cascade-ai 0.76.0 → 0.78.0

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import EventEmitter from 'node:events';
 import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import { z } from 'zod';
 import { Server } from 'node:http';
 import { OAuthClientInformationMixed, OAuthTokens, OAuthClientMetadata, OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
@@ -368,6 +369,20 @@ interface WebSearchConfig {
     braveApiKey?: string;
     tavilyApiKey?: string;
     maxResults?: number;
+    /**
+     * Route `searxngUrl` through the SSRF guard — set by hosts that take the URL
+     * from a request rather than from local config. Full reasoning on the
+     * matching field in `src/tools/web-search.ts`, which is the copy the tool
+     * actually reads.
+     *
+     * This shape is declared in THREE places that must move together: here, that
+     * interface, and `WebSearchConfigSchema` in `src/config/schema.ts`. The zod
+     * one is load-bearing rather than decorative — `createCascade` runs the whole
+     * config through `CascadeConfigSchema.parse()`, which strips keys the schema
+     * does not name, so a field added only to the interfaces type-checks and then
+     * silently vanishes at runtime.
+     */
+    guardSearxngUrl?: boolean;
 }
 interface Message {
     id: string;
@@ -858,6 +873,13 @@ interface ToolsConfig {
     shellBlocklist: string[];
     requireApprovalFor: string[];
     browserEnabled: boolean;
+    /**
+     * Let a run act on the desktop's built-in browser, not just read it. Separate
+     * from `browserEnabled` (headless Playwright) because it drives the user's
+     * signed-in session. See `src/config/schema.ts` and
+     * `src/tools/browser-control.ts`.
+     */
+    agentBrowserControl?: boolean;
     mcpServers?: McpServerConfig$1[];
     /**
      * Names of MCP servers (matching McpServerConfig.name) that the user has
@@ -3163,6 +3185,143 @@ declare class CurrentPageTool extends BaseTool {
     execute(_input: Record<string, unknown>, _options: ToolExecuteOptions): Promise<string>;
 }
 
+/** One thing to do to the open page. */
+interface BrowserAction {
+    kind: 'navigate' | 'click' | 'fill' | 'press' | 'wait_for' | 'extract_text';
+    /** navigate */
+    url?: string;
+    /** click, fill, wait_for, extract_text (optional — defaults to the body) */
+    selector?: string;
+    /** fill */
+    value?: string;
+    /** press — a single key name, e.g. "Enter" or "Tab" */
+    key?: string;
+    /** wait_for */
+    timeoutMs?: number;
+}
+interface BrowserActionOutcome {
+    ok: boolean;
+    /** Human- and model-readable account of what happened. */
+    detail: string;
+    /** Where the page ended up, when the host can tell. */
+    url?: string;
+    title?: string;
+}
+/**
+ * Who is asking, and how to stop them.
+ *
+ * Both fields exist because the browser is a SINGLETON the host owns while runs
+ * come and go. Without run identity the host cannot tell a Stop in one run from
+ * a Stop in every future run, and cannot tell two concurrent runs apart when
+ * they both reach for the same page.
+ */
+interface BrowserActionContext {
+    /**
+     * The run this action belongs to. Revocation and the host's single-owner
+     * lease both key on it, so a Stop scopes to the run the user was watching
+     * rather than to the process.
+     */
+    sessionId: string;
+    /**
+     * The individual worker asking — `tierId`, a per-instance id.
+     *
+     * Distinct from `sessionId` and both are needed. Every T3 worker in a run
+     * passes the same `taskId` as the session, so the session says which RUN to
+     * stop but cannot tell two sibling workers apart. The host leases the browser
+     * to one actor for a whole sequence, and a lease keyed by session would hand
+     * the same lease to every sibling at once — which is the state that lets one
+     * worker navigate away in the middle of another's fill-then-click.
+     */
+    actorId: string;
+    /**
+     * Cancels an action already in flight. `wait_for` can sit for 30s and
+     * `navigate` waits on the network, so without this a cancelled run keeps
+     * touching the user's authenticated page after it was stopped.
+     */
+    signal?: AbortSignal;
+}
+/**
+ * Performs one action against the browser view the host owns.
+ *
+ * Returning `ok: false` with a reason is expected and normal — a selector that
+ * matches nothing is a thing the model should be told about and can recover
+ * from, not an exception.
+ */
+type BrowserController = (action: BrowserAction, context: BrowserActionContext) => Promise<BrowserActionOutcome>;
+/**
+ * Told that one worker is finished with the browser for good.
+ *
+ * Separate from the controller because it is not an action: it carries no
+ * outcome and cannot fail. The host uses it to end that actor's sequence lease
+ * — the only signal that reliably means "will not ask again", as opposed to a
+ * worker that is merely waiting on its next model response.
+ */
+type BrowserActorRelease = (actorId: string) => void;
+declare class BrowserControlTool extends BaseTool {
+    readonly name = "browser_control";
+    readonly description: string;
+    readonly inputSchema: {
+        type: string;
+        properties: {
+            action: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            url: {
+                type: string;
+                description: string;
+            };
+            selector: {
+                type: string;
+                description: string;
+            };
+            value: {
+                type: string;
+                description: string;
+            };
+            key: {
+                type: string;
+                description: string;
+            };
+            timeoutMs: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+    private controller;
+    private release;
+    /** One-way. See `revoke`. */
+    private revoked;
+    constructor(controller: BrowserController, release?: BrowserActorRelease);
+    /**
+     * A worker has finished. Ends its hold on the browser.
+     *
+     * Called from the tier's terminal path rather than by the model, because a
+     * model cannot be relied on to announce that it is done — which is why the
+     * host cannot use idle time as the boundary instead.
+     */
+    releaseActor(actorId: string): void;
+    /**
+     * Permanently disable this tool, whatever the registry still holds.
+     *
+     * Registration-time gates cannot express "this run turned out to be
+     * unattended": a host that wires the controller and only then declares the
+     * run unattended has already registered the tool, and a check that ran at
+     * registration has no second chance. Enforcing at EXECUTION time makes the
+     * guarantee independent of call order, which is the whole point of stating
+     * the invariant rather than relying on the scheduler's current sequence.
+     *
+     * One-way on purpose. A safety gate that can be re-opened by a later call is
+     * a gate that a refactor re-opens by accident.
+     */
+    revoke(): void;
+    isDangerous(): boolean;
+    execute(input: Record<string, unknown>, options: ToolExecuteOptions): Promise<string>;
+}
+
 /** One entry in the per-run orchestration decision trail (see /why). */
 interface DecisionLogEntry {
     at: string;
@@ -3343,6 +3502,39 @@ declare class Cascade extends EventEmitter {
      * nothing. `disabledTools` still removes it.
      */
     setCurrentPageProvider(provider: CurrentPageProvider): void;
+    /**
+     * True when nobody is watching this run — a scheduled/cron task, which
+     * auto-approves every tool because there is no one to ask.
+     *
+     * That auto-approval is fine for ordinary tools and disqualifying for this
+     * one: `browser_control` drives the signed-in browser, and "every run asks
+     * first" is the promise the Settings copy makes. The property used to hold
+     * only because `runScheduledTask` happens not to call `setBrowserController`
+     * — a guarantee resting on an ABSENT call, which is exactly what a later
+     * refactor adds without noticing. Stated and enforced instead.
+     */
+    private unattended;
+    /**
+     * Declare that no human is watching this run, so capabilities that depend on
+     * a person being able to see and stop them are refused outright.
+     */
+    setUnattended(on: boolean): void;
+    /**
+     * Wire the host's browser so a run can ACT on the open page, not just read it.
+     *
+     * Two gates before this registers anything, and both matter:
+     *
+     *   - `tools.agentBrowserControl` must be on. Unlike read_current_page, which
+     *     reaches nothing the user has not already opened themselves, this drives
+     *     the session they are signed into. That is opt-in, not a default.
+     *   - `disabledTools` still removes it, the same as every other tool.
+     *   - The run must not be UNATTENDED. See `setUnattended`.
+     *
+     * Host-supplied like the page provider: the tool exists only where there is a
+     * real browser to drive, so it never has to be refused in the CLI or a hosted
+     * run — it is simply not there.
+     */
+    setBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
     private registerMediaTools;
     /**
      * Register `generate_document` where there is a real workspace to write into.
@@ -3785,6 +3977,15 @@ declare class T3Worker extends BaseTier {
     constructor(router: CascadeRouter, toolRegistry: ToolRegistry, parentId: string);
     setStore(store: MemoryStore, sessionId: string): void;
     execute(assignment: T2ToT3Assignment, taskId: string, signal?: AbortSignal): Promise<T3Result>;
+    /**
+     * End this worker's hold on the shared browser.
+     *
+     * Duck-typed rather than imported: `browser_control` is registered only by a
+     * host that HAS a browser (the desktop), so in the CLI and hosted runs there
+     * is no such tool and this is a no-op. Importing the class to instanceof-check
+     * it would couple the worker to a tool that usually is not there.
+     */
+    private releaseBrowserControl;
     sendToPeer(toId: string, content: unknown): void;
     requestFromPeer(peerId: string, subtaskId: string): Promise<string>;
     syncWithPeers(barrierName: string): Promise<void>;
@@ -4392,6 +4593,1147 @@ declare class ConfigManager {
     private ensureDefaultIdentity;
 }
 
+declare const CascadeConfigSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodLiteral<"1.0">>;
+    defaultIdentityId: z.ZodOptional<z.ZodString>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"]>;
+        label: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        deploymentName: z.ZodOptional<z.ZodString>;
+        apiVersion: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+        authToken: z.ZodOptional<z.ZodString>;
+        credentialSource: z.ZodOptional<z.ZodString>;
+        /**
+         * "This endpoint is self-hosted, so inference genuinely costs $0."
+         * Only meaningful for `ollama` and `openai-compatible`. Unset ⇒ inferred:
+         * ollama is local, openai-compatible is local when its baseUrl is
+         * loopback/LAN. Set it explicitly to override — e.g. `false` for an Ollama
+         * instance you rent, `true` for a llama.cpp box on your own LAN reached by
+         * hostname.
+         */
+        local: z.ZodOptional<z.ZodBoolean>;
+        /** Region for providers whose price varies by region (Azure: global | us | eu | …). */
+        region: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "anthropic" | "openai" | "gemini" | "azure" | "openai-compatible" | "ollama";
+        region?: string | undefined;
+        baseUrl?: string | undefined;
+        local?: boolean | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        deploymentName?: string | undefined;
+        apiVersion?: string | undefined;
+        model?: string | undefined;
+        authToken?: string | undefined;
+        credentialSource?: string | undefined;
+    }, {
+        type: "anthropic" | "openai" | "gemini" | "azure" | "openai-compatible" | "ollama";
+        region?: string | undefined;
+        baseUrl?: string | undefined;
+        local?: boolean | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        deploymentName?: string | undefined;
+        apiVersion?: string | undefined;
+        model?: string | undefined;
+        authToken?: string | undefined;
+        credentialSource?: string | undefined;
+    }>, "many">>;
+    models: z.ZodDefault<z.ZodObject<{
+        t1: z.ZodOptional<z.ZodString>;
+        t2: z.ZodOptional<z.ZodString>;
+        t3: z.ZodOptional<z.ZodString>;
+        vision: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        t1?: string | undefined;
+        t2?: string | undefined;
+        t3?: string | undefined;
+        vision?: string | undefined;
+    }, {
+        t1?: string | undefined;
+        t2?: string | undefined;
+        t3?: string | undefined;
+        vision?: string | undefined;
+    }>>;
+    tools: z.ZodDefault<z.ZodObject<{
+        shellAllowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        shellBlocklist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        browserEnabled: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Let a run ACT on the page open in the desktop's built-in browser — click,
+         * type, submit — not just read it.
+         *
+         * Distinct from `browserEnabled`, which turns on the headless Playwright
+         * tool. That one drives a throwaway browser with an empty cookie jar; this
+         * one drives the session the user is signed into, which is a different order
+         * of consequence and so gets its own switch rather than riding on that one.
+         *
+         * Off by default. Turning it on does not hand anything over silently: the
+         * tool still goes through the approval chain, and the browser panel carries a
+         * stop control for the run that is acting.
+         */
+        agentBrowserControl: z.ZodDefault<z.ZodBoolean>;
+        mcpServers: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            name: z.ZodString;
+            command: z.ZodOptional<z.ZodString>;
+            args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            url: z.ZodOptional<z.ZodString>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            oauthStore: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }, {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }>, {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }, {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }>, "many">>;
+        mcpTrusted: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Web search backends — at least one should be configured for best results */
+        webSearch: z.ZodOptional<z.ZodObject<{
+            /** Base URL of your SearXNG instance (e.g. http://localhost:8080) */
+            searxngUrl: z.ZodOptional<z.ZodString>;
+            /** Brave Search API key — get one at https://api.search.brave.com */
+            braveApiKey: z.ZodOptional<z.ZodString>;
+            /** Tavily API key — get one at https://tavily.com */
+            tavilyApiKey: z.ZodOptional<z.ZodString>;
+            /** Max results per search (default 5) */
+            maxResults: z.ZodDefault<z.ZodNumber>;
+            /**
+             * Send `searxngUrl` through the SSRF guard. Off for a local run, where the
+             * URL is the machine owner's own config and a self-hosted SearXNG is
+             * routinely on a private address; on for a host that accepts it from a
+             * request. See `src/tools/web-search.ts`.
+             *
+             * It has to be named HERE, not just on the TypeScript interfaces: the config
+             * passes through `CascadeConfigSchema.parse()` on its way into a run, and
+             * zod drops every key this object does not declare.
+             */
+            guardSearxngUrl: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            maxResults: number;
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        }, {
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            maxResults?: number | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        }>>;
+        /**
+         * Sandbox runtime for LLM-authored dynamic tools:
+         * - 'isolate': hard V8 isolate (isolated-vm) — no Node globals, true capability
+         *   confinement. Requires the optional native `isolated-vm` dependency.
+         * - 'worker': node:worker_threads (resource/kill limits, but not capability-confined).
+         * - 'auto' (default): use the isolate when `isolated-vm` loads, else fall back to worker.
+         */
+        dynamicToolSandbox: z.ZodDefault<z.ZodEnum<["isolate", "worker", "auto"]>>;
+        /**
+         * When set, ONLY these tool names are registered — the sole way to omit a
+         * built-in tool (shell/file/git/…) from existing at all, rather than just
+         * gating it behind approval. Omitted = full default set (unchanged).
+         */
+        enabledTools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /**
+         * Tools to remove even when they would otherwise be registered. Unlike
+         * `enabledTools` (an allowlist over the built-in set), this also reaches
+         * tools registered outside it — MCP tools and media generation — which is
+         * the only way to turn those off.
+         */
+        disabledTools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        shellAllowlist: string[];
+        shellBlocklist: string[];
+        requireApprovalFor: string[];
+        browserEnabled: boolean;
+        agentBrowserControl: boolean;
+        dynamicToolSandbox: "auto" | "isolate" | "worker";
+        mcpServers?: {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }[] | undefined;
+        mcpTrusted?: string[] | undefined;
+        webSearch?: {
+            maxResults: number;
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        } | undefined;
+        enabledTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
+    }, {
+        mcpServers?: {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }[] | undefined;
+        shellAllowlist?: string[] | undefined;
+        shellBlocklist?: string[] | undefined;
+        requireApprovalFor?: string[] | undefined;
+        browserEnabled?: boolean | undefined;
+        agentBrowserControl?: boolean | undefined;
+        mcpTrusted?: string[] | undefined;
+        webSearch?: {
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            maxResults?: number | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        } | undefined;
+        dynamicToolSandbox?: "auto" | "isolate" | "worker" | undefined;
+        enabledTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
+    }>>;
+    hooks: z.ZodDefault<z.ZodObject<{
+        preToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            command: z.ZodString;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }>, "many">>;
+        postToolUse: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            command: z.ZodString;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }>, "many">>;
+        preTask: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            command: z.ZodString;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }>, "many">>;
+        postTask: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            command: z.ZodString;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            timeout: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }, {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        preToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        preTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+    }, {
+        preToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        preTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+    }>>;
+    dashboard: z.ZodDefault<z.ZodObject<{
+        port: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Interface to bind the dashboard HTTP/WebSocket server to. Defaults to
+         * loopback so the dashboard — which exposes /api/run (arbitrary task
+         * execution) and config mutation — is never reachable from the network
+         * unless the operator explicitly opts in (e.g. "0.0.0.0" for team mode).
+         */
+        host: z.ZodDefault<z.ZodString>;
+        auth: z.ZodDefault<z.ZodBoolean>;
+        teamMode: z.ZodDefault<z.ZodEnum<["single", "multi"]>>;
+        secret: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        auth: boolean;
+        host: string;
+        port: number;
+        teamMode: "single" | "multi";
+        secret?: string | undefined;
+    }, {
+        auth?: boolean | undefined;
+        host?: string | undefined;
+        port?: number | undefined;
+        teamMode?: "single" | "multi" | undefined;
+        secret?: string | undefined;
+    }>>;
+    telemetry: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        posthogApiKey: z.ZodOptional<z.ZodString>;
+        distinctId: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        posthogApiKey?: string | undefined;
+        distinctId?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        posthogApiKey?: string | undefined;
+        distinctId?: string | undefined;
+    }>>;
+    memory: z.ZodDefault<z.ZodObject<{
+        maxSessionMessages: z.ZodDefault<z.ZodNumber>;
+        autoSummarizeAt: z.ZodDefault<z.ZodNumber>;
+        retentionDays: z.ZodDefault<z.ZodNumber>;
+        /** Opt-in session→knowledge distillation after each run. Default: false. */
+        rememberSessions: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        maxSessionMessages: number;
+        autoSummarizeAt: number;
+        retentionDays: number;
+        rememberSessions: boolean;
+    }, {
+        maxSessionMessages?: number | undefined;
+        autoSummarizeAt?: number | undefined;
+        retentionDays?: number | undefined;
+        rememberSessions?: boolean | undefined;
+    }>>;
+    tierLimits: z.ZodDefault<z.ZodObject<{
+        t1MaxTokens: z.ZodOptional<z.ZodNumber>;
+        t2MaxTokens: z.ZodOptional<z.ZodNumber>;
+        t3MaxTokens: z.ZodOptional<z.ZodNumber>;
+        t1Temperature: z.ZodOptional<z.ZodNumber>;
+        t2Temperature: z.ZodOptional<z.ZodNumber>;
+        t3Temperature: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        t1MaxTokens?: number | undefined;
+        t2MaxTokens?: number | undefined;
+        t3MaxTokens?: number | undefined;
+        t1Temperature?: number | undefined;
+        t2Temperature?: number | undefined;
+        t3Temperature?: number | undefined;
+    }, {
+        t1MaxTokens?: number | undefined;
+        t2MaxTokens?: number | undefined;
+        t3MaxTokens?: number | undefined;
+        t1Temperature?: number | undefined;
+        t2Temperature?: number | undefined;
+        t3Temperature?: number | undefined;
+    }>>;
+    extendedContext: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxMultiplier: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        maxMultiplier: number;
+    }, {
+        enabled?: boolean | undefined;
+        maxMultiplier?: number | undefined;
+    }>>;
+    budget: z.ZodDefault<z.ZodObject<{
+        dailyBudgetUsd: z.ZodOptional<z.ZodNumber>;
+        sessionBudgetUsd: z.ZodOptional<z.ZodNumber>;
+        /**
+         * Hard per-task token ceiling. A single `cascade run` is stopped once its
+         * combined token usage crosses this, so a mis-routed trivial task can never
+         * fan out into a runaway multi-agent burn. Resets every run. Raise it for
+         * genuinely large jobs. Defaults to 200k.
+         */
+        maxTokensPerRun: z.ZodDefault<z.ZodNumber>;
+        /** Optional hard per-task cost ceiling (USD). Unset = only the token cap applies. */
+        maxCostPerRunUsd: z.ZodOptional<z.ZodNumber>;
+        /**
+         * Consecutive systemic failures against ONE model before the run stops
+         * launching work that would fail the same way (dead key, wrong model id,
+         * exhausted quota). Lower reacts sooner and wastes less; higher absorbs a
+         * longer transient before giving up. Only failures that will certainly repeat
+         * are counted — see core/run-breaker.ts.
+         */
+        failureThreshold: z.ZodDefault<z.ZodNumber>;
+        warnAtPct: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTokensPerRun: number;
+        failureThreshold: number;
+        warnAtPct: number;
+        dailyBudgetUsd?: number | undefined;
+        sessionBudgetUsd?: number | undefined;
+        maxCostPerRunUsd?: number | undefined;
+    }, {
+        dailyBudgetUsd?: number | undefined;
+        sessionBudgetUsd?: number | undefined;
+        maxTokensPerRun?: number | undefined;
+        maxCostPerRunUsd?: number | undefined;
+        failureThreshold?: number | undefined;
+        warnAtPct?: number | undefined;
+    }>>;
+    theme: z.ZodDefault<z.ZodString>;
+    workspace: z.ZodDefault<z.ZodObject<{
+        cascadeMdPath: z.ZodDefault<z.ZodString>;
+        configPath: z.ZodDefault<z.ZodString>;
+        keystorePath: z.ZodDefault<z.ZodString>;
+        auditLogPath: z.ZodDefault<z.ZodString>;
+        debugWorldState: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        cascadeMdPath: string;
+        configPath: string;
+        keystorePath: string;
+        auditLogPath: string;
+        debugWorldState: boolean;
+    }, {
+        cascadeMdPath?: string | undefined;
+        configPath?: string | undefined;
+        keystorePath?: string | undefined;
+        auditLogPath?: string | undefined;
+        debugWorldState?: boolean | undefined;
+    }>>;
+    /**
+     * Per-provider tokens-per-minute overrides for the router's TpmLimiter (see
+     * DEFAULT_PROVIDER_TPM in core/router/tpm-limiter.ts). Documented as a raw
+     * config field for a while before this — since CascadeConfigSchema strips
+     * unknown keys, a config file setting it was silently discarded and the
+     * override never reached TpmLimiter's constructor. Optional/permissive on
+     * provider name (not a ProviderType enum) so a config still validates
+     * against a slightly newer/older provider list than this schema knows.
+     */
+    rateLimits: z.ZodOptional<z.ZodObject<{
+        providerTpm: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        providerTpm?: Record<string, number> | undefined;
+    }, {
+        providerTpm?: Record<string, number> | undefined;
+    }>>;
+    /**
+     * Cascade Auto: when true, the TaskAnalyzer selects the optimal model for each
+     * tier based on task type and complexity, overriding the static priority lists.
+     * Heuristic-first with AI inference fallback (adds ~0–500ms per task).
+     * ON by default since v0.19.0 — "Auto" without it was just a static priority
+     * list, not the benchmark-value routing the docs describe. Explicit per-tier
+     * model pins are unaffected; disable via config/Settings → Advanced.
+     */
+    cascadeAuto: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Cascade Auto trade-off bias when picking a model for a task:
+     *   - 'balanced' (default): quality × cost-efficiency — cheap models win
+     *     trivial tasks, strong models win hard ones.
+     *   - 'quality': pick the highest-benchmark model; cost only breaks ties.
+     *   - 'cost': pick the cheapest model that clears a per-task quality floor.
+     */
+    autoBias: z.ZodDefault<z.ZodEnum<["balanced", "quality", "cost"]>>;
+    /**
+     * Public-benchmark data source for Cascade Auto. All fields have safe
+     * defaults so zero config "just works" — live data is fetched in the
+     * background and the bundled snapshot is used until it arrives (or offline).
+     */
+    benchmarks: z.ZodDefault<z.ZodObject<{
+        /** Fetch current quality scores from a public source. Default: true. */
+        live: z.ZodDefault<z.ZodBoolean>;
+        /** How long a fetched snapshot stays fresh before re-fetching (hours). */
+        refreshHours: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Override the quality-benchmark source URL (must return the snapshot
+         * JSON shape). When unset, the maintained GitHub-raw snapshot is used.
+         */
+        sourceUrl: z.ZodOptional<z.ZodString>;
+        /** Fetch current per-token prices from OpenRouter (free, no key). */
+        pricingLive: z.ZodDefault<z.ZodBoolean>;
+        /** Cache location for the fetched snapshot (cloud → persistent volume). */
+        cacheFile: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        live: boolean;
+        pricingLive: boolean;
+        refreshHours: number;
+        sourceUrl?: string | undefined;
+        cacheFile?: string | undefined;
+    }, {
+        live?: boolean | undefined;
+        sourceUrl?: string | undefined;
+        pricingLive?: boolean | undefined;
+        refreshHours?: number | undefined;
+        cacheFile?: string | undefined;
+    }>>;
+    /**
+     * Runtime Tool Creation: when true, T3 workers can generate and register new tools
+     * at runtime via the ToolCreator when no existing tool can handle a required operation.
+     * Generated tools are session-scoped and sandboxed (see tools.dynamicToolSandbox).
+     * HTTP calls from generated tools require approval.
+     */
+    enableToolCreation: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Project knowledge (world state). `factsExtraction`: after each worker
+     * completes, run a cheap extraction pass that distills its output into
+     * queryable entity/relation/value facts (superseding older facts), which T1
+     * queries during planning instead of replaying the whole linear log. Best-effort
+     * and non-blocking; set false to keep only the raw linear log.
+     */
+    knowledge: z.ZodDefault<z.ZodObject<{
+        factsExtraction: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        factsExtraction: boolean;
+    }, {
+        factsExtraction?: boolean | undefined;
+    }>>;
+    /**
+     * Fast answer behaviour. `autoSimple`: pure small talk ("hi", "who are you")
+     * skips the T1/T2/T3 machinery for a direct single-model reply — same cost
+     * shape as the explicit fast-answer toggle, applied automatically.
+     */
+    fastAnswer: z.ZodDefault<z.ZodObject<{
+        autoSimple: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        autoSimple: boolean;
+    }, {
+        autoSimple?: boolean | undefined;
+    }>>;
+    /**
+     * Workspace code index (Phase 3). Opt-in. When enabled, Cascade registers a
+     * `code_search` tool backed by a hybrid + reranked index of the workspace so
+     * workers can find code by meaning. Build/refresh the index with
+     * `cascade index`; set autoRefresh to update it at run start (incremental —
+     * only changed files are re-embedded).
+     */
+    codeIndex: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        autoRefresh: z.ZodDefault<z.ZodBoolean>;
+        /** SQLite file for the index. Defaults to <workspace>/.cascade/code-index.db. */
+        dbPath: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        autoRefresh: boolean;
+        dbPath?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        autoRefresh?: boolean | undefined;
+        dbPath?: string | undefined;
+    }>>;
+    /**
+     * Persist runtime-generated tools to .cascade/dynamic-tools.json and reload them
+     * on startup for cross-run dedup. Reloaded (and peer-received) tools are always
+     * treated as UNTRUSTED — their dangerous actions re-escalate. Set false to disable
+     * persistence entirely.
+     */
+    persistDynamicTools: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * External plugin paths or npm package names to load at startup.
+     * Each entry must export a default ToolPlugin object.
+     * Example: ["./plugins/my-tool.js", "cascade-plugin-slack"]
+     */
+    plugins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Maximum number of concurrent inference requests to any local model provider
+     * (e.g. Ollama). Defaults to 1 to prevent GPU memory pressure when multiple
+     * T3 workers run in parallel on a single-GPU machine.
+     */
+    localConcurrency: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Timeout in milliseconds for a single local model inference call.
+     * Local models can take minutes for large parameter counts. Default: 5 minutes.
+     */
+    localInferenceTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Timeout (ms) for a single cloud LLM call (streaming or not). Guards against
+     * a stalled provider stream hanging the whole run with no output. On timeout
+     * the call errors and the worker escalates. Default: 2 minutes.
+     */
+    cloudInferenceTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Timeout (ms) for a tool-approval decision. If no decision arrives in time the
+     * request is DENIED (never auto-approved) so the run continues rather than
+     * hanging on an unanswered prompt. Default: 10 minutes.
+     */
+    approvalTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Boardroom plan approval: pause after the plan is produced so the user can
+     * review the org chart (sections, workers, estimated cost) before any worker
+     * spawns. Scope:
+     *   'never'   — never pause (default; no behavior change).
+     *   'complex' — pause Complex runs only ('always' is kept as an alias).
+     *   'all'     — pause Moderate and Complex runs.
+     * Headless/SDK consumers without a listener auto-approve, so pausing is safe
+     * outside the TUI.
+     */
+    planApproval: z.ZodDefault<z.ZodEnum<["never", "complex", "all", "always"]>>;
+    /**
+     * Plan-review behaviour for the boardroom gate:
+     *   autoReviewer      — a reviewer model critiques the plan (gaps/risks/cost)
+     *                       before you see it, and the critique is shown in the dialog.
+     *   editable          — allow editing the plan (drop sections) in the dialog.
+     *   maxRevisionRounds — how many steering-note → re-plan → re-ask rounds the
+     *                       boardroom allows before proceeding with the last plan.
+     */
+    planReview: z.ZodDefault<z.ZodObject<{
+        autoReviewer: z.ZodDefault<z.ZodBoolean>;
+        editable: z.ZodDefault<z.ZodBoolean>;
+        maxRevisionRounds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        autoReviewer: boolean;
+        editable: boolean;
+        maxRevisionRounds: number;
+    }, {
+        autoReviewer?: boolean | undefined;
+        editable?: boolean | undefined;
+        maxRevisionRounds?: number | undefined;
+    }>>;
+    /**
+     * Autonomy level. 'manual' (default): plan + tool approvals prompt as usual.
+     * 'auto': hands-off — the plan gate auto-approves and the escalator
+     * auto-approves NON-dangerous tools, while dangerous tools still escalate and
+     * budget caps remain the hard stop. Toggle at runtime with /auto.
+     */
+    autonomy: z.ZodDefault<z.ZodEnum<["manual", "auto"]>>;
+    /**
+     * Max corrective re-plan passes T1's reviewer runs before returning the best
+     * partial result. The run also stops early when a pass makes no net progress.
+     */
+    maxReplanPasses: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Reflection / self-critique. When enabled, after a worker's pass/fail self-test
+     * succeeds it runs a goal-alignment critique and revises once if the output is
+     * weak against the broader goal (not just the subtask spec). Off by default — it
+     * adds an LLM call per worker.
+     */
+    reflection: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxRounds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        maxRounds: number;
+    }, {
+        enabled?: boolean | undefined;
+        maxRounds?: number | undefined;
+    }>>;
+    /**
+     * T3 worker execution within a dependency wave:
+     *   'auto' (default) — sequential when the T3 tier is a LOCAL model (a single
+     *     GPU serializes anyway, so parallel just thrashes the queue), parallel for
+     *     cloud models.
+     *   'parallel' / 'sequential' — force it.
+     */
+    t3Execution: z.ZodDefault<z.ZodEnum<["auto", "parallel", "sequential"]>>;
+    /**
+     * Per-path privacy tiers. A subtask touching a `local-only` path is forced
+     * onto LOCAL models (never cloud) and its raw output is withheld from the
+     * tiers above. Patterns use .gitignore syntax, like .cascadeignore.
+     */
+    privacy: z.ZodOptional<z.ZodObject<{
+        paths: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodString;
+            policy: z.ZodEnum<["local-only"]>;
+        }, "strip", z.ZodTypeAny, {
+            pattern: string;
+            policy: "local-only";
+        }, {
+            pattern: string;
+            policy: "local-only";
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        paths: {
+            pattern: string;
+            policy: "local-only";
+        }[];
+    }, {
+        paths?: {
+            pattern: string;
+            policy: "local-only";
+        }[] | undefined;
+    }>>;
+    /** Routing controls — forceTier pins the root tier, bypassing the classifier. */
+    routing: z.ZodOptional<z.ZodObject<{
+        forceTier: z.ZodDefault<z.ZodEnum<["auto", "T1", "T2", "T3"]>>;
+        perfStatsPath: z.ZodOptional<z.ZodString>;
+        learnFromOutcomes: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        forceTier: "T1" | "T2" | "T3" | "auto";
+        learnFromOutcomes: boolean;
+        perfStatsPath?: string | undefined;
+    }, {
+        forceTier?: "T1" | "T2" | "T3" | "auto" | undefined;
+        perfStatsPath?: string | undefined;
+        learnFromOutcomes?: boolean | undefined;
+    }>>;
+    /**
+     * T3→T2 reinforcement: when enabled, a worker that discovers its subtask should
+     * fan out can call the `request_workers` tool to have its T2 manager spawn
+     * sibling workers for the new pieces (no 4th tier; bounded). Off by default.
+     */
+    reinforcements: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxPerSection: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        maxPerSection: number;
+    }, {
+        enabled?: boolean | undefined;
+        maxPerSection?: number | undefined;
+    }>>;
+    /**
+     * Render the TUI in the terminal's alternate screen buffer (like vim).
+     * Flicker-proof and restores the shell on exit, but native scrollback is
+     * unavailable — history scrolls in-app with PgUp/PgDn. Also enabled per
+     * session with the --alt-screen flag. Default: off.
+     */
+    altScreen: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    workspace: {
+        cascadeMdPath: string;
+        configPath: string;
+        keystorePath: string;
+        auditLogPath: string;
+        debugWorldState: boolean;
+    };
+    providers: {
+        type: "anthropic" | "openai" | "gemini" | "azure" | "openai-compatible" | "ollama";
+        region?: string | undefined;
+        baseUrl?: string | undefined;
+        local?: boolean | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        deploymentName?: string | undefined;
+        apiVersion?: string | undefined;
+        model?: string | undefined;
+        authToken?: string | undefined;
+        credentialSource?: string | undefined;
+    }[];
+    tools: {
+        shellAllowlist: string[];
+        shellBlocklist: string[];
+        requireApprovalFor: string[];
+        browserEnabled: boolean;
+        agentBrowserControl: boolean;
+        dynamicToolSandbox: "auto" | "isolate" | "worker";
+        mcpServers?: {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }[] | undefined;
+        mcpTrusted?: string[] | undefined;
+        webSearch?: {
+            maxResults: number;
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        } | undefined;
+        enabledTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
+    };
+    models: {
+        t1?: string | undefined;
+        t2?: string | undefined;
+        t3?: string | undefined;
+        vision?: string | undefined;
+    };
+    version: "1.0";
+    hooks: {
+        preToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        preTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+    };
+    dashboard: {
+        auth: boolean;
+        host: string;
+        port: number;
+        teamMode: "single" | "multi";
+        secret?: string | undefined;
+    };
+    telemetry: {
+        enabled: boolean;
+        posthogApiKey?: string | undefined;
+        distinctId?: string | undefined;
+    };
+    memory: {
+        maxSessionMessages: number;
+        autoSummarizeAt: number;
+        retentionDays: number;
+        rememberSessions: boolean;
+    };
+    tierLimits: {
+        t1MaxTokens?: number | undefined;
+        t2MaxTokens?: number | undefined;
+        t3MaxTokens?: number | undefined;
+        t1Temperature?: number | undefined;
+        t2Temperature?: number | undefined;
+        t3Temperature?: number | undefined;
+    };
+    extendedContext: {
+        enabled: boolean;
+        maxMultiplier: number;
+    };
+    budget: {
+        maxTokensPerRun: number;
+        failureThreshold: number;
+        warnAtPct: number;
+        dailyBudgetUsd?: number | undefined;
+        sessionBudgetUsd?: number | undefined;
+        maxCostPerRunUsd?: number | undefined;
+    };
+    theme: string;
+    cascadeAuto: boolean;
+    autoBias: "balanced" | "quality" | "cost";
+    benchmarks: {
+        live: boolean;
+        pricingLive: boolean;
+        refreshHours: number;
+        sourceUrl?: string | undefined;
+        cacheFile?: string | undefined;
+    };
+    enableToolCreation: boolean;
+    knowledge: {
+        factsExtraction: boolean;
+    };
+    fastAnswer: {
+        autoSimple: boolean;
+    };
+    codeIndex: {
+        enabled: boolean;
+        autoRefresh: boolean;
+        dbPath?: string | undefined;
+    };
+    persistDynamicTools: boolean;
+    plugins: string[];
+    localConcurrency: number;
+    localInferenceTimeoutMs: number;
+    cloudInferenceTimeoutMs: number;
+    approvalTimeoutMs: number;
+    planApproval: "never" | "complex" | "all" | "always";
+    planReview: {
+        autoReviewer: boolean;
+        editable: boolean;
+        maxRevisionRounds: number;
+    };
+    autonomy: "manual" | "auto";
+    maxReplanPasses: number;
+    reflection: {
+        enabled: boolean;
+        maxRounds: number;
+    };
+    t3Execution: "parallel" | "sequential" | "auto";
+    reinforcements: {
+        enabled: boolean;
+        maxPerSection: number;
+    };
+    altScreen: boolean;
+    defaultIdentityId?: string | undefined;
+    rateLimits?: {
+        providerTpm?: Record<string, number> | undefined;
+    } | undefined;
+    privacy?: {
+        paths: {
+            pattern: string;
+            policy: "local-only";
+        }[];
+    } | undefined;
+    routing?: {
+        forceTier: "T1" | "T2" | "T3" | "auto";
+        learnFromOutcomes: boolean;
+        perfStatsPath?: string | undefined;
+    } | undefined;
+}, {
+    workspace?: {
+        cascadeMdPath?: string | undefined;
+        configPath?: string | undefined;
+        keystorePath?: string | undefined;
+        auditLogPath?: string | undefined;
+        debugWorldState?: boolean | undefined;
+    } | undefined;
+    providers?: {
+        type: "anthropic" | "openai" | "gemini" | "azure" | "openai-compatible" | "ollama";
+        region?: string | undefined;
+        baseUrl?: string | undefined;
+        local?: boolean | undefined;
+        label?: string | undefined;
+        apiKey?: string | undefined;
+        deploymentName?: string | undefined;
+        apiVersion?: string | undefined;
+        model?: string | undefined;
+        authToken?: string | undefined;
+        credentialSource?: string | undefined;
+    }[] | undefined;
+    tools?: {
+        mcpServers?: {
+            name: string;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+            command?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            oauthStore?: string | undefined;
+        }[] | undefined;
+        shellAllowlist?: string[] | undefined;
+        shellBlocklist?: string[] | undefined;
+        requireApprovalFor?: string[] | undefined;
+        browserEnabled?: boolean | undefined;
+        agentBrowserControl?: boolean | undefined;
+        mcpTrusted?: string[] | undefined;
+        webSearch?: {
+            searxngUrl?: string | undefined;
+            braveApiKey?: string | undefined;
+            tavilyApiKey?: string | undefined;
+            maxResults?: number | undefined;
+            guardSearxngUrl?: boolean | undefined;
+        } | undefined;
+        dynamicToolSandbox?: "auto" | "isolate" | "worker" | undefined;
+        enabledTools?: string[] | undefined;
+        disabledTools?: string[] | undefined;
+    } | undefined;
+    models?: {
+        t1?: string | undefined;
+        t2?: string | undefined;
+        t3?: string | undefined;
+        vision?: string | undefined;
+    } | undefined;
+    version?: "1.0" | undefined;
+    defaultIdentityId?: string | undefined;
+    hooks?: {
+        preToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postToolUse?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        preTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+        postTask?: {
+            command: string;
+            timeout?: number | undefined;
+            name?: string | undefined;
+            tools?: string[] | undefined;
+        }[] | undefined;
+    } | undefined;
+    dashboard?: {
+        auth?: boolean | undefined;
+        host?: string | undefined;
+        port?: number | undefined;
+        teamMode?: "single" | "multi" | undefined;
+        secret?: string | undefined;
+    } | undefined;
+    telemetry?: {
+        enabled?: boolean | undefined;
+        posthogApiKey?: string | undefined;
+        distinctId?: string | undefined;
+    } | undefined;
+    memory?: {
+        maxSessionMessages?: number | undefined;
+        autoSummarizeAt?: number | undefined;
+        retentionDays?: number | undefined;
+        rememberSessions?: boolean | undefined;
+    } | undefined;
+    tierLimits?: {
+        t1MaxTokens?: number | undefined;
+        t2MaxTokens?: number | undefined;
+        t3MaxTokens?: number | undefined;
+        t1Temperature?: number | undefined;
+        t2Temperature?: number | undefined;
+        t3Temperature?: number | undefined;
+    } | undefined;
+    extendedContext?: {
+        enabled?: boolean | undefined;
+        maxMultiplier?: number | undefined;
+    } | undefined;
+    budget?: {
+        dailyBudgetUsd?: number | undefined;
+        sessionBudgetUsd?: number | undefined;
+        maxTokensPerRun?: number | undefined;
+        maxCostPerRunUsd?: number | undefined;
+        failureThreshold?: number | undefined;
+        warnAtPct?: number | undefined;
+    } | undefined;
+    theme?: string | undefined;
+    rateLimits?: {
+        providerTpm?: Record<string, number> | undefined;
+    } | undefined;
+    cascadeAuto?: boolean | undefined;
+    autoBias?: "balanced" | "quality" | "cost" | undefined;
+    benchmarks?: {
+        live?: boolean | undefined;
+        sourceUrl?: string | undefined;
+        pricingLive?: boolean | undefined;
+        refreshHours?: number | undefined;
+        cacheFile?: string | undefined;
+    } | undefined;
+    enableToolCreation?: boolean | undefined;
+    knowledge?: {
+        factsExtraction?: boolean | undefined;
+    } | undefined;
+    fastAnswer?: {
+        autoSimple?: boolean | undefined;
+    } | undefined;
+    codeIndex?: {
+        enabled?: boolean | undefined;
+        autoRefresh?: boolean | undefined;
+        dbPath?: string | undefined;
+    } | undefined;
+    persistDynamicTools?: boolean | undefined;
+    plugins?: string[] | undefined;
+    localConcurrency?: number | undefined;
+    localInferenceTimeoutMs?: number | undefined;
+    cloudInferenceTimeoutMs?: number | undefined;
+    approvalTimeoutMs?: number | undefined;
+    planApproval?: "never" | "complex" | "all" | "always" | undefined;
+    planReview?: {
+        autoReviewer?: boolean | undefined;
+        editable?: boolean | undefined;
+        maxRevisionRounds?: number | undefined;
+    } | undefined;
+    autonomy?: "manual" | "auto" | undefined;
+    maxReplanPasses?: number | undefined;
+    reflection?: {
+        enabled?: boolean | undefined;
+        maxRounds?: number | undefined;
+    } | undefined;
+    t3Execution?: "parallel" | "sequential" | "auto" | undefined;
+    privacy?: {
+        paths?: {
+            pattern: string;
+            policy: "local-only";
+        }[] | undefined;
+    } | undefined;
+    routing?: {
+        forceTier?: "T1" | "T2" | "T3" | "auto" | undefined;
+        perfStatsPath?: string | undefined;
+        learnFromOutcomes?: boolean | undefined;
+    } | undefined;
+    reinforcements?: {
+        enabled?: boolean | undefined;
+        maxPerSection?: number | undefined;
+    } | undefined;
+    altScreen?: boolean | undefined;
+}>;
+
 /** A provider row, as every settings surface manipulates it. */
 interface WritableProvider {
     type: string;
@@ -4874,6 +6216,14 @@ declare class DashboardServer {
      * always failing.
      */
     private currentPageProvider?;
+    /**
+     * Supplied by the desktop shell so a run can ACT on that page — click, type,
+     * submit — not just read it. Same reasoning as the provider above: absent in
+     * the CLI, so the tool is not registered rather than present and failing.
+     * Cascade applies the `tools.agentBrowserControl` gate on top of this.
+     */
+    private browserController?;
+    private browserActorRelease?;
     private activeControllers;
     /**
      * Run taskIds per chat session — file snapshots are keyed by the run's
@@ -4913,6 +6263,45 @@ declare class DashboardServer {
     constructor(config: CascadeConfig, store: MemoryStore, workspacePath?: string);
     /** Wire the host's browser view in (desktop only). */
     setCurrentPageProvider(provider: CurrentPageProvider): void;
+    /** Let runs act on that view, not just read it (desktop only). */
+    setBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * Told whenever settings are committed through THIS server.
+     *
+     * Settings reach the live config by two routes — the desktop's Electron IPC
+     * handler and this server's `config:update` socket — and both run the same
+     * `commitSettings`. The desktop mirrors `tools.agentBrowserControl` into its
+     * browser module after its own route, but had no way to learn about the
+     * other, so a socket write left the module's copy stale: an enable the module
+     * still refused, or worse a disable the module still honoured for a run
+     * already holding the tool. This is the same sibling-writer drift
+     * `settings-payload.ts` exists to prevent, one layer up.
+     */
+    private settingsChangeHook?;
+    onSettingsChanged(hook: (config: CascadeConfig) => void): void;
+    /**
+     * Told when a run ends, so a host holding run-scoped state can release it.
+     *
+     * The desktop uses this to retire a run's browser Stop control: that has to
+     * outlive each individual action (the gap between two actions is when the
+     * user most wants it) but must not outlive the run.
+     */
+    /**
+     * Fired when a run ends, carrying BOTH identifiers explicitly.
+     *
+     * They are different things and conflating them was a live bug: a chat
+     * `sessionId` can contain many runs (hence `sessionTaskIds`), while
+     * `Cascade.run()` mints a fresh random `taskId` per run — and it is the
+     * taskId that tools see as `ToolExecuteOptions.sessionId`. Passing only the
+     * chat id meant browser cleanup keyed on the task id matched nothing, so a
+     * finished run kept its Stop banner armed and held its browser lease until
+     * the deadlock ceiling.
+     */
+    private runEndedHook?;
+    onRunEnded(hook: (ids: {
+        sessionId: string;
+        taskId?: string;
+    }) => void): void;
     start(): Promise<void>;
     stop(): Promise<void>;
     getSocket(): DashboardSocket;
@@ -6206,23 +7595,8 @@ declare class CascadeToolError extends Error {
     constructor(userMessage: string, cause?: unknown, retryable?: boolean);
 }
 
-/** Selectable base models, in the order a picker should show them. */
 declare const AZURE_BASE_MODELS: readonly string[];
 declare function inferAzureBaseModel(deploymentName: string): string | null;
-/**
- * The ModelInfo for one configured Azure deployment. On Azure the deployment IS
- * the model (you address it by deployment name, and which base model backs it is
- * opaque to the API) — so each `providers[]` entry with a deploymentName becomes
- * one selectable model.
- *
- * Which base model it serves drives correct benchmark scoring + pricing, so we
- * resolve it: an explicit `cfg.model` (user override) wins, else we infer it from
- * the deployment name. When resolved to a known catalog model, this deployment
- * INHERITS that model's real economics (context window, pricing, vision, output
- * cap) while keeping the deployment name as its callable `id` and carrying the
- * base identity in `baseModelId`. Unresolved deployments fall back to neutral
- * GPT-4o-class defaults (an estimate, not $0), exactly as before.
- */
 declare function azureModelForDeployment(cfg: ProviderConfig): ModelInfo | null;
 
 interface CloudUser {
@@ -6456,4 +7830,4 @@ declare function gatherSyncBundle(config: CascadeConfig): SyncBundle;
 /** Merge a pulled bundle into a config, returning the updated config to persist. */
 declare function applySyncBundle(bundle: SyncBundle, config: CascadeConfig, cleanup?: RetiredProviderCleanup): CascadeConfig;
 
-export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };
+export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BrowserAction, type BrowserActionOutcome, BrowserControlTool, type BrowserController, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, CascadeConfigSchema, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };