@wular/coder 0.4.12 → 0.5.0

package/dist/{index-BdkdNI1v.d.ts → index-ezhbF5wC.d.ts}

@@ -1,195 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as z from "zod";
 import * as z$1 from "zod/mini";
-//#region src/core/config.d.ts
-declare const engineSchema: z$1.ZodMiniEnum<{
-  custom: "custom";
-  claude: "claude";
-  codex: "codex";
-}>;
-declare const effortSchema: z$1.ZodMiniEnum<{
-  low: "low";
-  medium: "medium";
-  high: "high";
-}>;
-declare const permissionSchema: z$1.ZodMiniEnum<{
-  "read-only": "read-only";
-  "workspace-write": "workspace-write";
-  auto: "auto";
-}>;
-declare const customModelSchema: z$1.ZodMiniObject<{
-  baseUrl: z$1.ZodMiniURL;
-  model: z$1.ZodMiniString<string>;
-  envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-    chat: "chat";
-    responses: "responses";
-  }>>;
-  disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-}, z$1.core.$strict>;
-/** The merged, effective shape (everything present after DEFAULT_CONFIG). */
-declare const mcpEntrySchema: z$1.ZodMiniObject<{
-  connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-  env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-  url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-    http: "http";
-    stdio: "stdio";
-  }>>;
-  headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-  tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-  description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-}, z$1.core.$strict>;
-declare const effectiveConfigSchema: z$1.ZodMiniObject<{
-  conversationCompactTokens: z$1.ZodMiniNumber<number>;
-  chain: z$1.ZodMiniArray<z$1.ZodMiniEnum<{
-    custom: "custom";
-    claude: "claude";
-    codex: "codex";
-  }>>;
-  engines: z$1.ZodMiniObject<{
-    codex: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-      network: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-    }, z$1.core.$strict>>;
-    claude: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-    }, z$1.core.$strict>>;
-    custom: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-    }, z$1.core.$strict>>;
-  }, z$1.core.$strict>;
-  models: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniObject<{
-    baseUrl: z$1.ZodMiniURL;
-    model: z$1.ZodMiniString<string>;
-    envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      chat: "chat";
-      responses: "responses";
-    }>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>, z$1.ZodMiniObject<{
-    provider: z$1.ZodMiniEnum<{
-      claude: "claude";
-      codex: "codex";
-    }>;
-    model: z$1.ZodMiniString<string>;
-    effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      low: "low";
-      medium: "medium";
-      high: "high";
-    }>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>, z$1.ZodMiniObject<{
-    disabled: z$1.ZodMiniBoolean<boolean>;
-  }, z$1.core.$strict>]>>>;
-  agents: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniBoolean<boolean>, z$1.ZodMiniObject<{
-    engine: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      low: "low";
-      medium: "medium";
-      high: "high";
-    }>>;
-    permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      "read-only": "read-only";
-      "workspace-write": "workspace-write";
-      auto: "auto";
-    }>>;
-    access: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      read: "read";
-      write: "write";
-    }>>;
-    runner: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      local: "local";
-      "local-docker": "local-docker";
-      "vercel-sandbox": "vercel-sandbox";
-      "github-actions": "github-actions";
-    }>>;
-    integrations: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
-      allowedEvents: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    }, z$1.core.$strict>>>;
-    connections: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>]>>>;
-  mcp: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
-    connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-    url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      http: "http";
-      stdio: "stdio";
-    }>>;
-    headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-    tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  }, z$1.core.$strict>>>;
-  approvals: z$1.ZodMiniObject<{
-    escalationTimeoutMs: z$1.ZodMiniNumber<number>;
-    allowedNetworkHosts: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
-  }, z$1.core.$strict>;
-}, z$1.core.$strict>;
-type McpConfigEntry = z$1.infer<typeof mcpEntrySchema> & {
-  repository?: boolean;
-};
-type Engine = z$1.infer<typeof engineSchema>;
-type Effort = z$1.infer<typeof effortSchema>;
-type Permission = z$1.infer<typeof permissionSchema>;
-type CustomModelConfig = z$1.infer<typeof customModelSchema>;
-type CoderConfig = z$1.infer<typeof effectiveConfigSchema>;
-declare const config: {
-  /** A config value by dotted key (or the whole effective config). */
-  get: (key?: string, opts?: {
-    cwd?: string;
-  }) => unknown;
-  /** Set a config value; `workspace` targets the repo file instead of the user file. */
-  set: (key: string, value: unknown, opts?: {
-    workspace?: boolean;
-    cwd?: string;
-    unset?: boolean;
-  }) => {
-    file: string;
-    key: string;
-    effective: unknown;
-    value?: unknown;
-    unset?: boolean;
-  };
-};
-//#endregion
 //#region ../node_modules/.bun/@types+unist@3.0.3/node_modules/@types/unist/index.d.ts
 // ## Interfaces
 /**
@@ -1290,75 +1101,16 @@ interface SerializedThread {
  */
 type ChannelVisibility = "private" | "workspace" | "external" | "unknown";
 //#endregion
-//#region src/agent/types.d.ts
-type Preset = 'read' | 'write';
-/** Per-integration wiring in a definition. `events` list = default behavior, map = event -> flow. */
-/** Event value in a definition map: a flow name, or options. */
-interface AgentEventOptions {
-  /** Flow to run; omit for the default agent. */
-  flow?: string;
-  /** Regex the event text must match (e.g. keywords on Slack `message`). */
-  match?: string;
-  /** May only narrow the agent's default permission for this event. */
-  permissions?: Permission;
-  /** `requester`: the task acts with the linked requester's own platform token. */
-  actAs?: 'requester';
-}
-interface AgentDefinitionIntegration {
-  events?: string[] | Record<string, string | true | AgentEventOptions>;
-}
-/** What an agent IS: `.coder/agents/<id>/agent.json` beside its system.md. */
-interface AgentDefinition {
-  /** Display name used in replies; defaults to the id. */
-  name?: string;
-  description?: string;
-  engine?: string;
-  runner?: string;
-  model?: string;
-  effort?: Effort;
-  permissions?: Permission;
-  /** Read-only or Read-write on its handles and connections; defaults to `write`. */
-  access?: Preset;
-  /** MCP servers every task of this agent attaches, in the `.mcp.json` entry shape. */
-  mcp?: Record<string, McpConfigEntry>;
-  integrations: Record<string, AgentDefinitionIntegration>;
-}
-/** Per-integration caps in usage: `allowedEvents` intersects the definition's. */
-interface AgentUsageIntegration {
-  allowedEvents?: string[];
-}
-/** How a repo RUNS an agent: one entry under `agents` in .coder/config.json. */
-interface AgentUsage {
-  engine?: string;
-  model?: string;
-  effort?: Effort;
-  permissions?: Permission;
-  /** May only lower the definition's access. */
-  access?: Preset;
-  integrations?: Record<string, AgentUsageIntegration>;
-  /** Connections its tasks may use, by id; absent allows every connection the task is granted. */
-  connections?: string[];
-  /** Off in this workspace; the other settings stay for when it is enabled again. */
-  disabled?: boolean;
-}
-interface Agent {
-  id: string;
-  /** definition.name ?? id. */
-  name: string;
-  definition: AgentDefinition;
-  usage?: AgentUsage;
-  /** Absolute folder path when the agent's body is on disk; remote agents have none. */
-  dir?: string;
-  /** Stored agent body, including system.md, when there is no on-disk folder. */
-  files?: Record<string, string>;
-  builtin: boolean;
-}
-/** A platform event, already typed by its integration. */
-interface AgentEvent {
+//#region src/integrations/types.d.ts
+/** Access: read-only tools, or every tool with the engine's reviewer deciding what leaves the sandbox. */
+declare const ACCESS: readonly ["read-only", "auto"];
+type Access = (typeof ACCESS)[number];
+/** A platform event, typed by its integration. */
+interface PlatformEvent {
   integration: string;
   /** Catalog name, e.g. `pull_request` or `mention`. */
   type: string;
-  /** `AgentApp.id` the webhook was addressed to. */
+  /** `PlatformApp.id` the webhook was addressed to. */
   appId: string;
   installationId: string;
   deliveryId: string;
@@ -1370,28 +1122,17 @@ interface AgentEvent {
   };
   /** Human text attached to the event: mention body, comment, PR title + body. */
   text: string;
-  /** What the platform tells an agent about where the event happened, such as a Linear issue; bounded. */
-  promptContext?: string;
-  /** The covered account it happened in, for an installation that covers several. */
-  within?: string;
+  /** The text @-mentions the app, on an event with no chat message to say so (an opened GitHub issue). */
+  mentioned?: true;
+  /** The platform account it happened in (Slack team, GitHub org), for an installation that covers several. */
+  account?: string;
   /** The Chat SDK thread and message it happened in, without raw platform payloads; replies go to this thread. */
   chat?: {
     thread: SerializedThread;
     message?: SerializedMessage;
   };
-  /** Whether the agent must answer: a mention, a 1:1 direct message, or a handle that answers every prompt. */
-  mustReply?: boolean;
-  /** The event's place in its conversation, gathered at dispatch; `more` counts messages past `since`'s cap. */
-  conversation?: {
-    index?: number;
-    since?: SinceMessage[];
-    more?: number;
-    /** Internal acknowledgement watermark of the recorded unseen snapshot. */
-    unseen?: {
-      version: number;
-      epoch?: string;
-    };
-  };
+  /** Where it happened and who may see that place; unknown privacy counts as private. */
+  space?: Space;
   repo?: {
     owner: string;
     name: string;
@@ -1399,94 +1140,242 @@ interface AgentEvent {
     defaultBranch: string;
   };
 }
-/** Per-installation settings a user sets from the platform (`/setup` in Slack). */
-interface InstallationSettings {
-  model?: string;
-  engine?: string;
-  effort?: string;
-}
-/** Where a task came from: a Coder surface, or the id of the integration whose event started it. */
-type TaskSource = 'dashboard' | 'cli' | 'schedule' | (string & {});
-interface AgentTask {
-  cwd?: string;
+/** A place events come from: a channel (DMs too), a repository or a team; `private` is unknown until the platform told it. */
+interface Space {
+  kind: 'channel' | 'repository' | 'team';
   id: string;
-  name?: string;
-  source: TaskSource;
-  agent: string;
-  /** Flow name, or `default` for the built-in single-task behavior. */
-  flow: string;
-  runner: RunnerKind;
-  /** Registered `http` runner the task routes to. */
-  runnerId?: string;
-  /** Effective permission after host, usage, and event narrowing. */
-  permissions?: Permission;
-  /** The platform event, or for a dashboard or CLI task on a repo, that repo through its install. */
-  event?: AgentEvent;
-  /** What a dashboard or CLI task asks; the newest turn after a continue. */
-  prompt?: string;
-  /** Flow arguments given directly, instead of derived from the event. */
-  args?: Record<string, unknown>;
-  /** Workspace MCP servers the task attaches, by name. */
-  mcp?: string[];
-  /** Connection ids granted when the task was made; secrets are resolved only when it starts. */
-  connections?: string[];
-  /** Handle the task posts as (GitHub `slug[bot]`, Slack bot user), so flows can trust only their own comments. */
-  author?: string;
-  definition: AgentDefinition;
-  /** Frozen id of the credential selected for this task. */
-  credential?: string;
-  /** The engine order for this task; a pinned engine has one entry. */
-  engineChain?: string[];
-  /** Applicable credentials frozen with the engine order, without their values. */
-  engineCredentials?: Record<string, string>;
-  /** Wular user who asked, when known; their personal credential comes first. */
-  requester?: string;
-  /** Stored agent body for runners whose checkout does not contain the agent. */
-  files?: Record<string, string>;
-  usage?: AgentUsage;
-  /** Effective tools per integration the agent declares, by its access mode; every installation of the agent's apps serves them. */
-  tools: Record<string, string[]>;
-  /** Context gathered by the receiver: notes for the turn and who asked. */
-  context?: TaskContext;
-  /** What the platform thread gets when the run fails without an answer. */
-  failureReply?: string;
-  /** The task's dashboard page, linked when the agent returns no reply where one is due. */
-  taskUrl?: string;
-}
-interface TaskContext {
-  outputSchema?: object;
-  /** Earlier turns a dashboard continuation pastes in, oldest first. */
-  messages?: Array<{
-    user: string;
-    text: string;
-    ts: string;
-  }>;
-  /** Completed turns of this task, kept across dashboard continuations. */
-  turns?: TaskTurn[];
-  /** Notes the receiver adds for the agent, such as a missing account connection. */
-  instructions?: string;
-  /** Whether this turn requires a reply. */
-  mustReply?: boolean;
-  /** The last conversation batch each kind admitted, by steer or resume. */
-  admissions?: Partial<Record<'batch' | 'reactions', string>>;
-  /** The Coder account behind the event's actor, when they connected it. */
-  user?: {
-    name: string;
-    email: string;
-  };
+  private?: boolean;
 }
-//#endregion
-//#region src/integrations/types.d.ts
 /** A message the agent did not get as a turn, as `since` lists it. */
 interface SinceMessage {
-  /** The platform's message id, so a message counts once; not shown to the agent. */
+  /** The platform's message id, so a message counts once. */
   id?: string;
+  /** The id of the thread it was posted in. */
+  thread?: string;
   author: string;
   text: string;
   sentAt: string;
 }
 //#endregion
+//#region src/core/config.d.ts
+/**
+ * Strict schema for a config object (a file's contents or the merged result).
+ * Unknown keys and out-of-range values are errors, not warnings. These schemas
+ * are the source of truth for the config domain types (types.ts re-exports the
+ * z.infer'd types).
+ */
+declare const engineSchema: z$1.ZodMiniEnum<{
+  custom: "custom";
+  claude: "claude";
+  codex: "codex";
+}>;
+declare const effortSchema: z$1.ZodMiniEnum<{
+  low: "low";
+  medium: "medium";
+  high: "high";
+}>;
+declare const customModelSchema: z$1.ZodMiniObject<{
+  baseUrl: z$1.ZodMiniURL;
+  model: z$1.ZodMiniString<string>;
+  envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    chat: "chat";
+    responses: "responses";
+  }>>;
+  contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
+  disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+}, z$1.core.$strict>;
+/** The merged, effective shape (everything present after DEFAULT_CONFIG). */
+declare const mcpEntrySchema: z$1.ZodMiniObject<{
+  connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+  env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+  url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    stdio: "stdio";
+    http: "http";
+  }>>;
+  headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+  tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+  description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  connect: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    start: "start";
+    "first-use": "first-use";
+  }>>;
+}, z$1.core.$strict>;
+declare const effectiveConfigSchema: z$1.ZodMiniObject<{
+  $schema: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  version: z$1.ZodMiniLiteral<1>;
+  chain: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
+  reviewModel: z$1.ZodMiniString<string>;
+  models: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniString<string>, z$1.ZodMiniLiteral<false>, z$1.ZodMiniObject<{
+    baseUrl: z$1.ZodMiniURL;
+    model: z$1.ZodMiniString<string>;
+    envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      chat: "chat";
+      responses: "responses";
+    }>>;
+    contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
+    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>]>>>;
+  agents: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniBoolean<boolean>, z$1.ZodMiniObject<{
+    model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    access: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      "read-only": "read-only";
+      auto: "auto";
+    }>>;
+    runner: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      local: "local";
+      "local-docker": "local-docker";
+      "vercel-sandbox": "vercel-sandbox";
+      "github-actions": "github-actions";
+    }>>;
+    integrations: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
+      allowedEvents: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    }, z$1.core.$strict>>>;
+    connections: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>]>>>;
+  mcp: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
+    connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+    url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      stdio: "stdio";
+      http: "http";
+    }>>;
+    headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+    tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    connect: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      start: "start";
+      "first-use": "first-use";
+    }>>;
+  }, z$1.core.$strict>>>;
+  network: z$1.ZodMiniObject<{
+    allowedHosts: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
+    readOnlyTasks: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>;
+}, z$1.core.$strict>;
+type McpConfigEntry = z$1.infer<typeof mcpEntrySchema> & {
+  repository?: boolean;
+};
+type Engine = z$1.infer<typeof engineSchema>;
+type Effort = z$1.infer<typeof effortSchema>;
+type CustomModelConfig = z$1.infer<typeof customModelSchema>;
+type CoderConfig = z$1.infer<typeof effectiveConfigSchema>;
+declare const config: {
+  /** A config value by dotted key (or the whole effective config). */
+  get: (key?: string, opts?: {
+    cwd?: string;
+  }) => unknown;
+  /** Set a config value; `workspace` targets the repo file instead of the user file. */
+  set: (key: string, value: unknown, opts?: {
+    workspace?: boolean;
+    cwd?: string;
+    unset?: boolean;
+  }) => {
+    file: string;
+    key: string;
+    effective: unknown;
+    value?: unknown;
+    unset?: boolean;
+  };
+};
+//#endregion
 //#region src/client/types.d.ts
+/** The parts of `agent.json` the dashboard shows or edits against. */
+interface AgentDefinition {
+  name?: string;
+  description?: string;
+  model?: string;
+  access?: Access;
+  integrations?: Record<string, {
+    events?: string[] | Record<string, unknown>;
+  }>;
+}
+/** Organization overrides for one agent (`AgentUsage` on the server). */
+interface AgentSettings {
+  engine?: string;
+  model?: string;
+  effort?: string;
+  /** A registered runner id; unset follows the requester's default. */
+  runner?: string;
+  access?: Access;
+  integrations?: Record<string, {
+    allowedEvents?: string[];
+  }>;
+  /** Connections its tasks may use, by id; absent allows every granted one. */
+  connections?: string[];
+  /** Off in this workspace: no platform events, no new tasks. */
+  disabled?: boolean;
+}
+interface AgentRow {
+  id: string;
+  name: string;
+  description?: string;
+  source: string;
+  /** The agent a task runs when it names none. */
+  default?: true;
+  repo?: string;
+  path?: string;
+  /** Browser address of the tracked folder, for repository agents. */
+  sourceUrl?: string;
+  currentVersion: number;
+  /** A local server's agent, which keeps no versions; `commit` is its folder's last commit. */
+  local?: true;
+  commit?: string;
+  updatedAt?: number;
+  definition?: AgentDefinition;
+  systemPrompt?: string;
+  files?: Record<string, string>;
+  settings?: AgentSettings;
+  versions?: VersionRow[];
+  /** The names it answers to, one per app that wakes on mentions, with the platform's display name. */
+  handles?: Array<{
+    name: string;
+    integration: string;
+    platform: string;
+  }>;
+  /** Where its apps are installed: the platform, the account and the app's name. */
+  installations?: Array<{
+    integration: string;
+    account: string;
+    app: string;
+  }>;
+  /** Platform events it failed to handle in the last day, with the newest; absent when none. */
+  deliveries?: {
+    failed: number;
+    recent: FailedDeliveryRow[];
+  };
+  /** The model it runs first for the caller, by name, and where its list runs for them. */
+  model?: string;
+  runsOn?: string;
+  /** Nothing can run any of its models for the caller: no credential of theirs or the workspace's, no sign-in on this machine. */
+  needsModel?: true;
+  /** Engines, and custom models as `custom/<name>`, that no workspace credential runs, so its settings can't pick them. */
+  unrunnable?: string[];
+  /** Why its definition is invalid; it answers no events until fixed. */
+  problems?: string[];
+  /** Keys its definition has that Coder renamed, with their new name, or no longer reads. */
+  stale?: {
+    renamed?: Record<string, string>;
+    unknown?: string[];
+  };
+}
+/** A platform event Coder failed to handle. */
+interface FailedDeliveryRow {
+  at: number;
+  platform: string;
+  type?: string;
+  error: string;
+  /** The thread or issue it came from. */
+  url?: string;
+}
 /** What publishing did to one of the agent's apps: pushed it, failed to, or found it needs changes on the platform. */
 interface AppSync {
   id: string;
@@ -1496,6 +1385,31 @@ interface AppSync {
   error?: string;
   drift?: true;
 }
+interface VersionRow {
+  version: number;
+  createdAt: number;
+  importedFrom?: string;
+  commit?: string;
+}
+/** An alias's model spec, false for a name turned off, or a custom endpoint. */
+type ModelEntry = string | false | {
+  baseUrl: string;
+  model: string;
+  envKey?: string;
+  wireApi?: 'chat' | 'responses';
+  contextWindow?: number;
+  disabled?: boolean;
+};
+type Config = {
+  version?: number;
+  chain?: string[];
+  reviewModel?: string;
+  models?: Record<string, ModelEntry>;
+  network?: {
+    allowedHosts?: string[];
+    readOnlyTasks?: boolean;
+  };
+};
 type RunnerKind = 'local' | 'local-docker' | 'vercel-sandbox' | 'github-actions' | 'http';
 interface RunnerSpec {
   kind: RunnerKind;
@@ -1547,11 +1461,20 @@ interface RunnerTest {
   detail: string;
   ms: number;
 }
+type ModelsShape = {
+  /** Built-in aliases, name -> model spec. */
+  builtin: Record<string, string>;
+  models: Record<string, ModelEntry>;
+  /** Where each chain model and the review model run for the caller, by spec. */
+  runsOn?: Record<string, string>;
+};
 interface ProbeResult {
   reachable: boolean;
   modelListed: boolean | null;
   /** Model ids the endpoint lists, or null when it has no list. */
   models: string[] | null;
+  /** Context window in tokens per model id, where the provider reports one. */
+  contextWindows?: Record<string, number>;
   detail: string;
 }
 /** One connection as the dashboard lists it; secrets never leave the server. */
@@ -1560,11 +1483,17 @@ interface ConnectionRow {
   name: string;
   /** `mcp`, `env` for an API key tasks read from `env`, or the integration id whose API it reaches. */
   provider: string;
-  /** Set on a member's own connection; `mine` when that member is the viewer. */
-  owner?: string;
-  mine?: true;
-  /** Absent follows the mode of the agent whose task uses it. */
-  access?: 'read' | 'write';
+  scope: 'personal' | 'workspace';
+  /** Set on a member's own connection; `asker` when that member is the one asking. */
+  owner?: {
+    id: string;
+    name?: string;
+  };
+  asker?: true;
+  /** Set on an agent's app installation, managed on that agent's Platforms tab. */
+  agent?: string;
+  /** `read-only` exposes only its read-only tools; absent or `auto` follows the task. */
+  access?: Access;
   auth: 'none' | 'key' | 'oauth';
   /** The remote server, or the stdio command, it is bound to. */
   url?: string;
@@ -1572,8 +1501,10 @@ interface ConnectionRow {
   /** The environment variable an `env` connection's key is in. */
   env?: string;
   account?: string;
-  /** `authorize`: OAuth not finished yet; `reconnect`: its secret stopped working. */
-  status: 'ok' | 'authorize' | 'reconnect';
+  /** `needs-auth`: its sign-in is unfinished or its secret stopped working; `disabled`: not granted to the task listing it. */
+  status: 'connected' | 'needs-auth' | 'disabled';
+  /** The task's tool search name for it, when the task has it. */
+  server?: string;
   createdAt: number;
 }
 interface LocalFolder {
@@ -1600,9 +1531,11 @@ interface TaskTurn {
   finishedAt?: number;
   /** First log sequence after this turn. */
   logSeq?: number;
+  /** The approval whose decision this turn's prompt is: it shows as that decision, not as a prompt. */
+  approval?: string;
 }
 //#endregion
-//#region src/core/task/log-view.d.ts
+//#region src/core/task/view.d.ts
 interface TaskLogEntry {
   at?: string;
   message?: string;
@@ -1633,21 +1566,27 @@ interface AgentPromptParts {
   };
   /** Conversation tasks: the events the agent subscribes to. */
   events?: string[];
-  /** The agent's access mode. */
-  access?: 'read' | 'write';
+  /** The agent's access. */
+  access?: Access;
 }
 interface SystemPromptParts extends AgentPromptParts {
-  /** The task's MCP servers as the worker renders them on each turn. */
-  servers?: string;
-  /** Coder's task tools this turn has, as the worker serves them. */
-  tools?: string[];
   cwd?: string;
   /** A platform event's task, whose final message is a reply in a thread; otherwise a general task. */
   conversation?: boolean;
   /** The engine runs on this machine, not on a hosted runner. */
   local?: boolean;
-  /** `coder task run --system` text and flow instructions. */
-  instructions?: string;
+  /** The task's scratch folder on the machine it runs on. */
+  scratch?: string;
+  /** Sandboxed commands reach only the hosts they declare (Claude auto). */
+  declareHosts?: boolean;
+  /** The task may write (auto). */
+  writes?: boolean;
+  /** `coder task run --append-system` text and flow instructions. */
+  appendSystem?: string;
+  /** The final message is JSON for a schema, not a summary. */
+  structured?: boolean;
+  /** The turn has platform servers, which act as the app or as the person asking. */
+  connections?: boolean;
 }
 //#endregion
 //#region src/core/types.d.ts
@@ -1672,18 +1611,31 @@ interface McpServerSpec {
     env?: string;
     header?: string;
   };
+  /** Where `connection`'s token goes; the tool search asks for it on first use. */
+  credentialOnUse?: {
+    env?: string;
+    header?: string;
+  };
+  /** When `connection` was created; its token is given only to the same row at the same `url`. */
+  connectionCreatedAt?: number;
   /** Tool allowlist; omit or empty for every tool the server offers. */
   tools?: string[];
   /** Schemas load before the first prompt instead of behind tool search or the hub. */
   alwaysLoad?: boolean;
+  /** When the tool search connects it: at turn start, its instructions and tool names in the prompt, or on first use (default). */
+  connect?: 'start' | 'first-use';
   /** Only tools the server marks read-only may be called. */
   readOnly?: boolean;
   /** The integration a platform tool server reaches, and the account of its installation. */
   integration?: string;
   account?: string;
-  /** What the server reaches and the access it allows, as the prompt lists it. */
+  /** A personal connection's member, as `Connection.owner`; its first use asks them. */
+  owner?: string;
+  /** One line naming the server's identity and what it reaches, as the tool search lists it. */
   description?: string;
-  access?: 'read' | 'write';
+  /** What the server's tools do; shown before the server's own instructions. On an `alwaysLoad` server, the instructions it serves. */
+  instructions?: string;
+  access?: Access;
 }
 type TaskStatus = 'queued' | 'running' | 'completed' | 'failed' | 'cancelled';
 /** A persisted task record (task.json). Most fields accrete over the lifecycle. */
@@ -1697,25 +1649,20 @@ interface Task {
   prompt?: string;
   outputSchema?: object;
   currentPrompt?: string | null;
-  system?: string | null;
-  promptParts?: Omit<SystemPromptParts, 'servers'>;
+  appendSystem?: string | null;
+  promptParts?: SystemPromptParts;
   systemPrompt?: string;
   model?: string | null;
   effort?: Effort | null;
-  permissions?: Permission;
+  access?: Access;
   resumeThreadId?: string | null;
   cwd?: string;
   pid?: number | null;
   dispatchId?: string;
   threadId?: string | null;
   previousThreadIds?: string[];
-  pendingRollover?: {
-    summary: string;
-    recent: string;
-    exchanges: number;
-  };
-  rollingOver?: boolean;
   steerClosed?: boolean;
+  resumeOwner?: number;
   conversation?: boolean;
   turnId?: string | null;
   steerEndpoint?: string | null;
@@ -1726,14 +1673,13 @@ interface Task {
   resumedAt?: string;
   error?: string;
   fallbacks?: Array<{
-    engine: Engine;
+    model: string;
     detail: string;
-    next: Engine;
+    next: string;
   }>;
   archived?: boolean;
   archivedAt?: string;
   autoArchived?: boolean;
-  simulateApproval?: boolean;
   flowRunId?: string;
   agentId?: string;
   source?: string;
@@ -1746,6 +1692,14 @@ interface Task {
   nativeMcp?: boolean;
   addDirs?: string[];
 }
+/** Task options after resolving CLI flags against config defaults. */
+interface ResolvedTaskOptions {
+  /** codex, claude, or custom. */
+  engine: Engine;
+  model: string | null;
+  effort: Effort | null;
+  access: Access;
+}
 /** The outcome of running one engine turn. status 0 == success. */
 interface TurnResult {
   status: number;
@@ -1766,15 +1720,21 @@ interface Availability {
   available: boolean;
   detail: string;
 }
-/** A persisted approval escalation and its answer, if any. */
+/** A task's escalation and its answer, if any. */
 interface Approval {
   id: string;
-  summary: string;
-  /** Where an escalated command runs. */
-  cwd?: string;
+  /** One short sentence: what the actions are for. */
+  reason: string;
+  /** The exact commands; one answer covers them all. */
+  actions: string[];
   createdAt?: string;
+  /** `by` names who answered; `deliveredAt` is set once the task has the decision; `closed` when the task was stopped first. */
   response?: {
-    decision: string;
+    decision: 'accept' | 'decline' | 'closed';
+    reason?: string;
+    answeredAt?: string;
+    by?: string;
+    deliveredAt?: string;
   } | null;
   [key: string]: unknown;
 }
@@ -1799,13 +1759,11 @@ interface GateResult {
 }
 /** Options shared with `coder run`, plus `returns`. */
 interface FlowTaskOptions<T = unknown> {
-  engine?: string;
   model?: string;
-  effort?: string;
-  permissions?: string;
+  access?: Access;
   mcp?: string | McpServerSpec[];
   name?: string;
-  system?: string;
+  appendSystem?: string;
   cwd?: string;
   addDirs?: string[];
   returns?: FlowSchema<T>;
@@ -1813,8 +1771,7 @@ interface FlowTaskOptions<T = unknown> {
 /** Overrides for one more turn, as `coder task steer` takes them. */
 interface FlowSteerOptions {
   model?: string;
-  effort?: string;
-  permissions?: string;
+  access?: Access;
 }
 type FlowRunStatus = 'running' | 'completed' | 'failed' | 'stopped';
 /** An event recorded by the flow runtime and delivered to its hooks and followers. */
@@ -1901,7 +1858,7 @@ interface DiscoveredFlow {
   scope: 'workspace' | 'global' | 'builtin';
 }
 //#endregion
-//#region src/flow/journal.d.ts
+//#region src/flow/runtime.d.ts
 /**
  * Prefix-order replay. A call matches the first unconsumed recorded entry with
  * an identical fingerprint (fingerprint match rather than strict positional
@@ -1919,8 +1876,6 @@ declare class Journal {
   replay(...fps: string[]): JournalEntry | null;
   record(entry: Omit<JournalEntry, 'seq'>): void;
 }
-//#endregion
-//#region src/flow/runtime.d.ts
 /** Progress callbacks a foreground caller can attach to a run. */
 interface FlowHooks {
   /** Fired once the run is armed, with a stop handle for a SIGINT handler. */
@@ -1930,6 +1885,8 @@ interface FlowHooks {
     runningIds: () => string[];
   }) => void;
   onEvent?: (event: FlowEvent) => void;
+  /** A cloud runner's credentials for one model, best first; none skips the model. Unset runs on the process's own logins. */
+  onModel?: (model: ResolvedTaskOptions) => Promise<NodeJS.ProcessEnv[]>;
 }
 interface RunContext {
   runId: string;
@@ -1953,10 +1910,9 @@ interface RunContext {
     env: Record<string, string>;
     ids: string[];
   };
-  ceiling?: {
-    agent: string;
-    permissions: string;
-  };
+  access?: Access;
+  /** The credential each of its tasks runs on, by task id, so a steer resumes on it. */
+  credentialEnv?: Map<string, NodeJS.ProcessEnv>;
 }
 declare class Semaphore {
   limit: number;
@@ -2021,6 +1977,12 @@ interface TurnResultEntry {
   [key: string]: unknown;
 }
 declare function readTurnResults(cwd: string, taskId: string): TurnResultEntry[];
+interface CacheMigration {
+  cache: string;
+  tasks: number;
+  flows: number;
+  files: number;
+}
 //#endregion
 //#region src/flow/executor.d.ts
 interface RunOptions {
@@ -2033,11 +1995,8 @@ interface RunOptions {
   /** Platform credential for built-in integrations; never persisted with the run. */
   integrationToken?: string;
   connections?: RunContext['connections'];
-  /** The agent whose permissions cap every task this run starts. */
-  ceiling?: {
-    agent: string;
-    permissions: string;
-  };
+  /** The agent's access, which caps every task this run starts. */
+  access?: Access;
 }
 interface RunSummary {
   runId: string;
@@ -2110,10 +2069,10 @@ interface FallbackPayload {
   fallback: {
     action: 'run-native-subagent';
     reason: 'no-engine-available';
-    permissions: string;
+    access: string;
     instructions: string;
     note: string;
-    system?: string;
+    appendSystem?: string;
     task: string;
   };
 }
@@ -2132,9 +2091,8 @@ declare class CoderError extends Error {
   /** approval-pending: the approval to answer. */
   approval?: {
     id: string;
-    summary: string;
-    cwd?: string | null;
-    networkHost?: string | null;
+    reason: string;
+    actions: string[];
   };
   /** task-failed (flow task()): the failed task's result. */
   result?: unknown;
@@ -2157,9 +2115,10 @@ interface TaskResult {
   turns: TurnResultEntry[];
   task: Task;
 }
-/** Read a task's current state and result.json without waiting. `tail` fills `steps`. */
+/** Read a task's state and result.json without waiting. `tail` fills `steps`; `task` is the snapshot to judge by (a wait's), so a next turn starting meanwhile does not hide the finished one's result. */
 declare function readTask(cwd: string, taskId: string, opts?: {
   tail?: number | 'all';
+  task?: Task;
 }): TaskResult;
 //#endregion
 //#region src/flow/index.d.ts
@@ -2210,9 +2169,8 @@ declare const args: z.ZodObject<{
   author: z.ZodOptional<z.ZodString>;
   path: z.ZodOptional<z.ZodArray<z.ZodString>>;
   exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  engine: z.ZodOptional<z.ZodString>;
   model: z.ZodOptional<z.ZodString>;
-  effort: z.ZodOptional<z.ZodEnum<{
+  depth: z.ZodOptional<z.ZodEnum<{
     low: "low";
     medium: "medium";
     high: "high";
@@ -2315,8 +2273,6 @@ interface ReviewAuth {
   token?: string;
   exec?: ReviewExec;
 }
-/** The platform reviews post to; its tool server holds the token. */
-declare const REVIEW_PLATFORM = "github";
 interface ReviewComment {
   id: number;
   body?: string | null;
@@ -2345,4 +2301,4 @@ declare function resolveReviewTarget(input: ReviewTargetInput, auth?: ReviewAuth
 /** Post unseen findings and upsert the sticky summary through GitHub's integration. */
 declare function postReview(input: ReviewPostInput, auth?: ReviewAuth): number;
 //#endregion
-export { type FlowTaskOptions as $, type flowSdk as A, TaskSource as At, type review$1 as B, renderReviewMarkdown as C, AgentDefinition as Ct, type reviewCli as D, InstallationSettings as Dt, type review as E, AgentUsage as Et, type archiveRuns as F, type pipeline as G, type flow as H, type deleteRuns as I, type DiscoveredFlow as J, type steer as K, type RunOptions as L, readTask as M, CustomModelConfig as Mt, type CoderError as N, config as Nt, type reviewFingerprints as O, Preset as Ot, type RunResult as P, type FlowStep as Q, type RunSummary as R, type postReview as S, Agent as St, type resolveReviewTarget as T, AgentTask as Tt, type gate as U, type readTurnResults as V, type log as W, type FlowRecord as X, type FlowEvent as Y, type FlowSteerOptions as Z, type description as _, RunnerRow as _t, type ReviewExec as a, type TaskStatus as at, type ownReviewComments as b, RunnerUpdate as bt, type ReviewPostSummary as c, TokenUsage as ct, type ReviewSummary as d, LocalFolder as dt, FlowTaskResult as et, type ReviewTarget as f, LocalFolders as ft, type concurrency as g, RunnerPairing as gt, type changedLines as h, RunnerKind as ht, type ReviewAuth as i, Task as it, type TaskResult as j, CoderConfig as jt, type args$1 as k, TaskContext as kt, type ReviewResult as l, AppSync as lt, args as m, RunnerInput as mt, type REVIEW_PLATFORM as n, Approval as nt, ReviewPostFinding as o, TurnResult as ot, ReviewTargetInput as p, ProbeResult as pt, task as q, ReviewArgs as r, Availability as rt, ReviewPostInput as s, TaskLogEntry as st, Finding as t, GateResult as tt, ReviewServices as u, ConnectionRow as ut, fingerprint as v, RunnerSpec as vt, type repositoryRules as w, AgentEvent as wt, type parseGithubPr as x, TaskTurn as xt, type lastReviewSummary as y, RunnerTest as yt, type StopSummary as z };
+export { type FlowTaskOptions as $, type TaskResult as A, PlatformEvent as At, type CacheMigration as B, repositoryRules as C, TaskTurn as Ct, type reviewFingerprints as D, McpConfigEntry as Dt, type reviewCli as E, Effort as Et, type deleteRuns as F, type pipeline as G, type flow as H, type RunOptions as I, type DiscoveredFlow as J, type steer as K, type RunSummary as L, CoderError as M, type RunResult as N, type args$1 as O, config as Ot, type archiveRuns as P, type FlowStep as Q, type StopSummary as R, type renderReviewMarkdown as S, RunnerUpdate as St, type review as T, CustomModelConfig as Tt, type gate as U, type readTurnResults as V, type log as W, type FlowRecord as X, type FlowEvent as Y, type FlowSteerOptions as Z, type fingerprint as _, RunnerKind as _t, type ReviewPostFinding as a, type TurnResult as at, type parseGithubPr as b, RunnerSpec as bt, type ReviewResult as c, AgentRow as ct, type ReviewTarget as d, ConnectionRow as dt, FlowTaskResult as et, type ReviewTargetInput as f, LocalFolder as ft, type description as g, RunnerInput as gt, type concurrency as h, ProbeResult as ht, type ReviewExec as i, Task as it, type readTask as j, SinceMessage as jt, type flowSdk as k, Access as kt, type ReviewServices as l, AppSync as lt, changedLines as m, ModelsShape as mt, type ReviewArgs as n, Approval as nt, ReviewPostInput as o, TaskLogEntry as ot, args as p, LocalFolders as pt, task as q, ReviewAuth as r, Availability as rt, ReviewPostSummary as s, TokenUsage as st, Finding as t, GateResult as tt, ReviewSummary as u, Config as ut, lastReviewSummary as v, RunnerPairing as vt, type resolveReviewTarget as w, CoderConfig as wt, type postReview as x, RunnerTest as xt, type ownReviewComments as y, RunnerRow as yt, type review$1 as z };