cascade-ai 0.78.0 → 0.80.0

package/dist/index.d.ts

@@ -880,6 +880,17 @@ interface ToolsConfig {
      * `src/tools/browser-control.ts`.
      */
     agentBrowserControl?: boolean;
+    /**
+     * Where a hosted run gets a browser. Absent means the capability does not
+     * exist on that surface. See `src/config/schema.ts` and
+     * `src/browser/remote/provider.ts`.
+     */
+    remoteBrowser?: {
+        provider?: 'cdp' | 'steel';
+        url?: string;
+        apiKey?: string;
+        maxSessions?: number;
+    };
     mcpServers?: McpServerConfig$1[];
     /**
      * Names of MCP servers (matching McpServerConfig.name) that the user has
@@ -3535,6 +3546,32 @@ declare class Cascade extends EventEmitter {
      * run — it is simply not there.
      */
     setBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * Wire a REMOTE browser — one the host connects to rather than one the user
+     * is signed into.
+     *
+     * A separate entry point because the enablement is a different question, and
+     * conflating them made the hosted capability dead on arrival: this went out
+     * calling `setBrowserController`, which gates on `agentBrowserControl`, and
+     * that flag means "drive the browser I am signed into on this machine". It
+     * defaults to false and has no meaning on a server, so the hosted tool was
+     * never registered at all — the feature looked shipped and did nothing.
+     *
+     * Configuring a provider IS the opt-in here. It takes a deliberate act with
+     * an endpoint and usually a paid account, and the browser it reaches is a
+     * throwaway signed into nothing — a smaller consent than handing over the
+     * session the user is already authenticated in, and one the desktop flag
+     * cannot stand in for.
+     */
+    setRemoteBrowserController(controller: BrowserController, release?: BrowserActorRelease): void;
+    /**
+     * The gates every surface shares, with only enablement differing.
+     *
+     * One place, because the two callers above are exactly the sibling-writer
+     * shape that has already drifted twice in this feature: a rule added to one
+     * and not the other is silent on the surface that missed it.
+     */
+    private registerBrowserControl;
     private registerMediaTools;
     /**
      * Register `generate_document` where there is a real workspace to write into.
@@ -4677,6 +4714,41 @@ declare const CascadeConfigSchema: z.ZodObject<{
          * stop control for the run that is acting.
          */
         agentBrowserControl: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Where a HOSTED run gets a browser, since it has none of its own.
+         *
+         * The desktop drives the Chromium the user is signed into and can watch. A
+         * server has neither, and running one inside the container is wrong twice
+         * over — page JavaScript issues requests no URL check ever sees, from inside
+         * the trust boundary, and a session costs 200-400 MB. So this points at a
+         * browser somebody else runs.
+         *
+         * Absent by default: no provider, no capability. There is nothing to turn
+         * off because nothing is registered until an endpoint is supplied.
+         */
+        remoteBrowser: z.ZodOptional<z.ZodObject<{
+            /** `cdp` for an endpoint you run; `steel` for a Steel deployment. */
+            provider: z.ZodOptional<z.ZodEnum<["cdp", "steel"]>>;
+            /** The websocket endpoint for `cdp`, or the API base for `steel`. */
+            url: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            /**
+             * Concurrent sessions. One by default and deliberately so: every session
+             * is billed, and a wave of workers each opening their own is a cost the
+             * user did not choose. Raising it is a decision, not a default.
+             */
+            maxSessions: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        }, {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        }>>;
         mcpServers: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
             name: z.ZodString;
             command: z.ZodOptional<z.ZodString>;
@@ -4790,6 +4862,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             oauthStore?: string | undefined;
         }[] | undefined;
+        remoteBrowser?: {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             maxResults: number;
@@ -4815,6 +4893,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
         requireApprovalFor?: string[] | undefined;
         browserEnabled?: boolean | undefined;
         agentBrowserControl?: boolean | undefined;
+        remoteBrowser?: {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             searxngUrl?: string | undefined;
@@ -5409,6 +5493,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             oauthStore?: string | undefined;
         }[] | undefined;
+        remoteBrowser?: {
+            maxSessions: number;
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             maxResults: number;
@@ -5588,6 +5678,12 @@ declare const CascadeConfigSchema: z.ZodObject<{
         requireApprovalFor?: string[] | undefined;
         browserEnabled?: boolean | undefined;
         agentBrowserControl?: boolean | undefined;
+        remoteBrowser?: {
+            url?: string | undefined;
+            provider?: "cdp" | "steel" | undefined;
+            apiKey?: string | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
         mcpTrusted?: string[] | undefined;
         webSearch?: {
             searxngUrl?: string | undefined;
@@ -5905,6 +6001,12 @@ interface SettingsPayload {
         braveApiKey?: string;
         tavilyApiKey?: string;
     };
+    remoteBrowser?: {
+        provider?: string;
+        url?: string;
+        apiKey?: string;
+        maxSessions?: number;
+    };
     advanced?: Record<string, unknown>;
 }
 /**
@@ -5968,6 +6070,12 @@ interface SettingsSnapshot {
         hasBraveKey: boolean;
         hasTavilyKey: boolean;
     };
+    remoteBrowser: {
+        provider?: string;
+        url?: string;
+        hasApiKey: boolean;
+        maxSessions?: number;
+    };
     advanced: Record<string, unknown>;
 }
 declare function settingsSnapshot(config: CascadeConfig): SettingsSnapshot;
@@ -6706,6 +6814,881 @@ declare function mcpServerPrefix(serverName: string): string;
  */
 declare function removeMcpServerDenials(disabledTools: string[] | undefined, serverName: string): string[] | undefined;
 
+/** A live browser session somebody else is hosting. */
+interface RemoteBrowserSession {
+    /** The provider's id for this session, needed to end it. */
+    id: string;
+    /**
+     * CDP endpoint to drive, for Playwright's `connectOverCDP`.
+     *
+     * Carries the provider's credentials in most cases (a token in the query
+     * string), so it is as sensitive as the API key and must never be logged.
+     */
+    cdpUrl: string;
+    /**
+     * A page showing the live session, embeddable in an iframe.
+     *
+     * A CAPABILITY URL: providers issue it deliberately without a token so it can
+     * be handed to a viewer, which means anyone holding it can watch and — where
+     * the provider supports input passthrough — drive the browser. It must never
+     * be persisted in run history, written to a log, or sent to any client other
+     * than the one that owns the run.
+     */
+    liveViewUrl?: string;
+}
+/**
+ * Somewhere to get a browser from.
+ *
+ * Deliberately tiny. Everything a session DOES goes over CDP and is identical
+ * whoever hosts it; only obtaining and releasing one differs, so those are the
+ * only two things a provider has to implement. That keeps a new adapter to a
+ * few dozen lines and keeps provider-specific behaviour from leaking into the
+ * driver.
+ */
+interface RemoteBrowserProvider {
+    /** A short name for messages the model and the user see. */
+    readonly name: string;
+    /**
+     * Whether `createSession` yields a browser of its own.
+     *
+     * False for a bare CDP endpoint, and the consequence is not cosmetic: that
+     * endpoint IS one browser, so two "sessions" against it are the same browser
+     * and, taking `contexts()[0].pages()[0]`, the same PAGE. Two runs would then
+     * type into each other's forms — across users on a shared deployment.
+     *
+     * A provider that cannot isolate is therefore capped at one concurrent run
+     * whatever the configured limit says. Raising a limit must not silently buy
+     * concurrency the provider cannot actually deliver.
+     */
+    readonly isolatesSessions: boolean;
+    createSession(signal?: AbortSignal): Promise<RemoteBrowserSession>;
+    endSession(id: string): Promise<void>;
+}
+/** How the host was told to obtain browsers. */
+interface RemoteBrowserConfig {
+    /** `cdp` for an endpoint you run; `steel` for a Steel deployment. */
+    provider?: 'cdp' | 'steel';
+    /**
+     * For `cdp`, the websocket endpoint to connect to.
+     * For `steel`, the API base — defaults to Steel's hosted API.
+     */
+    url?: string;
+    apiKey?: string;
+    /**
+     * Concurrent sessions allowed. One by default, and deliberately so: every
+     * session is billed, and a wave of workers each opening their own is a cost
+     * the user did not choose. Raising it is a decision, not a default.
+     */
+    maxSessions?: number;
+}
+
+/** What a run's watcher is told about its browser. */
+interface BrowserViewInfo {
+    /** A browser is attached to this run. Stop is meaningful while true. */
+    active: boolean;
+    /** Where to watch it, when the provider can stream one. */
+    liveViewUrl?: string;
+}
+/**
+ * One rendered frame of a run's browser, on its way to whoever is watching.
+ *
+ * A JPEG rather than a video stream, and deliberately: CDP's screencast is
+ * adaptive — Chrome sends a frame when the page actually changes, not on a
+ * clock — so an idle page costs nothing, and there is no media pipeline to run
+ * inside the deployment. It is worse than WebRTC for video-heavy pages and
+ * better than it for everything else this feature is pointed at.
+ */
+interface BrowserFrame {
+    /** base64 JPEG, as CDP hands it over. Never decoded on the way through. */
+    data: string;
+    /** The remote viewport, so a canvas can size itself without guessing. */
+    width: number;
+    height: number;
+    /**
+     * Which watch this frame belongs to. See `watchGen`.
+     *
+     * Travels with the picture so the receipt the client sends back names the
+     * watch it actually saw, rather than whichever one is current by the time it
+     * arrives.
+     */
+    generation: number;
+}
+/** Who is driving a run's browser, and whether it is being pictured. */
+interface BrowserControlState {
+    /** True while a person holds it and the agent is being refused. */
+    human: boolean;
+    /** Whether frames are being produced right now. See `setCapture`. */
+    capturing: boolean;
+    /**
+     * Whether THIS watch has confirmed receiving a picture. See `seenGen`.
+     *
+     * Pushed rather than inferred, for the same reason ownership is: the client
+     * cannot work it out while the picture is off, because it is the frames that
+     * would tell it. A client left to guess would guess from what it remembers of
+     * a previous watch, which is exactly the state this distinguishes.
+     */
+    confirmed: boolean;
+}
+/**
+ * One thing a person did to the page while they held it.
+ *
+ * Coordinates are NORMALISED — 0..1 across the frame — rather than pixels, and
+ * that is a boundary decision rather than a convenience. The picture the user
+ * clicked is a JPEG scaled twice on its way to them: once by CDP into
+ * `maxWidth`/`maxHeight`, once by the panel into whatever width the layout
+ * gave it. Only this side knows the viewport those pixels came from, so only
+ * this side can turn a click back into a page coordinate. A client sending
+ * pixels would have to reconstruct both scalings and would silently miss by a
+ * few pixels whenever it got one wrong — which, on a page of small controls, is
+ * a click on the wrong thing.
+ *
+ * Typing is `text` rather than a stream of key events because `Input.insertText`
+ * puts the whole string in at once: no IME to emulate, no per-character key
+ * codes to get wrong for anything but a US layout, and no chance of a password
+ * arriving one keystroke per socket message. `key` covers the keys that are
+ * commands rather than characters, from a fixed list — see `KEYS`.
+ */
+type BrowserInput = {
+    kind: 'move';
+    x: number;
+    y: number;
+} | {
+    kind: 'click';
+    x: number;
+    y: number;
+    button?: 'left' | 'right' | 'middle';
+    clicks?: number;
+} | {
+    kind: 'scroll';
+    x: number;
+    y: number;
+    deltaY: number;
+} | {
+    kind: 'text';
+    text: string;
+} | {
+    kind: 'key';
+    key: string;
+    modifiers?: Array<'Control' | 'Meta' | 'Shift'>;
+};
+interface RemoteBrowserControllerOptions {
+    provider: RemoteBrowserProvider;
+    /**
+     * Concurrent browser sessions. One by default: every session is billed, and
+     * a wave of workers each opening their own is a cost nobody chose.
+     */
+    maxSessions?: number;
+    /** Told when a run's live view becomes available, so the owner can watch. */
+    onLiveView?: (runId: string, liveViewUrl: string | undefined) => void;
+    /**
+     * Something that must finish before this controller may open anything.
+     *
+     * For ROTATION. A settings change builds a new controller and disposes the
+     * old one, and disposal is not instant: it detaches CDP sessions and hands
+     * provider sessions back over the network. Installing the replacement
+     * immediately meant the first action after a rotation could call
+     * `createSession` while the previous controller was still releasing — two
+     * controllers holding sessions against one provider's cap, which the pool
+     * here cannot see because it counts only its own. On a provider that
+     * enforces its own limit that action simply fails, and it is the first one
+     * after an operator changed a setting, which is the worst moment for it.
+     *
+     * Awaited once, before the pool slot is reserved, and never awaited again.
+     * A rejection is ignored on purpose: the old controller failing to tidy up
+     * is not a reason to refuse the new one work, and `dispose` already reports
+     * its own trouble.
+     */
+    ready?: Promise<unknown>;
+}
+declare class RemoteBrowserController {
+    private provider;
+    private maxSessions;
+    /**
+     * Live-view listeners, one per run.
+     *
+     * A single callback was fine while each run had its own controller. Now the
+     * controller is shared across a deployment, so one callback would send run
+     * A's live-view URL to whichever run registered last — and that URL is a
+     * bearer capability for a browser somebody else is driving.
+     */
+    private liveViewListeners;
+    /**
+     * Told when a run's browser changes hands, or stops being pictured.
+     *
+     * Needed because a takeover can end without anybody asking. The hold lapses
+     * on its own after `HUMAN_IDLE_MS`, and a client left believing it still has
+     * control would keep sending input into a lease it no longer holds — every
+     * event refused, with nothing on screen saying why.
+     */
+    private controlListeners;
+    /** What each run's listener was last told, so unchanged states stay quiet. */
+    private controlAnnounced;
+    /** An embedder that wants every run's live view, told which run each is. */
+    private onLiveViewAll;
+    private runs;
+    /**
+     * Runs that have a pool slot but no browser yet.
+     *
+     * Counted alongside `runs` against the cap. Without it the limit was a
+     * check-then-act across four awaits, and simultaneous first uses both won.
+     */
+    private opening;
+    /**
+     * A run's stop signal, created when its slot is reserved.
+     *
+     * Before this, Stop looked only in `runs` — so during the first `open()`,
+     * while the run existed only in `opening` and four awaits were in flight, it
+     * found nothing and returned. The open then completed, built a FRESH
+     * unaborted controller, and the click the user had stopped went ahead. The
+     * signal has to exist before the browser does.
+     */
+    private aborts;
+    /**
+     * Runs whose provider session is being released right now.
+     *
+     * `stopRun`, `endRun`, `releaseIfIdle`, and the stale-page branch of `open`
+     * all delete a run from `runs` synchronously and only THEN await
+     * `disposeRun` settling — the browser disconnect, and `provider.endSession`,
+     * which for Steel is a real HTTP `/release` call. Between that delete and
+     * the call actually finishing, the admission check in `open()` — which
+     * counts only `runs` and `opening` — saw the slot as free, so a second run
+     * could pass admission and call `createSession` before the first run's
+     * session was truly released. At `maxSessions: 1` that is two live, BILLED
+     * provider sessions at once, exactly what the pool exists to prevent.
+     * Counting this set alongside the other two closes the window.
+     *
+     * Keyed by run id, not a counter: every one of those four call sites checks
+     * the run is still IN `runs` before deleting it and starting teardown, and
+     * that delete is synchronous, so at most one teardown can ever be in flight
+     * for a given run id at a time — a second caller finds the entry already
+     * gone and never starts a competing one. The entry is removed only once its
+     * own teardown settles, so a later, genuine re-open of the same run id
+     * never collides with one still in flight.
+     */
+    private closing;
+    /** Runs the user has stopped, by run id — same meaning as on the desktop. */
+    private revoked;
+    /**
+     * One lease PER RUN, because there is one browser per run.
+     *
+     * The desktop has a single lease because it has a single browser. Here each
+     * run gets its own session, so a global lease would make run B queue behind
+     * run A for a browser it was never going to use — and with no queue timeout,
+     * queue for as long as A lasts. What limits runs against each other is the
+     * session POOL, not the lease.
+     */
+    private leases;
+    constructor(options: RemoteBrowserControllerOptions);
+    /**
+     * The predecessor's teardown, until it has been waited for once.
+     *
+     * Cleared as soon as it settles so the wait is not re-entered on every open
+     * — and so the promise itself is not retained for the life of the process.
+     */
+    private ready;
+    /**
+     * This controller has been retired and will never open anything again.
+     *
+     * Stronger than "its runs were ended", and it has to be. A caller parked on
+     * the `ready` gate above is invisible to `dispose()` — it holds no run and
+     * has reserved no slot, because it has not got that far — so a SECOND
+     * settings change, arriving while the first retirement is still settling,
+     * found nothing to wait for and let the newest controller start immediately.
+     * The parked caller then woke up on a controller nobody holds a reference to
+     * and allocated a session against the superseded configuration, with the
+     * newest controller free to allocate its own.
+     *
+     * Set synchronously at the top of `dispose`, so anything already waiting is
+     * excluded the moment retirement begins rather than when it finishes.
+     */
+    private retired;
+    private leaseFor;
+    /** The controller to hand to `Cascade.setBrowserController`. */
+    get controller(): (action: BrowserAction, context: BrowserActionContext) => Promise<BrowserActionOutcome>;
+    /** Watch one run's browser. The URL never goes to any other run's listener. */
+    onLiveViewFor(runKey: string, listener: (info: BrowserViewInfo) => void): void;
+    offLiveViewFor(runKey: string): void;
+    onControlFor(runKey: string, listener: (state: BrowserControlState) => void): void;
+    offControlFor(runKey: string): void;
+    /**
+     * Say who has the browser, but only when the answer has changed.
+     *
+     * The lease reports every ownership change, and during ordinary work that is
+     * one per action as workers take it and give it back. None of those are
+     * interesting to a viewer — the agent had it before and has it now — and
+     * emitting them would put a socket message on every click the agent makes.
+     */
+    private announceControl;
+    /**
+     * Tell a run's listener what its browser situation is.
+     *
+     * `active` is separate from the URL and both are needed: a provider with no
+     * live view is attached-but-unwatchable, and a finished run is not attached
+     * at all. Both have no URL, so a listener given only the URL cannot tell them
+     * apart — and would drop the Stop control for the first as if it were the
+     * second.
+     */
+    private announceLiveView;
+    /**
+     * Hand back a session the run turned out not to want.
+     *
+     * A browser opened for an action that is then refused would otherwise stay
+     * allocated and billed until the whole run ended, for a run that has just
+     * been stopped.
+     */
+    private releaseIfIdle;
+    /** Release every run's session. For when the deployment's config changes. */
+    dispose(): Promise<void>;
+    /** A worker finished; it will never ask for the browser again. */
+    actorEnded(actorId: string): void;
+    /**
+     * Start streaming this run's page to whoever is watching it.
+     *
+     * Nothing streams until someone asks. That is the whole reason this is a
+     * method rather than something `open()` does: an unwatched run would
+     * otherwise pay to encode frames nobody sees, on every run, forever — and on
+     * a metered provider it would pay for the bandwidth too.
+     *
+     * Frames are ACKED after they are handed on, never before. Chrome sends the
+     * next frame only once the previous is acknowledged, so this bounds it to one
+     * outstanding frame against OUR OWN handling. It does not reach further than
+     * that, and an earlier version of this comment claimed it did: `onFrame` ends
+     * at a socket emit, which hands the JPEG to a transport rather than to a
+     * viewer, so the ack says nothing about what the person actually received.
+     * Bounding the rest of the path is the transport's job — see `emitFrame`,
+     * where frames go out lossy so a slow connection drops pictures instead of
+     * banking stale ones. Dropping the ack stops the stream dead, which is why it
+     * is best-effort but unconditional.
+     *
+     * Returns false when there is nothing to watch — the run has no browser, or
+     * it is already being watched. Callers use that to avoid promising a viewer
+     * a stream that will never arrive.
+     */
+    startWatching(runId: string, onFrame: (frame: BrowserFrame) => void): Promise<boolean>;
+    /**
+     * Run one watch or unwatch after every one already asked for.
+     *
+     * The chain is kept non-rejecting on purpose: a failed attach must not poison
+     * every later request for this run, which is what a bare `.then` chain would
+     * do. The caller still sees its own failure, because that is the promise
+     * returned rather than the one stored.
+     */
+    private queueWatch;
+    /**
+     * Attach at most one physical CDP screencast session at a time.
+     *
+     * `startWatching()` already serializes watcher lifecycle through `watchQueue`,
+     * but the agent's detached-hidden restore cannot join that queue: it holds the
+     * action slot, while an earlier unwatch may be waiting for exactly that slot.
+     * Sharing only the physical attach closes the two-session race without making
+     * watcher teardown and agent mutation wait on each other in a cycle.
+     *
+     * A real watcher claims `onFrame` immediately, before it waits for an attach
+     * already started by the agent. The lower-level attach never writes the sink,
+     * so finishing an older temporary attempt cannot overwrite a newer viewer.
+     */
+    private attachScreencast;
+    /** Open one new CDP session and start the stream when it is safe to do so. */
+    private attachScreencastFresh;
+    /** Nobody is watching any more: stop paying to render frames. */
+    stopWatching(runId: string): Promise<void>;
+    /**
+     * Suspend or resume the picture without giving up control.
+     *
+     * The credential case, and the only reason this is separate from watching. A
+     * person who has taken the page over to sign in is about to type a password
+     * into a field whose contents are echoed as dots — but a password manager's
+     * dropdown, a "show password" toggle, a one-time code in plain text and the
+     * confirmation page afterwards are not, and all of them would otherwise be
+     * encoded into frames and sent across the network.
+     *
+     * What this does NOT do is hide anything from the agent: it stops the
+     * picture, not the page. Nothing about a suspended capture would stop a
+     * `extract_text` from reading the same screen — it is the lease that stops
+     * that, by refusing the agent for as long as the person holds it.
+     *
+     * Answers whether frames are flowing afterwards, which is what a UI needs to
+     * show and is not always what was asked for: a run with nobody watching has
+     * no session to suspend.
+     */
+    setCapture(runId: string, on: boolean): Promise<boolean>;
+    /**
+     * The capture transition itself, with no lease bookkeeping.
+     *
+     * Separate because the agent's restore in `act()` already holds the action
+     * slot — taking it again there would deadlock against itself, and the whole
+     * point of that call site is that it happens INSIDE the agent's turn.
+     *
+     * `confirmWithFrame` is used only by the agent's visibility gate. There, a
+     * successful CDP command is not enough: the externally visible state remains
+     * paused until a frame arrives, and the frame handler is the only code that
+     * promotes it to capturing. This makes a restore timeout sticky rather than
+     * a one-action refusal.
+     */
+    private applyCapture;
+    /**
+     * Wait, briefly, for Chrome to produce a frame.
+     *
+     * `Page.startScreencast` resolves when the command is accepted, which is not
+     * when a picture exists. The agent's visibility gate — "the page must be
+     * VISIBLE before anything changes it" — was therefore satisfied by a request
+     * rather than by a repaint, and the agent could click while the panel was
+     * still showing the page from before it was hidden, or nothing at all.
+     *
+     * A frame rather than a client receipt, deliberately. A receipt would prove
+     * somebody SAW it, which is stronger — and would make the agent's progress
+     * depend on a viewer that may not exist: this path runs after a handback or a
+     * lapse, when there may be nobody watching at all, and an agent that stalls
+     * because a tab was closed is a worse failure than the one being fixed. What
+     * this does guarantee is ours to guarantee: the stream is producing again.
+     *
+     * Bounded, and the bound rests on the property rounds 14 and 15 already rely
+     * on — a screencast that has just been started emits its first frame at once,
+     * whatever the page is doing. If one does not arrive, the picture genuinely
+     * has not come back, and the caller refuses on the same trade it already
+     * makes when the restore itself fails.
+     */
+    private nextFrame;
+    /** Whether a person is driving this run's browser right now. */
+    humanHolds(runId: string): boolean;
+    /**
+     * Hand this run's browser to the person watching it.
+     *
+     * The wait is the substance. An agent action already inside Playwright cannot
+     * be interrupted — `click` waits for its element to become actionable and
+     * then clicks, whatever anyone decided in the meantime — so a takeover that
+     * returned immediately would put the person on a page an action was still
+     * about to change. Bounded by the action ceiling, because that is the longest
+     * an action can legitimately take; past it something is wedged, and saying so
+     * is better than a spinner that never resolves.
+     *
+     * Idempotent for someone who already holds it: a second click of Take control
+     * just says they are still there.
+     */
+    takeOver(runId: string): Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    /** The person is done. Answers whether they were holding it at all. */
+    /**
+     * The viewer confirms it received a picture of this run's page.
+     *
+     * Reliable, one per watch, and the only thing that opens Hide. Checked
+     * against the CURRENT watch: a receipt that names an older one is from a
+     * viewer that has since been replaced, and vouching for its successor is the
+     * reconnect hole this counter exists to close.
+     */
+    frameSeen(runId: string, generation: number): void;
+    handBack(runId: string): boolean;
+    /**
+     * One thing the person did to the page.
+     *
+     * Authorised per event, not per session. A takeover is not a channel that
+     * stays open once opened: between two clicks the run can be stopped, the hold
+     * can lapse, the page can close, and each of those has to stop the NEXT
+     * event rather than be noticed at the end. So every event re-checks that this
+     * run is live and that the lease is still the person's, and every accepted
+     * event says so by extending the hold.
+     */
+    input(runId: string, event: BrowserInput): Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    /**
+     * The page's own coordinate space, measured rather than inferred.
+     *
+     * Cached, because a click should not cost a round trip, and invalidated by
+     * the frame metadata changing shape — which arrives free with every frame. A
+     * failed measurement falls back to the last good one rather than to a guess:
+     * a stale viewport is off by a resize, an invented one is off by anything.
+     */
+    private pageViewport;
+    /**
+     * Turn one authorised event into CDP calls. Coordinates arrive normalised.
+     *
+     * A switch with a default that REFUSES, rather than a chain of ifs ending in
+     * the click branch. This is a mutation boundary reached from a socket, so the
+     * question is not what a well-formed event does but what a malformed one
+     * does: the chain answered "clicks", which meant a version-skewed client
+     * sending `{ kind: 'drag', x, y }` pressed the mouse on a real page, and a
+     * kind with no coordinates at all clamped to 0 and clicked the top-left
+     * corner. Unknown input has to fail closed.
+     *
+     * The `never` in the default is the other half: adding a member to
+     * `BrowserInput` without handling it here stops compiling, so the next kind
+     * cannot silently inherit whatever the last branch happened to be.
+     */
+    private dispatch;
+    /** The user stopped this run. Refuses further actions and clears its queue. */
+    stopRun(runId: string): void;
+    /** A run ended: release its browser rather than pay for an idle session. */
+    endRun(runId: string): Promise<void>;
+    /** Forget a finished run entirely, so nothing accumulates per run. */
+    private forgetRun;
+    /**
+     * Let go of one run's browser.
+     *
+     * Best-effort throughout: a run is already over by the time this runs, and a
+     * provider that is briefly unreachable must not turn that into a failure the
+     * user sees. The provider's own idle timeout collects anything left.
+     */
+    private disposeRun;
+    /**
+     * Run `disposeRun`, with the run id counted in `closing` until it settles.
+     *
+     * The caller adds the id to `closing` itself, synchronously, in the same
+     * breath as deleting the run from `runs` — see the field comment. This just
+     * guarantees the removal happens, success or failure, so a disposal that
+     * throws cannot leave the slot counted against the pool forever.
+     */
+    private teardown;
+    private act;
+    /**
+     * The run's browser, opened on first use.
+     *
+     * The ONE place the session cap is enforced. An earlier version also checked
+     * it before taking the lease, on the reasoning that a run which cannot get a
+     * session would otherwise queue forever — true when every run shared one
+     * lease, and false once each run got its own, because a second run no longer
+     * queues behind the first at all. Its own revert-check proved it dead: taking
+     * it out changed no test. Two copies of a cap invite them to disagree.
+     */
+    private open;
+    /** The part that may fail, with the pool slot already reserved. */
+    private openReserved;
+    /** Count main-frame navigation only while this page is the run's active page. */
+    private trackPageNavigation;
+    /**
+     * Follow a page opened by the action that just finished.
+     *
+     * A popup/new tab is part of the same user gesture (OAuth is the common
+     * example). Keeping `held.page` and the screencast on its opener makes the
+     * new page both invisible and impossible to drive. This runs while the SAME
+     * action slot is still held, after the opening click/key has fully landed, so
+     * no later human/agent event can slip between detecting the popup and moving
+     * the view to it.
+     */
+    private followOpenedPage;
+    /**
+     * Make one live page the run's controlled/viewed page. Used in both
+     * directions: into a popup opened by an action, and back to another surviving
+     * page when that popup closes itself after OAuth/login completion.
+     */
+    private adoptPage;
+    private perform;
+}
+
+declare class GenericCdpProvider implements RemoteBrowserProvider {
+    readonly name = "CDP endpoint";
+    readonly isolatesSessions = false;
+    private endpoint;
+    constructor(endpoint: string);
+    /**
+     * There is no session to create — the endpoint is the session.
+     *
+     * `id` is a constant rather than a generated one because there is nothing to
+     * look up later: `endSession` has nothing to call. Inventing a unique id
+     * would imply a lifecycle this provider does not have.
+     */
+    createSession(): Promise<RemoteBrowserSession>;
+    /**
+     * Deliberately nothing.
+     *
+     * The endpoint belongs to whoever runs it and outlives any single run, so
+     * "ending" it is not ours to do — closing it would take the browser away from
+     * every other user of a shared endpoint. The driver still closes its own
+     * connection and its pages; this is only about the browser's lifetime.
+     */
+    endSession(): Promise<void>;
+}
+/**
+ * Whether a URL is a plausible CDP endpoint.
+ *
+ * Checked so a misconfiguration is a clear message at startup rather than an
+ * obscure Playwright failure on the first action, and so an `http://` URL
+ * pasted from a provider's docs is named as the mistake it is.
+ */
+declare function isCdpEndpoint(url: string): boolean;
+
+declare class SteelProvider implements RemoteBrowserProvider {
+    readonly name = "Steel";
+    readonly isolatesSessions = true;
+    private base;
+    private apiKey;
+    constructor(opts?: {
+        url?: string;
+        apiKey?: string;
+    });
+    createSession(signal?: AbortSignal): Promise<RemoteBrowserSession>;
+    endSession(id: string): Promise<void>;
+    private call;
+}
+
+/**
+ * Why an actor did not get the browser.
+ *
+ * A boolean was not enough: "the queue is full, try again" and "your run was
+ * stopped" are different things to tell a model, and a waiter dropped because
+ * the capability was switched off is neither. Reporting all three as "busy"
+ * had a model politely retrying something that would never be granted.
+ */
+type LeaseResult = 'granted' | 'busy' | 'cancelled' | 'off' | 'human';
+interface BrowserLeaseOptions {
+    /**
+     * Whether a run has been stopped. The lease skips revoked runs when handing
+     * on, so a stopped run is not dealt the browser only to refuse it a line
+     * later while the actor behind it waits out the whole queue.
+     */
+    isRevoked?: (sessionId: string) => boolean;
+    /** Called whenever ownership or queue depth changes, so a UI can follow. */
+    onChange?: () => void;
+}
+declare class BrowserLease {
+    private actor;
+    private session;
+    private ceilingTimer;
+    private waiting;
+    private lifecycleWired;
+    /**
+     * The action holding the browser, if any.
+     *
+     * Needed alongside the lease for a reason the lease cannot cover: the lease
+     * is RE-ENTRANT for its holder — that is what makes a sequence a sequence —
+     * so nothing in it stops ONE actor running two actions at once. A retry
+     * racing the call it retried is exactly that shape.
+     *
+     * A symbol because it identifies the individual call: only the action that
+     * took the slot may release it.
+     */
+    private action;
+    /** Whether the current action slot represents activity by its holder. */
+    private actionCountsAsHumanActivity;
+    /**
+     * The human action that has already consumed its one idle-deadline grace.
+     * A single wedged CDP request must not look like fresh activity every two
+     * minutes forever. The first deadline may yield to an event that began before
+     * it; a second deadline for that SAME event becomes a pending lapse instead.
+     */
+    private idleGraceAction;
+    /** Release the human hold as soon as this overlong action finally unwinds. */
+    private idleLapseAfterAction;
+    /**
+     * Everyone waiting for that slot, IN THE ORDER THEY ASKED.
+     *
+     * A queue rather than a poll, and the ordering is the whole reason for it.
+     * `acquireActionSlot` used to spin on a 25ms timer, which decides nothing
+     * about who goes first: each waiter checks on its own phase, so the one that
+     * asked SECOND can find the slot free a full poll ahead of the one that asked
+     * first. The person types one event per keypress — `{ kind: 'text', text }`
+     * carries a single character — so that reordering is not a theoretical
+     * unfairness, it is "passowrd" appearing in the box.
+     *
+     * The slot is handed straight from `endAction` to the head of this line while
+     * still synchronous, so nothing can slip in between the two, and a waiter
+     * that reaches the front never has to be told the slot is already taken.
+     */
+    private actionQueue;
+    /** Lapses a human hold nobody is using. See `HUMAN_IDLE_MS`. */
+    private humanTimer;
+    /**
+     * The person ASKED for the hold to end and it could not end yet.
+     *
+     * Kept as a request rather than only a retry timer, because the retry shares
+     * `humanTimer` with the idle deadline: an authorised event settling after the
+     * request would otherwise call `touch()`, re-arm that timer for a full idle
+     * interval, and quietly cancel a handback the person had already asked for.
+     * "Give it back" is not undone by activity that was already under way when
+     * they said it.
+     *
+     * Explicit requests ONLY. An idle expiry must never set this: a deadline that
+     * lands on the person's own in-flight event is evidence they were THERE, and
+     * recording it here made `touch()` bail afterwards, so the hold dropped the
+     * instant a fresh interaction finished. See `lapse()`.
+     */
+    private handBackWanted;
+    private isRevoked;
+    private onChange;
+    constructor(options?: BrowserLeaseOptions);
+    get holderActor(): string | null;
+    /** Whether a person, rather than the agent, is driving the page right now. */
+    get heldByHuman(): boolean;
+    /**
+     * Whether THIS actor is the one holding the browser right now.
+     *
+     * For asking again after a wait. `acquire` is re-entrant for the holder, so
+     * "I was granted the lease" is a fact about the moment it was granted and
+     * says nothing about the moment the caller finally gets to act.
+     */
+    heldBy(actorId: string): boolean;
+    get holderSession(): string | null;
+    get queueDepth(): number;
+    get actionInFlight(): boolean;
+    /**
+     * Declare that this host reports worker terminal states.
+     *
+     * When it does, timers stop being ownership boundaries entirely. When it does
+     * not — an embedder that wired a controller but not the release — the
+     * fallbacks stay, because something has to break a deadlock.
+     */
+    setLifecycleReleaseWired(on: boolean): void;
+    /**
+     * Take the browser for this actor, waiting in line if someone else holds it.
+     *
+     * Re-entrant for the actor that already holds it: that is the sequence case —
+     * the same worker coming back for its next step must not queue behind itself.
+     */
+    acquire(actorId: string, sessionId: string, signal?: AbortSignal): Promise<LeaseResult>;
+    /**
+     * One worker has finished its whole sequence, so its hold ends.
+     *
+     * THIS is the semantic release. It comes from the worker's own terminal path,
+     * so it means "this actor will never ask again" — which a timer can never
+     * mean about a worker that is merely thinking.
+     *
+     * Idempotent, and safe for an actor that never touched the browser.
+     */
+    actorEnded(actorId: string): void;
+    /**
+     * Give the browser up when about to return without using it.
+     *
+     * Two guards, both load-bearing. Never while an action is in flight, because
+     * the lease is RE-ENTRANT: the action still running may be this same actor's
+     * previous step, and taking the lease off it hands the page to a queued
+     * worker mid-sequence. And only while still the holder, because by the time a
+     * refusal path runs a Stop may already have handed the lease on.
+     */
+    releaseIfHeldBy(actorId: string): void;
+    /**
+     * Give the browser to the person watching it.
+     *
+     * Callers must have waited the in-flight action out first — see
+     * `acquireActionSlot`. This does not interrupt one, because it cannot: a
+     * Playwright call already inside the page finishes whatever it started, and
+     * taking the lease off it would only mean the person and a still-running
+     * `fill` were both touching the same form. Waiting is what makes "you have
+     * control" true when the UI says it.
+     *
+     * Every queued worker is turned away rather than left in line, for the same
+     * reason `acquire` refuses: they were planned against a page the person is
+     * about to change.
+     */
+    takeOver(sessionId: string): void;
+    /**
+     * The person is still there — anything they did counts.
+     *
+     * Called per authorised input rather than on a heartbeat, so the hold is
+     * extended by USE and not merely by a tab being open. A left-open panel on a
+     * forgotten laptop stops holding a billed session two minutes later.
+     */
+    touch(): void;
+    /** (Re)start the idle interval. The only place the deadline is set. */
+    private armIdle;
+    /**
+     * The idle deadline came round.
+     *
+     * Both ways a hold ends obey the same rule — never while one of the person's
+     * own events is still landing — but they resolve that clash in OPPOSITE
+     * directions, and routing the lapse through `handBack()` collapsed them into
+     * one. An event in flight BEGAN before this deadline, which makes it evidence
+     * the person was there; deferring the lapse and then releasing the moment
+     * that event lands ends the hold immediately after a fresh interaction, which
+     * is the precise opposite of what an idle deadline measures. So an
+     * interrupted lapse yields: the interval starts again, and the next silence
+     * decides.
+     *
+     * `handBack()` keeps the deferral instead, because "Give it back" is a
+     * decision and activity already under way when it was made does not withdraw
+     * it. Same rule, different answer, which is why they are different methods.
+     */
+    private lapse;
+    /**
+     * The person hands the browser back, or their hold lapses.
+     *
+     * Answers whether there was a human hold to end, so a caller can tell a real
+     * handback from a duplicate click or a lapse that already happened.
+     */
+    handBack(): boolean;
+    private clearHumanIdle;
+    /** Drop every queued waiter belonging to a run, and the lease if it holds it. */
+    dropRun(sessionId: string): void;
+    /** Turn everyone away — the capability itself has gone. */
+    dropAll(): void;
+    /** Hand the browser to the next actor in line, if any. */
+    release(): void;
+    /** Arm the deadlock ceiling. Not a release schedule — see the constant. */
+    armCeiling(): void;
+    clearCeiling(): void;
+    /**
+     * Take the per-action slot, or null when one is already running.
+     *
+     * PRIVATE, so the queue is the only way in. A caller that could take the slot
+     * without joining the line would be exactly the jump-the-queue the ordering
+     * is there to prevent.
+     */
+    private beginAction;
+    /**
+     * Release the slot, but only for the action that took it.
+     *
+     * Hands it to the head of the line rather than merely clearing it, and does
+     * so SYNCHRONOUSLY: the waiter's `beginAction` runs before this call returns,
+     * so there is no window in which the slot is free and somebody who asked
+     * later can take it.
+     */
+    endAction(token: symbol): boolean;
+    /**
+     * Take the slot only if it is free RIGHT NOW, never joining the line.
+     *
+     * For input that is a SAMPLE rather than a decision — pointer movement. A
+     * click or a keystroke is a thing the person meant to do and has to happen,
+     * so it waits its turn; a pointer position is one of many on the way
+     * somewhere, and one that cannot be applied now is worth less than the one
+     * behind it. Queueing them is actively harmful: on an endpoint slower than
+     * the client's sampling interval the backlog grows, and the click behind it
+     * can age out against `acquireActionSlot`'s bound and be refused — movement
+     * costing the person the action they actually intended.
+     *
+     * The queue length is checked as well as the slot, so a sample cannot step
+     * over a click that is already waiting.
+     */
+    tryActionSlot(): symbol | null;
+    /**
+     * Take the per-action slot, waiting in line for it if somebody has it.
+     *
+     * A release can hand the browser on while the previous holder's abort is
+     * still propagating through an awaited navigation. That is a handoff, not a
+     * conflict, so it is normally bounded: a wedged action must not pin an agent
+     * or a takeover forever. Human discrete input is the exception and passes
+     * `null`: once a click, key or committed text has been accepted into this
+     * ordered queue, expiring it merely because earlier accepted input took more
+     * than two seconds silently truncates what the person typed.
+     *
+     * Waiting and TAKING are one step, which they deliberately were not before:
+     * the wait used to answer "the slot looks free" and leave the caller to call
+     * `beginAction` afterwards. Two callers woken by the same release both saw it
+     * free, and the loser was told "another action is already running" — a
+     * refusal for having asked first. Granting it here means whoever reaches the
+     * front of the line gets it, and everybody else is still waiting rather than
+     * refused.
+     *
+     * `null` as a RESULT means a bounded wait ran out OR a caller-supplied queue
+     * cap refused a new waiter. `null` as `withinMs` means an ACCEPTED operation
+     * is intentionally unbounded by time and will leave the queue only when its
+     * turn arrives; it does not require accepting infinitely many operations.
+     * `countsAsHumanActivity=false` is for
+     * lifecycle barriers: they still serialize, but an idle deadline must not
+     * mistake framework cleanup for evidence that the person is present.
+     */
+    acquireActionSlot(withinMs?: number | null, countsAsHumanActivity?: boolean, maxQueued?: number | null): Promise<symbol | null>;
+    /**
+     * Queue one actor, resolving when it gets the browser or is turned away.
+     *
+     * `settle` is wrapped so it runs at most once and always takes the waiter out
+     * of the line: the timeout, an abort and a handoff all race, and settling
+     * twice would silently leave a dead entry holding a queue slot.
+     */
+    private enqueue;
+}
+
 /** A unit of indexed text. `sourceId` groups chunks from one document/file. */
 interface Chunk {
     id: string;
@@ -7830,4 +8813,4 @@ declare function gatherSyncBundle(config: CascadeConfig): SyncBundle;
 /** Merge a pulled bundle into a config, returning the updated config to persist. */
 declare function applySyncBundle(bundle: SyncBundle, config: CascadeConfig, cleanup?: RetiredProviderCleanup): CascadeConfig;
 
-export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BrowserAction, type BrowserActionOutcome, BrowserControlTool, type BrowserController, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, CascadeConfigSchema, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };
+export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, type AcceptanceOptions, type AcceptanceProbe, type AcceptanceResult, type AcceptanceVerdict, type ApprovalRequest, type ApprovalResponse, type AuditEntry, AuditLogger, type AzureDeploymentInput, type BenchmarksConfig, type Block, type BrowserAction, type BrowserActionOutcome, type BrowserControlState, BrowserControlTool, type BrowserController, type BrowserFrame, type BrowserInput, BrowserLease, type BudgetConfig, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, type CascadeConfig, CascadeConfigSchema, type CascadeEvent, type CascadeEventType, CascadeIgnore, type CascadeMessage, CascadeRouter, type CascadeRunOptions, type CascadeRunResult, type CascadeThemeName, CascadeToolError, type ChartSeries, type ChartSpec, type Chunk, type ChunkOptions, CloudClient, type CloudConversation, type CloudMessage, type CloudSession, type CloudSessionStore, type CloudTurnInput, type CloudUser, type CodeChunkOptions, type CodeChunker, CodeSearchTool, type CompileTaskGraphOptions, type CompiledTaskGraph, type CompleteFn, type CompletedNode, ConfigManager, type ConversationMessage, type CredentialDisposition, type CredentialEndpoint, type CredentialWriteOutcome, type CurrentPageProvider, type CurrentPageSnapshot, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DOCUMENT_MIME, type DashboardConfig, DashboardServer, DependencyScheduler, type DeviceStart, type DiscoveredMcpTool, type DistilledFact, type ChartKind as DocumentChartKind, type DocumentFormat, type Embedder, type EncryptedBlob, type EscalationDecision, type EscalationPayload, type ExtendedContextConfig, type FileManifest, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GenerateDocumentTool, type GenerateOptions, type GenerateResult, GenericCdpProvider, type GraphFactSource, GraphRetriever, type GraphSearchOptions, GraphSearchTool, type HookDefinition, type HooksConfig, HooksRunner, type Identity, type ImageAttachment, type ImageByteLoader, type ImageInfo, type ImageRef, type InlineRun, Keystore, LLMReranker, LM_STUDIO_BASE_URL, type LegacyThemeName, type LoadedImage, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, type ManifestDiff, McpClient, type McpDiscoveryResult, McpOAuthProvider, type McpOAuthState, type McpOAuthStore, type McpServerConfig$1 as McpServerConfig, type McpServerRename, type MemoryConfig, MemoryStore, type Message, type MessageContent, type MessagePayload, type MessageStatus, type MessageType, type ModelInfo, type ModelOverrides, type NativeProvider, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, type OpenAIEmbedderOptions, PROVIDER_DISPLAY_NAMES, type PeerMessage, type PeerMessageEvent, type PeerSyncPayload, type PeerSyncType, type PermissionDecision, type PermissionDecisionPayload, type PermissionRequest, type PermissionTrailEntry, type PlanReviewConfig, type ProviderConfig, type ProviderType, RESUME_SCHEMA_VERSION, type RankedFact, type RefreshResult, type RemoteBrowserConfig, RemoteBrowserController, type RemoteBrowserProvider, type RemoteBrowserSession, type RenderOptions, type Reranker, type ResumeCheckpoint, type ResumeReason, ResumeStore, type ResumeStoreOptions, type RetrievalContext, type RetrievalMode, type RetrievalPlan, Retriever, type RetrieverSearchOptions, type RuntimeNode, type RuntimeNodeLog, type RuntimeRefreshPayload, type RuntimeScope, type RuntimeSession, type RuntimeSnapshotPayload, type ScheduledTask, type SchedulerExecutionMode, type SchedulerHooks, type SchedulerOptions, type SchedulerResult, type ScoredChunk, type SearchOptions, type Session, type SessionCheckpoint, type SessionMetadata, type SessionSubscriptionPayload, type SettingsCommitResult, type SettingsCredentialResult, type SettingsPayload, type SettingsSnapshot, type Slide, SqliteVectorStore, type StatusUpdate, SteelProvider, type StoredMessage, type StreamChunk, type SyncBundle, T1Administrator, type T1ToT2Assignment, T1_MODEL_PRIORITY, T2Manager, type T2Result, type T2ToT3Assignment, T2_MODEL_PRIORITY, type T3Result, type T3ResultPayload, type T3SubtaskSpec, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, type TaskComplexity, type TaskGraph, type TaskGraphInputNode, type TaskGraphIssue, type TaskGraphIssueCode, type TaskGraphNode, type TaskGraphNodeKind, TaskGraphValidationError, type TaskGraphValidationMode, TaskScheduler, type TaskType, Telemetry, type TelemetryConfig, type Theme, type ThemeColors, type ThemeName, type TierConfig, type TierLimits, type TierRole, type TierStatus, type TokenUsage, type ToolCall, type ToolDefinition, type ToolExecuteOptions, ToolRegistry, type ToolResult, type ToolsConfig, VISION_MODEL_PRIORITY, type VectorStore, type WebSearchConfig, type WebhookConfig, type WorkspaceConfig, type WorkspaceFileReader, WorkspaceIndex, type WorkspaceIndexOptions, applyEndpointEdit, applyProviderApiKey, applyProviderCredential, applySettingsCredentials, applySettingsPayload, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildDocumentTools, buildManifest, buildSessionTranscript, bytesToBase64, cagCharBudget, chartKind, chartToTableRows, chatCompleterFromProviders, chunkCode, chunkText, commitSettings, compileSectionGraph, compileSubtaskGraph, compileTaskGraph, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, credentialDispositionForEdit, credentialEndpointIdentity, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, endpointFromSettingsPayload, evaluateAcceptance, explainRefusal, extractCharts, failures, fileExt, fileOAuthProvider, gatherSyncBundle, hasDefaultEndpoint, hasProviderCredential, hasUsableProvider, hashContent, heuristicCodeChunker, inferAzureBaseModel, inlineRuns, isCdpEndpoint, isDocumentFormat, isMcpToolName, matchImageLine, mcpServerPrefix, mcpToolName, nodeHttpFetch, normalizeEndpoint, parseBlocks, parseChartSpec, parseDelimited, parseRankOrder, parseSlide, planRetrieval, preferIpv4Host, priorAzureRow, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, renderDocument, renderDocx, renderPptx, renderXlsx, runCascade, sameAzureEndpoint, sameCredentialEndpoint, sameEndpoint, sessionWorthRemembering, settingsSnapshot, sniffImage, splitSlides, streamCascade, stripInline, summarizeCompleted, undecided, uniqueMcpServerName };