cascade-ai 0.77.0 → 0.79.0

package/dist/index.d.ts

@@ -873,6 +873,24 @@ interface ToolsConfig {
     shellBlocklist: string[];
     requireApprovalFor: string[];
     browserEnabled: boolean;
+    /**
+     * Let a run act on the desktop's built-in browser, not just read it. Separate
+     * from `browserEnabled` (headless Playwright) because it drives the user's
+     * signed-in session. See `src/config/schema.ts` and
+     * `src/tools/browser-control.ts`.
+     */
+    agentBrowserControl?: boolean;
+    /**
+     * Where a hosted run gets a browser. Absent means the capability does not
+     * exist on that surface. See `src/config/schema.ts` and
+     * `src/browser/remote/provider.ts`.
+     */
+    remoteBrowser?: {
+        provider?: 'cdp' | 'steel';
+        url?: string;
+        apiKey?: string;
+        maxSessions?: number;
+    };
     mcpServers?: McpServerConfig$1[];
     /**
      * Names of MCP servers (matching McpServerConfig.name) that the user has
@@ -3178,6 +3196,143 @@ declare class CurrentPageTool extends BaseTool {
     execute(_input: Record<string, unknown>, _options: ToolExecuteOptions): Promise<string>;
 }
 
+/** One thing to do to the open page. */
+interface BrowserAction {
+    kind: 'navigate' | 'click' | 'fill' | 'press' | 'wait_for' | 'extract_text';
+    /** navigate */
+    url?: string;
+    /** click, fill, wait_for, extract_text (optional — defaults to the body) */
+    selector?: string;
+    /** fill */
+    value?: string;
+    /** press — a single key name, e.g. "Enter" or "Tab" */
+    key?: string;
+    /** wait_for */
+    timeoutMs?: number;
+}
+interface BrowserActionOutcome {
+    ok: boolean;
+    /** Human- and model-readable account of what happened. */
+    detail: string;
+    /** Where the page ended up, when the host can tell. */
+    url?: string;
+    title?: string;
+}
+/**
+ * Who is asking, and how to stop them.
+ *
+ * Both fields exist because the browser is a SINGLETON the host owns while runs
+ * come and go. Without run identity the host cannot tell a Stop in one run from
+ * a Stop in every future run, and cannot tell two concurrent runs apart when
+ * they both reach for the same page.
+ */
+interface BrowserActionContext {
+    /**
+     * The run this action belongs to. Revocation and the host's single-owner
+     * lease both key on it, so a Stop scopes to the run the user was watching
+     * rather than to the process.
+     */
+    sessionId: string;
+    /**
+     * The individual worker asking — `tierId`, a per-instance id.
+     *
+     * Distinct from `sessionId` and both are needed. Every T3 worker in a run
+     * passes the same `taskId` as the session, so the session says which RUN to
+     * stop but cannot tell two sibling workers apart. The host leases the browser
+     * to one actor for a whole sequence, and a lease keyed by session would hand
+     * the same lease to every sibling at once — which is the state that lets one
+     * worker navigate away in the middle of another's fill-then-click.
+     */
+    actorId: string;
+    /**
+     * Cancels an action already in flight. `wait_for` can sit for 30s and
+     * `navigate` waits on the network, so without this a cancelled run keeps
+     * touching the user's authenticated page after it was stopped.
+     */
+    signal?: AbortSignal;
+}
+/**
+ * Performs one action against the browser view the host owns.
+ *
+ * Returning `ok: false` with a reason is expected and normal — a selector that
+ * matches nothing is a thing the model should be told about and can recover
+ * from, not an exception.
+ */
+type BrowserController = (action: BrowserAction, context: BrowserActionContext) => Promise<BrowserActionOutcome>;
+/**
+ * Told that one worker is finished with the browser for good.
+ *
+ * Separate from the controller because it is not an action: it carries no
+ * outcome and cannot fail. The host uses it to end that actor's sequence lease
+ * — the only signal that reliably means "will not ask again", as opposed to a
+ * worker that is merely waiting on its next model response.
+ */
+type BrowserActorRelease = (actorId: string) => void;
+declare class BrowserControlTool extends BaseTool {
+    readonly name = "browser_control";
+    readonly description: string;
+    readonly inputSchema: {
+        type: string;
+        properties: {
+            action: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            url: {
+                type: string;
+                description: string;
+            };
+            selector: {
+                type: string;
+                description: string;
+            };
+            value: {
+                type: string;
+                description: string;
+            };
+            key: {
+                type: string;
+                description: string;
+            };
+            timeoutMs: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+    private controller;
+    private release;
+    /** One-way. See `revoke`. */
+    private revoked;
+    constructor(controller: BrowserController, release?: BrowserActorRelease);
+    /**
+     * A worker has finished. Ends its hold on the browser.
+     *
+     * Called from the tier's terminal path rather than by the model, because a
+     * model cannot be relied on to announce that it is done — which is why the
+     * host cannot use idle time as the boundary instead.
+     */
+    releaseActor(actorId: string): void;
+    /**
+     * Permanently disable this tool, whatever the registry still holds.
+     *
+     * Registration-time gates cannot express "this run turned out to be
+     * unattended": a host that wires the controller and only then declares the
+     * run unattended has already registered the tool, and a check that ran at
+     * registration has no second chance. Enforcing at EXECUTION time makes the
+     * guarantee independent of call order, which is the whole point of stating
+     * the invariant rather than relying on the scheduler's current sequence.
+     *
+     * One-way on purpose. A safety gate that can be re-opened by a later call is
+     * a gate that a refactor re-opens by accident.
+     */
+    revoke(): void;
+    isDangerous(): boolean;
+    execute(input: Record<string, unknown>, options: ToolExecuteOptions): Promise<string>;
+}
+
 /** One entry in the per-run orchestration decision trail (see /why). */
 interface DecisionLogEntry {
     at: string;
@@ -3358,6 +3513,65 @@ declare class Cascade extends EventEmitter {
      * nothing. `disabledTools` still removes it.
      */
     setCurrentPageProvider(provider: CurrentPageProvider): void;
+    /**
+     * True when nobody is watching this run — a scheduled/cron task, which
+     * auto-approves every tool because there is no one to ask.
+     *
+     * That auto-approval is fine for ordinary tools and disqualifying for this
+     * one: `browser_control` drives the signed-in browser, and "every run asks
+     * first" is the promise the Settings copy makes. The property used to hold
+     * only because `runScheduledTask` happens not to call `setBrowserController`
+     * — a guarantee resting on an ABSENT call, which is exactly what a later
+     * refactor adds without noticing. Stated and enforced instead.
+     */
+    private unattended;
+    /**
+     * Declare that no human is watching this run, so capabilities that depend on
+     * a person being able to see and stop them are refused outright.
+     */
+    setUnattended(on: boolean): void;
+    /**
+     * Wire the host's browser so a run can ACT on the open page, not just read it.
+     *
+     * Two gates before this registers anything, and both matter:
+     *
+     *   - `tools.agentBrowserControl` must be on. Unlike read_current_page, which
+     *     reaches nothing the user has not already opened themselves, this drives
+     *     the session they are signed into. That is opt-in, not a default.
+     *   - `disabledTools` still removes it, the same as every other tool.
+     *   - The run must not be UNATTENDED. See `setUnattended`.
+     *
+     * Host-supplied like the page provider: the tool exists only where there is a
+     * real browser to drive, so it never has to be refused in the CLI or a hosted
+     * run — it is simply not there.
+     */
+    setBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * Wire a REMOTE browser — one the host connects to rather than one the user
+     * is signed into.
+     *
+     * A separate entry point because the enablement is a different question, and
+     * conflating them made the hosted capability dead on arrival: this went out
+     * calling `setBrowserController`, which gates on `agentBrowserControl`, and
+     * that flag means "drive the browser I am signed into on this machine". It
+     * defaults to false and has no meaning on a server, so the hosted tool was
+     * never registered at all — the feature looked shipped and did nothing.
+     *
+     * Configuring a provider IS the opt-in here. It takes a deliberate act with
+     * an endpoint and usually a paid account, and the browser it reaches is a
+     * throwaway signed into nothing — a smaller consent than handing over the
+     * session the user is already authenticated in, and one the desktop flag
+     * cannot stand in for.
+     */
+    setRemoteBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * The gates every surface shares, with only enablement differing.
+     *
+     * One place, because the two callers above are exactly the sibling-writer
+     * shape that has already drifted twice in this feature: a rule added to one
+     * and not the other is silent on the surface that missed it.
+     */
+    private registerBrowserControl;
     private registerMediaTools;
     /**
      * Register `generate_document` where there is a real workspace to write into.
@@ -3800,6 +4014,15 @@ declare class T3Worker extends BaseTier {
     constructor(router: CascadeRouter, toolRegistry: ToolRegistry, parentId: string);
     setStore(store: MemoryStore, sessionId: string): void;
     execute(assignment: T2ToT3Assignment, taskId: string, signal?: AbortSignal): Promise<T3Result>;
+    /**
+     * End this worker's hold on the shared browser.
+     *
+     * Duck-typed rather than imported: `browser_control` is registered only by a
+     * host that HAS a browser (the desktop), so in the CLI and hosted runs there
+     * is no such tool and this is a no-op. Importing the class to instanceof-check
+     * it would couple the worker to a tool that usually is not there.
+     */
+    private releaseBrowserControl;
     sendToPeer(toId: string, content: unknown): void;
     requestFromPeer(peerId: string, subtaskId: string): Promise<string>;
     syncWithPeers(barrierName: string): Promise<void>;
@@ -4477,6 +4700,55 @@ declare const CascadeConfigSchema: z.ZodObject<{
         shellBlocklist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         requireApprovalFor: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         browserEnabled: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Let a run ACT on the page open in the desktop's built-in browser — click,
+         * type, submit — not just read it.
+         *
+         * Distinct from `browserEnabled`, which turns on the headless Playwright
+         * tool. That one drives a throwaway browser with an empty cookie jar; this
+         * one drives the session the user is signed into, which is a different order
+         * of consequence and so gets its own switch rather than riding on that one.
+         *
+         * Off by default. Turning it on does not hand anything over silently: the
+         * tool still goes through the approval chain, and the browser panel carries a
+         * stop control for the run that is acting.
+         */
+        agentBrowserControl: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Where a HOSTED run gets a browser, since it has none of its own.
+         *
+         * The desktop drives the Chromium the user is signed into and can watch. A
+         * server has neither, and running one inside the container is wrong twice
+         * over — page JavaScript issues requests no URL check ever sees, from inside
+         * the trust boundary, and a session costs 200-400 MB. So this points at a
+         * browser somebody else runs.
+         *
+         * Absent by default: no provider, no capability. There is nothing to turn
+         * off because nothing is registered until an endpoint is supplied.
+         */
+        remoteBrowser: z.ZodOptional<z.ZodObject<{
+            /** `cdp` for an endpoint you run; `steel` for a Steel deployment. */
+            provider: z.ZodOptional<z.ZodEnum<["cdp", "steel"]>>;
+            /** The websocket endpoint for `cdp`, or the API base for `steel`. */
+            url: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            /**
+             * Concurrent sessions. One by default and deliberately so: every session
+             * is billed, and a wave of workers each opening their own is a cost the
+             * user did not choose. Raising it is a decision, not a default.
+             */
+            maxSessions: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        }, {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        }>>;
         mcpServers: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
             name: z.ZodString;
             command: z.ZodOptional<z.ZodString>;
@@ -4579,6 +4851,7 @@ declare const CascadeConfigSchema: z.ZodObject<{
         shellBlocklist: string[];
         requireApprovalFor: string[];
         browserEnabled: boolean;
+        agentBrowserControl: boolean;
         dynamicToolSandbox: "auto" | "isolate" | "worker";
         mcpServers?: {
             name: string;
@@ -4589,6 +4862,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             oauthStore?: string | undefined;
         }[] | undefined;
+        remoteBrowser?: {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             maxResults: number;
@@ -4613,6 +4892,13 @@ declare const CascadeConfigSchema: z.ZodObject<{
         shellBlocklist?: string[] | undefined;
         requireApprovalFor?: string[] | undefined;
         browserEnabled?: boolean | undefined;
+        agentBrowserControl?: boolean | undefined;
+        remoteBrowser?: {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             searxngUrl?: string | undefined;
@@ -5196,6 +5482,7 @@ declare const CascadeConfigSchema: z.ZodObject<{
         shellBlocklist: string[];
         requireApprovalFor: string[];
         browserEnabled: boolean;
+        agentBrowserControl: boolean;
         dynamicToolSandbox: "auto" | "isolate" | "worker";
         mcpServers?: {
             name: string;
@@ -5206,6 +5493,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             oauthStore?: string | undefined;
         }[] | undefined;
+        remoteBrowser?: {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             maxResults: number;
@@ -5384,6 +5677,13 @@ declare const CascadeConfigSchema: z.ZodObject<{
         shellBlocklist?: string[] | undefined;
         requireApprovalFor?: string[] | undefined;
         browserEnabled?: boolean | undefined;
+        agentBrowserControl?: boolean | undefined;
+        remoteBrowser?: {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             searxngUrl?: string | undefined;
@@ -5701,6 +6001,12 @@ interface SettingsPayload {
         braveApiKey?: string;
         tavilyApiKey?: string;
     };
+    remoteBrowser?: {
+        provider?: string;
+        url?: string;
+        apiKey?: string;
+        maxSessions?: number;
+    };
     advanced?: Record<string, unknown>;
 }
 /**
@@ -5764,6 +6070,12 @@ interface SettingsSnapshot {
         hasBraveKey: boolean;
         hasTavilyKey: boolean;
     };
+    remoteBrowser: {
+        provider?: string;
+        url?: string;
+        hasApiKey: boolean;
+        maxSessions?: number;
+    };
     advanced: Record<string, unknown>;
 }
 declare function settingsSnapshot(config: CascadeConfig): SettingsSnapshot;
@@ -6012,6 +6324,14 @@ declare class DashboardServer {
      * always failing.
      */
     private currentPageProvider?;
+    /**
+     * Supplied by the desktop shell so a run can ACT on that page — click, type,
+     * submit — not just read it. Same reasoning as the provider above: absent in
+     * the CLI, so the tool is not registered rather than present and failing.
+     * Cascade applies the `tools.agentBrowserControl` gate on top of this.
+     */
+    private browserController?;
+    private browserActorRelease?;
     private activeControllers;
     /**
      * Run taskIds per chat session — file snapshots are keyed by the run's
@@ -6051,6 +6371,45 @@ declare class DashboardServer {
     constructor(config: CascadeConfig, store: MemoryStore, workspacePath?: string);
     /** Wire the host's browser view in (desktop only). */
     setCurrentPageProvider(provider: CurrentPageProvider): void;
+    /** Let runs act on that view, not just read it (desktop only). */
+    setBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * Told whenever settings are committed through THIS server.
+     *
+     * Settings reach the live config by two routes — the desktop's Electron IPC
+     * handler and this server's `config:update` socket — and both run the same
+     * `commitSettings`. The desktop mirrors `tools.agentBrowserControl` into its
+     * browser module after its own route, but had no way to learn about the
+     * other, so a socket write left the module's copy stale: an enable the module
+     * still refused, or worse a disable the module still honoured for a run
+     * already holding the tool. This is the same sibling-writer drift
+     * `settings-payload.ts` exists to prevent, one layer up.
+     */
+    private settingsChangeHook?;
+    onSettingsChanged(hook: (config: CascadeConfig) => void): void;
+    /**
+     * Told when a run ends, so a host holding run-scoped state can release it.
+     *
+     * The desktop uses this to retire a run's browser Stop control: that has to
+     * outlive each individual action (the gap between two actions is when the
+     * user most wants it) but must not outlive the run.
+     */
+    /**
+     * Fired when a run ends, carrying BOTH identifiers explicitly.
+     *
+     * They are different things and conflating them was a live bug: a chat
+     * `sessionId` can contain many runs (hence `sessionTaskIds`), while
+     * `Cascade.run()` mints a fresh random `taskId` per run — and it is the
+     * taskId that tools see as `ToolExecuteOptions.sessionId`. Passing only the
+     * chat id meant browser cleanup keyed on the task id matched nothing, so a
+     * finished run kept its Stop banner armed and held its browser lease until
+     * the deadlock ceiling.
+     */
+    private runEndedHook?;
+    onRunEnded(hook: (ids: {
+        sessionId: string;
+        taskId?: string;
+    }) => void): void;
     start(): Promise<void>;
     stop(): Promise<void>;
     getSocket(): DashboardSocket;
@@ -6455,6 +6814,384 @@ declare function mcpServerPrefix(serverName: string): string;
  */
 declare function removeMcpServerDenials(disabledTools: string[] | undefined, serverName: string): string[] | undefined;
 
+/** A live browser session somebody else is hosting. */
+interface RemoteBrowserSession {
+    /** The provider's id for this session, needed to end it. */
+    id: string;
+    /**
+     * CDP endpoint to drive, for Playwright's `connectOverCDP`.
+     *
+     * Carries the provider's credentials in most cases (a token in the query
+     * string), so it is as sensitive as the API key and must never be logged.
+     */
+    cdpUrl: string;
+    /**
+     * A page showing the live session, embeddable in an iframe.
+     *
+     * A CAPABILITY URL: providers issue it deliberately without a token so it can
+     * be handed to a viewer, which means anyone holding it can watch and — where
+     * the provider supports input passthrough — drive the browser. It must never
+     * be persisted in run history, written to a log, or sent to any client other
+     * than the one that owns the run.
+     */
+    liveViewUrl?: string;
+}
+/**
+ * Somewhere to get a browser from.
+ *
+ * Deliberately tiny. Everything a session DOES goes over CDP and is identical
+ * whoever hosts it; only obtaining and releasing one differs, so those are the
+ * only two things a provider has to implement. That keeps a new adapter to a
+ * few dozen lines and keeps provider-specific behaviour from leaking into the
+ * driver.
+ */
+interface RemoteBrowserProvider {
+    /** A short name for messages the model and the user see. */
+    readonly name: string;
+    /**
+     * Whether `createSession` yields a browser of its own.
+     *
+     * False for a bare CDP endpoint, and the consequence is not cosmetic: that
+     * endpoint IS one browser, so two "sessions" against it are the same browser
+     * and, taking `contexts()[0].pages()[0]`, the same PAGE. Two runs would then
+     * type into each other's forms — across users on a shared deployment.
+     *
+     * A provider that cannot isolate is therefore capped at one concurrent run
+     * whatever the configured limit says. Raising a limit must not silently buy
+     * concurrency the provider cannot actually deliver.
+     */
+    readonly isolatesSessions: boolean;
+    createSession(signal?: AbortSignal): Promise<RemoteBrowserSession>;
+    endSession(id: string): Promise<void>;
+}
+/** How the host was told to obtain browsers. */
+interface RemoteBrowserConfig {
+    /** `cdp` for an endpoint you run; `steel` for a Steel deployment. */
+    provider?: 'cdp' | 'steel';
+    /**
+     * For `cdp`, the websocket endpoint to connect to.
+     * For `steel`, the API base — defaults to Steel's hosted API.
+     */
+    url?: string;
+    apiKey?: string;
+    /**
+     * Concurrent sessions allowed. One by default, and deliberately so: every
+     * session is billed, and a wave of workers each opening their own is a cost
+     * the user did not choose. Raising it is a decision, not a default.
+     */
+    maxSessions?: number;
+}
+
+/** What a run's watcher is told about its browser. */
+interface BrowserViewInfo {
+    /** A browser is attached to this run. Stop is meaningful while true. */
+    active: boolean;
+    /** Where to watch it, when the provider can stream one. */
+    liveViewUrl?: string;
+}
+interface RemoteBrowserControllerOptions {
+    provider: RemoteBrowserProvider;
+    /**
+     * Concurrent browser sessions. One by default: every session is billed, and
+     * a wave of workers each opening their own is a cost nobody chose.
+     */
+    maxSessions?: number;
+    /** Told when a run's live view becomes available, so the owner can watch. */
+    onLiveView?: (runId: string, liveViewUrl: string | undefined) => void;
+}
+declare class RemoteBrowserController {
+    private provider;
+    private maxSessions;
+    /**
+     * Live-view listeners, one per run.
+     *
+     * A single callback was fine while each run had its own controller. Now the
+     * controller is shared across a deployment, so one callback would send run
+     * A's live-view URL to whichever run registered last — and that URL is a
+     * bearer capability for a browser somebody else is driving.
+     */
+    private liveViewListeners;
+    /** An embedder that wants every run's live view, told which run each is. */
+    private onLiveViewAll;
+    private runs;
+    /**
+     * Runs that have a pool slot but no browser yet.
+     *
+     * Counted alongside `runs` against the cap. Without it the limit was a
+     * check-then-act across four awaits, and simultaneous first uses both won.
+     */
+    private opening;
+    /**
+     * A run's stop signal, created when its slot is reserved.
+     *
+     * Before this, Stop looked only in `runs` — so during the first `open()`,
+     * while the run existed only in `opening` and four awaits were in flight, it
+     * found nothing and returned. The open then completed, built a FRESH
+     * unaborted controller, and the click the user had stopped went ahead. The
+     * signal has to exist before the browser does.
+     */
+    private aborts;
+    /**
+     * Runs whose provider session is being released right now.
+     *
+     * `stopRun`, `endRun`, `releaseIfIdle`, and the stale-page branch of `open`
+     * all delete a run from `runs` synchronously and only THEN await
+     * `disposeRun` settling — the browser disconnect, and `provider.endSession`,
+     * which for Steel is a real HTTP `/release` call. Between that delete and
+     * the call actually finishing, the admission check in `open()` — which
+     * counts only `runs` and `opening` — saw the slot as free, so a second run
+     * could pass admission and call `createSession` before the first run's
+     * session was truly released. At `maxSessions: 1` that is two live, BILLED
+     * provider sessions at once, exactly what the pool exists to prevent.
+     * Counting this set alongside the other two closes the window.
+     *
+     * Keyed by run id, not a counter: every one of those four call sites checks
+     * the run is still IN `runs` before deleting it and starting teardown, and
+     * that delete is synchronous, so at most one teardown can ever be in flight
+     * for a given run id at a time — a second caller finds the entry already
+     * gone and never starts a competing one. The entry is removed only once its
+     * own teardown settles, so a later, genuine re-open of the same run id
+     * never collides with one still in flight.
+     */
+    private closing;
+    /** Runs the user has stopped, by run id — same meaning as on the desktop. */
+    private revoked;
+    /**
+     * One lease PER RUN, because there is one browser per run.
+     *
+     * The desktop has a single lease because it has a single browser. Here each
+     * run gets its own session, so a global lease would make run B queue behind
+     * run A for a browser it was never going to use — and with no queue timeout,
+     * queue for as long as A lasts. What limits runs against each other is the
+     * session POOL, not the lease.
+     */
+    private leases;
+    constructor(options: RemoteBrowserControllerOptions);
+    private leaseFor;
+    /** The controller to hand to `Cascade.setBrowserController`. */
+    get controller(): (action: BrowserAction, context: BrowserActionContext) => Promise<BrowserActionOutcome>;
+    /** Watch one run's browser. The URL never goes to any other run's listener. */
+    onLiveViewFor(runKey: string, listener: (info: BrowserViewInfo) => void): void;
+    offLiveViewFor(runKey: string): void;
+    /**
+     * Tell a run's listener what its browser situation is.
+     *
+     * `active` is separate from the URL and both are needed: a provider with no
+     * live view is attached-but-unwatchable, and a finished run is not attached
+     * at all. Both have no URL, so a listener given only the URL cannot tell them
+     * apart — and would drop the Stop control for the first as if it were the
+     * second.
+     */
+    private announceLiveView;
+    /**
+     * Hand back a session the run turned out not to want.
+     *
+     * A browser opened for an action that is then refused would otherwise stay
+     * allocated and billed until the whole run ended, for a run that has just
+     * been stopped.
+     */
+    private releaseIfIdle;
+    /** Release every run's session. For when the deployment's config changes. */
+    dispose(): Promise<void>;
+    /** A worker finished; it will never ask for the browser again. */
+    actorEnded(actorId: string): void;
+    /** The user stopped this run. Refuses further actions and clears its queue. */
+    stopRun(runId: string): void;
+    /** A run ended: release its browser rather than pay for an idle session. */
+    endRun(runId: string): Promise<void>;
+    /** Forget a finished run entirely, so nothing accumulates per run. */
+    private forgetRun;
+    /**
+     * Let go of one run's browser.
+     *
+     * Best-effort throughout: a run is already over by the time this runs, and a
+     * provider that is briefly unreachable must not turn that into a failure the
+     * user sees. The provider's own idle timeout collects anything left.
+     */
+    private disposeRun;
+    /**
+     * Run `disposeRun`, with the run id counted in `closing` until it settles.
+     *
+     * The caller adds the id to `closing` itself, synchronously, in the same
+     * breath as deleting the run from `runs` — see the field comment. This just
+     * guarantees the removal happens, success or failure, so a disposal that
+     * throws cannot leave the slot counted against the pool forever.
+     */
+    private teardown;
+    private act;
+    /**
+     * The run's browser, opened on first use.
+     *
+     * The ONE place the session cap is enforced. An earlier version also checked
+     * it before taking the lease, on the reasoning that a run which cannot get a
+     * session would otherwise queue forever — true when every run shared one
+     * lease, and false once each run got its own, because a second run no longer
+     * queues behind the first at all. Its own revert-check proved it dead: taking
+     * it out changed no test. Two copies of a cap invite them to disagree.
+     */
+    private open;
+    /** The part that may fail, with the pool slot already reserved. */
+    private openReserved;
+    private perform;
+}
+
+declare class GenericCdpProvider implements RemoteBrowserProvider {
+    readonly name = "CDP endpoint";
+    readonly isolatesSessions = false;
+    private endpoint;
+    constructor(endpoint: string);
+    /**
+     * There is no session to create — the endpoint is the session.
+     *
+     * `id` is a constant rather than a generated one because there is nothing to
+     * look up later: `endSession` has nothing to call. Inventing a unique id
+     * would imply a lifecycle this provider does not have.
+     */
+    createSession(): Promise<RemoteBrowserSession>;
+    /**
+     * Deliberately nothing.
+     *
+     * The endpoint belongs to whoever runs it and outlives any single run, so
+     * "ending" it is not ours to do — closing it would take the browser away from
+     * every other user of a shared endpoint. The driver still closes its own
+     * connection and its pages; this is only about the browser's lifetime.
+     */
+    endSession(): Promise<void>;
+}
+/**
+ * Whether a URL is a plausible CDP endpoint.
+ *
+ * Checked so a misconfiguration is a clear message at startup rather than an
+ * obscure Playwright failure on the first action, and so an `http://` URL
+ * pasted from a provider's docs is named as the mistake it is.
+ */
+declare function isCdpEndpoint(url: string): boolean;
+
+declare class SteelProvider implements RemoteBrowserProvider {
+    readonly name = "Steel";
+    readonly isolatesSessions = true;
+    private base;
+    private apiKey;
+    constructor(opts?: {
+        url?: string;
+        apiKey?: string;
+    });
+    createSession(signal?: AbortSignal): Promise<RemoteBrowserSession>;
+    endSession(id: string): Promise<void>;
+    private call;
+}
+
+/**
+ * Why an actor did not get the browser.
+ *
+ * A boolean was not enough: "the queue is full, try again" and "your run was
+ * stopped" are different things to tell a model, and a waiter dropped because
+ * the capability was switched off is neither. Reporting all three as "busy"
+ * had a model politely retrying something that would never be granted.
+ */
+type LeaseResult = 'granted' | 'busy' | 'cancelled' | 'off';
+interface BrowserLeaseOptions {
+    /**
+     * Whether a run has been stopped. The lease skips revoked runs when handing
+     * on, so a stopped run is not dealt the browser only to refuse it a line
+     * later while the actor behind it waits out the whole queue.
+     */
+    isRevoked?: (sessionId: string) => boolean;
+    /** Called whenever ownership or queue depth changes, so a UI can follow. */
+    onChange?: () => void;
+}
+declare class BrowserLease {
+    private actor;
+    private session;
+    private ceilingTimer;
+    private waiting;
+    private lifecycleWired;
+    /**
+     * The action holding the browser, if any.
+     *
+     * Needed alongside the lease for a reason the lease cannot cover: the lease
+     * is RE-ENTRANT for its holder — that is what makes a sequence a sequence —
+     * so nothing in it stops ONE actor running two actions at once. A retry
+     * racing the call it retried is exactly that shape.
+     *
+     * A symbol because it identifies the individual call: only the action that
+     * took the slot may release it.
+     */
+    private action;
+    private isRevoked;
+    private onChange;
+    constructor(options?: BrowserLeaseOptions);
+    get holderActor(): string | null;
+    get holderSession(): string | null;
+    get queueDepth(): number;
+    get actionInFlight(): boolean;
+    /**
+     * Declare that this host reports worker terminal states.
+     *
+     * When it does, timers stop being ownership boundaries entirely. When it does
+     * not — an embedder that wired a controller but not the release — the
+     * fallbacks stay, because something has to break a deadlock.
+     */
+    setLifecycleReleaseWired(on: boolean): void;
+    /**
+     * Take the browser for this actor, waiting in line if someone else holds it.
+     *
+     * Re-entrant for the actor that already holds it: that is the sequence case —
+     * the same worker coming back for its next step must not queue behind itself.
+     */
+    acquire(actorId: string, sessionId: string, signal?: AbortSignal): Promise<LeaseResult>;
+    /**
+     * One worker has finished its whole sequence, so its hold ends.
+     *
+     * THIS is the semantic release. It comes from the worker's own terminal path,
+     * so it means "this actor will never ask again" — which a timer can never
+     * mean about a worker that is merely thinking.
+     *
+     * Idempotent, and safe for an actor that never touched the browser.
+     */
+    actorEnded(actorId: string): void;
+    /**
+     * Give the browser up when about to return without using it.
+     *
+     * Two guards, both load-bearing. Never while an action is in flight, because
+     * the lease is RE-ENTRANT: the action still running may be this same actor's
+     * previous step, and taking the lease off it hands the page to a queued
+     * worker mid-sequence. And only while still the holder, because by the time a
+     * refusal path runs a Stop may already have handed the lease on.
+     */
+    releaseIfHeldBy(actorId: string): void;
+    /** Drop every queued waiter belonging to a run, and the lease if it holds it. */
+    dropRun(sessionId: string): void;
+    /** Turn everyone away — the capability itself has gone. */
+    dropAll(): void;
+    /** Hand the browser to the next actor in line, if any. */
+    release(): void;
+    /** Arm the deadlock ceiling. Not a release schedule — see the constant. */
+    armCeiling(): void;
+    clearCeiling(): void;
+    /** Take the per-action slot, or null when one is already running. */
+    beginAction(): symbol | null;
+    /** Release the slot, but only for the action that took it. */
+    endAction(token: symbol): boolean;
+    /**
+     * Wait, briefly, for an outgoing action to unwind.
+     *
+     * A release can hand the browser on while the previous holder's abort is
+     * still propagating through an awaited navigation. That is a handoff, not a
+     * conflict, so it is waited out rather than refused — but bounded, because a
+     * wedged action must not pin the queue.
+     */
+    awaitActionSlot(): Promise<boolean>;
+    /**
+     * Queue one actor, resolving when it gets the browser or is turned away.
+     *
+     * `settle` is wrapped so it runs at most once and always takes the waiter out
+     * of the line: the timeout, an abort and a handoff all race, and settling
+     * twice would silently leave a dead entry holding a queue slot.
+     */
+    private enqueue;
+}
+
 /** A unit of indexed text. `sourceId` groups chunks from one document/file. */
 interface Chunk {
     id: string;
@@ -7579,4 +8316,4 @@ declare function gatherSyncBundle(config: CascadeConfig): SyncBundle;
 /** Merge a pulled bundle into a config, returning the updated config to persist. */
 declare function applySyncBundle(bundle: SyncBundle, config: CascadeConfig, cleanup?: RetiredProviderCleanup): CascadeConfig;
 
-export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, CascadeConfigSchema, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };
+export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BrowserAction, type BrowserActionOutcome, BrowserControlTool, type BrowserController, BrowserLease, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, CascadeConfigSchema, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, GenericCdpProvider, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RemoteBrowserConfig, RemoteBrowserController, type RemoteBrowserProvider, type RemoteBrowserSession, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, SteelProvider, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isCdpEndpoint, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };