agent-mcp-hub 0.5.2

package/dist/adapters/cursor.js

@@ -0,0 +1,33 @@
+export const cursorAdapter = {
+    name: "cursor",
+    summary: "Cursor Agent (cursor-agent) — Cursor's repo-aware autonomous coding agent; implements and edits code from a natural-language task.",
+    binary: "cursor-agent",
+    loginCommand: "cursor-agent login",
+    apiKeyEnv: "CURSOR_API_KEY",
+    // `cursor-agent models` requires a valid account, so exit 0 proves authentication
+    // — far stronger than `--version`. probeRequiresOutput stays false on purpose: it
+    // prints prose ("gpt-5.3-codex-low - Codex 5.3 Low"), not bare ids, so the
+    // identifier heuristic would find nothing and condemn a healthy CLI.
+    probeArgs: ["models"],
+    // Line-anchored on purpose: a loose /retry attempt \d+/i would also match that
+    // phrase appearing mid-line in output from a build script the agent runs.
+    stallSignatures: [
+        /^connection lost, reconnecting to \S+ \(attempt \d+\)\.*$/i,
+        /^retry attempt \d+\.*$/i,
+        /^retriable\s*error:\s*connection stalled\b/i,
+    ],
+    buildInvocation(prompt, options = {}) {
+        // --force: cursor-agent otherwise blocks on an interactive permission prompt
+        // ("Workspace Trust Required" / command approval) in any directory it has not
+        // seen before, which for a server invoked against arbitrary cwds is most of
+        // them. There is no stdin to answer it with in print mode, so the run would
+        // hang until the timeout kills it. (`--trust` is NOT a cursor-agent flag —
+        // passing it makes the CLI exit 1 with "unknown option '--trust'".)
+        const args = ["-p", "--output-format", "text", "--force"];
+        if (options.model)
+            args.push("--model", options.model);
+        // No positional prompt: cursor-agent reads it from piped stdin in print mode.
+        return { args, stdin: prompt };
+    },
+};
+//# sourceMappingURL=cursor.js.map

package/dist/adapters/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/adapters/cursor.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,IAAI,EAAE,QAAQ;IACd,OAAO,EACL,oIAAoI;IACtI,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,oBAAoB;IAClC,SAAS,EAAE,gBAAgB;IAC3B,kFAAkF;IAClF,kFAAkF;IAClF,2EAA2E;IAC3E,qEAAqE;IACrE,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,+EAA+E;IAC/E,0EAA0E;IAC1E,eAAe,EAAE;QACf,4DAA4D;QAC5D,yBAAyB;QACzB,6CAA6C;KAC9C;IACD,eAAe,CAAC,MAAc,EAAE,UAA2B,EAAE;QAC3D,6EAA6E;QAC7E,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,8EAA8E;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;CACF,CAAC"}

package/dist/adapters/opencode.d.ts

@@ -0,0 +1,2 @@
+import type { AgentAdapter } from "../types.js";
+export declare const opencodeAdapter: AgentAdapter;

package/dist/adapters/opencode.js

@@ -0,0 +1,23 @@
+export const opencodeAdapter = {
+    name: "opencode",
+    summary: "OpenCode — an open-source, provider-agnostic coding agent for agentic code changes; its model defaults to the user's opencode config unless a model is provided. Prompts must not start with '-'.",
+    binary: "opencode",
+    // `opencode models` prints bare ids ("opencode/big-pickle"), one per line, and
+    // exercises config + provider resolution rather than just starting the binary.
+    probeArgs: ["models"],
+    probeRequiresOutput: true,
+    loginCommand: "opencode auth login",
+    buildInvocation(prompt, options = {}) {
+        if (prompt.startsWith("-")) {
+            // opencode documents neither stdin input nor a "--" delimiter, so a
+            // dash-leading prompt could be parsed as a flag by its CLI.
+            throw new Error("opencode cannot safely run prompts that start with '-' (its CLI may parse them as flags). Rephrase the prompt to start with a word, e.g. \"explain --help ...\".");
+        }
+        const args = ["run"];
+        if (options.model)
+            args.push("--model", options.model);
+        args.push(prompt);
+        return { args };
+    },
+};
+//# sourceMappingURL=opencode.js.map

package/dist/adapters/opencode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../../src/adapters/opencode.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,IAAI,EAAE,UAAU;IAChB,OAAO,EACL,mMAAmM;IACrM,MAAM,EAAE,UAAU;IAClB,+EAA+E;IAC/E,+EAA+E;IAC/E,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAE,qBAAqB;IACnC,eAAe,CAAC,MAAc,EAAE,UAA2B,EAAE;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,kKAAkK,CACnK,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/ansi.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Remove ANSI escape sequences and collapse carriage-return spinner runs so the
+ * text is safe to embed in a plain MCP message. Pure: no I/O.
+ */
+export declare function stripAnsi(s: string): string;

package/dist/ansi.js

@@ -0,0 +1,15 @@
+/**
+ * Canonical zero-dep `ansi-regex` pattern source. Matches 7-bit `ESC[…`, 8-bit
+ * CSI (`›`), OSC (`ESC]…BEL`), private `?`/`#` params, SGR, and cursor
+ * moves. Built with the `g` flag so `.replace` clears every occurrence. Kept as
+ * a string so the source is auditable against upstream.
+ */
+const ANSI_PATTERN = "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))";
+/**
+ * Remove ANSI escape sequences and collapse carriage-return spinner runs so the
+ * text is safe to embed in a plain MCP message. Pure: no I/O.
+ */
+export function stripAnsi(s) {
+    return s.replace(new RegExp(ANSI_PATTERN, "g"), "").replace(/\r+/g, "");
+}
+//# sourceMappingURL=ansi.js.map

package/dist/ansi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../src/ansi.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,YAAY,GAChB,uLAAuL,CAAC;AAE1L;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/confirm.d.ts

@@ -0,0 +1,36 @@
+import type { ElicitRequestFormParams } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * The confirm gate has three modes:
+ *  - `"off"`   — MCP_CONFIRM unset/other → run without a gate (default).
+ *  - `"on"`    — MCP_CONFIRM in {1,true,on,all} → ask; DEGRADE OPEN (run with a
+ *    warning) if the client cannot show a form.
+ *  - `"strict"`— MCP_CONFIRM=strict → ask; FAIL CLOSED (refuse to run) if the
+ *    client cannot show a form. For operators who need "no run without a human".
+ */
+export type ConfirmMode = "off" | "on" | "strict";
+export declare function confirmMode(env?: NodeJS.ProcessEnv): ConfirmMode;
+/** True iff the confirm gate is active in any mode (`on` or `strict`). */
+export declare function confirmEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Truncate `input` so the RESULT length is `<= max`, counting the ellipsis
+ * marker (…, U+2026). Inputs already within `max` are returned unchanged.
+ */
+export declare function truncate(input: string, max: number): string;
+/** Short human summary naming the agent, with cwd/model lines only when present. */
+export declare function buildConfirmMessage(agentName: string, opts: {
+    prompt: string;
+    model?: string;
+    cwd?: string;
+}): string;
+/** Summary listing every enabled agent name for a single run_all confirmation. */
+export declare function buildRunAllMessage(agentNames: string[], opts: {
+    prompt: string;
+    cwd?: string;
+    model?: string;
+}): string;
+/** requestedSchema for elicitInput: a single required boolean the client renders.
+ *  Typed against the SDK so a malformed edit fails typecheck (drift-safe). The
+ *  import is type-only — erased at runtime, so this module stays pure. */
+export declare const CONFIRM_SCHEMA: ElicitRequestFormParams["requestedSchema"];
+/** Canonical terminal cancel wording shared by both call sites (asserted in tests). */
+export declare const CANCEL_TAIL = "run cancelled by user \u2014 nothing was executed. Do not retry unless the user asks.";

package/dist/confirm.js

@@ -0,0 +1,65 @@
+const ENABLING = new Set(["1", "true", "on", "all"]);
+export function confirmMode(env = process.env) {
+    const raw = env.MCP_CONFIRM?.trim().toLowerCase();
+    if (raw === undefined)
+        return "off";
+    if (raw === "strict")
+        return "strict";
+    return ENABLING.has(raw) ? "on" : "off";
+}
+/** True iff the confirm gate is active in any mode (`on` or `strict`). */
+export function confirmEnabled(env = process.env) {
+    return confirmMode(env) !== "off";
+}
+/**
+ * Truncate `input` so the RESULT length is `<= max`, counting the ellipsis
+ * marker (…, U+2026). Inputs already within `max` are returned unchanged.
+ */
+export function truncate(input, max) {
+    if (max < 1)
+        return "";
+    if (input.length <= max)
+        return input;
+    return input.slice(0, max - 1) + "…";
+}
+const PROMPT_MAX = 300;
+/** Short human summary naming the agent, with cwd/model lines only when present. */
+export function buildConfirmMessage(agentName, opts) {
+    const lines = [`Run agent "${agentName}"?`, `prompt: ${truncate(opts.prompt, PROMPT_MAX)}`];
+    if (opts.cwd !== undefined)
+        lines.push(`cwd: ${opts.cwd}`);
+    if (opts.model !== undefined)
+        lines.push(`model: ${opts.model}`);
+    return lines.join("\n");
+}
+/** Summary listing every enabled agent name for a single run_all confirmation. */
+export function buildRunAllMessage(agentNames, opts) {
+    const lines = [
+        `Run all agents (${agentNames.join(", ")})?`,
+        `prompt: ${truncate(opts.prompt, PROMPT_MAX)}`,
+    ];
+    if (opts.cwd !== undefined)
+        lines.push(`cwd: ${opts.cwd}`);
+    // `model` is shown so a caller sees exactly what is forwarded to each CLI —
+    // it is attacker-influenceable and must not be hidden from the human gate.
+    if (opts.model !== undefined)
+        lines.push(`model: ${opts.model}`);
+    return lines.join("\n");
+}
+/** requestedSchema for elicitInput: a single required boolean the client renders.
+ *  Typed against the SDK so a malformed edit fails typecheck (drift-safe). The
+ *  import is type-only — erased at runtime, so this module stays pure. */
+export const CONFIRM_SCHEMA = {
+    type: "object",
+    properties: {
+        confirm: {
+            type: "boolean",
+            title: "Run this agent?",
+            description: "Confirm to run; decline to cancel.",
+        },
+    },
+    required: ["confirm"],
+};
+/** Canonical terminal cancel wording shared by both call sites (asserted in tests). */
+export const CANCEL_TAIL = "run cancelled by user — nothing was executed. Do not retry unless the user asks.";
+//# sourceMappingURL=confirm.js.map

package/dist/confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.js","sourceRoot":"","sources":["../src/confirm.ts"],"names":[],"mappings":"AAIA,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAYrD,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,GAAW;IACjD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,IAAsD;IAEtD,MAAM,KAAK,GAAG,CAAC,cAAc,SAAS,IAAI,EAAE,WAAW,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,UAAoB,EACpB,IAAsD;IAEtD,MAAM,KAAK,GAAG;QACZ,mBAAmB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC5C,WAAW,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;KAC/C,CAAC;IACF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;0EAE0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAA+C;IACxE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,oCAAoC;SAClD;KACF;IACD,QAAQ,EAAE,CAAC,SAAS,CAAC;CACtB,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,WAAW,GACtB,kFAAkF,CAAC"}

package/dist/exec.d.ts

@@ -0,0 +1,146 @@
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+}
+export type Exec = (binary: string, args: string[], opts?: {
+    cwd?: string;
+    timeoutMs?: number;
+    idleTimeoutMs?: number;
+    input?: string;
+    maxOutputBytes?: number;
+    /** Fired synchronously once per ACCEPTED output chunk. Never awaited. */
+    onActivity?: () => void;
+    /**
+     * Line patterns the CLI prints on its DIAGNOSTIC stream (stderr) when it
+     * cannot reach its backend. Matched against stderr ONLY: the model's answer
+     * arrives on stdout, so a model that quotes one of these phrases can never
+     * trip the detector.
+     */
+    stallSignatures?: readonly RegExp[];
+    /**
+     * How many distinct reconnect cycles (each cycle = one "attempt N" line) the
+     * child must emit before we treat the stall as permanent. Default 2 — a
+     * single legitimate reconnect cycle emits exactly one attempt line.
+     */
+    stallAttemptLimit?: number;
+    /**
+     * Absolute strike cap for signatures that carry no attempt number (e.g. a
+     * repeated "RetriableError: …"). Default 4.
+     */
+    stallStrikeLimit?: number;
+    /**
+     * Env-var names to DELETE from the child's environment. Least-privilege
+     * denylist that keeps exec generic — it never learns which adapter owns
+     * which key. Callers pass the OTHER agents' credential var names (the union
+     * of every agent's apiKeyEnv MINUS the one being spawned) so a compromised
+     * or prompt-injected child cannot read a sibling agent's key FROM THE ENV.
+     * This is env-var isolation, not a full secret boundary: `HOME` is preserved
+     * (agents need their config there), so an agent can still read a sibling's
+     * on-disk credential file — hardening the env is necessary but not sufficient.
+     * Every other var (PATH, HOME, proxy/CA/XDG/locale) is preserved. Undefined or
+     * empty leaves behavior identical to inheriting the full parent env.
+     */
+    stripEnvKeys?: readonly string[];
+    /**
+     * Env vars to SET on the child, applied AFTER stripEnvKeys (so an override
+     * here always wins). Used to harden a subprocess against its own working
+     * tree — e.g. neutralising git's config search path so an untrusted repo's
+     * `.git/config` / global / system config cannot execute code during
+     * `git diff` / `git status`. Keys set here are never treated as strippable.
+     */
+    env?: Readonly<Record<string, string>>;
+}) => Promise<ExecResult>;
+/**
+ * TOTAL runtime cap (never reset). Parsed once at module load; override via
+ * MCP_AGENT_TIMEOUT_MS. Raised to 30 min so long PRODUCTIVE runs survive — the
+ * idle timeout, not this, is the fast hung-agent detector.
+ */
+export declare const DEFAULT_TIMEOUT_MS: number;
+/**
+ * IDLE (inactivity) cap: reset on every accepted output chunk. Parsed once at
+ * module load; override via MCP_AGENT_IDLE_TIMEOUT_MS. Generous default so a
+ * slow-but-streaming CLI is not killed mid-work.
+ */
+export declare const DEFAULT_IDLE_TIMEOUT_MS: number;
+export declare const DEFAULT_MAX_OUTPUT_BYTES: number;
+export declare const DEFAULT_STALL_ATTEMPT_LIMIT = 2;
+export declare const DEFAULT_STALL_STRIKE_LIMIT = 4;
+/**
+ * Hard ceiling on any single timer (total or idle). Two jobs:
+ *  1. Correctness — `setTimeout` truncates a delay > 2^31-1 ms (~24.8 days) to
+ *     1ms and fires it IMMEDIATELY, so an unclamped huge `timeoutMs` would kill
+ *     the child the instant it starts. 24h is safely under that boundary.
+ *  2. Load-shedding — a single run can hold a concurrency slot for at most 24h,
+ *     so a caller cannot pin all slots for weeks with an enormous `timeoutMs`.
+ */
+export declare const MAX_TIMEOUT_MS: number;
+/** Clamp a caller-supplied timer to [1, MAX_TIMEOUT_MS]; floors non-integers. */
+export declare function clampTimer(ms: number): number;
+/**
+ * Cap on children spawned concurrently across the process. Parsed once at module
+ * load; override via MCP_MAX_CONCURRENT_AGENTS.
+ */
+export declare const MAX_CONCURRENT_AGENTS: number;
+/**
+ * Thrown when every permit is busy AND the wait queue is already full. Overload
+ * sheds load here instead of growing latency unbounded — the caller retries
+ * later. Surfaces through runCommand → runAdapter → the tool handler's catch as
+ * an `isError` result (the 503-equivalent in the stateless per-request model).
+ */
+export declare class ServerBusyError extends Error {
+    readonly code = "SERVER_BUSY";
+    constructor();
+}
+/** Thrown when the child process fails to spawn (binary missing / not on PATH). */
+export declare class SpawnError extends Error {
+    readonly cause?: unknown | undefined;
+    readonly code = "spawn";
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Thrown when `cwd` does not exist (or is not a directory). Checked BEFORE spawn
+ * because both a missing binary and a missing cwd surface as bare ENOENT from
+ * spawn, and collapsing them is actively misleading: a caller passing a repo path
+ * the server cannot see was told "codex was not found on PATH" while codex was
+ * installed and healthy. Distinguishing them up front makes the real fault legible.
+ */
+export declare class InvalidCwdError extends Error {
+    readonly cwd: string;
+    readonly code = "invalid_cwd";
+    constructor(cwd: string);
+}
+/**
+ * Thrown when the child is killed for exceeding a timeout. Carries the bound and
+ * WHICH cap fired: `"idle"` (no output for idleTimeoutMs — likely hung/unreachable)
+ * or `"total"` (exceeded the total runtime cap). `kind` is additive and defaults
+ * to `"total"`, so `new TimeoutError(msg, ms)` call sites are unchanged.
+ */
+export declare class TimeoutError extends Error {
+    readonly timeoutMs: number;
+    readonly kind: "idle" | "total";
+    readonly code = "timeout";
+    constructor(message: string, timeoutMs: number, kind?: "idle" | "total");
+}
+/** Thrown when the child is killed for exceeding `maxOutputBytes`. Carries the cap. */
+export declare class OutputLimitError extends Error {
+    readonly maxOutputBytes: number;
+    readonly code = "output_limit";
+    constructor(message: string, maxOutputBytes: number);
+}
+/**
+ * Thrown when the child is detected as stalled: it prints diagnostic reconnect
+ * phrases on stderr (the adapter's `stallSignatures`) but never produces stdout,
+ * and the attempt/strike counters corroborate that it will not recover. The
+ * process group is killed; the rejection surfaces on `close` so the semaphore
+ * permit is released only after the tree is actually gone.
+ */
+export declare class AgentStalledError extends Error {
+    readonly signature: string;
+    readonly strikes: number;
+    readonly code = "stream_stalled";
+    constructor(message: string, signature: string, strikes: number);
+}
+/** Best-effort: kill every still-live child's process group. Never throws. */
+export declare function reapAllChildren(): void;
+export declare const runCommand: Exec;