResult>;
+  /** Report and record a failed turn, then throw its error. */
+  private failCliTurn;
+  protected openTurnSession(input: AgentExecutionInput, recorder: SdkHostServices["recorder"], onEvent: ((event: StreamEvent) => void) | undefined): Promise<{
+    providerMessageIds: _$_tangle_network_sdk_session_persistence0.ProviderMessageIds | undefined;
+    cached: AgentExecutionResult;
+    sessionId: string;
+    providerSessionId: string | undefined;
+    transcriptReplay: "fork" | "restored" | undefined;
+  } | {
+    providerMessageIds: _$_tangle_network_sdk_session_persistence0.ProviderMessageIds | undefined;
+    cached: undefined;
+    sessionId: string;
+    providerSessionId: string | undefined;
+    transcriptReplay: "fork" | "restored" | undefined;
+  }>;
+  protected materializeTurnProfile(input: AgentExecutionInput, sessionId: string): Promise<{
+    executionProfile: AgentProfile | undefined;
+    profilePlan: WorkspacePlanApplication | undefined;
+  }>;
+  protected recordTurnPrompt(input: AgentExecutionInput, session: {
+    sessionId: string;
+    transcriptReplay: "fork" | "restored" | undefined;
+    providerMessageIds: ReturnType<typeof readProviderMessageIds>;
+  }, recorder: SdkHostServices["recorder"], attachmentOptions?: {
+    nativeAttachmentKinds?: ReadonlyArray<"image" | "file">;
+    inlineImageBudgetBytes?: number;
+  }): Promise<{
+    preparedInput: {
+      promptText: string;
+      persistedParts: _$_tangle_network_sdk_session_persistence0.MessagePart[];
+      attachments: PreparedAttachment[];
+    };
+    promptText: string;
+  }>;
+  /** Resolve this turn's config, environment and argv, and check them against the session contract. */
+  private planLaunch;
+  /** Reserve and announce the native session id a pre-minted harness already has. */
+  private bindNativeSession;
+  private runCliTurn;
+  protected abstract buildExecArgs(params: {
+    message: string;
+    config: TConfig; /** Canonical identity for providers whose native config binds HTTP headers. */
+    correlationHeaders?: Readonly<Record<string, string>>;
+    model?: string;
+    sessionId?: string; /** Set on a new session of a harness whose contract pre-mints its id: the adapter MUST start the native session under this id with the contract's identity args (e.g. */
+    mintedSessionId?: string;
+    workspaceRoot: string;
+    systemPrompt?: string; /** The plan's ADDITIVE prompt intent: the harness's own prompt stays in force and this text is added after it. */
+    appendSystemPrompt?: string;
+    attachments?: PreparedAttachment[]; /** Preserve the origin of launch flags when a CLI needs one selected agent. */
+    profilePlan?: WorkspacePlanApplication;
+  }): CliExecArgs;
+  protected abstract createEventParser(state: ExecutionState, onEvent?: (event: StreamEvent) => void): StreamParserConfig<TEvent>;
+  /** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
+  private turnSpawnConfig;
+  /** The launch one turn would make, without starting it: the spawn config (argv, cwd, environment, identity or launcher). */
+  prepareLaunch(input: CliExecutionInput, options?: {
+    providerSessionId?: string;
+  }): Promise<PreparedCliLaunch>;
+  protected spawnExecutionProcess(request: CliTurnSpawn<TConfig, TEvent>): CliTurnProcess | Promise<CliTurnProcess>;
+}
+//#endregion
+//#region src/acp-session-adapter.d.ts
+declare abstract class AcpProviderAdapterBase<TConfig extends AcpBridgeConfig, TTurn extends AcpTurn<TConfig> = AcpTurn<TConfig>> extends CliProviderAdapterBase<TConfig> {
+  protected abstract readonly loadsNativeSessions: boolean;
+  private readonly acpSessions;
+  protected abstract resolveTurn(input: AgentExecutionInput): TTurn;
+  protected abstract processSpec(turn: TTurn, context: {
+    sessionId: string;
+    workspaceRoot: string;
+  }): AcpProcessSpec | Promise<AcpProcessSpec>;
+  protected abstract spawnFailureMessage(failure: {
+    message: string;
+    missingBinary: boolean;
+  }, turn: TTurn): string;
+  protected abstract promptBlocks(input: AgentExecutionInput, prepared: {
+    promptText: string;
+    persistedParts: MessagePart[];
+    attachments: PreparedAttachment[];
+  }, turn: TTurn): AcpContentBlock[];
+  protected spawnBridge(request: AcpBridgeSpawn): RpcBridge;
+  protected checkAgentProtocolVersion(_advertised: number, _turn: TTurn): void;
+  protected resumeSessionId(): string | undefined;
+  protected onSessionOpened(_bridge: RpcBridge, _acpSessionId: string, _turn: TTurn, _options: {
+    timeoutMs: number;
+  }): Promise<void>;
+  protected onBridgeSpawned(_bridge: RpcBridge, _sessionId: string, _turn: TTurn): void;
+  protected beginTurn(_sessionId: string, _input: AgentExecutionInput, _onEvent: ((event: StreamEvent) => void) | undefined): () => void;
+  protected onToolFailed(_sessionId: string, _failureText: string | undefined): StreamEvent[];
+  protected takeTurnFailure(_sessionId: string): Error | undefined;
+  protected onSessionEvicted(_sessionId: string): void;
+  protected turnLogContext(_turn: TTurn): Record<string, unknown>;
+  execute(input: AgentExecutionInput, services: SdkHostServices, onEvent?: (event: StreamEvent) => void): Promise<AgentExecutionResult>;
+  protected interruptStuckTurn(): void;
+  protected acknowledgeLostTurn(_detail: string): Promise<boolean>;
+  private acquireAcpSession;
+  private checkProtocolVersion;
+  private openNativeSession;
+  private promptAcpSession;
+  private scheduleIdleReap;
+  private cancelIdleReap;
+  protected evictAcpSession(sessionId: string, reason: string): void;
+  protected evictAcpSessionsWhere(matches: (processKey: string) => boolean, reason: string): void;
+  private mapAcpUpdate;
+  private mapToolStatus;
+  private formatBridgeError;
+  private sessionSetupError;
+  healthCheck(): Promise<boolean>;
+  shutdown(): Promise<void>;
+  addMcp(_name: string, _config: McpConfig): Promise<void>;
+  getMcpStatus(): Promise<McpStatusResponse>;
+  protected buildExecArgs(): never;
+  protected buildExecEnv(_config: TConfig): Record<string, string | undefined>;
+  protected createEventParser(): never;
+  protected buildMcpAddArgs(_name: string, _config: McpConfig | LocalMcpConfig): string[];
+}
+//#endregion
+//#region src/errors.d.ts
+/**
+ * A session's persisted transcript exists but could not be read for replay
+ * into the fresh provider session this turn starts. The turn fails instead
+ * of serving an empty conversation under the same session id. The sidecar's
+ * client-visible whitelist matches on `code`; the wire contract is the
+ * duck-typed field, not class identity.
+ */
+declare class SessionRehydrationError extends Error {
+  readonly code = "session_rehydration_failed";
+  constructor(message: string, cause: unknown);
+}
+/**
+ * Marks a turn failure the adapter raised before it planned the launch:
+ * session preparation or profile materialization refused, so no native
+ * process received this turn and it left no native transcript to copy.
+ * Only the adapter marks, on the error object it caught; error text never
+ * does, so a provider message that reads the same is not marked.
+ */
+declare function rejectNotLaunched<E>(error: E): never;
+/** Whether this error is one the adapter raised before launching anything. */
+declare function wasNeverLaunched(error: Error): boolean;
+//#endregion
+//#region src/event-parsers.d.ts
+/**
+ * Parser for harnesses that print one JSON event per line (claude-code,
+ * codex, amp, factory-droids). Values that fail `accept` are logged and
+ * dropped; unparseable lines become a `PARSE_ERROR` warning. The first event
+ * `isReady` accepts reports the CLI's own start time as `cli_initialize`,
+ * measured from parser creation, which immediately precedes the spawn.
+ */
+declare function jsonEventParser<TEvent>(logger: CliProviderLogger, onEvent: ((event: StreamEvent) => void) | undefined, spec: {
+  /** Names the harness in the "Received non-<label> event" warning. */label: string;
+  accept(raw: unknown): raw is TEvent;
+  map(event: TEvent): StreamEvent[];
+  isReady?(event: TEvent): boolean;
+}): StreamParserConfig<TEvent>;
+/** What a plaintext harness's line mapper records about the response. */
+interface PlaintextResponse {
+  /** Appends one line of the assistant's reply. */
+  text(line: string): void;
+  /** Records an error line; a turn with errors and no reply fails with the last one. */
+  error(message: string): void;
+}
+/**
+ * Parser for harnesses that print their reply as plain stdout lines (hermes,
+ * nanoclaw). Lines classify into provider events; the reply is
+ * emitted as one text part when stdout closes. A turn that printed errors
+ * but no reply ends `failed` with the last error instead of an empty
+ * `completed`.
+ */
+declare function plaintextResponseParser<TEvent>(state: ExecutionState, onEvent: ((event: StreamEvent) => void) | undefined, spec: {
+  classify(line: string): TEvent | null;
+  map(event: TEvent, response: PlaintextResponse): StreamEvent[]; /** Failure detail when errors were seen but none carried a message. */
+  emptyFailureDetail: string;
+}): StreamParserConfig<TEvent>;
+//#endregion
+//#region src/execution-request-headers.d.ts
+declare const EXECUTION_ID_HEADER = "X-Tangle-Execution-ID";
+/** Router column that joins a model request to the turn trace that caused it. */
+declare const EXECUTION_TRACE_HEADER = "X-Tangle-Trace-ID";
+declare const MANAGED_QUOTE_VERSION_HEADER = "X-Tangle-Managed-Quote-Version";
+/** Every header a turn's correlation may set, lowercased. */
+declare const EXECUTION_CORRELATION_HEADERS: string[];
+/**
+ * Capture diagnostic identity without forwarding caller-supplied transport headers.
+ * `traceId` is the turn's trace id; a value no header can carry is omitted,
+ * because a trace is diagnostic and must never refuse the run.
+ */
+declare function executionCorrelationHeaders(binding: InteractionExecutionBinding | undefined, traceId?: string, quoteVersion?: string): Readonly<Record<string, string>> | undefined;
+//#endregion
+//#region src/file-parts.d.ts
+/** Infers a MIME type from a filename's extension. Unknown/no extension → undefined. */
+declare function inferMediaType(filename: string): string | undefined;
+/**
+ * Builds the canonical URL for a file part. A data URI passes through
+ * verbatim; a path is returned unchanged if it already carries a recognized
+ * scheme, else converted to a percent-encoded `file://` URL.
+ *
+ * Callers must pass an already-resolved absolute path — `trackFilePart`
+ * resolves relative paths (or drops the observation when it can't) before
+ * ever reaching here, so a relative path arriving at this layer means a
+ * caller bypassed that resolution. We throw rather than mint a malformed
+ * `file://` URL (e.g. `file://./chart.png`, whose authority is `.`).
+ */
+declare function buildFileUrl(input: {
+  path?: string;
+  dataUri?: string;
+}): string;
+/** Deterministic, stable part id for a file announced within one message. */
+declare function deterministicFilePartId(messageId: string, key: string): string;
+declare function deriveFilePart(input: {
+  path: string;
+  messageId: string;
+  workspaceRoot?: string;
+}): {
+  id: string;
+  key: string;
+  filename: string;
+  mediaType?: string;
+  url: string;
+} | null;
+declare function trackFilePart(state: ExecutionState, args: {
+  path?: string;
+  dataUri?: string;
+  filename?: string;
+  mediaType?: string;
+  changeKind?: "add" | "update" | "delete";
+}): {
+  id: string;
+  filename?: string;
+  mediaType?: string;
+  url: string;
+} | null;
+//#endregion
+//#region src/interaction-mcp-server.d.ts
+/**
+ * Compatibility adapter for callers that used the old optional `onStop` field.
+ * Agent Core owns the MCP server, retry-safe transport, and teardown lifecycle.
+ */
+type InteractionMcpServerConfig$1 = Omit<InteractionMcpServerConfig, "onStop"> & {
+  onStop?: InteractionMcpServerConfig["onStop"];
+};
+declare class InteractionMcpServer$1 extends InteractionMcpServer {
+  constructor(config: InteractionMcpServerConfig$1);
+}
+//#endregion
+//#region src/interaction-support.d.ts
+declare class McpInteractionSupport {
+  /** MCP server name; tool names become `mcp__<name>__<tool>`. */
+  private readonly serverName;
+  /**
+   * The {@link InteractionKind} values this harness wires (e.g.
+   * `[InteractionKind.Question, InteractionKind.Plan]`). Passed as the literal
+   * `InteractionKind.*` values so the coverage/live-e2e CI gates that grep
+   * `adapter.ts` see the declaration.
+   */
+  private readonly kinds;
+  /** The shared emit → block → respond → fail-closed round-trip. */
+  readonly broker: InteractionBroker;
+  private activeServer?;
+  private terminalPlan?;
+  constructor(/** MCP server name; tool names become `mcp__<name>__<tool>`. */
+
+  serverName: string,
+  /**
+   * The {@link InteractionKind} values this harness wires (e.g.
+   * `[InteractionKind.Question, InteractionKind.Plan]`). Passed as the literal
+   * `InteractionKind.*` values so the coverage/live-e2e CI gates that grep
+   * `adapter.ts` see the declaration.
+   */
+
+  kinds: readonly string[]);
+  /** The interaction kinds to advertise from `getCapabilities().interactions`. */
+  capabilityKinds(): string[];
+  /** The active per-execution server (its `url`/`token`), once started. */
+  get server(): InteractionMcpServer | undefined;
+  /**
+   * Start a per-execution server bound to 127.0.0.1 with an ephemeral bearer
+   * token, registering only the enabled tools. `emit` is the live event sink;
+   * broker-backed tools block on an answer, while plans emit only after their
+   * terminal confirmation. Returns the server for CLI injection.
+   */
+  start(sessionId: string, binding: InteractionExecutionBinding, emit?: (event: StreamEvent) => void, plan?: {
+    planHost: SdkPlanHost;
+    providerState: () => PlanProviderState;
+    onCommitted?: (submitted: DurablePlan) => void | Promise<void>;
+  }): Promise<InteractionMcpServer>;
+  confirmSubmittedPlan(): Promise<DurablePlan>;
+  withdrawSubmittedPlan(reason: string): Promise<void>;
+  /** Close the request boundary before inspecting or withdrawing its plan. */
+  drainSubmittedPlan(sessionId: string): Promise<void>;
+  /**
+   * Fail-closed every pending interaction for the session, then stop the server.
+   * `failSession` runs FIRST so any request still blocked in the server resolves
+   * (deny) before close, and the whole thing swallows errors — it runs in adapter
+   * `finally` blocks and must never mask the turn's real error.
+   */
+  stop(sessionId: string): Promise<void>;
+  /**
+   * Route an inbound live `/interactions` response for permission or question.
+   * Plans are durable records and never enter this response channel.
+   */
+  respond(response: InteractionResponse): boolean;
+}
+//#endregion
+//#region src/mcp-commands.d.ts
+/** A local MCP server's argv: the `command` array, or `command` then `args`. */
+declare function localMcpArgv(config: McpConfig): string[];
+/**
+ * A local MCP server's environment, from `environment` (agent-backend-types)
+ * or `env` (agent-interface): reading one drops the other family's variables.
+ */
+declare function localMcpEnv(config: McpConfig): Record<string, string> | undefined;
+declare const isLocalMcpConfig: (c: McpConfig) => c is LocalMcpConfig;
+//#endregion
+//#region src/metering.d.ts
+type CliTokenUsage = NonNullable<ExecutionState["tokenUsage"]>;
+declare function readCliTokenUsage(raw: unknown): CliTokenUsage | undefined;
+declare function recordCliTokenUsage(state: ExecutionState, ...sources: unknown[]): boolean;
+/**
+ * Adds one usage report to the running total instead of replacing it.
+ *
+ * For a CLI that reports usage PER TURN (pi) rather than once per run,
+ * `recordCliTokenUsage` would leave the execution billed as its final turn
+ * alone. Use this wherever a single execution can produce more than one usage
+ * report; use `recordCliTokenUsage` when the CLI emits one cumulative total.
+ *
+ * Returns true when a usage report was found in `sources` and folded in.
+ */
+declare function accumulateCliTokenUsage(state: ExecutionState, ...sources: unknown[]): boolean;
+declare function parseCliUsageLine(line: string): Record<string, unknown> | undefined;
+//#endregion
+//#region src/secret-native-proof.d.ts
+type BinaryLaunch = Pick<CliSpawnConfig, "command" | "cwd" | "env" | "signal" | "isolatedIdentity"> & {
+  inheritEnv: boolean;
+};
+/** Prove an immutable executable, under the launch's own identity and environment. */
+declare function provenStoreBinary(expected: string, config: BinaryLaunch): Promise<string>;
+/** A reported version alone cannot establish an immutable executable. */
+declare function isTrustedStoreBinary(realpath: string): boolean;
+/** The real file a launch of `command` executes under `pathEnv`. */
+declare function resolveExecutableRealpath(command: string, pathEnv: string | undefined): string | undefined;
+type SealedEntry = readonly [relative: string, mode: number, directory: boolean];
+declare const SEALED_NATIVE_HOME_LAYOUT: {
+  readonly codex: readonly [readonly [".", 1016, true], readonly [".codex", 1016, true], readonly [".agents", 360, true], readonly [".codex/skills", 360, true], readonly [".codex/rules", 360, true], readonly [".codex/config.toml", 288, false], readonly [".codex/AGENTS.md", 288, false], readonly [".codex/AGENTS.override.md", 288, false], readonly [".codex/hooks.json", 288, false]];
+  readonly opencode: readonly [readonly [".", 456, true], readonly [".opencode", 360, true]];
+};
+declare function assertSealedNativeHome(home: string, gid: number, layout: readonly SealedEntry[]): void;
+type RefusalDetail = {
+  path?: string;
+  exitCode?: number | null;
+} & Partial<Record<"expected" | "actual", string | number | boolean>>;
+/** Only selected structural facts enter a refusal; payloads and causes never do. */
+declare function refuseSecretLaunch(reason: string, {
+  path,
+  expected,
+  actual,
+  exitCode
+}?: RefusalDetail): never;
+//#endregion
+//#region src/reasoning-effort.d.ts
+/** The argv carrying `nativeReasoningControl` for a profile effort, or none. */
+declare function nativeEffortArgs(harness: HarnessType, effort: ReasoningEffort | undefined): string[];
+/**
+ * Kimi stays local until #14839: the sandbox ships kimi-cli 1.49.0 as
+ * `kimi-code` (binary `--thinking`/`--no-thinking`) while other paths run
+ * kimi-code 2.x. A model whose name has "thinking" or "reason" always thinks
+ * (kimi-cli `derive_model_capabilities`), so `off` throws there.
+ */
+declare function kimiThinkingArgs(level: ReasoningEffort | undefined, modelId?: string | null): string[];
+//#endregion
+//#region src/reasoning-parts.d.ts
+/**
+ * Assigns a stable part id and an append-only delta to a reasoning block
+ * emission, absorbing provider replay/growth patterns:
+ *
+ * - text exactly matches an already-tracked block → `null` (duplicate
+ *   delivery, e.g. a final assistant message replaying streamed content —
+ *   emit nothing). Byte-identical distinct blocks therefore dedupe to one
+ *   part; safer than duplicate-part spam.
+ * - text extends the most recent block → same part id, delta = the suffix
+ *   (cumulative re-emission of a growing block).
+ * - otherwise → a new block: fresh part id, delta = the full text, so
+ *   consumers can be pure appenders (prev text for a fresh id is empty).
+ */
+declare function trackReasoningBlock(state: ExecutionState, blockText: string): {
+  partId: string;
+  text: string;
+  delta: string;
+  isNewBlock: boolean;
+} | null;
+//#endregion
+//#region src/repeated-tool-failure.d.ts
+/** What a tripped guard reports to the caller. */
+interface RepeatedToolFailure {
+  /** The tool the model meant to call. */
+  tool: string;
+  /** Why the call was rejected, in the tool's own words. */
+  detail: string;
+  /** How many times in a row this exact rejection came back. */
+  count: number;
+}
+interface RepeatedToolFailureGuardOptions {
+  /** Identical failures in a row that trip the guard. At least 1. */
+  limit: number;
+  /**
+   * Tool names a provider substitutes for a model call it could not parse
+   * into any real tool.
+   *
+   * These do not present as failures. OpenCode rewrites an unparseable call to
+   * a tool named `invalid` that carries the parse error as its OUTPUT and
+   * completes. A guard that reads only `status` scores a run of them as
+   * progress and clears its count on every one.
+   */
+  repairToolNames?: ReadonlySet<string>;
+}
+declare function createRepeatedToolFailureGuard(options: RepeatedToolFailureGuardOptions): {
+  /**
+   * Feed one tool part. Returns the trip on the call that reaches the limit,
+   * and `undefined` every other time. A tripped guard stays tripped and
+   * reports once, so a caller can kill the turn without racing the events
+   * still in flight behind it.
+   */
+  observe(part: Pick<ToolPart, "id" | "tool" | "state">): {
+    count: number;
+    tool: string;
+    detail: string;
+  } | undefined;
+};
+//#endregion
+//#region src/secret-profile-scope.d.ts
+type ScopeOwner = {
+  readonly proxy?: SecretProfileMcpCredentialProxy;
+};
+declare function secretMcpScope(sessionId: string, uid: number | undefined, owner?: ScopeOwner): string;
+declare function forgetSessionScopes(target: {
+  sessionId: string;
+} | {
+  owner: ScopeOwner;
+}): Promise<void>;
+//#endregion
+//#region src/stream-parts.d.ts
+/**
+ * The text, reasoning and tool part emissions every stream-json harness
+ * shares. A provider's event mapper decodes its own wire shape, then calls
+ * these so part ids, buffers, tool timing and processing phases stay one
+ * implementation across claude-code, codex, kimi, amp and factory-droids.
+ */
+/**
+ * Records the CLI's native session id on the turn and announces it: the
+ * generic `session.updated` plus the provider-attributed observation the
+ * turn observer keys evidence on.
+ */
+declare function sessionObservedEvents(state: ExecutionState, provider: string, sessionId: string): StreamEvent[];
+/** Correlation fields every emitted part carries. */
+declare function streamPartBase(state: ExecutionState, partId?: string): {
+  id: string;
+  sessionID: string;
+  messageID: string;
+};
+/**
+ * Appends a text delta to the turn's single text part. The first text of a
+ * turn also signals the `generating` phase.
+ */
+declare function textDeltaEvents(state: ExecutionState, delta: string): StreamEvent[];
+/** The whole reply as one text part, for harnesses that do not stream. */
+declare function finalTextEvent(state: ExecutionState, text: string): StreamEvent;
+/**
+ * Applies a cumulative text frame (the whole assistant text so far). Only the
+ * suffix past the buffer is emitted; a frame that does not extend the buffer
+ * replaces it and is emitted whole.
+ */
+declare function textSnapshotEvents(state: ExecutionState, text: string): StreamEvent[];
+/**
+ * Records a thinking block under a stable part id (see trackReasoningBlock).
+ * With `signalPhase`, the turn's first block also signals `thinking`.
+ */
+declare function reasoningEvents(state: ExecutionState, thinking: string, options: {
+  signalPhase: boolean;
+}): StreamEvent[];
+/** Registers a running tool call and emits its running part. */
+declare function toolStartEvents(state: ExecutionState, call: {
+  id: string;
+  name: string;
+  input: unknown;
+}): StreamEvent[];
+/**
+ * Completes a tracked tool call. A successful result emits `afterSuccess`
+ * (file parts the provider detected) and then the `tool-result` phase. A
+ * result for an untracked call is a warning.
+ */
+declare function toolResultEvents(state: ExecutionState, result: {
+  id: string;
+  content: unknown;
+  isError: boolean;
+  metadata?: Record<string, unknown>;
+  afterSuccess?: (toolCall: ToolCallState) => StreamEvent[];
+}): StreamEvent[];
+//#endregion
+//#region src/terminal-plan-support.d.ts
+type TerminalPlanSupportOptions = {
+  planHost: SdkPlanHost;
+  providerState: () => PlanProviderState;
+  emit?: (event: StreamEvent) => void;
+  onCommitted?: (plan: DurablePlan) => void | Promise<void>;
+};
+/** One-shot durable plan submission for a single provider turn. */
+declare class TerminalPlanSupport {
+  private readonly options;
+  private committed?;
+  private submittedBody?;
+  private inFlight?;
+  private confirmInFlight?;
+  private confirmed;
+  constructor(options: TerminalPlanSupportOptions);
+  get plan(): DurablePlan | undefined;
+  /** Wait for a submission already accepted by this turn before failure cleanup. */
+  settleSubmission(): Promise<void>;
+  submit(body: string, sourceToolCallId: string): Promise<DurablePlan>;
+  confirm(): Promise<DurablePlan>;
+  withdraw(reason: string): Promise<void>;
+}
+//#endregion
+//#region src/writable-home.d.ts
+/** HOME and the XDG base directories a CLI resolves under it. */
+declare function homeXdgEnv(home: string): {
+  HOME: string;
+  XDG_CONFIG_HOME: string;
+  XDG_CACHE_HOME: string;
+  XDG_DATA_HOME: string;
+  XDG_STATE_HOME: string;
+};
+//#endregion
+export { deterministicFilePartId as $, SecretProfileMcpCredentialProxy as $t, isTrustedStoreBinary as A, AcpTurn as At, localMcpEnv as B, InteractionToggleKind as Bt, createRepeatedToolFailureGuard as C, AcpBridgeConfig as Ct, NATIVE_SESSION_CONTRACTS$1 as D, AcpNewSessionResult as Dt, nativeEffortArgs as E, AcpInitializeResult as Et, parseCliUsageLine as F, CliProviderLogger as Ft, InteractionMcpServerConfig$1 as G, interactionToggleEnabled as Gt, AskUserBridge as H, ToolCallState as Ht, readCliTokenUsage as I, CliProviderOptions as It, RequestPlanBridge as J, turnInteractionEnabled as Jt, PermissionPromptBridge as K, readEphemeralContext as Kt, recordCliTokenUsage as L, EphemeralContextInput as Lt, refuseSecretLaunch as M, CliExecArgs as Mt, resolveExecutableRealpath as N, CliExecutionInput as Nt, SEALED_NATIVE_HOME_LAYOUT as O, AcpPromptResult as Ot, accumulateCliTokenUsage as P, CliProviderConfig as Pt, deriveFilePart as Q, SECRET_REFERENCE_PREFIX as Qt, isLocalMcpConfig as R, ExecutionState as Rt, RepeatedToolFailureGuardOptions as S, ACP_PROTOCOL_VERSION as St, kimiThinkingArgs as T, AcpInitializeParams as Tt, DEFAULT_INTERACTION_MCP_SERVER_NAME as U, TurnEndReason as Ut, McpInteractionSupport as V, PerTurnInteractionInput as Vt, InteractionMcpServer$1 as W, enabledInteractionKinds as Wt, interactionMcpToolName as X, withTurnInteractions as Xt, brokerInteractionTools$1 as Y, withEphemeralContext as Yt, buildFileUrl as Z, SECRET_REFERENCE as Zt, toolResultEvents as _, createExecutionState as _t, PERMISSION_DECISION_TIMEOUT_MS as a, requireRecord as an, MANAGED_QUOTE_VERSION_HEADER as at, secretMcpScope as b, PreparedCliLaunch as bt, homeXdgEnv as c, servableMcpServer as cn, jsonEventParser as ct, finalTextEvent as d, AcpBridgeSpawn as dn, SessionRehydrationError as dt, SecretProfileMcpServer as en, inferMediaType as et, reasoningEvents as f, AcpProcessSpec as fn, rejectNotLaunched as ft, textSnapshotEvents as g, runtimeSecretsOverlay as gt, textDeltaEvents as h, CliProviderAdapterBase as ht, InteractionHttpBridge as i, joinQueue as in, EXECUTION_TRACE_HEADER as it, provenStoreBinary as j, acpContentText as jt, assertSealedNativeHome as k, AcpSessionUpdateParams as kt, TerminalPlanSupport as l, servableStdioServer as ln, plaintextResponseParser as lt, streamPartBase as m, AcpProviderAdapterBase as mt, HarnessId$1 as n, isLoopbackEndpoint as nn, EXECUTION_CORRELATION_HEADERS as nt, WorkspacePlanApplication$1 as o, resolveReferences as on, executionCorrelationHeaders as ot, sessionObservedEvents as p, spawnAcpBridge as pn, wasNeverLaunched as pt, RequestPermissionBridge as q, turnEndReason as qt, InteractionBroker$1 as r, isPlainRecord as rn, EXECUTION_ID_HEADER as rt, codexDeveloperInstructionArgs as s, secretSessionTurnQueue as sn, PlaintextResponse as st, CODEX_DISABLED_FEATURE_ARGS as t, assertSealedNativeSearchPath as tn, trackFilePart as tt, TerminalPlanSupportOptions as u, untilSettledOrAborted as un, InvalidAttachmentError as ut, toolStartEvents as v, CliTurnProcess as vt, trackReasoningBlock as w, AcpContentBlock as wt, RepeatedToolFailure as x, ACP_MIN_PROTOCOL_VERSION as xt, forgetSessionScopes as y, CliTurnSpawn as yt, localMcpArgv as z, InteractionToggleConfig as zt };
+//# sourceMappingURL=index-BpO3fvbf.d.mts.map