@themoltnet/pi-extension 0.36.2 → 0.37.1

package/dist/index.d.ts

@@ -1,1369 +1,16 @@
-import { AgentSession } from '@earendil-works/pi-coding-agent';
-import { Api } from '@earendil-works/pi-ai';
-import { BashOperations } from '@earendil-works/pi-coding-agent';
-import { CommandAnalysis } from '@themoltnet/shell-command-analyzer';
-import { connect } from '@themoltnet/sdk';
-import { EditOperations } from '@earendil-works/pi-coding-agent';
+import { createPiOtelExtension } from '@themoltnet/pi-runtime';
 import { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import { ExtensionContext } from '@earendil-works/pi-coding-agent';
-import { LoadSkillsResult } from '@earendil-works/pi-coding-agent';
-import { Model } from '@earendil-works/pi-ai';
-import { Readable } from 'node:stream';
-import { ReadOperations } from '@earendil-works/pi-coding-agent';
-import { ShellCommandAnalyzer } from '@themoltnet/shell-command-analyzer';
-import { Skill } from '@earendil-works/pi-coding-agent';
-import { Static } from 'typebox';
-import { TObject } from 'typebox';
-import { ToolCallEvent } from '@earendil-works/pi-coding-agent';
-import { ToolDefinition } from '@earendil-works/pi-coding-agent';
-import { TSchema } from 'typebox';
-import { Type } from 'typebox';
-import { VM } from '@earendil-works/gondolin';
-import { WriteOperations } from '@earendil-works/pi-coding-agent';
+import { PiOtelOptions } from '@themoltnet/pi-runtime';
+import { ProviderErrorRetryUi } from '@themoltnet/pi-runtime';
 
-/**
- * Apply agent env vars to the host process, mirroring `moltnet start`.
- * Resolves relative paths (e.g. GIT_CONFIG_GLOBAL) against the repo root.
- */
-export declare function activateAgentEnv(agentEnv: Record<string, string | undefined>, repoRoot: string): void;
-
-/** Minimal shape of the SDK method the resolver needs (keeps deps testable). */
-export declare interface AllowedToolsClient {
-    runtimeProfiles: {
-        allowedTools: (profileId: string, options: {
-            teamId: string;
-        }) => Promise<{
-            enforcement: ToolEnforcement;
-            allowedTools: string[];
-        }>;
-    };
-}
-
-/**
- * Construct an `AgentSession`. By default it is in-memory; callers may opt
- * parent sessions into daemon-owned file persistence via `sessionPersistence`.
- * The caller is responsible for eventually invoking `session.prompt(...)` and
- * for tearing down — the helper does no lifecycle management beyond
- * construction.
- */
-export declare function buildAgentSession(args: BuildAgentSessionArgs): Promise<AgentSession>;
-
-declare interface BuildAgentSessionArgs {
-    /** Host directory mounted into the VM. */
-    mountPath: string;
-    /** Host working directory where the agent session should start. */
-    cwdPath: string;
-    /** pi auth directory (resolved from `PI_CODING_AGENT_DIR` or `~/.pi/agent`). */
-    piAuthDir: string;
-    /** Resolved pi model handle (provider + model id). */
-    modelHandle: Model<Api>;
-    /** Optional runtime-profile thinking/reasoning level applied at session start. */
-    thinkingLevel?: PiThinkingLevel | null;
-    /** Optional runtime-profile sampling temperature applied to provider requests. */
-    temperature?: number | null;
-    /** Optional runtime-profile nucleus sampling probability mass. */
-    topP?: number | null;
-    /** Optional runtime-profile top-k sampling cutoff. */
-    topK?: number | null;
-    /** Optional runtime-profile generated output token cap. */
-    maxOutputTokens?: number | null;
-    /** Pre-built customTools array. Caller composes Gondolin + MoltNet + submit tools. */
-    customTools: ToolDefinition[];
-    /** System-prompt fragments appended after pi's defaults. Parent passes the
-     *  runtime instructor; subagents pass their narrower variant. */
-    appendSystemPrompt: string[];
-    /** Skills to advertise in `<available_skills>`. Default: empty list. */
-    skillsOverride?: () => LoadSkillsResult;
-    /** Span attributes merged onto every OTel span the session emits. */
-    otelSpanAttrs: Record<string, string | number | boolean>;
-    /** Agent name for `gen_ai.agent.name` on the root span. */
-    agentName: string;
-    /**
-     * Extra pi extension factories appended after the always-on telemetry (and
-     * model-options) extensions — e.g. the tool-policy `tool_call` gate. Each is a
-     * plain `(pi) => void` registrar, same shape as the OTel extension.
-     */
-    extraExtensionFactories?: ((pi: ExtensionAPI) => void)[];
-    /**
-     * Parent sessions may persist their conversation history in a daemon-owned
-     * directory. Subagents should leave this unset and stay in-memory.
-     */
-    sessionPersistence?: {
-        sessionDir: string;
-        forkFromSessionPath?: string | null;
-    };
-}
-
-declare type ClaimCondition = {
-    op: 'all';
-    conditions: ClaimCondition[];
-} | {
-    op: 'any';
-    conditions: ClaimCondition[];
-} | {
-    op: 'task_status';
-    taskId: string;
-    statuses: TaskStatus[];
-} | {
-    op: 'task_accepted';
-    taskId: string;
-};
-
-declare const ClaimCondition: Type.TUnsafe<ClaimCondition>;
-
-declare interface ClaimedTask {
-    /** The claimed task payload itself. */
-    task: Task;
-    /** Attempt number assigned by the source/queue. */
-    attemptN: number;
-    /** Runtime profile id selected by the source when claim routing is profile-scoped. */
-    profileId?: string;
-    /** W3C trace headers from the claim response for OTel context propagation. */
-    traceHeaders: Record<string, string>;
-}
-
-declare const CONTEXT_BINDINGS: readonly ["skill", "context_inline", "prompt_prefix", "user_inline"];
-
-declare type ContextBinding = (typeof CONTEXT_BINDINGS)[number];
-
-declare const ContextBinding: Type.TUnsafe<"skill" | "context_inline" | "prompt_prefix" | "user_inline">;
-
-/**
- * One context entry. Bytes are inlined: the proposer chose them, and the
- * task's `inputCid` already pins the entire input — including
- * `context[]` — so we don't need a separate per-entry hash, fetcher, or
- * flagged-content gate. Tasks reference rendered packs (or any other
- * external content) by copying their bytes into `content` at task
- * creation time.
- *
- * - `slug` — short identifier the daemon uses to disambiguate
- *            entries. For `skill` binding it becomes the directory
- *            name under the runtime's skill discovery path. Must be
- *            kebab-case-safe (alphanumeric + dashes/underscores).
- * - `binding` — how the bytes are delivered to the LLM (see above).
- * - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
- *               entry; total per-task context bytes are bounded by the
- *               soft `maxItems` cap and per-binding daemon limits.
- *               Raised from 32 KiB in 2026-05 — protocol-heavy operator
- *               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
- *               at ~35 KiB inline, and the original cap was sized for
- *               short example skills, not the kind of skill the eval
- *               substrate is dogfooded on (#943, #823).
- */
-declare const ContextRef: Type.TObject<{
-    slug: Type.TString;
-    binding: Type.TUnsafe<"skill" | "context_inline" | "prompt_prefix" | "user_inline">;
-    content: Type.TString;
-}>;
-
-declare type ContextRef = {
-    slug: string;
-    binding: ContextBinding;
-    content: string;
-};
-
-export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string): BashOperations;
-
-export declare function createGondolinEditOps(vm: VM, localCwd: string, guestWorkspace: string): EditOperations;
-
-export declare function createGondolinReadOps(vm: VM, localCwd: string, guestWorkspace: string): ReadOperations;
-
-export declare function createGondolinWriteOps(vm: VM, localCwd: string, guestWorkspace: string): WriteOperations;
-
-/**
- * Create all MoltNet tool definitions, ready to pass to `pi.registerTool()`.
- */
-export declare function createMoltNetTools(config: MoltNetToolsConfig): ToolDefinition<any, any>[];
-
-export declare function createPiOtelExtension(options?: PiOtelOptions): (pi: ExtensionAPI) => void;
+export { createPiOtelExtension }
 
 export declare function createPiProviderErrorRetryUi(ctx: ExtensionContext): ProviderErrorRetryUi | undefined;
 
-export declare function createPiRetryTriage(options: {
-    model: Model<Api>;
-    thinkingLevel?: PiRetryTriageThinkingLevel | null;
-    piAgentDir: string;
-    timeoutMs?: number;
-    cwd?: string;
-}): PiRetryTriage;
-
-/**
- * Factory that builds a pi-specific `executeTask` function suitable for
- * injection into `AgentRuntime`. The returned function caches the resolved
- * checkpoint across tasks so the second task hits the snapshot cache.
- */
-export declare function createPiTaskExecutor(opts: ExecutePiTaskOptions): (claimedTask: ClaimedTask, reporter: TaskReporter) => Promise<TaskOutput>;
-
-/**
- * Build the subagent custom tool for a parent session. The handle
- * exposes the call counter so executors can emit summary telemetry
- * when the parent terminates.
- */
-export declare function createSubagentTool(args: CreateSubagentToolArgs): SubagentToolHandle;
-
-export declare interface CreateSubagentToolArgs {
-    /** Host directory mounted into the VM. */
-    mountPath: string;
-    /** Host working directory the subagent should start in. Defaults to mountPath. */
-    cwdPath?: string;
-    /** pi auth directory the parent resolved. */
-    piAuthDir: string;
-    /** Resolved pi model handle — subagents share it. */
-    modelHandle: Model<Api>;
-    /** Runtime-profile thinking/reasoning level — subagents inherit it. */
-    thinkingLevel?: PiThinkingLevel | null;
-    /** Runtime-profile sampling temperature — subagents inherit it. */
-    temperature?: number | null;
-    /** Runtime-profile nucleus sampling probability mass — subagents inherit it. */
-    topP?: number | null;
-    /** Runtime-profile top-k sampling cutoff — subagents inherit it. */
-    topK?: number | null;
-    /** Runtime-profile generated output token cap — subagents inherit it. */
-    maxOutputTokens?: number | null;
-    /** Agent name for telemetry. */
-    agentName: string;
-    /**
-     * Custom tools every subagent inherits (Gondolin-routed
-     * built-ins + moltnet_* tools, etc). MUST NOT include
-     * the parent's submit-output tool, the parent's `subagent` tool,
-     * or any other parent-only artefact — the caller is responsible
-     * for filtering. The subagent appends its own submit tool.
-     */
-    inheritedCustomTools: ToolDefinition[];
-    /**
-     * The parent runtime instructor verbatim. Subagents prepend it to
-     * their own short "you are a subagent" preamble so the same
-     * invariants (gh auth, diary discipline, accountable commits)
-     * apply if the subagent takes those actions. The parent's task
-     * description dictates whether they should.
-     */
-    parentRuntimeInstructor: string;
-    parentTaskId: string;
-    parentTaskType: string;
-    parentAttemptN: number;
-    /**
-     * Parent task's cancel signal. When the daemon cancels the parent
-     * task (operator cancel or task-level `runningTimeoutSec` expiry),
-     * each in-flight subagent's inner `session.abort()` is invoked so
-     * it tears down promptly instead of running until its own LLM
-     * call resolves. Mirrors the existing `wireSessionAbort` pattern
-     * the parent session uses.
-     *
-     * Optional only because the test seam can omit it; production
-     * callers (executePiTask) pass `reporter.cancelSignal`.
-     */
-    parentCancelSignal?: AbortSignal;
-    /**
-     * Per-call fallback timeout. Defends against an inner session that
-     * ignores `abort()` for any reason (LLM provider stuck, tool call
-     * hanging on I/O, etc.). When the timeout fires, `session.abort()`
-     * is invoked and the tool returns `isError: true` with a
-     * `subagent_timed_out` reason the parent LLM can recover from.
-     *
-     * Default: 5 minutes. Set to `0` to disable (relying purely on
-     * parentCancelSignal). Negative values are treated as the default.
-     */
-    timeoutMs?: number;
-    /**
-     * Test seam. Production callers leave this undefined and get
-     * `buildAgentSession` from the factory module. Tests inject a mock
-     * that returns a stub session implementing only `prompt()` to
-     * exercise the tool's logic without booting a VM.
-     */
-    buildAgentSession?: (args: BuildAgentSessionArgs) => Promise<AgentSession>;
-    /**
-     * Contract registry for resolving output_schema names to TypeBox
-     * schemas at call time. The subagent tool reads ONLY via `.get()`
-     * and `.list()` — the registry is immutable after construction.
-     *
-     * Production callers (executePiTask) create the registry with
-     * built-in contracts at session-setup; tests inject a registry
-     * with whatever stubs they need.
-     */
-    contractRegistry: SubagentContractRegistry;
-    /**
-     * Extra pi extension factories every subagent session registers — chiefly the
-     * tool-policy `tool_call` gate. A subagent runs in its own `AgentSession`, so
-     * without re-registering the gate here it would execute tools un-checked,
-     * escaping the parent's enforcement (#1348 B2). Empty/undefined when tool
-     * enforcement is `off`, so subagents then match the parent's un-gated
-     * behaviour. The factories are read-only closures, safe to share across the
-     * parent and every subagent session.
-     */
-    extraExtensionFactories?: ((pi: ExtensionAPI) => void)[];
-}
-
-/**
- * A pi extension factory that gates every `tool_call` against the resolved
- * policy. Blocks in `enforce`, audits (and allows) in `watch`, and is a no-op in
- * `off`. Register it in a session's `extensionFactories`.
- */
-export declare function createToolPolicyExtension(deps: ToolPolicyExtensionDeps): (pi: ExtensionAPI) => void;
-
-/**
- * Map a pi `tool_call` event to a gate decision, extracting the shell command
- * for `bash` and delegating to {@link decideToolCall}.
- */
-export declare function decideForEvent(event: ToolCallEvent, policy: SessionToolPolicy, analyze: ShellCommandAnalyzer['analyze']): GateDecision;
-
-/**
- * Decide whether a tool call is permitted by the resolved policy.
- *
- * Fail-closed in `enforce` (audited-but-allowed in `watch`, no-op in `off`) for:
- *
- * 1. **Unresolvable commands** — a `bash` command whose executables cannot be
- *    statically resolved (command substitution, `eval`, non-literal command
- *    names, unparseable input).
- * 2. **Arbitrary-code interpreters** — a `bash` command that invokes a shell or
- *    language interpreter (`bash -c`, `python`, `node`, `perl`, …; the
- *    analyzer's `arbitrary-code` risk tier). Being name-listed is NOT enough:
- *    we cannot statically see the code such an interpreter runs, so the policy's
- *    allow-set can't bound it. This is the interim conservative stance for
- *    issue #1348 — an operator who lists `bash` still cannot smuggle
- *    `bash -c "curl … | sh"` past `enforce`.
- * 3. **Unlisted executables** — any resolved executable not in `allowedTools`.
- *
- * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
- * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
- * is NOT blocked on the tier alone. The analyzer already re-analyzes the
- * sub-commands it can see through documented escape flags (`find -exec`,
- * `tar --to-command`, …), but techniques it cannot parse statically could still
- * escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
- * capability-aware allow-set) is tracked as future work.
- */
-export declare function decideToolCall(input: GateInput): GateDecision;
-
-/**
- * Ensure a cached snapshot exists, building one if needed.
- * Returns the absolute path to the qcow2 checkpoint file.
- */
-export declare function ensureSnapshot(options?: EnsureSnapshotOptions): Promise<string>;
-
-export declare interface EnsureSnapshotOptions {
-    config?: SnapshotConfig;
-    onProgress?: (message: string) => void;
-    /** Max number of old snapshots to keep (default 1). */
-    maxCached?: number;
-}
-
-/**
- * Run one attempt of `task` in a freshly-resumed Gondolin VM. Owns the full
- * lifecycle: resume VM → wire tools → pi session → close VM. Always returns
- * a `TaskOutput` (failures surface as `status: 'failed'`); throws only on
- * unrecoverable setup errors.
- */
-export declare function executePiTask(claimedTask: ClaimedTask, reporter: TaskReporter, opts: ExecutePiTaskOptions): Promise<TaskOutput>;
-
-export declare interface ExecutePiTaskOptions {
-    /** MoltNet agent whose credentials the VM boots with. */
-    agentName: string;
-    /**
-     * Host root that owns `.moltnet/<agentName>/`.
-     *
-     * Defaults to `mountPath`, but callers that mount scratch workspaces should
-     * pass the stable sandbox root.
-     */
-    agentRootDir?: string;
-    /** Host cwd that the VM mounts into the guest (defaults to `process.cwd()`). */
-    mountPath?: string;
-    /** LLM selection. */
-    provider: string;
-    model: string;
-    /**
-     * Runtime-profile reasoning/thinking level. Null/undefined means use Pi's
-     * configured default; explicit `off` disables provider thinking where
-     * supported.
-     */
-    thinkingLevel?: PiThinkingLevel | null;
-    /** Optional sampling temperature. Null/undefined means provider default. */
-    temperature?: number | null;
-    /** Optional nucleus-sampling probability mass. Null/undefined means provider default. */
-    topP?: number | null;
-    /** Optional top-k sampling cutoff. Null/undefined means provider default. */
-    topK?: number | null;
-    /** Optional cap on generated output tokens. Null/undefined means provider/model default. */
-    maxOutputTokens?: number | null;
-    /** Extra hosts to allow in the sandbox egress policy. */
-    extraAllowedHosts?: string[];
-    /** Sandbox overrides (env, VFS shadows, resources). */
-    sandboxConfig?: SandboxConfig;
-    /** Host environment variable names to forward into the Pi VM. */
-    forwardEnv?: string[];
-    /**
-     * Runtime profile context defaults. Merged with task.input.context at
-     * execution time because the selected runtime profile is known only after
-     * claim. Task entries override profile entries with the same slug.
-     */
-    runtimeProfileContext?: readonly ContextRef[];
-    /**
-     * Runtime profile id, used to resolve the tool-policy allow-set at session
-     * start. Required together with a non-`off` `toolEnforcement` for the
-     * `tool_call` gate to run.
-     */
-    runtimeProfileId?: string;
-    /** Tool-policy enforcement mode for the selected runtime profile. */
-    toolEnforcement?: ToolEnforcement;
-    /**
-     * Forwarded to `buildTaskUserPrompt` for per-type builders. Static
-     * across tasks. Today no built-in builder needs per-task `extras` —
-     * judges fetch their own dependent data via MoltNet tools
-     * (`moltnet_get_task`, `moltnet_list_task_attempts`, etc.) at run
-     * time, which keeps this layer task-type-agnostic. Field is kept
-     * for forward compat with custom prompt builders that might want it.
-     */
-    promptExtras?: Record<string, unknown>;
-    /** Snapshot progress callback; defaults to stderr logging. */
-    onSnapshotProgress?: (message: string) => void;
-    /**
-     * Optional pre-resolved checkpoint path. If omitted, `ensureSnapshot` is
-     * invoked. Useful for batch execution where the caller wants to cache
-     * across tasks.
-     */
-    checkpointPath?: string;
-    /**
-     * Lazy checkpoint resolver used by `createPiTaskExecutor` so snapshot
-     * creation can happen after the reporter has been opened and can surface
-     * setup failures as task messages.
-     */
-    resolveCheckpointPath?: () => Promise<string>;
-    /**
-     * Set when the caller already opened the reporter before handing control
-     * to `executePiTask`.
-     */
-    reporterAlreadyOpened?: boolean;
-    /**
-     * Optional callback invoked alongside every `reporter.record()` so
-     * the daemon can mirror task messages into its local logger.
-     * Bound at executor-construction time — use when one task runs per
-     * process (e.g. `once.ts`) and per-task context is known before
-     * the executor is built. For poll mode, prefer `makeOnTurnEvent`
-     * below. If both are set, `makeOnTurnEvent` wins.
-     * See `TurnEventHandler` for payload shape. Defaults to a no-op.
-     */
-    onTurnEvent?: TurnEventHandler;
-    /**
-     * Per-task factory variant for `onTurnEvent`. Invoked once per
-     * task with the claimed task before any emit, so the returned
-     * handler can bind taskId / attemptN into a pino child.
-     * Use in poll mode where N tasks run sequentially in the same
-     * process. See #1078.
-     */
-    makeOnTurnEvent?: TurnEventHandlerFactory;
-    /**
-     * Cap the number of tool-use turns per attempt. When the limit is
-     * reached, the pi session is aborted and the attempt finalizes with
-     * `error.code: max_turns_exceeded`. A tool-use turn = any `turn_end`
-     * whose `stopReason !== 'end_turn'` (matches the Anthropic SDK
-     * `max_turns` semantics: the model's final text-only response doesn't
-     * count). Default `0` = disabled. Recommended `30` for `fulfill_brief`.
-     * Closes part of #1094.
-     */
-    maxTurns?: number;
-    /**
-     * Cap the number of `bash` tool timeouts per attempt. A timeout is a
-     * `tool_execution_end` for `bash` whose result text contains
-     * "Command timed out after" (pi's stable error wrapper from
-     * `@earendil-works/pi-coding-agent`'s bash tool). When the limit is
-     * reached, the pi session is aborted and the attempt finalizes with
-     * `error.code: max_bash_timeouts_exceeded`. Catches the death-spiral
-     * pattern from task `a3762f44` where the model kept retrying
-     * long-blocking shell commands until the host job timeout fired.
-     * Default `3`. Set to `0` to disable. Closes part of #1094.
-     */
-    maxBashTimeouts?: number;
-    /**
-     * Number of correction turns allowed after the first invalid submit-output
-     * tool call. A value of 2 permits three invalid submit calls total before
-     * the attempt fails with output_validation_failed.
-     */
-    maxSubmitValidationRetries?: number;
-    /**
-     * Number of same-session re-prompts when the model ends its turn WITHOUT
-     * calling the submit-output tool at all (no captured payload and no
-     * exhausted validation budget). Distinct from
-     * `maxSubmitValidationRetries`, which recovers *invalid-args* submit calls.
-     * Each re-prompt names the submit tool and forbids a prose reply. When the
-     * budget is spent the attempt still fails with `submit_output_missing`.
-     * Only applies to task types that register a submit tool. Default `3`. Set
-     * to `0` to disable. See #1528.
-     */
-    maxSubmitMissingReprompts?: number;
-    /**
-     * Continuation prompt sent when a turn ends without a submit call. Defaults
-     * to `buildSubmitMissingPrompt(<tool name>)`.
-     */
-    submitMissingPrompt?: string;
-    /**
-     * Cap provider-error retries inside the same Pi session. A retry is attempted
-     * only after a Pi assistant turn ends with `stopReason: "error"` and the
-     * provider diagnostic is not a known credential/model/config failure. This is
-     * distinct from daemon attempt retry: the active session keeps its context and
-     * receives a short continuation prompt.
-     *
-     * Default `4`. Set to `0` to disable.
-     */
-    maxProviderErrorRetries?: number;
-    /** Base delay for same-session provider-error retries. Default `2000`. */
-    providerErrorRetryBaseDelayMs?: number;
-    /** Maximum delay for same-session provider-error retries. Default `30000`. */
-    providerErrorRetryMaxDelayMs?: number;
-    /** Continuation prompt sent after a retryable provider error. Default `Go on`. */
-    providerErrorRetryPrompt?: string;
-    /**
-     * Optional UI adapter for interactive pi/TUI callers. The daemon normally
-     * leaves this unset and consumes the structured `provider_error_retry` task
-     * message instead.
-     */
-    providerErrorRetryUi?: ProviderErrorRetryUi;
-    /**
-     * Skip per-call UI approval for matching `moltnet_host_exec` commands.
-     * Keep false/undefined for interactive consumers. `true` skips every dialog
-     * after HOST_EXEC_ALLOWED; an array limits auto-approval to matching rules.
-     */
-    hostExecAutoApprove?: HostExecAutoApproveConfig;
-    /**
-     * Optional daemon-supplied execution plan. Keeps task semantics out of
-     * `pi-extension` while still letting callers opt into stable worktrees and
-     * file-backed Pi sessions for selected task classes.
-     */
-    makeExecutionPlan?: PiTaskExecutionPlanFactory;
-    /**
-     * Immutable subagent contract registry used to resolve `output_schema`
-     * names at subagent tool call time. Constructed by the daemon (or
-     * tests) from static built-in schemas — `execute-pi-task` never hardcodes
-     * contracts. See #1106.
-     */
-    subagentContractRegistry?: SubagentContractRegistry;
-    /**
-     * Structured logger for tool-policy resolution/gate events. The daemon passes
-     * its task-bound pino child so these lines carry taskId/attemptN and join the
-     * run's NDJSON stream. When omitted, tool-policy events fall back to raw
-     * NDJSON on stderr (single-process / test callers). See #1348.
-     */
-    toolPolicyLogger?: ToolPolicyLogger;
-}
-
-/**
- * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
- * only exists in the main worktree, not in git worktrees).
- */
-export declare function findMainWorktree(startPath?: string): string;
-
-/**
- * The gate's verdict:
- * - `{ allow: true }` — let the tool run.
- * - `{ allow: false, reason }` — block it (enforce mode).
- * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
- */
-export declare type GateDecision = {
-    allow: true;
-} | {
-    allow: false;
-    reason: string;
-} | {
-    audit: string;
-    missing?: string[];
-};
-
-export declare interface GateInput {
-    /** Pi tool name (e.g. 'bash', 'read', 'write', or a custom tool id). */
-    toolName: string;
-    /** The shell command, when `toolName === 'bash'`. */
-    command?: string;
-    enforcement: ToolEnforcement;
-    /** Names the policy allows (structured tool names + shell executable names). */
-    allowedTools: ReadonlySet<string>;
-    /**
-     * Synchronous shell analyzer (`ShellCommandAnalyzer.analyze`). Injected so the
-     * decision stays pure and testable; the analyzer's async WASM init happens
-     * once at session start.
-     */
-    analyze: (command: string) => CommandAnalysis;
-}
-
-/**
- * Baseline env keys forwarded to host-exec child processes.
- * Callers can extend this set at sandbox startup via `MoltNetToolsConfig.hostExecBaseEnv`.
- */
-export declare const HOST_EXEC_DEFAULT_BASE_ENV: ReadonlySet<string>;
-
-declare type HostExecAutoApproveConfig = boolean | readonly HostExecAutoApproveRule[];
-
-declare interface HostExecAutoApproveRule {
-    /** Exact executable name. Must still pass HOST_EXEC_ALLOWED. */
-    executable: string;
-    /** Optional ordered argument prefix; flags after the prefix are allowed. */
-    argsPrefix?: readonly string[];
-    /** Optional unordered argument tokens that must appear somewhere. */
-    argsContains?: readonly string[];
-    /** Optional argument tokens that prevent auto-approval when present. */
-    argsExcludes?: readonly string[];
-}
-
-export declare interface InjectedTaskContext {
-    /** Refs that were delivered, in declared order, for audit. */
-    injected: ContextRef[];
-    /** Synthetic Skill objects to splice into pi's skillsOverride. */
-    skills: Skill[];
-    /** Prepend this to `appendSystemPrompt`. Empty when nothing
-     *  contributed (omit the array entry rather than pass an empty
-     *  string to keep pi's prompt assembly tidy). */
-    systemPromptPrefix: string;
-    /** Append this to the task user prompt BEFORE `session.prompt()`. */
-    userInlineSuffix: string;
-}
-
-/**
- * Resolve effective runtime context and inject the side effects Pi
- * needs. Safe to call with an empty array — returns an inert result.
- */
-export declare function injectTaskContext(args: InjectTaskContextArgs): Promise<InjectedTaskContext>;
-
-export declare interface InjectTaskContextArgs {
-    /** Empty array (the default for any non-eval task) is a no-op. */
-    context: readonly ContextRef[];
-    /** Guest filesystem handle. In production this is `managed.vm.fs`. */
-    fs: VmFsForContext;
-    /** Guest path where the active host workspace is mounted. */
-    guestWorkspace: string;
-}
-
-export declare function loadCredentials(agentDir: string): VmCredentials;
-
-export declare interface ManagedVm {
-    vm: VM;
-    credentials: VmCredentials;
-    mountPath: string;
-    guestWorkspace: string;
-    agentDir: string;
-}
-
-declare type MoltNetAgent = Awaited<ReturnType<typeof connect>>;
-
 declare function moltnetExtension(pi: ExtensionAPI): void;
 export default moltnetExtension;
 
-/**
- * Active-task context. When present, `moltnet_create_entry` is forced to
- * land entries in `diaryId` (the task diary), regardless of the env-derived
- * diary, and auto-injects provenance tags under the `task:*` namespace
- * (`task:id:<id>`, `task:type:<type>`, `task:attempt:<n>`, and
- * `task:correlation:<id>` when the task carries one). See issue #979 +
- * the #986 follow-up that introduced the namespace.
- */
-declare interface MoltNetTaskContext {
-    taskId: string;
-    taskType: string;
-    attemptN: number;
-    diaryId: string;
-    /**
-     * Optional correlation id. When set, propagated as a
-     * `task:correlation:<id>` provenance tag so all entries from a
-     * multi-task workflow can be grouped without enumerating individual
-     * task ids.
-     */
-    correlationId: string | null;
-}
-
-declare interface MoltNetToolsConfig {
-    getAgent(): MoltNetAgent | null;
-    getDiaryId(): string | null;
-    getTeamId(): string | null;
-    getSessionErrors(): readonly TrackedError[];
-    clearSessionErrors(): void;
-    /** Host working directory for host-exec commands (worktree path or cwd). */
-    getHostCwd?(): string;
-    /**
-     * Optional workspace-file reader. Daemon/Gondolin callers provide this so
-     * artifact uploads see guest overlay writes that may not exist on the host
-     * mount path yet.
-     */
-    openWorkspaceFileForRead?(filePath: string): Promise<{
-        stream: Readable;
-        isFile: boolean;
-        sizeBytes?: number;
-        displayPath?: string;
-    }>;
-    /**
-     * Set of process.env keys that are safe to forward to host-exec child
-     * processes. Configured at sandbox startup so the caller can include
-     * agent-specific vars (e.g. MOLTNET_AGENT_NAME) alongside the defaults.
-     * Defaults to HOST_EXEC_DEFAULT_BASE_ENV when omitted.
-     */
-    hostExecBaseEnv?: ReadonlySet<string>;
-    /**
-     * When true, `moltnet_host_exec` skips the per-call UI approval dialog.
-     * Intended for non-interactive daemon automation only; interactive
-     * consumers should keep the default false behavior.
-     */
-    autoApproveHostExec?: boolean;
-    /**
-     * Host-exec auto-approval policy. `true` skips all dialogs after the
-     * executable allowlist check. An array skips only commands matching one of
-     * the supplied executable/argument rules. Omitted/false preserves the
-     * interactive approval flow.
-     */
-    hostExecAutoApprove?: HostExecAutoApproveConfig;
-    /**
-     * Active-task context, populated by the agent-daemon path. When set,
-     * `moltnet_create_entry` enforces `diaryId === taskContext.diaryId` and
-     * injects provenance tags. When absent (interactive pi-extension / TUI),
-     * entry creation behaves as before (env-derived diary, no auto-tags).
-     */
-    getTaskContext?(): MoltNetTaskContext | null;
-}
-
-export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriageResult;
-
-export declare interface PiOtelOptions {
-    /** Agent name for `gen_ai.agent.name` on the root span. */
-    agentName?: string;
-    /**
-     * Extra attributes merged onto every span. Use MoltNet-specific keys
-     * like `moltnet.task.id` — any `gen_ai.*` keys here are filtered out
-     * since the extension is authoritative for those.
-     */
-    spanAttributes?: Record<string, string | number | boolean>;
-}
-
-export declare type PiRetryTriage = (input: PiRetryTriageInput) => Promise<PiRetryTriageResult>;
-
-export declare type PiRetryTriageConfidence = RetryTriageConfidence;
-
-export declare type PiRetryTriageDecision = RetryTriageDecision;
-
-export declare interface PiRetryTriageInput {
-    task: {
-        id: string;
-        taskType: string;
-        teamId: string;
-        input: unknown;
-    };
-    attemptN: number;
-    maxAttempts?: number | null;
-    remainingAttempts?: number | null;
-    error: unknown;
-    recentMessages?: {
-        timestamp: string;
-        kind: string;
-        payload: unknown;
-    }[];
-}
-
-export declare interface PiRetryTriageResult {
-    decision: RetryTriageDecision;
-    confidence: RetryTriageConfidence;
-    reason: string;
-}
-
-export declare type PiRetryTriageThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
-
-export declare interface PiSessionPersistencePlan {
-    sessionDir: string;
-    forkFromSessionPath?: string | null;
-}
-
-export declare interface PiTaskExecutionPlan {
-    /**
-     * Effective workspace mode for this task instance.
-     * `scratch_mount` means mount an empty scratch directory rather than the
-     * daemon checkout.
-     */
-    workspaceMode: 'shared_mount' | 'dedicated_worktree' | 'scratch_mount';
-    /**
-     * Daemon-local reuse key. When set alongside `workspaceScope: 'session'`,
-     * dedicated worktrees may be retained and reopened across related tasks.
-     */
-    sessionKey: string | null;
-    /**
-     * Workspace identity selected by the daemon. `null` means the task should
-     * run against the shared mount path.
-     */
-    workspaceId: string | null;
-    /**
-     * Branch to create or reopen for the workspace. `null` means no dedicated
-     * worktree is required.
-     */
-    worktreeBranch: string | null;
-    /**
-     * Base ref a NEW `worktreeBranch` is cut from. Used by `fork` continuations
-     * to branch from the parent's tip instead of the default (main/HEAD). Ignored
-     * when `worktreeBranch` already exists.
-     */
-    worktreeBaseRef?: string | null;
-    /**
-     * Lifetime of the task workspace from the daemon's point of view.
-     * `attempt` = disposable; `session` = keep stable for the reuse key.
-     */
-    workspaceScope: 'attempt' | 'session';
-    /**
-     * Optional existing workspace root to attach instead of creating a fresh
-     * shared/worktree/scratch workspace. Used for read-only-ish producer
-     * inspection by applying VFS shadowing on top of the mounted path.
-     */
-    workspaceAttachment?: PiWorkspaceAttachmentPlan | null;
-    /**
-     * Optional seed content for a freshly created scratch workspace.
-     */
-    workspaceSeed?: PiWorkspaceSeedPlan | null;
-    /**
-     * Optional location for file-backed Pi session history. When omitted,
-     * the executor keeps the conversation in memory for this attempt only.
-     */
-    sessionPersistence?: PiSessionPersistencePlan | null;
-}
-
-export declare type PiTaskExecutionPlanFactory = (claimedTask: ClaimedTask) => Promise<PiTaskExecutionPlan | null> | PiTaskExecutionPlan | null;
-
-declare type PiThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
-
-declare interface PiWorkspaceAttachmentPlan {
-    mountPath: string;
-    cwdPath: string;
-    shadowWrites?: 'deny' | 'tmpfs';
-}
-
-declare interface PiWorkspaceSeedPlan {
-    copyFromPath: string;
-    source: 'producer';
-}
-
-export declare interface ProviderErrorRetryEvent extends Record<string, unknown> {
-    event: 'provider_error_retry';
-    retry: number;
-    maxRetries: number;
-    delayMs: number;
-    reason: string;
-}
-
-export declare type ProviderErrorRetryLevel = 'info' | 'warning' | 'error';
-
-export declare interface ProviderErrorRetryUi {
-    /**
-     * Mirrors pi's `ctx.hasUI`. Undefined means "UI adapter is present"; false
-     * lets callers pass a stable adapter from both TUI and headless contexts.
-     */
-    hasUI?: boolean;
-    setStatus?: (key: string, message: string) => void | Promise<void>;
-    notify?: (message: string, level: ProviderErrorRetryLevel) => void | Promise<void>;
-}
-
-export declare function redactRetryTriageSecrets(value: string): string;
-
-/**
- * Resolve the session's tool policy at start-up.
- *
- * `off` short-circuits without a network call. Otherwise the allowed-tool set
- * is fetched from the API. If that fetch fails, the mode decides the fallback:
- * `enforce` **fails closed** (empty allow-set → every non-`off` tool is
- * blocked); `watch` fails open (empty allow-set → every tool is audited but
- * allowed).
- *
- * The result is a **session-start snapshot**: it is resolved once and cached for
- * the session's lifetime. Policy edits made while a task is running do not take
- * effect until the next session — a deliberate trade-off (one resolution per
- * session, stable enforcement for the run) accepted over re-fetching per call.
- */
-export declare function resolveSessionToolPolicy(input: ResolveSessionToolPolicyInput): Promise<SessionToolPolicy>;
-
-declare interface ResolveSessionToolPolicyInput {
-    agent: AllowedToolsClient;
-    profileId: string;
-    teamId: string;
-    /**
-     * The profile's enforcement mode, already known to the daemon from the
-     * resolved runtime profile. Used to decide fail-open vs fail-closed when the
-     * allowed-tools fetch fails.
-     */
-    enforcement: ToolEnforcement;
-    logger: ToolPolicyLogger;
-    /**
-     * Deadline for the allowed-tools fetch. A hung API call must not stall session
-     * start-up indefinitely, so on timeout we abort and fall back to the
-     * mode-appropriate degraded policy. Defaults to
-     * {@link DEFAULT_RESOLVE_TIMEOUT_MS}; `0`/negative disables the deadline.
-     */
-    timeoutMs?: number;
-}
-
-export declare function resolveTaskWorktreePath(mainRepo: string, workspaceId: string): string;
-
-export declare interface ResumeCommand {
-    /** Shell command, same semantics as the string form. */
-    run: string;
-    /** Optional generic runtime predicate for whether this step should run. */
-    when?: ResumeCommandWhen;
-    /** Additional attempts on non-zero exit. Default 0. */
-    retries?: number;
-    /** Linear backoff between attempts in ms. Delay before attempt N+1 is
-     *  `(N + 1) * retryBackoffMs` (so 2s, 4s, … with the default). */
-    retryBackoffMs?: number;
-}
-
-/** Structured form of a resume command with optional retry policy. */
-declare interface ResumeCommandWhen {
-    /**
-     * Effective workspace mode(s) that should run this command.
-     * Evaluated by the runtime from the mounted workspace shape rather than
-     * from task type semantics.
-     */
-    workspaceMode?: ('shared_mount' | 'dedicated_worktree' | 'scratch_mount')[];
-}
-
-/**
- * Resume a VM from a checkpoint, inject credentials, configure egress +
- * TLS. Returns the managed VM handle.
- */
-export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
-
-export declare type RetryTriageConfidence = 'low' | 'medium' | 'high';
-
-export declare type RetryTriageDecision = 'retry' | 'do_not_retry';
-
-export declare interface SandboxConfig {
-    /** Snapshot build settings. */
-    snapshot?: {
-        /** Shell commands to run after the base setup. */
-        setupCommands?: string[];
-        /** Additional hosts to allow network access during build. */
-        allowedHosts?: string[];
-        /** Overlay disk size (default '3G'). */
-        overlaySize?: string;
-    };
-    /** Runtime network egress policy. Separate from snapshot build access. */
-    network?: {
-        /** Additional host patterns allowed while the VM is running.
-         * Internal and private address resolution remains blocked. */
-        allowedHosts?: string[];
-        /** Host patterns explicitly allowed to resolve to internal/private IPs. */
-        allowedInternalHosts?: string[];
-    };
-    /** Shell commands to run every VM resume, after platform setup
-     *  (TLS, DNS, git safe.directory, tmpfs node_modules) and before
-     *  the agent session starts. Use for per-session bootstrap that
-     *  doesn't belong baked into the snapshot.
-     *
-     *  Not included in the snapshot cache key — changes here apply on
-     *  every resume without triggering a snapshot rebuild. Each command
-     *  runs in a fresh shell with `set -eu` and `set -o pipefail`; a
-     *  non-zero exit (including from any segment of a pipeline) aborts
-     *  resume with the failing command's stderr/stdout tail.
-     *
-     *  Each entry is either a raw string (no retries) or an object
-     *  `{ run, when?, retries?, retryBackoffMs? }`. `when` gates the
-     *  command on generic runtime properties such as effective
-     *  `workspaceMode`; this keeps sandbox policy decoupled from task
-     *  types. `retries` is the number of ADDITIONAL attempts after the
-     *  first failure (default 0 = no retry). Use for steps that hit the
-     *  network and may legitimately race DHCP/registry availability on a
-     *  fresh resume (e.g. `pnpm install`). The wrapped command must be
-     *  idempotent. */
-    resumeCommands?: (string | ResumeCommand)[];
-    /** VFS shadow settings — hide host paths from the guest. */
-    vfs?: {
-        /** Paths (relative to workspace root) to shadow from the host mount. */
-        shadow?: string[];
-        /** What to do with writes to shadowed paths: 'deny' or 'tmpfs' (default 'tmpfs'). */
-        shadowMode?: 'deny' | 'tmpfs';
-    };
-    /** Environment variable overrides for the guest VM (applied on top of defaults). */
-    env?: Record<string, string>;
-    /** Host-side escape hatch policy. Applies only to `moltnet_host_exec`. */
-    hostExec?: {
-        /**
-         * `true` auto-approves every allowed executable. An array auto-approves
-         * only commands matching one of the executable/argument rules.
-         */
-        autoApprove?: boolean | {
-            executable: string;
-            argsPrefix?: string[];
-            argsContains?: string[];
-            argsExcludes?: string[];
-        }[];
-    };
-    /** VM resource allocation. */
-    resources?: {
-        /** Memory size in qemu syntax (default '1G'). */
-        memory?: string;
-        /** CPU count (default 2). */
-        cpus?: number;
-    };
-}
-
-/** The resolved allow-set + enforcement mode for a runtime session. */
-export declare interface SessionToolPolicy {
-    enforcement: ToolEnforcement;
-    allowedTools: ReadonlySet<string>;
-    /**
-     * `true` when the allow-set is a **degraded fallback** — the allowed-tools
-     * fetch failed or timed out and this policy is the fail-closed/fail-open
-     * default, NOT the operator's actual configuration. An intentional
-     * empty-but-resolved policy (e.g. a profile with no bound tools) has
-     * `degraded: false`. Surfaced in every audit/block log so an operator can tell
-     * "blocked because the policy is empty" from "blocked because we couldn't read
-     * the policy". `off` and successful resolutions are never degraded.
-     */
-    degraded: boolean;
-}
-
-/** Extract snapshot-specific config for backwards compat with ensureSnapshot. */
-export declare type SnapshotConfig = NonNullable<SandboxConfig['snapshot']>;
-
-declare interface SubagentContractRegistry {
-    /** Resolve a contract by name. Returns `null` for unknown names. */
-    get(name: string): SubagentOutputContract | null;
-    /** List all registered contracts. */
-    list(): SubagentOutputContract[];
-}
-
-declare interface SubagentOutputContract {
-    /** Stable identifier the parent uses to reference this contract.
-     *  Lower-snake-case by convention (e.g. `judge_eval_variant_result`). */
-    readonly name: string;
-    /** Human-readable description shown in the subagent tool's help text
-     *  and in the inner session's submit-tool description. Useful when a
-     *  parent LLM has multiple contracts to choose from. */
-    readonly description: string;
-    /**
-     * TypeBox schema the subagent's submit-tool args MUST validate
-     * against. The args ARE the output payload (no `{ output: ... }`
-     * wrapping), so the LLM gets field-level guidance directly.
-     */
-    readonly parametersSchema: TSchema;
-}
-
-export declare interface SubagentToolHandle {
-    /** ToolDefinition to register via `customTools` on the parent session. */
-    readonly tool: ToolDefinition;
-    /** How many times the parent LLM has called this tool. */
-    getCallCount: () => number;
-}
-
-/**
- * Parameters shape the parent LLM sees when calling the subagent tool.
- *
- *   - `task`         — natural-language instructions for the subagent.
- *                      The parent authors this per call. Must be
- *                      non-empty.
- *   - `output_schema` — name of a registered SubagentOutputContract.
- *                      Resolved at call time; unknown names error.
- */
-export declare const SubagentToolParameters: TObject<{
-    task: Type.TString;
-    output_schema: Type.TString;
-}>;
-
-export declare type SubagentToolParameters = Static<typeof SubagentToolParameters>;
-
-/**
- * The Task promise body.
- *
- * Type-neutrality invariant: no property on this type is specific to one
- * `taskType`. Type-specific payload lives inside `input` (validated
- * against the schema registered for `taskType`).
- */
-declare const Task: Type.TObject<{
-    id: Type.TString;
-    taskType: Type.TString;
-    title: Type.TUnion<[Type.TString, Type.TNull]>;
-    tags: Type.TArray<Type.TString>;
-    teamId: Type.TString;
-    diaryId: Type.TUnion<[Type.TString, Type.TNull]>;
-    outputKind: Type.TUnion<[Type.TLiteral<"artifact">, Type.TLiteral<"judgment">]>;
-    input: Type.TRecord<"^.*$", Type.TUnknown>;
-    inputSchemaCid: Type.TString;
-    inputCid: Type.TString;
-    references: Type.TArray<Type.TObject<{
-        taskId: Type.TUnion<[Type.TString, Type.TNull]>;
-        outputCid: Type.TOptional<Type.TString>;
-        role: Type.TUnion<[Type.TLiteral<"judged_work">, Type.TLiteral<"reviewed_diff">, Type.TLiteral<"target_source">, Type.TLiteral<"context">]>;
-        external: Type.TOptional<Type.TObject<{
-            kind: Type.TUnion<[Type.TLiteral<"github_pr">, Type.TLiteral<"github_issue">, Type.TLiteral<"http_url">]>;
-            pr: Type.TOptional<Type.TNumber>;
-            issue: Type.TOptional<Type.TNumber>;
-            url: Type.TOptional<Type.TString>;
-            commit_sha: Type.TOptional<Type.TString>;
-            snapshot_cid: Type.TOptional<Type.TString>;
-        }>>;
-        artifact: Type.TOptional<Type.TObject<{
-            cid: Type.TString;
-            attemptN: Type.TOptional<Type.TInteger>;
-            kind: Type.TOptional<Type.TString>;
-            title: Type.TOptional<Type.TString>;
-            contentType: Type.TOptional<Type.TString>;
-        }>>;
-    }>>;
-    correlationId: Type.TUnion<[Type.TString, Type.TNull]>;
-    proposedByAgentId: Type.TUnion<[Type.TString, Type.TNull]>;
-    proposedByHumanId: Type.TUnion<[Type.TString, Type.TNull]>;
-    acceptedAttemptN: Type.TUnion<[Type.TNumber, Type.TNull]>;
-    claimCondition: Type.TUnion<[Type.TUnsafe<ClaimCondition>, Type.TNull]>;
-    requiredExecutorTrustLevel: Type.TUnion<[Type.TLiteral<"selfDeclared">, Type.TLiteral<"agentSigned">, Type.TLiteral<"releaseVerifiedTool">, Type.TLiteral<"sandboxAttested">]>;
-    allowedProfiles: Type.TArray<Type.TObject<{
-        profileId: Type.TString;
-    }>>;
-    status: Type.TUnion<[Type.TLiteral<"waiting">, Type.TLiteral<"queued">, Type.TLiteral<"dispatched">, Type.TLiteral<"running">, Type.TLiteral<"completed">, Type.TLiteral<"failed">, Type.TLiteral<"cancelled">, Type.TLiteral<"expired">]>;
-    queuedAt: Type.TString;
-    completedAt: Type.TUnion<[Type.TString, Type.TNull]>;
-    expiresAt: Type.TUnion<[Type.TString, Type.TNull]>;
-    cancelledByAgentId: Type.TUnion<[Type.TString, Type.TNull]>;
-    cancelledByHumanId: Type.TUnion<[Type.TString, Type.TNull]>;
-    cancelReason: Type.TUnion<[Type.TString, Type.TNull]>;
-    maxAttempts: Type.TNumber;
-    dispatchTimeoutSec: Type.TUnion<[Type.TInteger, Type.TNull]>;
-    runningTimeoutSec: Type.TUnion<[Type.TInteger, Type.TNull]>;
-}>;
-
-declare type Task = Static<typeof Task>;
-
-declare const TaskMessage: Type.TObject<{
-    taskId: Type.TString;
-    attemptN: Type.TNumber;
-    seq: Type.TNumber;
-    timestamp: Type.TString;
-    kind: Type.TUnion<[Type.TLiteral<"text_delta">, Type.TLiteral<"tool_call_start">, Type.TLiteral<"tool_call_end">, Type.TLiteral<"turn_end">, Type.TLiteral<"error">, Type.TLiteral<"info">]>;
-    payload: Type.TRecord<"^.*$", Type.TUnknown>;
-}>;
-
-declare type TaskMessage = Static<typeof TaskMessage>;
-
-/**
- * Terminal result of an attempt. Distinct from `TaskAttempt` — this is
- * the compact shape the runtime surfaces back to whoever drove it
- * (stdout reporter, API reporter in PR 7, etc.).
- */
-declare const TaskOutput: Type.TObject<{
-    taskId: Type.TString;
-    attemptN: Type.TNumber;
-    status: Type.TUnion<[Type.TLiteral<"completed">, Type.TLiteral<"failed">, Type.TLiteral<"cancelled">]>;
-    output: Type.TUnion<[Type.TRecord<"^.*$", Type.TUnknown>, Type.TNull]>;
-    outputCid: Type.TUnion<[Type.TString, Type.TNull]>;
-    usage: Type.TObject<{
-        inputTokens: Type.TInteger;
-        outputTokens: Type.TInteger;
-        cacheReadTokens: Type.TOptional<Type.TInteger>;
-        cacheWriteTokens: Type.TOptional<Type.TInteger>;
-        toolCalls: Type.TOptional<Type.TInteger>;
-        model: Type.TOptional<Type.TString>;
-        provider: Type.TOptional<Type.TString>;
-    }>;
-    durationMs: Type.TNumber;
-    error: Type.TOptional<Type.TObject<{
-        code: Type.TString;
-        message: Type.TString;
-        stack: Type.TOptional<Type.TString>;
-        retryable: Type.TOptional<Type.TBoolean>;
-        retry: Type.TOptional<Type.TObject<{
-            source: Type.TUnion<[Type.TLiteral<"explicit">, Type.TLiteral<"deterministic">, Type.TLiteral<"attempts_exhausted">, Type.TLiteral<"triage">, Type.TLiteral<"triage_failed">]>;
-            decision: Type.TOptional<Type.TUnion<[Type.TLiteral<"retry">, Type.TLiteral<"do_not_retry">]>>;
-            confidence: Type.TOptional<Type.TUnion<[Type.TLiteral<"low">, Type.TLiteral<"medium">, Type.TLiteral<"high">]>>;
-            reason: Type.TOptional<Type.TString>;
-        }>>;
-    }>>;
-    contentSignature: Type.TOptional<Type.TString>;
-}>;
-
-declare type TaskOutput = Static<typeof TaskOutput>;
-
-/**
- * Append-only event sink for a single task attempt.
- *
- * Contract: `TaskReporter` is the ONLY I/O surface `executeTask` has.
- * Whether events go to stdout, a JSONL file, or an HTTP POST is the
- * reporter's concern — so `executeTask` is identical in local and API
- * modes (the single abstraction that lets PR 7 be pure plumbing).
- *
- * Records written via `record()` carry a monotonic `seq` per
- * `(taskId, attemptN)`; reporters assign it internally.
- *
- * Reporters MUST be idempotent on replay: if the same `seq` is seen
- * twice with the same payload, that's a reconnect, not a bug.
- */
-declare interface TaskReporter {
-    /**
-     * Open the reporter for a specific attempt. Called once before any
-     * `record()` calls. Reporters that don't need per-attempt state can
-     * return immediately.
-     */
-    open(ctx: {
-        taskId: string;
-        attemptN: number;
-    }): Promise<void>;
-    /**
-     * Record one event. `seq`, `timestamp`, `taskId`, `attemptN` are
-     * supplied by the reporter — callers pass the body only.
-     */
-    record(body: Omit<TaskMessage, 'taskId' | 'attemptN' | 'seq' | 'timestamp'>): Promise<void>;
-    /**
-     * Final accounting. Writes a summary the runtime can surface; does
-     * NOT imply a particular output kind (completion vs failure).
-     */
-    finalize(usage: TaskUsage): Promise<void>;
-    /** Flush buffers + release resources. Called once. Idempotent. */
-    close(): Promise<void>;
-    /**
-     * Signal that aborts when the task is cancelled by the proposer (or a
-     * diary writer) while the executor is running. `ApiTaskReporter`
-     * aborts this on the next heartbeat that observes `cancelled: true`
-     * in the response (#938). Local reporters (`StdoutReporter`,
-     * `JsonlTaskReporter`) never abort — there's no remote cancel
-     * channel for `FileTaskSource`.
-     *
-     * Executors should pass this signal into long-running work
-     * (LLM calls, sandbox execution, file ops) and surface a
-     * `status: 'cancelled'` output when it fires. The runtime also
-     * checks the signal post-execute and converts any output to
-     * `cancelled` if the executor returned without honoring it.
-     */
-    readonly cancelSignal: AbortSignal;
-    /**
-     * The reason supplied to `/tasks/:id/cancel` by the canceller, if
-     * cancellation has been observed. Null until `cancelSignal` aborts.
-     */
-    readonly cancelReason: string | null;
-    /**
-     * Request local cancellation of the in-flight task. Runtime shutdown uses
-     * this to trip the same executor-facing signal as proposer cancellation,
-     * without waiting for the next server heartbeat.
-     */
-    requestCancel?(reason: string): void;
-}
-
-declare const TaskStatus: Type.TUnion<[Type.TLiteral<"waiting">, Type.TLiteral<"queued">, Type.TLiteral<"dispatched">, Type.TLiteral<"running">, Type.TLiteral<"completed">, Type.TLiteral<"failed">, Type.TLiteral<"cancelled">, Type.TLiteral<"expired">]>;
-
-declare type TaskStatus = Static<typeof TaskStatus>;
-
-/**
- * Token / cost accounting for one attempt.
- * Reported by the runtime; persisted per-attempt, also rolled up into
- * `TaskOutput.usage` for convenience.
- */
-declare const TaskUsage: Type.TObject<{
-    inputTokens: Type.TInteger;
-    outputTokens: Type.TInteger;
-    cacheReadTokens: Type.TOptional<Type.TInteger>;
-    cacheWriteTokens: Type.TOptional<Type.TInteger>;
-    toolCalls: Type.TOptional<Type.TInteger>;
-    model: Type.TOptional<Type.TString>;
-    provider: Type.TOptional<Type.TString>;
-}>;
-
-declare type TaskUsage = Static<typeof TaskUsage>;
-
-/**
- * Map a host-side absolute path to a guest-side workspace path.
- * Throws if the path escapes the workspace.
- */
-export declare function toGuestPath(localCwd: string, localPath: string, guestWorkspace: string): string;
-
-export declare type ToolEnforcement = Static<typeof ToolEnforcementSchema>;
-
-declare const ToolEnforcementSchema = Type.Union(toolEnforcementLiterals, {
-    description:
-    'Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed).',
-});
-
-export declare interface ToolPolicyExtensionDeps {
-    policy: SessionToolPolicy;
-    analyzer: ShellCommandAnalyzer;
-    logger: ToolPolicyLogger;
-}
-
-/**
- * Structured logger the resolver and gate emit to. Deliberately the pino
- * `(obj, msg)` shape so the daemon can pass a task-bound pino child directly —
- * every tool-policy line then carries the daemon's taskId/attemptN context and
- * lands in the same NDJSON stream as the rest of the run.
- */
-declare interface ToolPolicyLogger {
-    debug: (obj: Record<string, unknown>, msg: string) => void;
-    info: (obj: Record<string, unknown>, msg: string) => void;
-    warn: (obj: Record<string, unknown>, msg: string) => void;
-}
-
-declare interface TrackedError {
-    toolName: string;
-    toolCallId: string;
-    input: Record<string, unknown>;
-    error: string;
-    timestamp: number;
-}
-
-export declare interface TurnEventHandler {
-    (event: TurnEventKind, summary: Record<string, unknown>): void;
-}
-
-export declare type TurnEventHandlerFactory = (claimedTask: ClaimedTask) => TurnEventHandler;
-
-export declare type TurnEventKind = Parameters<TaskReporter['record']>[0]['kind'];
-
-export declare interface VmConfig {
-    /** Absolute path to the qcow2 checkpoint. */
-    checkpointPath: string;
-    /** MoltNet agent name (used to resolve credentials). */
-    agentName: string;
-    /**
-     * Host root that owns `.moltnet/<agentName>/`.
-     *
-     * Defaults to the main git worktree for backwards compatibility. Daemon
-     * callers pass the sandbox root so non-git scratch/shared tasks can boot.
-     */
-    agentRootDir?: string;
-    /** Host directory to mount into the VM. */
-    mountPath: string;
-    /** Effective workspace shape selected by the caller. */
-    workspaceMode?: 'shared_mount' | 'dedicated_worktree' | 'scratch_mount';
-    /** Additional hosts to allow in egress policy. */
-    extraAllowedHosts?: string[];
-    /** Full sandbox config (vfs shadows, env overrides). */
-    sandboxConfig?: SandboxConfig;
-    /**
-     * Host environment variable names to copy into the VM process.
-     *
-     * Runtime profiles use this for provider API keys: `requiredEnv` proves the
-     * daemon host has the secret, and this allowlist forwards only those names
-     * into the guest without storing secret values in the profile.
-     */
-    forwardEnv?: string[];
-    /** Abort resume/setup work, closing any live VM owned by resumeVm. */
-    signal?: AbortSignal;
-}
-
-export declare interface VmCredentials {
-    moltnetJson: string;
-    agentEnvRaw: string;
-    /**
-     * Pi OAuth/API-key auth blob. Null when neither `~/.pi/agent/auth.json`
-     * (resolved via `PI_CODING_AGENT_DIR` when set) is present — in that
-     * case the daemon relies on Pi's env-var providers (`ANTHROPIC_API_KEY`,
-     * etc.) carried via `agentEnv` and the host environment instead. CI uses
-     * this path.
-     */
-    piAuthJson: string | null;
-    agentEnv: Record<string, string | undefined>;
-    gitconfig: string | null;
-    sshPrivateKey: string | null;
-    sshPublicKey: string | null;
-    allowedSigners: string | null;
-    /** Raw PEM content of the GitHub App private key, or null if not configured. */
-    githubAppPem: string | null;
-    /** VM-local filename for the GitHub App PEM (basename of host path), or null. */
-    githubAppPemFilename: string | null;
-}
-
-/**
- * Subset of `@earendil-works/gondolin`'s `VmFs` we actually use. We
- * narrow the dependency surface so unit tests can hand in a
- * vitest-mocked object without instantiating a real VM. We use `any`
- * for the options parameter to make this interface bivariantly
- * compatible with `VmFs` (whose options types differ between
- * `mkdir` and `writeFile`); the orchestrator only ever calls these
- * methods with the documented option shape, so the looseness is
- * confined to this seam.
- */
-export declare interface VmFsForContext {
-    mkdir: (dirPath: string, options?: any) => Promise<void>;
-    writeFile: (filePath: string, data: string | Uint8Array, options?: any) => Promise<void>;
-}
+export { PiOtelOptions }
 
 export { }