dsh-pentester 0.1.0-alpha.2 → 2.0.0

package/lib/index.d.ts

@@ -1,3938 +1,29 @@
 import Schema from "@deepseek-ai/schemastery";
 import { Context } from "@deepseek-ai/cordis";
-//#region src/host/config.d.ts
-interface PluginConfig {
-  readonly verbose: boolean;
-  readonly devSeed: boolean;
-  /** UI Preview: development-only sample read model for inspecting the Pentester interface. */
-  readonly uiPreview: boolean;
-}
-/** Only an explicit boolean `true` enables the DEV fixture. */
-declare function resolvePluginConfig(input: unknown): PluginConfig;
-//#endregion
-//#region src/runtime/config.d.ts
-interface RuntimeConfig {
-  readonly verbose: boolean;
-  readonly devSeed: boolean;
-  readonly storageRoot: string;
-  readonly dockerSocket: string;
-}
-declare function resolveRuntimeConfig(input: unknown): RuntimeConfig;
-//#endregion
-//#region src/domain/ids.d.ts
-type EngagementId = string & {
-  readonly __brand: 'EngagementId';
-};
-type TargetId = string & {
-  readonly __brand: 'TargetId';
-};
-type AssetId = string & {
-  readonly __brand: 'AssetId';
-};
-type ScopeId = string & {
-  readonly __brand: 'ScopeId';
-};
-type StageId = string & {
-  readonly __brand: 'StageId';
-};
-type TaskId = string & {
-  readonly __brand: 'TaskId';
-};
-type AgentTemplateId = string & {
-  readonly __brand: 'AgentTemplateId';
-};
-type AgentRunId = string & {
-  readonly __brand: 'AgentRunId';
-};
-type SkillId = string & {
-  readonly __brand: 'SkillId';
-};
-type McpServerId = string & {
-  readonly __brand: 'McpServerId';
-};
-type ToolboxId = string & {
-  readonly __brand: 'ToolboxId';
-};
-type ToolId = string & {
-  readonly __brand: 'ToolId';
-};
-type ToolCallId = string & {
-  readonly __brand: 'ToolCallId';
-};
-type ArtifactId = string & {
-  readonly __brand: 'ArtifactId';
-};
-type EvidenceId = string & {
-  readonly __brand: 'EvidenceId';
-};
-type FindingId = string & {
-  readonly __brand: 'FindingId';
-};
-type FindingOccurrenceId = string & {
-  readonly __brand: 'FindingOccurrenceId';
-};
-type EventId = string & {
-  readonly __brand: 'EventId';
-};
-//#endregion
-//#region src/domain/workflow/stages.d.ts
-declare const PTES_STAGE_KINDS: readonly ["pre-engagement", "intelligence-gathering", "threat-modeling", "vulnerability-analysis", "exploitation", "post-exploitation", "reporting"];
-type PtesStageKind = (typeof PTES_STAGE_KINDS)[number];
-//#endregion
-//#region src/config/types.d.ts
-/**
- * Global Pentester Configuration domain model (ADR-0006).
- *
- * Three layers:
- *   Factory Defaults  — code-built, version-controlled, authoritative baseline.
- *   Global Overrides  — user-edited replacements for built-in entities + custom
- *                       entities + disabled built-in ids, persisted.
- *   Effective Config  — Factory ⊕ Overrides ∖ Disabled, resolved at runtime.
- *
- * Never store the full Factory catalog in the persisted Global config; only
- * overrides/custom/disabled survive (see PentesterGlobalConfigV1).
- */
-type ConfigEntitySource = 'builtin' | 'custom';
-interface BaseConfigEntity {
-  readonly id: string;
-  readonly name: string;
-  readonly description: string;
-  readonly enabled: boolean;
-  readonly source: ConfigEntitySource;
-  readonly revision: number;
-}
-/** Global-config Agent definition. Resolves to a runtime AgentTemplate. */
-interface AgentConfigEntity extends BaseConfigEntity {
-  readonly id: AgentTemplateId;
-  readonly instructions: string;
-  readonly skillIds: readonly SkillId[];
-  readonly mcpServerIds: readonly McpServerId[];
-  readonly allowedToolboxIds: readonly ToolboxId[];
-  readonly primaryToolboxId?: ToolboxId;
-}
-/** A Pentester Worker knowledge / procedural instruction (no execution power). */
-interface SkillConfigEntity extends BaseConfigEntity {
-  readonly id: SkillId;
-  readonly instructions: string;
-}
-type McpConfigLifecycle = 'agent_run' | 'engagement';
-/** Environment reference (never a plaintext secret). */
-interface McpEnvVar {
-  readonly name: string;
-  /** Host env var name to inherit (secret reference), not a literal value. */
-  readonly sourceEnv: string;
-}
-interface McpConfigEntity extends BaseConfigEntity {
-  readonly id: McpServerId;
-  readonly transport: 'stdio';
-  readonly command: string;
-  readonly args: readonly string[];
-  readonly env: readonly McpEnvVar[];
-  readonly lifecycle: McpConfigLifecycle;
-}
-type ToolboxImageSource = 'builtin' | 'pull' | 'dockerfile';
-interface ToolboxImageDefinition {
-  readonly source: ToolboxImageSource;
-  readonly ref: string;
-  readonly dockerfilePath?: string;
-  readonly buildContext?: string;
-}
-interface ToolboxConfigEntity extends BaseConfigEntity {
-  readonly id: ToolboxId;
-  readonly image: ToolboxImageDefinition;
-  readonly lifecycle: McpConfigLifecycle;
-}
-/** Which Agents are AVAILABLE to the Orchestrator during one fixed PTES Stage. */
-interface StageAgentPolicy {
-  readonly stageId: StageId;
-  readonly stageKind: PtesStageKind;
-  readonly allowedAgentTemplateIds: readonly AgentTemplateId[];
-}
-interface EntityOverrideSet<T extends BaseConfigEntity> {
-  /** id → Global replacement for a built-in entity. */
-  readonly builtinOverrides: Readonly<Record<string, T>>;
-  /** id → custom entity (id starts with a custom prefix, never collides with factory). */
-  readonly custom: Readonly<Record<string, T>>;
-  /** Built-in ids disabled in the Global layer. */
-  readonly disabledBuiltinIds: readonly string[];
-}
-interface PentesterGlobalConfigV1 {
-  readonly schemaVersion: 1;
-  readonly globalRevision: number;
-  readonly agents: EntityOverrideSet<AgentConfigEntity>;
-  readonly skills: EntityOverrideSet<SkillConfigEntity>;
-  readonly mcpServers: EntityOverrideSet<McpConfigEntity>;
-  readonly toolboxes: EntityOverrideSet<ToolboxConfigEntity>;
-  readonly stageOverrides: Readonly<Record<string, readonly AgentTemplateId[]>>;
-}
-interface EffectivePentesterConfig {
-  readonly globalRevision: number;
-  readonly agents: Readonly<Record<AgentTemplateId, AgentConfigEntity>>;
-  readonly skills: Readonly<Record<SkillId, SkillConfigEntity>>;
-  readonly mcpServers: Readonly<Record<McpServerId, McpConfigEntity>>;
-  readonly toolboxes: Readonly<Record<ToolboxId, ToolboxConfigEntity>>;
-  readonly stagePolicies: Readonly<Record<StageId, StageAgentPolicy>>;
-}
-//#endregion
-//#region src/domain/agent.d.ts
-type AgentTemplateKind = 'built-in' | 'user';
-interface AgentTemplate {
-  readonly id: AgentTemplateId;
-  readonly kind: AgentTemplateKind;
-  readonly name: string;
-  readonly description: string;
-  readonly rolePrompt: string;
-  readonly model?: string;
-  readonly skillIds: readonly SkillId[];
-  readonly mcpServerIds: readonly McpServerId[];
-  readonly allowedToolboxIds: readonly ToolboxId[];
-  readonly attachedStages: readonly PtesStageKind[];
-}
-declare const AGENT_RUN_STATUSES: readonly ["created", "running", "blocked", "completed", "failed", "cancelled", "interrupted"];
-type AgentRunStatus = (typeof AGENT_RUN_STATUSES)[number];
-/**
- * Immutable configuration snapshot captured when an AgentRun is created.
- * A running Worker must never change mid-flight when Global Settings change:
- * instructions / skills / MCP / Docker image stay exactly as snapshotted.
- */
-interface AgentRunConfigSnapshot {
-  readonly agentTemplateId: AgentTemplateId;
-  readonly agentTemplateRevision: number;
-  readonly agentName: string;
-  readonly instructions: string;
-  readonly skillIds: readonly SkillId[];
-  readonly mcpServerIds: readonly McpServerId[];
-  readonly allowedToolboxIds: readonly ToolboxId[];
-  readonly primaryToolboxId?: ToolboxId;
-}
-interface AgentRun {
-  readonly id: AgentRunId;
-  readonly engagementId: EngagementId;
-  readonly templateId: AgentTemplateId;
-  readonly status: AgentRunStatus;
-  readonly taskIds: readonly TaskId[];
-  readonly currentTaskId?: TaskId;
-  /** Immutable Global-config snapshot captured at creation (rev-stable). */
-  readonly configSnapshot?: AgentRunConfigSnapshot;
-}
-//#endregion
-//#region src/domain/artifact.d.ts
-declare const ARTIFACT_KINDS: readonly ["asset", "service", "endpoint", "technology", "observation", "attack-surface", "attack-path", "hypothesis", "impact", "other"];
-type ArtifactKind = (typeof ARTIFACT_KINDS)[number];
-interface ArtifactProvenance {
-  readonly sourcePtapMessageId: string;
-  readonly createdInStageId: StageId;
-  readonly producedByTaskId: TaskId;
-  readonly producedByAgentRunId: AgentRunId;
-  readonly observedAt: string;
-}
-interface ArtifactIdentityFields {
-  readonly assetValue?: string;
-  readonly assetId?: string;
-  readonly protocol?: string;
-  readonly port?: number;
-  readonly serviceId?: string;
-  readonly method?: string;
-  readonly path?: string;
-  readonly ownerRef?: string;
-  readonly technologyName?: string;
-}
-interface Artifact {
-  readonly id: ArtifactId;
-  readonly engagementId: EngagementId;
-  readonly kind: ArtifactKind;
-  readonly createdInStageId: StageId;
-  readonly producedByTaskId: TaskId;
-  readonly producedByAgentRunId: AgentRunId;
-  readonly evidenceIds: readonly EvidenceId[];
-  readonly summary: string;
-  readonly identityKey?: string;
-  readonly identity?: ArtifactIdentityFields;
-  readonly provenance: readonly ArtifactProvenance[];
-}
-/** Protocol-facing draft. PTES Core assigns `ArtifactId` on persist. */
-interface ArtifactSubmission extends ArtifactIdentityFields {
-  readonly kind: ArtifactKind;
-  readonly summary: string;
-  readonly evidenceRefs?: readonly string[];
-}
-//#endregion
-//#region src/domain/capability.d.ts
-type CapabilityReference = {
-  readonly kind: 'skill';
-  readonly skillId: SkillId;
-} | {
-  readonly kind: 'mcp';
-  readonly mcpServerId: McpServerId;
-} | {
-  readonly kind: 'toolbox';
-  readonly toolboxId: ToolboxId;
-};
-//#endregion
-//#region src/domain/evidence.d.ts
-declare const EVIDENCE_KINDS: readonly ["http-request", "http-response", "screenshot", "tool-output", "file", "raw-scanner-output", "other"];
-type EvidenceKind = (typeof EVIDENCE_KINDS)[number];
-interface Evidence {
-  readonly id: EvidenceId;
-  readonly engagementId: EngagementId;
-  readonly kind: EvidenceKind;
-  readonly producedByTaskId?: TaskId;
-  readonly producedByAgentRunId?: AgentRunId;
-  readonly ref: string;
-  readonly summary: string;
-  readonly mediaType?: string;
-  readonly sizeBytes: number;
-  readonly sha256: string;
-  readonly createdInStageId: StageId;
-  readonly sourcePtapMessageId: string;
-  readonly createdAt: string;
-}
-/** Protocol-facing draft. Small content may be inline; large content uses `ref`. */
-interface EvidenceSubmission {
-  readonly kind: EvidenceKind;
-  readonly summary: string;
-  readonly content?: string;
-  readonly ref?: string;
-  readonly mediaType?: string;
-}
-//#endregion
-//#region src/domain/finding.d.ts
-declare const FINDING_STATUSES: readonly ["candidate", "validating", "confirmed", "unconfirmed", "false_positive"];
-type FindingStatus = (typeof FINDING_STATUSES)[number];
-declare const FINDING_SEVERITIES: readonly ["info", "low", "medium", "high", "critical"];
-type FindingSeverity = (typeof FINDING_SEVERITIES)[number];
-interface Finding {
-  readonly id: FindingId;
-  readonly engagementId: EngagementId;
-  readonly title: string;
-  readonly severity: FindingSeverity;
-  readonly confidence: number;
-  readonly status: FindingStatus;
-  readonly occurrenceIds: readonly FindingOccurrenceId[];
-  readonly category?: string;
-  readonly weakness?: string;
-  readonly cwe?: string;
-  readonly identityKey?: string;
-  readonly createdInStageId?: StageId;
-  readonly producedByTaskId?: TaskId;
-  readonly producedByAgentRunId?: AgentRunId;
-}
-interface FindingOccurrence {
-  readonly id: FindingOccurrenceId;
-  readonly findingId: FindingId;
-  readonly engagementId: EngagementId;
-  readonly assetId: AssetId;
-  readonly endpoint?: string;
-  readonly serviceId?: string;
-  readonly evidenceIds: readonly EvidenceId[];
-  readonly reproductionContext?: string;
-  readonly status: FindingStatus;
-  readonly identityKey?: string;
-}
-interface FindingOccurrenceSubmission {
-  readonly assetId: string;
-  readonly endpoint?: string;
-  readonly serviceId?: string;
-  readonly evidenceRefs?: readonly string[];
-  readonly reproductionContext?: string;
-}
-/** Protocol-facing draft. PTES Core assigns `FindingId` on persist. */
-interface FindingSubmission {
-  readonly title: string;
-  readonly severity: FindingSeverity;
-  readonly confidence: number;
-  readonly status: FindingStatus;
-  readonly summary?: string;
-  readonly category?: string;
-  readonly weakness?: string;
-  readonly cwe?: string;
-  readonly occurrence?: FindingOccurrenceSubmission;
-}
-//#endregion
-//#region src/domain/ptap.d.ts
-declare const PTAP_PROTOCOL: "ptap";
-declare const PTAP_VERSION: 1;
-declare const PTAP_COMMAND_TYPES: readonly ["task.request", "steer.message", "delegate.decision", "capability.decision"];
-declare const PTAP_EVENT_TYPES: readonly ["progress.updated", "artifact.produced", "evidence.produced", "finding.produced", "delegate.requested", "capability.requested", "task.completed", "task.failed", "task.blocked"];
-type PtapCommandType = (typeof PTAP_COMMAND_TYPES)[number];
-type PtapEventType = (typeof PTAP_EVENT_TYPES)[number];
-type PtapMessageType = PtapCommandType | PtapEventType;
-declare const AGENT_PROGRESS_STATUSES: readonly ["planning", "working", "waiting", "blocked", "finalizing"];
-type AgentProgressStatus = (typeof AGENT_PROGRESS_STATUSES)[number];
-declare const STEER_SOURCES: readonly ["user", "orchestrator"];
-type SteerSource = (typeof STEER_SOURCES)[number];
-declare const DELEGATE_DECISIONS: readonly ["accepted", "rejected"];
-type DelegateDecision = (typeof DELEGATE_DECISIONS)[number];
-declare const CAPABILITY_DECISIONS: readonly ["granted", "denied"];
-type CapabilityDecision = (typeof CAPABILITY_DECISIONS)[number];
-declare const TASK_CONSTRAINT_PRIORITIES: readonly ["low", "normal", "high"];
-type TaskConstraintPriority = (typeof TASK_CONSTRAINT_PRIORITIES)[number];
-type PtapMessageId = string & {
-  readonly __brand: 'PtapMessageId';
-};
-type PtapRequestId = string & {
-  readonly __brand: 'PtapRequestId';
-};
-interface PtapEnvelope<TType extends PtapMessageType, TPayload> {
-  readonly protocol: typeof PTAP_PROTOCOL;
-  readonly version: typeof PTAP_VERSION;
-  readonly messageId: PtapMessageId;
-  readonly type: TType;
-  readonly engagementId: EngagementId;
-  readonly stageId: StageId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly timestamp: string;
-  readonly payload: TPayload;
-}
-interface PtapInputRefs {
-  readonly assets?: readonly AssetId[];
-  readonly artifacts?: readonly ArtifactId[];
-  readonly evidence?: readonly EvidenceId[];
-  readonly findings?: readonly FindingId[];
-}
-interface TaskRequestPayload {
-  readonly goal: string;
-  readonly instructions?: string;
-  readonly inputRefs?: PtapInputRefs;
-  readonly constraints?: {
-    readonly priority?: TaskConstraintPriority;
-  };
-}
-interface SteerMessagePayload {
-  readonly message: string;
-  readonly source: SteerSource;
-}
-interface DelegateDecisionPayload {
-  readonly requestId: PtapRequestId;
-  readonly decision: DelegateDecision;
-  readonly reason?: string;
-  readonly createdTaskId?: TaskId;
-}
-interface CapabilityDecisionPayload {
-  readonly requestId: PtapRequestId;
-  readonly decision: CapabilityDecision;
-  readonly reason?: string;
-}
-interface ProgressUpdatedPayload {
-  readonly status: AgentProgressStatus;
-  readonly summary: string;
-  readonly currentAction?: string;
-}
-interface ArtifactProducedPayload {
-  readonly artifact: ArtifactSubmission;
-  readonly summary?: string;
-  readonly reportWorthy?: boolean;
-}
-interface EvidenceProducedPayload {
-  readonly evidence: EvidenceSubmission;
-  readonly summary?: string;
-  readonly reportWorthy?: boolean;
-}
-interface FindingProducedPayload {
-  readonly finding: FindingSubmission;
-  readonly summary?: string;
-  readonly reportWorthy?: boolean;
-}
-interface DelegateRequestedPayload {
-  readonly requestId: PtapRequestId;
-  readonly goal: string;
-  readonly reason: string;
-  readonly preferredAgentTemplateId?: AgentTemplateId;
-  readonly inputRefs?: PtapInputRefs;
-}
-interface CapabilityRequestedPayload {
-  readonly requestId: PtapRequestId;
-  readonly capability: CapabilityReference;
-  readonly reason: string;
-}
-interface SuggestedTask {
-  readonly goal: string;
-  readonly reason?: string;
-  readonly preferredAgentTemplateId?: AgentTemplateId;
-}
-interface TaskCompletedPayload {
-  readonly summary: string;
-  readonly produced?: {
-    readonly artifacts?: readonly PtapMessageId[];
-    readonly evidence?: readonly PtapMessageId[];
-    readonly findings?: readonly PtapMessageId[];
-  };
-  readonly suggestedTasks?: readonly SuggestedTask[];
-  /** P1-5: which exit criteria this completion satisfied (typed, not prose). */
-  readonly exitCondition?: {
-    /** Stable machine code (e.g. "recon-service-inventory"). */
-    readonly code: string;
-    readonly satisfiedCriteria: readonly string[];
-  };
-}
-interface TaskFailedPayload {
-  readonly summary: string;
-  readonly code?: string;
-  readonly retryable: boolean;
-  readonly details?: string;
-}
-/**
- * A Worker declares its Task blocked: it cannot make progress on its own and
- * requires Orchestrator/user intervention. `reasonCode` is a stable machine
- * code (e.g. `missing_credentials`, `user_decision_required`,
- * `target_unreachable`); `recoverable` tells the Orchestrator whether a later
- * continue/steer can resume the Task.
- */
-interface TaskBlockedPayload {
-  readonly summary: string;
-  readonly reasonCode: string;
-  /** True when a later continue/steer may resume the Task. */
-  readonly recoverable: boolean;
-  /** Optional machine-readable diagnostics (never secrets). */
-  readonly diagnostics?: readonly string[];
-}
-type TaskRequestMessage = PtapEnvelope<'task.request', TaskRequestPayload>;
-type SteerMessage = PtapEnvelope<'steer.message', SteerMessagePayload>;
-type DelegateDecisionMessage = PtapEnvelope<'delegate.decision', DelegateDecisionPayload>;
-type CapabilityDecisionMessage = PtapEnvelope<'capability.decision', CapabilityDecisionPayload>;
-type ProgressUpdatedMessage = PtapEnvelope<'progress.updated', ProgressUpdatedPayload>;
-type ArtifactProducedMessage = PtapEnvelope<'artifact.produced', ArtifactProducedPayload>;
-type EvidenceProducedMessage = PtapEnvelope<'evidence.produced', EvidenceProducedPayload>;
-type FindingProducedMessage = PtapEnvelope<'finding.produced', FindingProducedPayload>;
-type DelegateRequestedMessage = PtapEnvelope<'delegate.requested', DelegateRequestedPayload>;
-type CapabilityRequestedMessage = PtapEnvelope<'capability.requested', CapabilityRequestedPayload>;
-type TaskCompletedMessage = PtapEnvelope<'task.completed', TaskCompletedPayload>;
-type TaskFailedMessage = PtapEnvelope<'task.failed', TaskFailedPayload>;
-type TaskBlockedMessage = PtapEnvelope<'task.blocked', TaskBlockedPayload>;
-type PtapCommand = TaskRequestMessage | SteerMessage | DelegateDecisionMessage | CapabilityDecisionMessage;
-type PtapEvent = ProgressUpdatedMessage | ArtifactProducedMessage | EvidenceProducedMessage | FindingProducedMessage | DelegateRequestedMessage | CapabilityRequestedMessage | TaskCompletedMessage | TaskFailedMessage | TaskBlockedMessage;
-type PtapMessage = PtapCommand | PtapEvent;
-//#endregion
-//#region src/domain/orchestrator.d.ts
-declare const ORCHESTRATOR_DECISION_TYPES: readonly ["create_task", "continue_agent_run", "cancel_task", "request_stage_transition", "delegate_response", "capability_response", "noop"];
-type OrchestratorDecisionType = (typeof ORCHESTRATOR_DECISION_TYPES)[number];
-declare const ORCHESTRATOR_WAKE_KINDS: readonly ["engagement.created", "user.message", "task.completed", "task.blocked", "task.failed", "task.cancelled", "task.interrupted", "delegate.requested", "capability.requested", "finding.produced", "artifact.important", "workflow.result", "engagement.recovered", "agent.steered"];
-type OrchestratorWakeKind = (typeof ORCHESTRATOR_WAKE_KINDS)[number];
-interface OrchestratorWakeEvent {
-  readonly kind: OrchestratorWakeKind;
-  readonly engagementId: EngagementId;
-  /**
-   * Task whose terminal event (completed/blocked/failed) produced this wake.
-   * Used by the Parent Wakeup Bridge to build a deterministic delta and to
-   * deduplicate wakes by (taskId, terminalEventId).
-   */
-  readonly taskId?: TaskId;
-  /** The canonical store eventId of the terminal transition (idempotency key). */
-  readonly terminalEventId?: EventId;
-}
-interface OrchestratorReasoningOutput {
-  readonly summary?: string;
-  readonly decisions: readonly unknown[];
-}
-declare const ORCHESTRATOR_REJECTION_REASONS: readonly ["template_not_found", "agent_not_found", "agent_disabled", "stage_agent_not_allowed", "agent_configuration_invalid", "template_not_eligible", "invalid_parent_task", "invalid_continuation", "agent_run_not_found", "capability_not_allowed", "invalid_stage", "stage_mismatch", "source_not_allowed", "scope_violation", "stale_decision", "unsupported_decision", "invalid_decision", "invalid_arguments", "runtime_contract_error"];
-type OrchestratorRejectionReason = (typeof ORCHESTRATOR_REJECTION_REASONS)[number];
-type OrchestratorDecisionResult = {
-  readonly status: 'accepted';
-  readonly type: OrchestratorDecisionType;
-  readonly taskId?: TaskId;
-  readonly agentRunId?: AgentRunId;
-  readonly runStatus?: string;
-} | {
-  readonly status: 'rejected';
-  readonly reason: OrchestratorRejectionReason;
-  readonly message?: string;
-  readonly currentStageKind?: string;
-  readonly requestedStageKind?: string;
-  readonly nextAction?: string;
-  readonly repeated_rejection?: boolean;
-} | {
-  readonly status: 'failed';
-  readonly message: string;
-};
-/**
- * P0-A: a Task's canonical terminal status. A Task reaches one of these ONLY
- * through a terminal PTAP (ptap_complete_task / ptap_block_task /
- * ptap_fail_task), the Worker Finalizer, or a user-initiated cancel
- * (pentester_cancel_task / Stop). A plain DSH turn/end never equals
- * completion — it is finalized as `failed` (WORKER_TERMINATED_WITHOUT_TASK_TERMINAL).
- * P0-3/P0-5: `cancelled` is a real user-initiated terminal state — never
- * recorded as failed.
- */
-declare const TASK_TERMINAL_STATUSES: readonly ["completed", "blocked", "failed", "cancelled"];
-type TaskTerminalStatus = (typeof TASK_TERMINAL_STATUSES)[number];
-/**
- * Deterministic terminal payload handed to the Parent Wakeup Bridge. The
- * Orchestrator re-reads canonical state from these fields — never from the
- * Worker's final prose.
- */
-interface TaskTerminalInfo {
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly status: TaskTerminalStatus;
-  /** Canonical store eventId of the terminal transition (idempotency key). */
-  readonly terminalEventId: EventId;
-  readonly summary: string;
-  readonly reasonCode?: string;
-  readonly recoverable?: boolean;
-  readonly details?: string;
-  readonly produced?: {
-    readonly artifacts?: readonly string[];
-    readonly evidence?: readonly string[];
-    readonly findings?: readonly string[];
-  };
-}
-//#endregion
-//#region src/domain/workflow.d.ts
-declare const WORKFLOW_TRANSITION_MODES: readonly ["normal", "manual_override", "skip"];
-type WorkflowTransitionMode = (typeof WORKFLOW_TRANSITION_MODES)[number];
-declare const WORKFLOW_TRANSITION_SOURCES: readonly ["orchestrator", "user"];
-type WorkflowTransitionSource = (typeof WORKFLOW_TRANSITION_SOURCES)[number];
-declare const WORKFLOW_REJECTION_REASONS: readonly ["source_not_allowed", "no_active_stage", "from_stage_mismatch", "not_next_stage", "criteria_unsatisfied", "stale_transition", "invalid_stage_state", "workflow_complete"];
-type WorkflowTransitionRejectionReason = (typeof WORKFLOW_REJECTION_REASONS)[number];
-interface WorkflowTransitionRequest {
-  readonly engagementId: EngagementId;
-  readonly fromStageId: StageId;
-  readonly toStageId?: StageId;
-  readonly mode: WorkflowTransitionMode;
-  readonly source: WorkflowTransitionSource;
-  /** P1-6: human-readable skip reason (user instruction). */
-  readonly reason?: string;
-}
-interface StageTaskFacts {
-  readonly total: number;
-  readonly pending: number;
-  readonly running: number;
-  readonly completed: number;
-  readonly failed: number;
-  readonly cancelled: number;
-  readonly interrupted: number;
-  readonly blocked: number;
-}
-interface WorkflowFacts {
-  readonly targetCount: number;
-  readonly assetCount: number;
-  readonly scopeConfigured: boolean;
-  readonly stageTasks: Readonly<Record<string, StageTaskFacts>>;
-}
-interface ExitCriteriaCheckResult {
-  readonly id: string;
-  readonly description: string;
-  readonly satisfied: boolean;
-}
-interface ExitCriteriaEvaluation {
-  readonly stageId: StageId;
-  readonly satisfied: boolean;
-  readonly checks: readonly ExitCriteriaCheckResult[];
-}
-interface WorkflowTransitionAccepted {
-  readonly status: 'accepted';
-  readonly fromStageId: StageId;
-  readonly toStageId?: StageId;
-  readonly previousStageStatus: 'active';
-  readonly finalStageStatus: 'completed' | 'skipped';
-  readonly criteria?: ExitCriteriaEvaluation;
-}
-interface WorkflowTransitionAlreadyApplied {
-  readonly status: 'already_applied';
-  readonly fromStageId: StageId;
-  readonly toStageId?: StageId;
-}
-interface WorkflowTransitionRejected {
-  readonly status: 'rejected';
-  readonly reason: WorkflowTransitionRejectionReason;
-  readonly message?: string;
-  readonly criteria?: ExitCriteriaEvaluation;
-}
-type WorkflowTransitionResult = WorkflowTransitionAccepted | WorkflowTransitionAlreadyApplied | WorkflowTransitionRejected;
-//#endregion
-//#region src/orchestrator/runtime.d.ts
-interface OrchestratorReasoningInput {
-  readonly engagementId: EngagementId;
-  readonly currentStageId?: StageId;
-  readonly triggers: readonly OrchestratorWakeEvent[];
-  readonly lastWorkflowTransitionResult?: WorkflowTransitionResult;
-}
-interface OrchestratorAgentRuntime {
-  reason(input: OrchestratorReasoningInput): Promise<OrchestratorReasoningOutput>;
-}
-interface SpawnAgentRunInput {
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly agentTemplateId: AgentTemplateId;
-}
-interface ContinueAgentRunInput {
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-}
-interface SteerAgentRunInput {
-  readonly agentRunId: AgentRunId;
-  readonly message: string;
-}
-interface AgentRunRuntime {
-  spawn(input: SpawnAgentRunInput): Promise<void>;
-  continue(input: ContinueAgentRunInput): Promise<void>;
-  steer(input: SteerAgentRunInput): Promise<void>;
-  /** P0-3/P0-5: cancel the Worker's live AgentRun (native session cancel). */
-  cancel(agentRunId: AgentRunId): Promise<void>;
-}
-interface AgentTemplateRegistry {
-  get(id: AgentTemplateId): AgentTemplate | undefined;
-  listEligibleForStage(stageKind: AgentTemplate['attachedStages'][number]): readonly AgentTemplate[];
-}
-interface ProducedDataSink {
-  handleArtifact(message: PtapMessage): void | Promise<void>;
-  handleEvidence(message: PtapMessage): void | Promise<void>;
-  handleFinding(message: PtapMessage): void | Promise<void>;
-}
-interface PtapOutbound {
-  emit(message: PtapMessage): void;
-}
-interface AuditSink {
-  record(event: string, detail?: unknown): void;
-}
-declare class InMemoryAgentTemplateRegistry implements AgentTemplateRegistry {
-  private readonly templates;
-  constructor(templates: readonly AgentTemplate[]);
-  get(id: AgentTemplateId): AgentTemplate | undefined;
-  entries(): IterableIterator<[AgentTemplateId, AgentTemplate]>;
-  listEligibleForStage(stageKind: AgentTemplate['attachedStages'][number]): readonly AgentTemplate[];
-}
-declare class InMemoryPtapOutbound implements PtapOutbound {
-  readonly messages: PtapMessage[];
-  emit(message: PtapMessage): void;
-}
-declare class InMemoryAuditSink implements AuditSink {
-  readonly events: Array<{
-    event: string;
-    detail?: unknown;
-  }>;
-  record(event: string, detail?: unknown): void;
-}
-interface RuntimeProgress {
-  readonly status: AgentProgressStatus;
-  readonly summary: string;
-}
-//#endregion
-//#region src/domain/asset.d.ts
-declare const ASSET_ORIGINS: readonly ["initial-target", "discovered", "derived"];
-type AssetOrigin = (typeof ASSET_ORIGINS)[number];
-interface Asset {
-  readonly id: AssetId;
-  readonly engagementId: EngagementId;
-  readonly value: string;
-  readonly origin: AssetOrigin;
-  readonly sourceTargetId?: TargetId;
-}
-//#endregion
-//#region src/domain/stage.d.ts
-declare const STAGE_STATUSES: readonly ["pending", "active", "completed", "skipped"];
-type StageStatus = (typeof STAGE_STATUSES)[number];
-declare const STAGE_TRANSITION_REASONS: readonly ["workflow", "manual_override", "skip"];
-type StageTransitionReason = (typeof STAGE_TRANSITION_REASONS)[number];
-interface Stage {
-  readonly id: StageId;
-  readonly engagementId: EngagementId;
-  readonly kind: PtesStageKind;
-  readonly status: StageStatus;
-  /** P1-6: human-readable reason when the Stage was user-skipped. */
-  readonly skippedReason?: string;
-  /** P1-6: ISO timestamp when the Stage was skipped. */
-  readonly skippedAt?: string;
-}
-//#endregion
-//#region src/domain/task.d.ts
-declare const TASK_STATUSES: readonly ["pending", "running", "blocked", "completed", "failed", "cancelled", "interrupted"];
-type TaskStatus = (typeof TASK_STATUSES)[number];
-interface Task {
-  readonly id: TaskId;
-  readonly engagementId: EngagementId;
-  readonly stageId: StageId;
-  readonly kind: PtesStageKind;
-  readonly goal: string;
-  readonly primaryAgentRunId: AgentRunId;
-  readonly dependsOn: readonly TaskId[];
-  readonly status: TaskStatus;
-  readonly parentTaskId?: TaskId;
-}
-//#endregion
-//#region src/domain/context.d.ts
-declare const CONTEXT_TRUST_LEVELS: readonly ["system", "user", "trusted_internal", "untrusted_external"];
-type ContextTrustLevel = (typeof CONTEXT_TRUST_LEVELS)[number];
-declare const CONTEXT_SOURCE_TYPES: readonly ["engagement", "task", "agent_run", "asset", "artifact", "evidence", "finding", "user"];
-type ContextSourceType = (typeof CONTEXT_SOURCE_TYPES)[number];
-declare const CONTEXT_ITEM_KINDS: readonly ["asset", "artifact", "finding", "evidence", "related_task", "guidance"];
-type ContextItemKind = (typeof CONTEXT_ITEM_KINDS)[number];
-type ContextPriority = 1 | 2 | 3 | 4 | 5 | 6;
-interface ContextSource {
-  readonly type: ContextSourceType;
-  readonly sourceId?: string;
-  readonly producedByTaskId?: TaskId;
-  readonly producedByAgentRunId?: AgentRunId;
-  readonly createdInStageId?: StageId;
-  readonly contentKind?: string;
-}
-interface ContextResourceRef {
-  readonly resourceId: string;
-  readonly kind: string;
-  readonly mediaType?: string;
-  readonly sizeBytes?: number;
-}
-interface InlineContextContent {
-  readonly text: string;
-  readonly mediaType?: string;
-}
-interface ContextItemBase {
-  readonly id: string;
-  readonly kind: ContextItemKind;
-  readonly trust: ContextTrustLevel;
-  readonly source: ContextSource;
-  readonly summary?: string;
-  readonly content?: InlineContextContent;
-  readonly ref?: ContextResourceRef;
-  readonly priority: ContextPriority;
-}
-type AssetContextItem = ContextItemBase & {
-  readonly kind: 'asset';
-};
-type ArtifactContextItem = ContextItemBase & {
-  readonly kind: 'artifact';
-};
-type FindingContextItem = ContextItemBase & {
-  readonly kind: 'finding';
-};
-type EvidenceContextItem = ContextItemBase & {
-  readonly kind: 'evidence';
-};
-type RelatedTaskContextItem = ContextItemBase & {
-  readonly kind: 'related_task';
-};
-type UserGuidanceContextItem = ContextItemBase & {
-  readonly kind: 'guidance';
-};
-type ContextItem = AssetContextItem | ArtifactContextItem | FindingContextItem | EvidenceContextItem | RelatedTaskContextItem | UserGuidanceContextItem;
-interface ContextConstraint {
-  readonly id: string;
-  readonly text: string;
-}
-interface EngagementContext {
-  readonly id: EngagementId;
-  readonly objectives: string;
-}
-interface ScopeContext {
+//#region src/model.d.ts
+interface AgentProfile {
   readonly id: string;
-  readonly summary: string;
-}
-interface RoeContext {
-  readonly summary: string;
-}
-interface StageContext {
-  readonly id: StageId;
-  readonly kind: PtesStageKind;
-  readonly status: string;
-}
-interface TaskContext {
-  readonly id: TaskId;
-  readonly goal: string;
-  readonly status: string;
-  readonly stageId: StageId;
-  readonly parentTaskId?: TaskId;
-}
-interface AgentTemplateContext {
-  readonly id: AgentTemplateId;
-  readonly name: string;
-  readonly role: string;
-  /**
-   * POLICY METADATA ONLY — never rendered as "available tools". The actual
-   * model-facing tools come from the Worker Tool Manifest (resolveWorkerTools).
-   */
-  readonly capabilities: readonly string[];
-}
-interface TaskLineageContext {
-  readonly parentTaskId?: TaskId;
-  readonly parentSummary?: string;
-}
-interface ContextBundleMetadata {
-  readonly builtAt: string;
-  readonly itemCount: number;
-}
-interface ContextDeltaMetadata {
-  readonly builtAt: string;
-  readonly addedCount: number;
-}
-interface TaskContextBundle {
-  readonly engagement: EngagementContext;
-  readonly scope: ScopeContext;
-  readonly roe: RoeContext;
-  readonly stage: StageContext;
-  readonly task: TaskContext;
-  readonly agentTemplate: AgentTemplateContext;
-  readonly lineage: TaskLineageContext;
-  readonly assets: readonly AssetContextItem[];
-  readonly artifacts: readonly ArtifactContextItem[];
-  readonly findings: readonly FindingContextItem[];
-  readonly evidence: readonly EvidenceContextItem[];
-  readonly relatedTasks: readonly RelatedTaskContextItem[];
-  readonly userGuidance: readonly UserGuidanceContextItem[];
-  readonly constraints: readonly ContextConstraint[];
-  readonly metadata: ContextBundleMetadata;
-}
-interface TaskContextDelta {
-  readonly task: TaskContext;
-  readonly addedItems: readonly ContextItem[];
-  readonly addedRefs: readonly ContextResourceRef[];
-  readonly userGuidance: readonly UserGuidanceContextItem[];
-  readonly changedConstraints: readonly ContextConstraint[];
-  readonly metadata: ContextDeltaMetadata;
-}
-interface ContextBudget {
-  readonly maxAssets: number;
-  readonly maxArtifacts: number;
-  readonly maxFindings: number;
-  readonly maxEvidenceRefs: number;
-  readonly maxRelatedTasks: number;
-  readonly maxUserGuidance: number;
-  readonly maxContextItems: number;
-  readonly maxEstimatedChars: number;
-  readonly maxInlineChars: number;
-  readonly maxMandatoryChars: number;
-}
-interface ExplicitContextRef {
-  readonly id: string;
-  readonly required?: boolean;
-}
-interface ContextDeliveryState {
-  readonly agentRunId: AgentRunId;
-  readonly deliveredItemIds: readonly string[];
-  readonly deliveredRefIds: readonly string[];
-  readonly revision: number;
-  readonly constraintFingerprint?: string;
-}
-declare const CONTEXT_BUILD_ERROR_CODES: readonly ["context_state_invalid", "task_not_found", "agent_run_not_found", "template_not_found", "scope_missing", "unresolved_required_ref", "mandatory_context_too_large", "delivery_state_invalid", "provider_failure"];
-type ContextBuildErrorCode = (typeof CONTEXT_BUILD_ERROR_CODES)[number];
-//#endregion
-//#region src/domain/target.d.ts
-interface Target {
-  readonly id: TargetId;
-  readonly engagementId: EngagementId;
-  readonly value: string;
-  readonly initialAssetId: AssetId;
-}
-//#endregion
-//#region src/domain/state.d.ts
-declare const ENGAGEMENT_SNAPSHOT_SCHEMA_VERSION: 1;
-interface EngagementRuntimeState {
-  readonly id: EngagementId;
-  readonly objectives: string;
-  readonly scopeId: ScopeId;
-  readonly scopeSummary: string;
-  /** P0-1: true when no un-archived Root Session remains attached. Archived
-   *  Engagements are excluded from bootstrap candidates but keep all history. */
-  readonly archived?: boolean;
-  /** ISO timestamp of archive (when archived). */
-  readonly archivedAt?: string;
-}
-interface WorkflowState {
-  readonly currentStageId?: StageId;
-}
-interface EngagementStateSnapshot {
-  readonly schemaVersion: typeof ENGAGEMENT_SNAPSHOT_SCHEMA_VERSION;
-  readonly lastEventSequence: number;
-  readonly engagement: EngagementRuntimeState;
-  readonly workflow: WorkflowState;
-  readonly stages: Readonly<Record<string, Stage>>;
-  readonly targets: Readonly<Record<string, Target>>;
-  readonly assets: Readonly<Record<string, Asset>>;
-  readonly tasks: Readonly<Record<string, Task>>;
-  readonly agentRuns: Readonly<Record<string, AgentRun>>;
-}
-//#endregion
-//#region src/domain/ptes-core.d.ts
-declare const PTES_CORE_INDEX_SCHEMA_VERSION: 1;
-type ArtifactRecord = Artifact;
-type FindingRecord = Finding;
-type FindingOccurrenceRecord = FindingOccurrence;
-interface EvidenceRecord extends Evidence {
-  readonly resourceRef: ContextResourceRef;
-}
-type ArtifactUpsertStatus = 'created' | 'merged';
-type FindingUpsertStatus = 'created' | 'merged';
-type OccurrenceUpsertStatus = 'created' | 'merged';
-interface ArtifactUpsertResult {
-  readonly status: ArtifactUpsertStatus;
-  readonly artifact: ArtifactRecord;
-}
-interface FindingUpsertResult {
-  readonly status: FindingUpsertStatus;
-  readonly finding: FindingRecord;
-}
-interface FindingOccurrenceUpsertResult {
-  readonly status: OccurrenceUpsertStatus;
-  readonly occurrence: FindingOccurrenceRecord;
-  readonly finding: FindingRecord;
-}
-type IngestionResult = {
-  readonly type: 'artifact';
-  readonly artifactId: ArtifactId;
-  readonly status: ArtifactUpsertStatus;
-} | {
-  readonly type: 'evidence';
-  readonly evidenceId: EvidenceId;
-} | {
-  readonly type: 'finding';
-  readonly findingId: FindingId;
-  readonly occurrenceId?: FindingOccurrenceId;
-  readonly findingStatus: FindingUpsertStatus;
-  readonly occurrenceStatus?: OccurrenceUpsertStatus;
-};
-interface ArtifactQuery {
-  readonly kind?: Artifact['kind'];
-  readonly identityKey?: string;
-}
-interface EvidenceQuery {
-  readonly kind?: Evidence['kind'];
-}
-interface FindingQuery {
-  readonly status?: FindingStatus;
-  readonly identityKey?: string;
-}
-interface EvidenceStorageLimits {
-  readonly maxEvidenceBytes: number;
-}
-interface PtesCoreState {
-  readonly schemaVersion: typeof PTES_CORE_INDEX_SCHEMA_VERSION;
-  readonly lastEventSequence: number;
-  readonly engagementId: EngagementId;
-  readonly artifacts: Readonly<Record<string, ArtifactRecord>>;
-  readonly artifactIdsByIdentityKey: Readonly<Record<string, ArtifactId>>;
-  readonly evidence: Readonly<Record<string, EvidenceRecord>>;
-  readonly findings: Readonly<Record<string, FindingRecord>>;
-  readonly occurrences: Readonly<Record<string, FindingOccurrenceRecord>>;
-  readonly findingIdsByIdentityKey: Readonly<Record<string, FindingId>>;
-  readonly occurrenceIdsByIdentityKey: Readonly<Record<string, FindingOccurrenceId>>;
-  readonly ingestion: Readonly<Record<string, IngestionResult>>;
-}
-//#endregion
-//#region src/domain/tools.d.ts
-declare const TOOL_CALL_STATUSES: readonly ["requested", "pending_approval", "queued", "running", "succeeded", "failed", "timed_out", "cancelled", "interrupted", "denied", "capability_required"];
-type ToolCallStatus = (typeof TOOL_CALL_STATUSES)[number];
-declare const TOOL_RISK_DECISIONS: readonly ["AUTO", "APPROVAL", "DENY"];
-type ToolRiskDecision = (typeof TOOL_RISK_DECISIONS)[number];
-declare const TOOL_FAILURE_KINDS: readonly ["timeout", "transport", "execution", "backend_unavailable", "toolbox_image_unavailable", "cancelled", "invalid_result", "unknown"];
-type ToolFailureKind = (typeof TOOL_FAILURE_KINDS)[number];
-declare const TOOLBOX_LIFECYCLES: readonly ["agent_run", "engagement"];
-type ToolboxLifecycle = (typeof TOOLBOX_LIFECYCLES)[number];
-declare const MCP_LIFECYCLES: readonly ["agent_run", "engagement"];
-type McpLifecycle = (typeof MCP_LIFECYCLES)[number];
-declare const IMAGE_RESOLVE_SOURCES: readonly ["existing", "built", "pulled"];
-type ImageResolveSource = (typeof IMAGE_RESOLVE_SOURCES)[number];
-declare const TOOL_RETRY_HINTS: readonly ["transient", "permanent", "unknown"];
-type ToolRetryHint = (typeof TOOL_RETRY_HINTS)[number];
-declare const TOOL_TERMINATIONS: readonly ["confirmed", "requested", "unknown"];
-type ToolTermination = (typeof TOOL_TERMINATIONS)[number];
-type ToolBackendBinding = {
-  readonly kind: 'docker';
-  readonly executor: string;
-} | {
-  readonly kind: 'mcp';
-  readonly serverId: McpServerId;
-  readonly remoteToolName: string;
-};
-interface ToolTimeoutSpec {
-  readonly defaultMs: number;
-  readonly maxMs: number;
-}
-interface ToolScopeTarget {
-  readonly value: string;
-}
-interface ToolCallRequest {
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly toolId: ToolId;
-  readonly arguments: unknown;
-  readonly timeoutMs?: number;
-  readonly retryOf?: ToolCallId;
-}
-interface ToolDefinition {
-  readonly id: ToolId;
-  readonly name: string;
-  readonly description: string;
-  readonly toolboxId: ToolboxId;
-  readonly backend: ToolBackendBinding;
-  readonly risk: ToolRiskDecision;
-  readonly timeout: ToolTimeoutSpec;
-  readonly requiredArgumentKeys?: readonly string[];
-  readonly scopeTargets?: (args: Record<string, unknown>) => readonly ToolScopeTarget[];
-}
-interface ToolboxProvisioning {
-  readonly dockerfile?: {
-    readonly context: string;
-    readonly dockerfile: string;
-  };
-  readonly pull?: {
-    readonly image: string;
-  };
-}
-interface ToolboxDefinition {
-  readonly id: ToolboxId;
   readonly name: string;
   readonly description: string;
-  readonly toolIds: readonly ToolId[];
-  readonly image: string;
-  readonly lifecycle: ToolboxLifecycle;
-  readonly provisioning?: ToolboxProvisioning;
-  readonly env?: Readonly<Record<string, string>>;
-  readonly secrets?: Readonly<Record<string, string>>;
-}
-interface ToolOutputLimits {
-  readonly maxInlineOutputBytes: number;
-  readonly maxTotalCapturedBytes: number;
-}
-interface DockerToolboxBinding {
-  readonly engagementId: EngagementId;
-  readonly agentRunId?: AgentRunId;
-  readonly toolboxId: ToolboxId;
-  readonly lifecycle: ToolboxLifecycle;
-  readonly containerId: string;
-  readonly image: string;
-  readonly imageId?: string;
-  readonly imageSource?: ImageResolveSource;
-}
-interface McpTransportDefinition {
-  readonly kind: 'fixture' | 'stdio' | 'http';
-  readonly command?: string;
-  readonly args?: readonly string[];
-  readonly url?: string;
-}
-interface McpServerConfig {
-  readonly env?: Readonly<Record<string, string>>;
-  readonly secrets?: Readonly<Record<string, string>>;
-}
-interface McpServerDefinition {
-  readonly id: McpServerId;
-  readonly name: string;
-  readonly lifecycle: McpLifecycle;
-  readonly transport: McpTransportDefinition;
-  readonly config: McpServerConfig;
-}
-interface McpRuntimeBinding {
-  readonly engagementId: EngagementId;
-  readonly agentRunId?: AgentRunId;
-  readonly serverId: McpServerId;
-  readonly lifecycle: McpLifecycle;
-  readonly runtimeId?: string;
-}
-interface ToolOutputResourceRef extends ContextResourceRef {}
-interface ToolCallRecord {
-  readonly toolCallId: ToolCallId;
-  readonly request: ToolCallRequest;
-  readonly status: ToolCallStatus;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-  readonly retryOf?: ToolCallId;
-  readonly reason?: string;
-  readonly outputRefs?: readonly ToolOutputResourceRef[];
-  readonly retryHint?: ToolRetryHint;
-  readonly failureKind?: ToolFailureKind;
-  readonly termination?: ToolTermination;
-  readonly policySnapshot?: {
-    readonly risk?: ToolRiskDecision;
-    readonly scope?: 'allowed' | 'denied';
-  };
-}
-interface PendingToolCall {
-  readonly toolCallId: ToolCallId;
-  readonly request: ToolCallRequest;
-  readonly status: 'pending_approval';
-  readonly requestedAt: string;
-  readonly policySnapshot: {
-    readonly risk: 'APPROVAL';
-    readonly scope: 'allowed';
-    readonly toolboxId: ToolboxId;
-  };
-}
-interface ToolBrokerConcurrencyLimits {
-  readonly maxPerEngagement: number;
-  readonly maxPerAgentRun: number;
-}
-//#endregion
-//#region src/harness/session-binding.d.ts
-interface HarnessSessionBinding {
-  readonly engagementId: EngagementId;
-  readonly agentRunId: AgentRunId;
-  readonly sessionId: string;
-  readonly templateId: string;
-  readonly templateRole: string;
-  readonly model?: string;
-  readonly skillIds: readonly string[];
-  readonly mcpIds: readonly string[];
-  /** Root Orchestrator Session that spawned this worker (trusted parentage). */
-  readonly parentRootSessionId?: string;
-}
-interface HarnessSessionBindingStore {
-  get(agentRunId: AgentRunId): Promise<HarnessSessionBinding | undefined>;
-  bind(binding: HarnessSessionBinding): Promise<void>;
-  remove(agentRunId: AgentRunId): Promise<void>;
-}
-//#endregion
-//#region src/reporting/types.d.ts
-declare const REPORT_STATUSES: readonly ["not_started", "drafting", "ready", "failed"];
-type ReportStatus = (typeof REPORT_STATUSES)[number];
-interface ReportState {
-  readonly status: ReportStatus;
-  readonly version: number;
-  readonly generatedAt?: string;
-  readonly reportingAgentRunId?: AgentRunId;
-  readonly error?: string;
-}
-interface ReportBuildResult {
-  readonly markdown: string;
-  readonly markdownPath: string;
-  readonly html?: string;
-  readonly htmlPath?: string;
-  readonly state: ReportState;
-  readonly markdownRef: ContextResourceRef;
-  readonly htmlRef?: ContextResourceRef;
-}
-//#endregion
-//#region src/projection/types.d.ts
-declare const PENTECSTER_PROJECTION_KEYS: readonly ["pentester", "pentester.assets", "pentester.findings", "pentester.evidence", "pentester.activity", "pentester.report"];
-type PentesterProjectionKey = (typeof PENTECSTER_PROJECTION_KEYS)[number];
-interface TargetSummary {
-  readonly id: string;
-  readonly value: string;
-}
-interface StageSummary {
-  readonly id: StageId;
-  readonly kind: PtesStageKind;
-  readonly name: string;
-  readonly status: StageStatus;
-  readonly completedTasks: number;
-  readonly runningTasks: number;
-  readonly totalTasks: number;
-  readonly findingCount: number;
-  readonly exitCriteriaSatisfied: boolean;
-  /** P1-5: the specific satisfied exit criteria (descriptions), never just
-   *  "退出条件已满足". */
-  readonly satisfiedCriteria: readonly string[];
-  /** P1-6: skip reason when the Stage was user-skipped (archived audit). */
-  readonly skippedReason?: string;
-}
-interface AttentionItem {
-  readonly kind: 'pending_approval' | 'failed_task' | 'blocked_task' | 'capability_required';
-  readonly id: string;
-  readonly title: string;
-  readonly toolId?: string;
-  readonly target?: string;
-  readonly risk?: string;
-  readonly agentRunId?: string;
-  readonly taskId?: string;
-  readonly reason?: string;
-}
-interface RunningItem {
-  readonly agentRunId: AgentRunId;
-  readonly taskId: TaskId;
-  readonly taskGoal: string;
-  /** 'starting' = launched but no Worker activity yet; else the run status. */
-  readonly status: AgentRunStatus | 'starting';
-  readonly stageKind: PtesStageKind;
-  readonly templateName?: string;
-  readonly sessionId?: string;
-  readonly sessionAvailable: boolean;
-}
-interface ActivityItem {
-  readonly id: string;
-  readonly kind: 'finding' | 'asset' | 'task' | 'stage' | 'tool' | 'approval' | 'evidence' | 'engagement' | 'agent';
-  readonly title: string;
-  readonly createdAt?: string;
-}
-interface EnvironmentProjection {
-  readonly status: 'checking' | 'ready' | 'blocked';
-  readonly checkedAt?: string;
-  readonly generation?: number;
-  /** Short actionable reason when blocked (e.g. "Docker API unreachable"). */
-  readonly reason?: string;
-  readonly code?: string;
-  readonly recoverable?: boolean;
-}
-interface PentesterProjection {
-  readonly engagement: {
-    readonly id: EngagementId;
-    readonly status: string;
-    readonly targets: readonly TargetSummary[];
-    readonly scopeSummary: string;
-  };
-  /** Host-enforced Environment Readiness Gate state (UI: Checking/Ready/Blocked). */
-  readonly environment: EnvironmentProjection;
-  readonly workflow: {
-    readonly currentStageId?: StageId;
-    readonly currentStageKind?: PtesStageKind;
-    readonly stages: readonly StageSummary[];
-  };
-  readonly counts: {
-    readonly assets: number;
-    readonly findings: number;
-    readonly evidence: number;
-    readonly runningTasks: number;
-    readonly runningAgents: number;
-    readonly pendingApprovals: number;
-  };
-  readonly findingSeverityCounts: {
-    readonly critical: number;
-    readonly high: number;
-    readonly medium: number;
-    readonly low: number;
-    readonly info: number;
-  };
-  readonly attention: readonly AttentionItem[];
-  readonly running: readonly RunningItem[];
-  readonly recentActivity: readonly ActivityItem[];
-}
-interface AssetProjectionItem {
-  readonly id: AssetId;
-  /** P1-2: human-readable display id ("A-001") — never the raw UUID. */
-  readonly displayId: string;
-  readonly value: string;
-  readonly origin: AssetOrigin;
-  readonly parentId?: string;
-  readonly relatedFindingCount: number;
-  readonly serviceCount: number;
-  readonly endpointCount: number;
-  readonly discoveredBy?: string;
-}
-interface AssetsProjection {
-  readonly engagementId: EngagementId;
-  readonly assets: readonly AssetProjectionItem[];
-}
-interface FindingProjectionItem {
-  readonly id: FindingId;
-  /** P1-2: human-readable display id ("V-001") — never the raw UUID. */
-  readonly displayId: string;
-  readonly title: string;
-  readonly status: FindingStatus;
-  readonly severity: FindingSeverity;
-  readonly occurrenceIds: readonly FindingOccurrenceId[];
-  readonly createdInStageId?: StageId;
-  readonly description?: string;
-  readonly remediation?: string;
-  readonly producedByTaskId?: string;
-  readonly producedByAgentRunId?: string;
-}
-interface OccurrenceProjectionItem {
-  readonly id: FindingOccurrenceId;
-  readonly findingId: FindingId;
-  readonly assetId: AssetId;
-  readonly endpoint?: string;
-  readonly evidenceIds: readonly EvidenceId[];
-  readonly status: FindingStatus;
-}
-interface FindingsProjection {
-  readonly engagementId: EngagementId;
-  readonly findings: readonly FindingProjectionItem[];
-  readonly occurrences: readonly OccurrenceProjectionItem[];
-}
-interface EvidenceProjectionItem {
-  readonly id: EvidenceId;
-  readonly kind: string;
-  readonly mediaType?: string;
-  readonly sizeBytes: number;
-  readonly createdAt: string;
-  readonly taskId?: TaskId;
-  readonly agentRunId?: AgentRunId;
-  readonly findingIds: readonly FindingId[];
-  readonly occurrenceIds: readonly FindingOccurrenceId[];
-  readonly resourceRef: ContextResourceRef;
-  readonly previewable: boolean;
-  /** P1-2: human-readable display id ("E-001") — never the raw UUID. */
-  readonly displayId: string;
-}
-interface EvidenceProjection {
-  readonly engagementId: EngagementId;
-  readonly items: readonly EvidenceProjectionItem[];
-}
-interface ActivityProjection {
-  readonly engagementId: EngagementId;
-  readonly tasks: readonly {
-    readonly id: TaskId;
-    readonly goal: string;
-    readonly status: TaskStatus;
-    readonly stageKind: PtesStageKind;
-  }[];
-  readonly agentRuns: readonly {
-    readonly id: AgentRunId;
-    readonly status: AgentRunStatus;
-    readonly sessionId?: string;
-  }[];
-  readonly approvals: readonly {
-    readonly id: ToolCallId;
-    readonly toolId: string;
-    readonly status: 'pending_approval';
-    readonly target?: string;
-    readonly risk: string;
-    readonly agentRunId: string;
-    readonly taskId: string;
-    readonly reason?: string;
-  }[];
-  readonly toolCalls: readonly {
-    readonly id: ToolCallId;
-    readonly toolId: string;
-    readonly status: string;
-  }[];
-}
-interface ReportProjection {
-  readonly engagementId: EngagementId;
-  readonly status: 'not_started' | 'drafting' | 'ready' | 'failed';
-  readonly version?: number;
-  readonly generatedAt?: string;
-  readonly markdownRef?: ContextResourceRef;
-  readonly htmlRef?: ContextResourceRef;
-  readonly pdfRef?: ContextResourceRef;
-  readonly preview?: string;
-}
-interface CanonicalReadModel {
-  readonly engagement: EngagementStateSnapshot;
-  readonly ptes: PtesCoreState;
-  readonly toolCalls: readonly ToolCallRecord[];
-  readonly pendingApprovals: readonly PendingToolCall[];
-  readonly bindings: readonly HarnessSessionBinding[];
-  readonly report?: ReportState;
-  /** templateId → display name (for Running / detail UI). */
-  readonly templateNames?: Readonly<Record<string, string>>;
-  /** Host-enforced Environment Readiness Gate state. */
-  readonly environment?: EnvironmentProjection;
-  /** agentRunId → true once the Worker emitted its first runtime activity
-   *  (P1-9: UI shows "starting" before this, "running" after). */
-  readonly workerActivity?: Readonly<Record<string, boolean>>;
-}
-//#endregion
-//#region src/runtime/parent-wakeup-outbox.d.ts
-/**
- * P0-A ParentWakeupOutbox — durable intent to wake the parent Orchestrator
- * session after a Task terminal transition.
- *
- * INVARIANT: the outbox record and the canonical Task terminal state are
- * written in the SAME commit window. `ptap_complete_task` returns ok:true
- * ONLY after both (a) the Task reached a terminal state AND (b) the outbox
- * record exists. There is no observable "Task completed but no wakeup intent".
- *
- * State machine:
- *   pending        — created with the terminal transition; not yet dispatched
- *   delivering     — dispatcher picked it up, parent continuation in flight
- *   delivered      — parent inbox injected AND continuation scheduled
- *   failed_retryable — dispatch failed; startup recovery retries
- *
- * Idempotency key: (parentSessionId, terminalEventId). The store dedupes on
- * insert — a replayed terminal event never creates a second record.
- */
-declare const PARENT_WAKEUP_STATES: readonly ["pending", "delivering", "delivered", "failed_retryable"];
-type ParentWakeupState = (typeof PARENT_WAKEUP_STATES)[number];
-interface ParentWakeupRecord {
-  readonly id: string;
-  /** Canonical store eventId of the terminal transition (idempotency half-key). */
-  readonly terminalEventId: EventId;
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  /** Worker DSH session that produced the terminal event. */
-  readonly childSessionId: string;
-  /** Root Orchestrator DSH session to wake. */
-  readonly parentSessionId: string;
-  readonly terminalStatus: 'completed' | 'blocked' | 'failed' | 'cancelled';
-  readonly summary: string;
-  readonly artifactRefs: readonly string[];
-  readonly evidenceRefs: readonly string[];
-  readonly findingRefs: readonly string[];
-  readonly reasonCode?: string;
-  readonly recoverable?: boolean;
-  readonly state: ParentWakeupState;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-  readonly attempts: number;
-}
-interface CreateParentWakeupInput {
-  readonly terminalEventId: EventId;
-  readonly engagementId: EngagementId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly childSessionId: string;
-  readonly parentSessionId: string;
-  readonly terminalStatus: 'completed' | 'blocked' | 'failed' | 'cancelled';
-  readonly summary: string;
-  readonly artifactRefs?: readonly string[];
-  readonly evidenceRefs?: readonly string[];
-  readonly findingRefs?: readonly string[];
-  readonly reasonCode?: string;
-  readonly recoverable?: boolean;
-}
-declare class ParentWakeupOutbox {
-  private readonly path;
-  private records;
-  private readonly byKey;
-  private constructor();
-  static open(engagementDir: string): Promise<ParentWakeupOutbox>;
-  list(): readonly ParentWakeupRecord[];
-  /** Records still needing delivery (pending / failed_retryable). */
-  listPending(): readonly ParentWakeupRecord[];
-  get(id: string): ParentWakeupRecord | undefined;
-  /**
-   * Idempotent insert. Returns the existing record when the same
-   * (parentSessionId, terminalEventId) already exists — a duplicate terminal
-   * event never creates a second record.
-   */
-  insert(input: CreateParentWakeupInput): Promise<ParentWakeupRecord>;
-  /** Mark a record delivering (dispatcher picked it up). */
-  markDelivering(id: string): Promise<void>;
-  /** Mark delivered (parent inbox injected + continuation scheduled). */
-  markDelivered(id: string): Promise<void>;
-  /** Mark failed but retryable (dispatcher error, plugin restart retries). */
-  markFailedRetryable(id: string): Promise<void>;
-  private update;
-  private persist;
-}
-//#endregion
-//#region src/tools/audit.d.ts
-interface ToolAuditSink {
-  record(event: string, detail?: unknown): void;
-}
-//#endregion
-//#region src/tools/backend.d.ts
-interface ToolBackendExecutionContext {
-  readonly toolCallId: ToolCallId;
-  readonly toolId: ToolId;
-  readonly request: ToolCallRequest;
-}
-interface ToolBackendSuccess {
-  readonly status: 'succeeded';
-  readonly summary?: string;
-  readonly data?: unknown;
-  readonly outputs?: Readonly<Record<string, string>>;
-  readonly binaryOutputs?: Readonly<Record<string, Buffer>>;
-}
-interface ToolBackendFailure {
-  readonly status: 'failed';
-  readonly kind: 'timeout' | 'transport' | 'execution' | 'backend_unavailable' | 'toolbox_image_unavailable' | 'cancelled' | 'invalid_result' | 'unknown';
-  readonly message: string;
-  readonly retryHint: ToolRetryHint;
-}
-type ToolBackendResult = ToolBackendSuccess | ToolBackendFailure;
-interface ToolBackendCancelResult {
-  readonly termination: ToolTermination;
-}
-interface ToolBackend {
-  execute(context: ToolBackendExecutionContext): Promise<ToolBackendResult>;
-  cancel(executionId: string): Promise<ToolBackendCancelResult>;
-}
-//#endregion
-//#region src/tools/catalog.d.ts
-interface ToolCatalog {
-  get(toolId: ToolId): ToolDefinition | undefined;
-  listForToolbox(toolboxId: ToolboxId): readonly ToolDefinition[];
-  list(): readonly ToolDefinition[];
-}
-//#endregion
-//#region src/tools/capability.d.ts
-interface ToolboxGrantStore {
-  hasGrant(agentRunId: AgentRunId, toolboxId: ToolboxId): boolean;
-  grant(agentRunId: AgentRunId, toolboxId: ToolboxId): Promise<void>;
-  revoke(agentRunId: AgentRunId, toolboxId: ToolboxId): Promise<void>;
-  calls: number;
-}
-declare class DurableToolboxGrantStore implements ToolboxGrantStore {
-  calls: number;
-  private readonly path;
-  private grants;
-  private constructor();
-  static open(engagementDir: string): Promise<DurableToolboxGrantStore>;
-  hasGrant(agentRunId: AgentRunId, toolboxId: ToolboxId): boolean;
-  grant(agentRunId: AgentRunId, toolboxId: ToolboxId): Promise<void>;
-  revoke(agentRunId: AgentRunId, toolboxId: ToolboxId): Promise<void>;
-}
-//#endregion
-//#region src/tools/mcp-auth.d.ts
-interface McpAuthorization {
-  isAuthorized(agentRunId: AgentRunId, serverId: McpServerId): boolean;
-}
-//#endregion
-//#region src/tools/result.d.ts
-type ToolExecuteResult = {
-  readonly status: 'succeeded';
-  readonly toolCallId: ToolCallId;
-  readonly toolId: ToolId;
-  readonly summary?: string;
-  readonly data?: unknown;
-  readonly outputRefs: readonly ToolOutputResourceRef[];
-} | {
-  readonly status: 'pending_approval';
-  readonly toolCallId: ToolCallId;
-} | {
-  readonly status: 'denied';
-  readonly toolCallId: ToolCallId;
-  readonly reason: string;
-} | {
-  readonly status: 'capability_required';
-  readonly toolCallId: ToolCallId;
-  readonly toolboxId: ToolboxId;
-} | {
-  readonly status: 'failed';
-  readonly toolCallId: ToolCallId;
-  readonly kind: ToolFailureKind;
-  readonly message: string;
-  readonly retryHint: ToolRetryHint;
-} | {
-  readonly status: 'timed_out';
-  readonly toolCallId: ToolCallId;
-  readonly termination: ToolTermination;
-} | {
-  readonly status: 'cancelled';
-  readonly toolCallId: ToolCallId;
-  readonly termination?: ToolTermination;
-} | {
-  readonly status: 'queued';
-  readonly toolCallId: ToolCallId;
-} | {
-  readonly status: 'interrupted';
-  readonly toolCallId: ToolCallId;
-};
-//#endregion
-//#region src/tools/risk-policy.d.ts
-interface ToolRiskContext {
-  readonly request: ToolCallRequest;
-  readonly tool: ToolDefinition;
-}
-interface ToolRiskPolicy {
-  evaluate(context: ToolRiskContext): Promise<ToolRiskDecision>;
-  calls: number;
-}
-//#endregion
-//#region src/tools/scope-policy.d.ts
-interface ToolScopeContext {
-  readonly request: ToolCallRequest;
-  readonly tool: ToolDefinition;
-  readonly targets: readonly ToolScopeTarget[];
-}
-interface ToolScopeDecision {
-  readonly decision: 'allowed' | 'denied';
-  readonly reason?: string;
-}
-interface ToolScopePolicy {
-  evaluate(context: ToolScopeContext): Promise<ToolScopeDecision>;
-  calls: number;
-}
-//#endregion
-//#region src/tools/broker.d.ts
-interface EngagementView {
-  getTask(id: TaskId): Task | undefined;
-  getAgentRun(id: AgentRunId): AgentRun | undefined;
-  getTemplate?(id: AgentTemplateId): AgentTemplate | undefined;
-}
-interface ToolBrokerOptions {
-  readonly engagementDir: string;
-  readonly engagementId: EngagementId;
-  readonly engagement: EngagementView;
-  readonly grants: ToolboxGrantStore;
-  readonly docker: ToolBackend;
-  readonly mcp: ToolBackend;
-  readonly catalog?: ToolCatalog;
-  readonly scopePolicy: ToolScopePolicy;
-  readonly riskPolicy?: ToolRiskPolicy;
-  readonly limits?: ToolBrokerConcurrencyLimits;
-  readonly audit?: ToolAuditSink;
-  readonly now?: () => string;
-  readonly mcpAuth?: McpAuthorization;
-}
-declare class ToolBroker {
-  readonly directory: string;
-  readonly engagementId: EngagementId;
-  private readonly engagement;
-  private readonly grants;
-  private readonly docker;
-  private readonly mcp;
-  private readonly catalog;
-  private readonly scopePolicy;
-  private readonly riskPolicy;
-  private readonly limits;
-  private readonly audit;
-  private readonly mcpAuth;
-  private readonly now;
-  private readonly calls;
-  private readonly approvals;
-  private readonly outputs;
-  private chain;
-  private draining;
-  private constructor();
-  static open(options: ToolBrokerOptions): Promise<ToolBroker>;
-  getCall(id: ToolCallId): ToolCallRecord | undefined;
-  listPending(): readonly PendingToolCall[];
-  execute(request: ToolCallRequest): Promise<ToolExecuteResult>;
-  approve(toolCallId: ToolCallId): Promise<ToolExecuteResult>;
-  reject(toolCallId: ToolCallId, reason?: string): Promise<ToolExecuteResult>;
-  cancel(toolCallId: ToolCallId): Promise<ToolExecuteResult>;
-  /**
-   * P0-3/P0-5: cancel every in-flight tool call (requested/queued/running/
-   * pending_approval) for one AgentRun. Best-effort per call; used when the
-   * user stops a Subagent / cancels a Task.
-   */
-  cancelAgentRunCalls(agentRunId: AgentRunId): Promise<number>;
-  private serialized;
-  private admit;
-  private admitApproval;
-  private enqueueOrDispatch;
-  private canRun;
-  private dispatch;
-  private finishDispatch;
-  private resultFromRecord;
-  private drain;
-  private validateIdentity;
-  private effectiveToolbox;
-  private backendFor;
-  private denyMcp;
-  private save;
-  private finish;
-}
-//#endregion
-//#region src/projection/commands.d.ts
-type PentesterCommand = {
-  readonly type: 'approval.approve';
-  readonly approvalId: ToolCallId;
-} | {
-  readonly type: 'approval.reject';
-  readonly approvalId: ToolCallId;
-  readonly reason?: string;
-} | {
-  readonly type: 'conversation.open';
-  readonly agentRunId: string;
-} | {
-  /** P0-5: user stops a running Subagent / cancels a Task from the UI. */
-  readonly type: 'task.stop';
-  readonly taskId?: TaskId;
-  readonly reason?: string;
-};
-type PentesterCommandResult = {
-  readonly status: 'accepted';
-  readonly type: PentesterCommand['type'];
-  readonly sessionId?: string;
-  readonly projection?: PentesterProjection;
-} | {
-  readonly status: 'rejected';
-  readonly reason: string;
-};
-//#endregion
-//#region src/projection/publisher.d.ts
-interface PublishedBundle {
-  readonly revision: number;
-  readonly overview: PentesterProjection;
-  readonly assets: AssetsProjection;
-  readonly findings: FindingsProjection;
-  readonly evidence: EvidenceProjection;
-  readonly activity: ActivityProjection;
-  readonly report: ReportProjection;
-}
-/**
- * Binding-aware projection publisher: resolves `sessionId → engagementId →
- * canonical bundle`. A session with no binding reads an explicit empty/unbound
- * state (never a guess, never the last-published bundle, never a Workspace
- * merge). Updates propagate to every session bound to the same Engagement
- * (S1/S2 → E1 both refresh when E1 changes).
- */
-declare class PentesterProjectionPublisher {
-  private readonly builder;
-  private readonly byEngagement;
-  /** sessionId → engagementId (Root binding mirror; the durable store is authoritative). */
-  private readonly sessionEngagement;
-  private previewEnabled;
-  private globalRevision;
-  /** Enable presentation-only sample projections when no real bundle exists. */
-  setUiPreview(enabled: boolean): void;
-  isUiPreviewEnabled(): boolean;
-  private previewBundle;
-  /** Publish (or refresh) the canonical bundle for one Engagement. */
-  publish(model: CanonicalReadModel): PublishedBundle;
-  /** The current bundle for one Engagement (undefined when never published). */
-  currentFor(engagementId: EngagementId): PublishedBundle | undefined;
-  /** Legacy single-engagement view (devSeed / single-engagement tests). */
-  current(): PublishedBundle | undefined;
-  engagementId(): EngagementId | undefined;
-  /** Bind a Root Session to its Engagement (projection resolution authority). */
-  bindSession(sessionId: string, engagementId?: EngagementId): void;
-  isBound(sessionId: string | undefined, viaEvent: boolean): boolean;
-  /** Per-session resolution: sessionId → engagementId → canonical bundle. */
-  viewForSession(sessionId: string, key: PentesterProjectionKey): PublishedBundle[keyof Omit<PublishedBundle, 'revision'>] | null;
-  /** Per-engagement resolution (used by the per-session projection unit). */
-  viewForEngagement(engagementId: EngagementId, key: PentesterProjectionKey): PublishedBundle[keyof Omit<PublishedBundle, 'revision'>] | null;
-  /** Legacy single-bundle view (kept for existing tests / devSeed). */
-  view(key: PentesterProjectionKey, bound: boolean): PublishedBundle[keyof Omit<PublishedBundle, 'revision'>] | null;
-}
-//#endregion
-//#region src/ptes-core/events.d.ts
-declare const PTES_CORE_EVENT_TYPES: readonly ["artifact.created", "artifact.merged", "evidence.created", "finding.created", "finding.updated", "finding.status_changed", "occurrence.created", "occurrence.merged", "occurrence.status_changed"];
-type PtesCoreEventType = (typeof PTES_CORE_EVENT_TYPES)[number];
-interface PtesCoreEventEnvelope<TType extends PtesCoreEventType, TPayload> {
-  readonly eventId: EventId;
-  readonly sequence: number;
-  readonly type: TType;
-  readonly engagementId: EngagementId;
-  readonly timestamp: string;
-  readonly sourcePtapMessageId?: string;
-  readonly ingestionResult?: IngestionResult;
-  readonly payload: TPayload;
-}
-interface ArtifactCreatedPayload {
-  readonly artifact: ArtifactRecord;
-}
-interface ArtifactMergedPayload {
-  readonly artifactId: ArtifactId;
-  readonly provenance: ArtifactProvenance;
-  readonly evidenceIds: readonly EvidenceId[];
-}
-interface EvidenceCreatedPayload {
-  readonly evidence: EvidenceRecord;
-}
-interface FindingCreatedPayload {
-  readonly finding: FindingRecord;
-}
-interface FindingUpdatedPayload {
-  readonly findingId: FindingId;
-  readonly occurrenceIds: readonly FindingOccurrenceId[];
-}
-interface FindingStatusChangedPayload {
-  readonly findingId: FindingId;
-  readonly from: FindingStatus;
-  readonly to: FindingStatus;
-}
-interface OccurrenceCreatedPayload {
-  readonly occurrence: FindingOccurrenceRecord;
-}
-interface OccurrenceMergedPayload {
-  readonly occurrenceId: FindingOccurrenceId;
-  readonly evidenceIds: readonly EvidenceId[];
-}
-interface OccurrenceStatusChangedPayload {
-  readonly occurrenceId: FindingOccurrenceId;
-  readonly from: FindingStatus;
-  readonly to: FindingStatus;
-}
-type ArtifactCreatedEvent = PtesCoreEventEnvelope<'artifact.created', ArtifactCreatedPayload>;
-type ArtifactMergedEvent = PtesCoreEventEnvelope<'artifact.merged', ArtifactMergedPayload>;
-type EvidenceCreatedEvent = PtesCoreEventEnvelope<'evidence.created', EvidenceCreatedPayload>;
-type FindingCreatedEvent = PtesCoreEventEnvelope<'finding.created', FindingCreatedPayload>;
-type FindingUpdatedEvent = PtesCoreEventEnvelope<'finding.updated', FindingUpdatedPayload>;
-type FindingStatusChangedEvent = PtesCoreEventEnvelope<'finding.status_changed', FindingStatusChangedPayload>;
-type OccurrenceCreatedEvent = PtesCoreEventEnvelope<'occurrence.created', OccurrenceCreatedPayload>;
-type OccurrenceMergedEvent = PtesCoreEventEnvelope<'occurrence.merged', OccurrenceMergedPayload>;
-type OccurrenceStatusChangedEvent = PtesCoreEventEnvelope<'occurrence.status_changed', OccurrenceStatusChangedPayload>;
-type PtesCoreEvent = ArtifactCreatedEvent | ArtifactMergedEvent | EvidenceCreatedEvent | FindingCreatedEvent | FindingUpdatedEvent | FindingStatusChangedEvent | OccurrenceCreatedEvent | OccurrenceMergedEvent | OccurrenceStatusChangedEvent;
-//#endregion
-//#region src/ptes-core/repositories/artifacts.d.ts
-interface ArtifactUpsertInput {
-  readonly kind: ArtifactKind;
-  readonly summary: string;
-  readonly identity?: ArtifactIdentityFields;
-  readonly identityKey?: string;
-  readonly evidenceIds: readonly EvidenceId[];
-  readonly provenance: ArtifactProvenance;
-  readonly createdInStageId: StageId;
-  readonly producedByTaskId: TaskId;
-  readonly producedByAgentRunId: AgentRunId;
-}
-interface ArtifactRepository {
-  get(id: ArtifactId): Promise<ArtifactRecord | undefined>;
-  list(query?: ArtifactQuery): Promise<readonly ArtifactRecord[]>;
-  upsert(input: ArtifactUpsertInput): Promise<ArtifactUpsertResult>;
-}
-//#endregion
-//#region src/ptes-core/repositories/evidence.d.ts
-interface EvidenceCreateInput {
-  readonly kind: EvidenceKind;
-  readonly summary: string;
-  readonly bytes: Uint8Array;
-  readonly mediaType?: string;
-  readonly createdInStageId: StageId;
-  readonly producedByTaskId: TaskId;
-  readonly producedByAgentRunId: AgentRunId;
-  readonly sourcePtapMessageId: string;
-}
-interface EvidenceRepository {
-  get(id: EvidenceId): Promise<EvidenceRecord | undefined>;
-  list(query?: EvidenceQuery): Promise<readonly EvidenceRecord[]>;
-  create(input: EvidenceCreateInput): Promise<EvidenceRecord>;
-  readBytes(id: EvidenceId): Promise<Uint8Array>;
-}
-//#endregion
-//#region src/ptes-core/repositories/findings.d.ts
-interface FindingUpsertInput {
-  readonly title: string;
-  readonly severity: FindingSeverity;
-  readonly confidence: number;
-  readonly category?: string;
-  readonly weakness?: string;
-  readonly cwe?: string;
-  readonly identityKey?: string;
-  readonly createdInStageId: StageId;
-  readonly producedByTaskId: TaskId;
-  readonly producedByAgentRunId: AgentRunId;
-  readonly sourcePtapMessageId?: string;
-  readonly ingestionResult?: IngestionResult;
-  readonly finalizeIngestion?: boolean;
-}
-interface FindingOccurrenceUpsertInput {
-  readonly findingId: FindingId;
-  readonly assetId: AssetId;
-  readonly endpoint?: string;
-  readonly serviceId?: string;
-  readonly evidenceIds: readonly EvidenceId[];
-  readonly reproductionContext?: string;
-  readonly identityKey: string;
-  readonly sourcePtapMessageId?: string;
-  readonly ingestionResult?: IngestionResult;
-}
-interface FindingStatusUpdateInput {
-  readonly findingId: FindingId;
-  readonly to: FindingStatus;
-}
-interface FindingRepository {
-  get(id: FindingId): Promise<FindingRecord | undefined>;
-  list(query?: FindingQuery): Promise<readonly FindingRecord[]>;
-  getOccurrence(id: FindingOccurrenceId): Promise<FindingOccurrenceRecord | undefined>;
-  listOccurrences(findingId?: FindingId): Promise<readonly FindingOccurrenceRecord[]>;
-  upsertFinding(input: FindingUpsertInput): Promise<FindingUpsertResult>;
-  upsertOccurrence(input: FindingOccurrenceUpsertInput): Promise<FindingOccurrenceUpsertResult>;
-  updateStatus(input: FindingStatusUpdateInput): Promise<FindingRecord>;
-}
-//#endregion
-//#region src/ptes-core/store.d.ts
-interface PtesCoreStoreOptions {
-  readonly engagementDir: string;
-  readonly engagementId: EngagementId;
-  readonly limits?: EvidenceStorageLimits;
-  readonly now?: () => string;
-}
-interface PtesCoreStore {
-  readonly artifacts: ArtifactRepository;
-  readonly evidence: EvidenceRepository;
-  readonly findings: FindingRepository;
-  readonly directory: string;
-  readonly engagementId: EngagementId;
-  getState(): PtesCoreState;
-  getIngestion(sourcePtapMessageId: string): IngestionResult | undefined;
-  listOrphanBlobs(): Promise<readonly string[]>;
-  cleanOrphanBlobs(): Promise<readonly string[]>;
-}
-declare class DurablePtesCoreStore implements PtesCoreStore {
-  readonly artifacts: ArtifactRepository;
-  readonly evidence: EvidenceRepository;
-  readonly findings: FindingRepository;
-  readonly directory: string;
-  readonly engagementId: EngagementId;
-  private readonly blobs;
-  private readonly limits;
-  private readonly now;
-  private chain;
-  private current;
-  private constructor();
-  getState(): PtesCoreState;
-  getIngestion(sourcePtapMessageId: string): IngestionResult | undefined;
-  listOrphanBlobs(): Promise<readonly string[]>;
-  cleanOrphanBlobs(): Promise<readonly string[]>;
-  static open(options: PtesCoreStoreOptions): Promise<DurablePtesCoreStore>;
-  applyPreparedEvents(events: readonly PtesCoreEvent[]): Promise<PtesCoreState>;
-  private serialized;
-  private readEvidenceBytes;
-  private filterArtifacts;
-  private filterEvidence;
-  private filterFindings;
-  private commitEvents;
-  private envelope;
-  private replayedArtifact;
-  private replayedEvidence;
-  private replayedFinding;
-  private replayedOccurrence;
-  private upsertArtifact;
-  private createEvidence;
-  private upsertFinding;
-  private upsertOccurrence;
-  private updateFindingStatus;
-}
-//#endregion
-//#region src/state/engagement-state-store.d.ts
-interface CreateEngagementInput {
-  readonly parentDir: string;
-  readonly objectives: string;
-  readonly scopeSummary: string;
-  readonly targets: readonly {
-    readonly value: string;
-  }[];
-}
-interface CreateTaskInput {
-  readonly stageId: StageId;
-  readonly goal: string;
-  readonly templateId: AgentTemplateId;
-  readonly continueAgentRunId?: AgentRunId;
-  readonly dependsOn?: readonly TaskId[];
-  readonly parentTaskId?: TaskId;
-  /** Immutable Global-config snapshot captured at AgentRun creation. */
-  readonly configSnapshot?: AgentRunConfigSnapshot;
-}
-interface SerializedStoreApi {
-  snapshot(): EngagementStateSnapshot;
-  advanceStages(steps: readonly {
-    readonly stageId: StageId;
-    readonly to: StageStatus;
-    readonly reason: StageTransitionReason;
-    readonly skippedReason?: string;
-  }[]): Promise<void>;
-}
-declare class EngagementStateStore {
-  private writeChain;
-  readonly directory: string;
-  private current;
-  private constructor();
-  getSnapshot(): EngagementStateSnapshot;
-  static create(input: CreateEngagementInput): Promise<EngagementStateStore>;
-  static load(engagementDir: string): Promise<EngagementStateStore>;
-  static recover(engagementDir: string): Promise<EngagementStateStore>;
-  private enqueue;
-  private nextEvents;
-  private commit;
-  /**
-   * Run `fn` on the latest in-memory snapshot inside the per-Engagement write chain.
-   * Callers must not enqueue other store methods from `fn`.
-   */
-  runSerialized<T>(fn: (api: SerializedStoreApi) => Promise<T>): Promise<T>;
-  transitionStage(input: {
-    readonly stageId: StageId;
-    readonly to: StageStatus;
-    readonly reason: StageTransitionReason;
-  }): Promise<void>;
-  advanceStages(steps: readonly {
-    readonly stageId: StageId;
-    readonly to: StageStatus;
-    readonly reason: StageTransitionReason;
-    readonly skippedReason?: string;
-  }[]): Promise<void>;
-  private advanceStagesUnlocked;
-  createTask(input: CreateTaskInput): Promise<{
-    taskId: TaskId;
-    agentRunId: AgentRunId;
-  }>;
-  startTask(taskId: TaskId): Promise<void>;
-  /**
-   * P1-9: mark an AgentRun as genuinely `running` — called when the Worker
-   * runtime emits its first activity (PTAP progress/artifact) after launch.
-   * Prevents the UI from showing "running" before the Worker actually runs.
-   */
-  markAgentRunRunning(agentRunId: AgentRunId, taskId: TaskId): Promise<void>;
-  completeTask(taskId: TaskId): Promise<EventId>;
-  failTask(taskId: TaskId): Promise<EventId>;
-  cancelTask(taskId: TaskId): Promise<EventId>;
-  blockTask(taskId: TaskId): Promise<EventId>;
-  completeAgentRun(agentRunId: AgentRunId): Promise<void>;
-  failAgentRun(agentRunId: AgentRunId): Promise<void>;
-  cancelAgentRun(agentRunId: AgentRunId): Promise<void>;
-  blockAgentRun(agentRunId: AgentRunId): Promise<void>;
-  private transitionTask;
-  private transitionAgentRun;
-  /**
-   * P0-1: mark the Engagement archived (last active Root Session detached).
-   * History is retained; only the active association is closed. Idempotent.
-   */
-  archiveEngagement(detachedSessionIds: readonly string[]): Promise<void>;
-  recoverRunningWork(): Promise<void>;
-}
-//#endregion
-//#region src/tools/docker-engine.d.ts
-interface DockerImageInspect {
-  readonly id: string;
-  readonly digest?: string;
-}
-interface DockerContainerInspect {
-  readonly id: string;
-  readonly running: boolean;
-  readonly image: string;
-}
-/** Minimal container row for listing (P0-B GC scans by label/name/image). */
-interface DockerContainerListItem {
-  readonly id: string;
-  readonly name: string;
-  readonly image: string;
-  readonly running: boolean;
-  readonly labels?: Readonly<Record<string, string>>;
-}
-interface DockerListContainersInput {
-  readonly all?: boolean;
-  /** Docker label filter: `key=value`. */
-  readonly label?: string;
-}
-interface DockerHostConfig {
-  readonly privileged?: boolean;
-  readonly networkMode?: string;
-  readonly pidMode?: string;
-  readonly ipcMode?: string;
-  readonly capAdd?: readonly string[];
-  readonly binds?: readonly string[];
-}
-interface DockerCreateContainerInput {
-  readonly image: string;
-  readonly name?: string;
-  readonly cmd?: readonly string[];
-  readonly env?: readonly string[];
-  readonly labels?: Readonly<Record<string, string>>;
-  readonly hostConfig: DockerHostConfig;
-}
-interface DockerExecInput {
-  readonly containerId: string;
-  readonly argv: readonly string[];
-  readonly cwd?: string;
-  readonly env?: readonly string[];
-  readonly timeoutMs?: number;
-  readonly abort?: AbortSignal;
-  readonly maxTotalCapturedBytes?: number;
-  readonly onExecCreated?: (execId: string) => void;
-}
-interface DockerExecResult {
-  readonly execId: string;
-  readonly exitCode: number;
-  readonly stdout: Buffer;
-  readonly stderr: Buffer;
-  readonly truncated: boolean;
-  readonly captureLimitReached: boolean;
-}
-interface DockerEngineClient {
-  inspectImage(ref: string): Promise<DockerImageInspect | undefined>;
-  buildImage(input: {
-    contextDir: string;
-    dockerfile: string;
-    tag: string;
-  }): Promise<DockerImageInspect>;
-  pullImage(image: string): Promise<DockerImageInspect>;
-  createContainer(input: DockerCreateContainerInput): Promise<{
-    containerId: string;
-  }>;
-  inspectContainer(containerId: string): Promise<DockerContainerInspect | undefined>;
-  startContainer(containerId: string): Promise<void>;
-  stopContainer(containerId: string): Promise<void>;
-  removeContainer(containerId: string): Promise<void>;
-  /** List containers (P0-B GC). `label` filters on `dsh.pentester.*` labels. */
-  listContainers(input?: DockerListContainersInput): Promise<readonly DockerContainerListItem[]>;
-  exec(input: DockerExecInput): Promise<DockerExecResult>;
-  cancelExec(execId: string): Promise<'confirmed' | 'requested' | 'unknown'>;
-}
-//#endregion
-//#region src/tools/engagement-container-store.d.ts
-interface EngagementContainerBinding {
-  readonly engagementId: EngagementId;
-  readonly profile: string;
-  readonly image: string;
-  readonly containerId: string;
-  readonly imageId?: string;
-  readonly imageSource?: 'existing' | 'built' | 'pulled';
-  readonly createdAt: string;
-}
-//#endregion
-//#region src/tools/toolbox-registry.d.ts
-declare class InMemoryToolboxRegistry {
-  private readonly boxes;
-  constructor(boxes?: readonly ToolboxDefinition[]);
-  get(id: ToolboxId): ToolboxDefinition | undefined;
-  list(): readonly ToolboxDefinition[];
-}
-//#endregion
-//#region src/tools/docker-provisioner.d.ts
-interface ResolvedToolboxImage {
-  readonly toolboxId: ToolboxId;
-  readonly image: string;
-  readonly inspect: DockerImageInspect;
-  readonly source: ImageResolveSource;
-}
-declare class ToolboxProvisioner {
-  inspectCalls: number;
-  buildCalls: number;
-  pullCalls: number;
-  private readonly engine;
-  private readonly registry;
-  private readonly repoRoot;
-  private readonly sources;
-  constructor(input: {
-    readonly engine: DockerEngineClient;
-    readonly registry?: InMemoryToolboxRegistry;
-    readonly repoRoot?: string;
-  });
-  definition(id: ToolboxId): ToolboxDefinition | undefined;
-  inspect(id: ToolboxId): Promise<DockerImageInspect | undefined>;
-  build(id: ToolboxId): Promise<ResolvedToolboxImage>;
-  pull(id: ToolboxId): Promise<ResolvedToolboxImage>;
-  resolve(id: ToolboxId): Promise<ResolvedToolboxImage | undefined>;
-  private require;
-}
-//#endregion
-//#region src/tools/docker-backend.d.ts
-interface DockerToolBackend extends ToolBackend {
-  readonly kind: 'docker';
-}
-interface DockerToolExecutorOptions {
-  readonly engagementDir: string;
-  readonly engagementId: EngagementId;
-  readonly engine: DockerEngineClient;
-  readonly catalog?: ToolCatalog;
-  readonly registry?: InMemoryToolboxRegistry;
-  readonly provisioner?: ToolboxProvisioner;
-  readonly outputLimits?: ToolOutputLimits;
-  /**
-   * Host path of the DSH project working directory, bind-mounted into the
-   * container as `/workspace` (the default exec cwd). Trusted host value —
-   * never from the model. When absent the Engagement workspace is mounted to
-   * `/workspace` instead (legacy fallback) and `/artifacts` is omitted.
-   */
-  readonly workspacePath?: string;
-  /**
-   * P0-B: stable workspace identity label value (hashed, never the raw path).
-   * Recorded on the managed container so GC can attribute it without parsing
-   * container names.
-   */
-  readonly workspaceLabel?: string;
-  /**
-   * P1-4: human-readable slug for the container name (e.g. "192-168-107-5").
-   * Derived from the Engagement's targets — never a UUID.
-   */
-  readonly nameSlug?: string;
-}
-declare class DockerToolExecutor implements DockerToolBackend {
-  readonly kind: "docker";
-  executeCalls: number;
-  cancelCalls: number;
-  lastContext?: ToolBackendExecutionContext;
-  lastArgv?: readonly string[];
-  lastContainerId?: string;
-  lastResolvedImage?: DockerImageInspect;
-  firewallObjectsCreated: number;
-  private readonly engagementDir;
-  private readonly engagementId;
-  private readonly engine;
-  private readonly catalog;
-  private readonly registry;
-  private readonly provisioner;
-  private readonly limits;
-  private workspacePath;
-  private workspaceLabel;
-  private nameSlug;
-  /** P0-B: 1 Engagement = 1 persistent container (engagementId × profile). */
-  private engagementContainers;
-  private readonly inflight;
-  private constructor();
-  static open(options: DockerToolExecutorOptions): Promise<DockerToolExecutor>;
-  listBindings(): readonly DockerToolboxBinding[];
-  /** P0-B: expose the engagement container bindings (provenance + GC). */
-  listEngagementContainers(): readonly EngagementContainerBinding[];
-  /**
-   * P0-B: bind the trusted DSH workspace AFTER open (recovery path). The DSH
-   * session's header cwd — never ~/.dsh — is the /workspace mount source.
-   * Setting it late also updates the workspace label on the container.
-   */
-  setWorkspacePath(workspacePath: string | undefined): void;
-  /** P0-B: the current /workspace mount source (trusted DSH workspace). */
-  currentWorkspacePath(): string | undefined;
-  inspectRuntime(binding: DockerToolboxBinding): Promise<'running' | 'stopped' | 'missing' | 'unknown'>;
-  startRuntime(binding: DockerToolboxBinding): Promise<void>;
-  stopRuntime(binding: DockerToolboxBinding): Promise<void>;
-  cleanupRuntime(binding: DockerToolboxBinding): Promise<void>;
-  execute(context: ToolBackendExecutionContext): Promise<ToolBackendResult>;
-  cancel(executionId: string): Promise<ToolBackendCancelResult>;
-  /**
-   * P0-B Engagement CLOSED: stop + remove the managed container(s) for this
-   * Engagement and forget the bindings. Returns removed container ids.
-   */
-  closeEngagementContainers(): Promise<readonly string[]>;
-  /**
-   * P0-B explicit runtime reset: stop + remove + recreate the Engagement's
-   * managed container (next ensure re-creates it lazily).
-   */
-  resetEngagementContainer(): Promise<string | undefined>;
-  /**
-   * P0-B: DISPOSABLE execution smoke. Creates a transient container (no
-   * managed label, no persistent binding), runs `argv`, and ALWAYS removes it
-   * (PASS or FAIL). The global preflight uses this so it never leaves a
-   * long-running `sleep infinity` container behind. Persistent containers are
-   * created ONLY by ensureEngagementContainer (via execute).
-   */
-  runDisposableSmoke(input: {
-    readonly argv: readonly string[];
-    readonly cwd?: string;
-    readonly env?: Readonly<Record<string, string>>;
-    readonly timeoutMs?: number;
-  }): Promise<{
-    ok: boolean;
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    message?: string;
-  }>;
-  private toolboxIdFor;
-  private argvFor;
-}
-//#endregion
-//#region src/tools/mcp-registry.d.ts
-declare class InMemoryMcpServerRegistry {
-  private readonly servers;
-  constructor(servers?: readonly McpServerDefinition[]);
-  get(id: McpServerId): McpServerDefinition | undefined;
-  list(): readonly McpServerDefinition[];
-}
-//#endregion
-//#region src/tools/mcp-backend.d.ts
-interface McpToolBackend extends ToolBackend {
-  readonly kind: 'mcp';
-}
-interface McpTransportCall {
-  readonly serverId: McpServerId;
-  readonly remoteToolName: string;
-  readonly arguments: unknown;
-  readonly replay: boolean;
-}
-interface McpTransport {
-  call(input: McpTransportCall): Promise<{
-    result: unknown;
-    text?: string;
-  }>;
-  reconnect?(serverId: McpServerId): Promise<void>;
-}
-interface McpToolExecutorOptions {
-  readonly engagementDir: string;
-  readonly engagementId: EngagementId;
-  readonly transport: McpTransport;
-  readonly catalog?: ToolCatalog;
-  readonly registry?: InMemoryMcpServerRegistry;
-}
-declare class McpToolExecutor implements McpToolBackend {
-  readonly kind: "mcp";
-  executeCalls: number;
-  cancelCalls: number;
-  lastContext?: ToolBackendExecutionContext;
-  lastRuntimeId?: string;
-  private readonly engagementId;
-  private readonly transport;
-  private readonly catalog;
-  private readonly registry;
-  private bindings;
-  private seq;
-  private constructor();
-  static open(options: McpToolExecutorOptions): Promise<McpToolExecutor>;
-  listBindings(): readonly McpRuntimeBinding[];
-  restoreRuntime(binding: McpRuntimeBinding): Promise<void>;
-  execute(context: ToolBackendExecutionContext): Promise<ToolBackendResult>;
-  cancel(_executionId: string): Promise<ToolBackendCancelResult>;
-}
-//#endregion
-//#region src/host/seed.d.ts
-interface DevSeed {
-  readonly engagement: EngagementStateStore;
-  readonly ptes: DurablePtesCoreStore;
-  readonly broker: ToolBroker;
-  readonly bindings: HarnessSessionBinding[];
-  loadModel(): CanonicalReadModel;
-}
-//#endregion
-//#region src/host/runtime.d.ts
-interface HostEngagementSource {
-  readonly engagementId: EngagementId;
-  loadModel(): CanonicalReadModel;
-  readonly broker: Pick<ToolBroker, 'approve' | 'reject' | 'listPending' | 'getCall'>;
-  readonly orchestratorSessions: Readonly<Record<string, EngagementId>>;
-  readEvidence(evidenceId: EvidenceId): Promise<{
-    readonly text?: string;
-    readonly mediaType?: string;
-    readonly error?: string;
-  }>;
-}
-interface HostSession {
-  readonly id: string;
-  readonly header?: {
-    readonly agentPreset?: string;
-    readonly parentSession?: string;
-    readonly cwd?: string;
-  };
-  append: (type: string, data: Record<string, unknown>) => unknown;
-}
-interface HostContext {
-  readonly sessionProjections: {
-    register: (definition: {
-      key: string;
-      schema: unknown;
-      init: () => unknown;
-      apply: (state: unknown, event: unknown) => unknown;
-      view: (state: unknown) => unknown;
-      stateVersion: number;
-    }) => () => void;
-  };
-  commands?: {
-    register: (definition: {
-      name: string;
-      description: string;
-      handler: (invocation: {
-        agent: {
-          session: HostSession;
-        };
-        rawInput: string;
-      }) => Promise<{
-        kind: 'success' | 'error';
-        text?: string;
-      }> | {
-        kind: 'success' | 'error';
-        text?: string;
-      };
-    }) => () => void;
-  };
-  on?: (event: string, listener: (...args: unknown[]) => void) => () => void;
-  /**
-   * P0-1: durable DSH workspace registry (archivedSessionIds).
-   *
-   * OPTIONAL service — read it through the non-strict reflect accessor
-   * (`ctx.get('workspaceRegistry', false)`), never as a direct property:
-   * Cordis's context proxy throws "cannot get property ... without inject"
-   * for any service not declared in the enclosing callback's inject list,
-   * so even a `=== undefined` guard on a direct access crashes when the
-   * assembly does not inject the service.
-   */
-  workspaceRegistry?: {
-    readonly archivedSessionIds: readonly string[];
-  };
-}
-/**
- * P0-1: called by the host when a Root Session is archived so the plugin can
- * detach it from its Engagement (and archive the Engagement when empty).
- */
-type SessionArchivedHook = (sessionId: string) => Promise<void> | void;
-declare class PentesterHostRuntime {
-  readonly publisher: PentesterProjectionPublisher;
-  readonly sessions: Map<string, HostSession>;
-  private seed;
-  private readonly sources;
-  private tickSeq;
-  /**
-   * Host-enforced Environment Readiness Gate hook: invoked when a Pentester
-   * session activates. The plugin registers this to run the global preflight
-   * and emit pentester/environment-preflight-* events into the session log.
-   */
-  onSessionActivated?: (session: HostSession) => Promise<void> | void;
-  /**
-   * P0-1: invoked when a Root Session is archived (DSH workspace registry
-   * reports it). The plugin detaches the session from its Engagement and
-   * archives the Engagement when no active Root remains.
-   */
-  onSessionArchived?: SessionArchivedHook;
-  /** Track the last-seen archived set (P0-1 archive detection). */
-  private lastArchivedSessionIds;
-  /** Next tick sequence (used by context injection command ids). */
-  nextTickSeq(): number;
-  bindSource(source: HostEngagementSource): void;
-  /** Re-publish one composition's canonical bundle (after a canonical mutation). */
-  publishComposition(composition: PentesterComposition): void;
-  /** Append a projection-invalidation tick for one session (canonical changed). */
-  tickSession(sessionId: string, name: 'pentester-sync' | 'pentester-attach'): void;
-  start(options: {
-    readonly devSeed: boolean;
-    readonly parentDir?: string;
-    readonly seed?: DevSeed;
-  }): Promise<void>;
-  registerProjections(ctx: HostContext): void;
-  registerCommands(ctx: HostContext): void;
-  listenSessions(ctx: HostContext): void;
-  private ctx;
-  /**
-   * P0-1: diff the DSH archived-session set against the last seen one and
-   * fire `onSessionArchived` for each newly archived session.
-   */
-  checkArchivedSessions(): Promise<void>;
-  /** Non-strict reflect read of the optional workspace registry (absent → undefined). */
-  private workspaceRegistryOf;
-  private reconcileArchived;
-  private attached;
-  private readonly engagementBySession;
-  private isAttached;
-  private isPentesterRootSession;
-  /** Bind a Harness session to an Engagement. Override is for tests / multi-engagement isolation. */
-  bindSessionEngagement(sessionId: string, engagementId: EngagementId): void;
-  /** P0-1: unbind a session from its Engagement (Session archived). */
-  unbindSessionEngagement(sessionId: string): void;
-  hasSeed(): boolean;
-  listPending(): PendingToolCall[];
-  seedEngagementId(): EngagementId | undefined;
-  seedPrimaryRunId(): AgentRunId | undefined;
-  attachSession(session: HostSession): Promise<{
-    kind: 'success';
-    text: string;
-  }>;
-  dispatch(sessionId: string, command: PentesterCommand): Promise<PentesterCommandResult>;
-  private asCommandResult;
-  private liveSource;
-  private isRootPentesterAttached;
-  private dispatchFromSlash;
-  private dispatchSeed;
-  readEvidence(evidenceId: string): Promise<{
-    readonly text?: string;
-    readonly mediaType?: string;
-    readonly error?: string;
-  }>;
-  openConversation(agentRunId: string): Promise<PentesterCommandResult>;
-  private tick;
-}
-//#endregion
-//#region src/runtime/wakeup-bridge.d.ts
-/**
- * P0-A ParentWakeupDispatcher.
- *
- * A Worker's terminal PTAP (or the Worker Finalizer) produces a canonical
- * task.completed / task.blocked / task.failed store event AND a durable
- * ParentWakeupRecord in the same commit window. This dispatcher turns that
- * record into a REAL parent continuation:
- *
- *   1. inject a deterministic plugin-origin user message into the parent's
- *      DSH inbox (source.kind='plugin', plugin='dsh-pentester') — NEVER the
- *      Worker's prose, only the terminal delta;
- *   2. schedule/resume the parent Agent so a NEW turn starts (the parent is
- *      normally idle after its own turn/end; `agent.followup` wakes it).
- *
- * State machine: pending → delivering → delivered | failed_retryable.
- * Idempotency: (parentSessionId, terminalEventId) is the durable key; the
- * outbox dedupes inserts and the dispatcher only delivers records not yet
- * marked delivered. Startup recovery re-scans pending/failed_retryable
- * records so a crash never loses a terminal notification.
- */
-/** The DSH-native continuation seam (live agent handle). */
-interface ParentAgentHandle {
-  /** Deliver one user-role message to the next-turn inbox AND wake the driver. */
-  followup(message: {
-    readonly id: string;
-    readonly role: 'user';
-    readonly content: readonly [{
-      readonly type: 'text';
-      readonly text: string;
-    }];
-    readonly source: {
-      readonly kind: 'plugin';
-      readonly plugin: 'dsh-pentester';
-    };
-  }): void;
-}
-interface ParentWakeupDispatcherDeps {
-  /** Resolve the parent Orchestrator HostSession for a record. */
-  resolveParentSession: (input: {
-    readonly engagementId: EngagementId;
-    readonly taskId: TaskId;
-    readonly agentRunId: AgentRunId;
-    readonly parentSessionId: string;
-  }) => HostSession | undefined;
-  /**
-   * Resolve the live DSH agent handle for the parent session. `undefined`
-   * means the parent is not currently live — the record stays pending and a
-   * later dispatch/retry picks it up.
-   */
-  resolveParentAgent: (parentSessionId: string) => ParentAgentHandle | undefined;
-  /** Test/embedding hook: called INSTEAD of the native followup when no agent resolves. */
-  continueParentFallback?: (session: HostSession, record: ParentWakeupRecord) => Promise<void> | void;
-  /** Diagnostics / audit sink. */
-  log?: (event: string, detail?: unknown) => void;
-}
-declare class ParentWakeupDispatcher {
-  private deps;
-  constructor(deps: ParentWakeupDispatcherDeps);
-  /** Replace the deps (composition default → host-installed live deps). */
-  install(deps: ParentWakeupDispatcherDeps): void;
-  /**
-   * Create the durable wakeup intent (called inside the terminal transition
-   * window) and dispatch immediately. Returns the record.
-   */
-  notify(outbox: ParentWakeupOutbox, info: TaskTerminalInfo, childSessionId: string, parentSessionId: string): Promise<ParentWakeupRecord>;
-  /**
-   * Dispatch one pending record: inject the inbox message + schedule the
-   * parent continuation. Returns true when delivered.
-   */
-  dispatch(outbox: ParentWakeupOutbox, record: ParentWakeupRecord): Promise<boolean>;
-  /**
-   * P0-A startup recovery: re-dispatch every pending/failed_retryable record.
-   * Called by the plugin host after compositions + sessions are live so a
-   * crash between terminal transition and delivery never loses the wakeup.
-   */
-  recoverPending(outbox: ParentWakeupOutbox): Promise<number>;
-}
-//#endregion
-//#region src/runtime/docker-endpoint.d.ts
-/**
- * Docker endpoint resolution — NEVER hard-codes a single socket path.
- *
- * Priority (first hit wins):
- *   1. plugin config `dockerSocket` (explicit operator choice)
- *   2. `DOCKER_HOST` env (standard Docker override)
- *   3. configured Docker runtime/context (`docker context inspect` current)
- *   4. platform default:
- *        macOS → OrbStack socket if present (~/.orbstack/run/docker.sock)
- *        macOS → ~/.docker/run/docker.sock (Docker Desktop) if present
- *        Linux → /var/run/docker.sock
- *
- * All discovery is read-only (fs stat / docker context inspect).
- */
-type DockerEndpointSource = 'plugin_config' | 'docker_host' | 'docker_context' | 'platform_default';
-interface ResolvedDockerEndpoint {
-  readonly socketPath: string;
-  readonly source: DockerEndpointSource;
-}
-//#endregion
-//#region src/runtime/environment-gate.d.ts
-/**
- * Pentester Environment Readiness Gate.
- *
- * A deterministic GLOBAL preflight that must pass before a Pentester Session
- * enters normal workflow (bootstrap / stage transition / create_task / spawn /
- * execution). Every check is READ-ONLY — no target traffic, no state mutation.
- *
- * The Host enforces the gate; it is never the model's responsibility to call
- * a "check" tool. A failed gate blocks the corresponding action and returns
- * typed diagnostics with `executionRetryable` / `recoverable` semantics.
- */
-type EnvironmentStatus = 'checking' | 'ready' | 'blocked';
-type EnvironmentCheckCode = 'ENVIRONMENT_NOT_READY' | 'AGENTS_SERVICE_UNAVAILABLE' | 'DOCKER_RUNTIME_UNAVAILABLE' | 'FACTORY_IMAGE_UNAVAILABLE' | 'WORKSPACE_UNAVAILABLE' | 'WORKER_TOOL_MISSING' | 'WORKER_COMMAND_MISSING';
-interface EnvironmentDiagnostic {
-  readonly code: EnvironmentCheckCode;
-  readonly message: string;
-  /** False for deterministic contract/environment failures — do NOT let the
-   *  model retry the same call immediately. */
-  readonly executionRetryable: false;
-  /** True when the environment condition may resolve (daemon starts, image
-   *  gets built) — the HOST may re-run the gate later. */
-  readonly recoverable: boolean;
-}
-interface GlobalEnvironmentState {
-  readonly status: EnvironmentStatus;
-  readonly checkedAt: string;
-  readonly generation: number;
-  readonly diagnostic?: EnvironmentDiagnostic;
-  /** True when every check passed and the state is cached for reuse. */
-  readonly ready: boolean;
-}
-interface GlobalEnvironmentChecks {
-  /** DSH project workspace path resolved & existing on disk. */
-  readonly workspacePath: string;
-  /** Whether the agents/subagent service is available (native or injected). */
-  readonly agentsServiceAvailable: boolean;
-  /** Whether container_exec (and exec tools) are registered model-facing. */
-  readonly execToolsRegistered: readonly string[];
-  /** Docker endpoint + engine (reached via resolver; NOT hard-coded). */
-  readonly endpoint: ResolvedDockerEndpoint;
-  readonly engine: DockerEngineClient;
-  /** Factory image ref to resolve (e.g. dsh-pentester/kali:latest). */
-  readonly factoryImage: string;
-  /** Whether the approval runtime (Tool Broker pending-approval) is available. */
-  readonly approvalRuntimeAvailable: boolean;
-  /** Whether the role-based tool registration is valid (templates resolve). */
-  readonly roleToolRegistrationValid: boolean;
-  /** Whether PTAP contracts/schemas are loaded. */
-  readonly ptapContractsLoaded: boolean;
-  /**
-   * Optional execution round-trip smoke runner. When provided, the gate runs a
-   * no-target, no-network smoke command through the SAME production chain the
-   * Worker uses (resolver → container → binding → Broker → Executor → result
-   * adapter → lossless JSON). Failure ⇒ ENVIRONMENT_NOT_READY.
-   */
-  readonly runExecutionSmoke?: () => Promise<ExecutionSmokeResult>;
-}
-interface ExecutionSmokeResult {
-  readonly ok: boolean;
-  readonly code?: 'EXECUTION_RUNTIME_UNAVAILABLE' | 'EXECUTION_CONTAINER_UNAVAILABLE' | 'EXECUTION_RESULT_SERIALIZATION_FAILED' | 'EXECUTION_SMOKE_TEST_FAILED';
-  readonly message?: string;
-  readonly stdout?: string;
-}
-/**
- * Run the GLOBAL environment gate. Returns a cached READY state when the last
- * check passed; re-runs when the previous state is not ready or is stale.
- */
-declare class PentesterEnvironmentGate {
-  private state;
-  private generation;
-  /** Invalidate the cached READY state (Docker/runtime changed). */
-  invalidate(): void;
-  cached(): GlobalEnvironmentState | undefined;
-  /** Force a full re-check (used by tests / after a runtime change). */
-  recheck(checks: GlobalEnvironmentChecks, now?: string): Promise<GlobalEnvironmentState>;
-  ensure(checks: GlobalEnvironmentChecks, now?: string): Promise<GlobalEnvironmentState>;
-}
-//#endregion
-//#region src/workflow/facts.d.ts
-interface WorkflowFactsProvider {
-  getFacts(input: {
-    engagementId: EngagementId;
-    state: EngagementStateSnapshot;
-  }): Promise<WorkflowFacts>;
-}
-//#endregion
-//#region src/workflow/engine.d.ts
-declare class WorkflowEngine {
-  private readonly store;
-  private readonly facts;
-  constructor(store: EngagementStateStore, facts?: WorkflowFactsProvider);
-  evaluateExitCriteria(engagementId: EngagementId, stageId: StageId): Promise<ExitCriteriaEvaluation>;
-  requestTransition(request: WorkflowTransitionRequest): Promise<WorkflowTransitionResult>;
-}
-//#endregion
-//#region src/context/delivery-state.d.ts
-interface ContextDeliveryStateStore {
-  get(agentRunId: AgentRunId): Promise<ContextDeliveryState | undefined>;
-  recordDelivery(agentRunId: AgentRunId, itemIds: readonly string[], refIds: readonly string[], constraintFingerprint?: string): Promise<void>;
-}
-//#endregion
-//#region src/context/errors.d.ts
-declare class ContextBuildError extends Error {
-  readonly code: ContextBuildErrorCode;
-  constructor(code: ContextBuildErrorCode, message: string);
-}
-type ContextBuildResult<T> = {
-  readonly ok: true;
-  readonly value: T;
-} | {
-  readonly ok: false;
-  readonly error: ContextBuildError;
-};
-//#endregion
-//#region src/context/providers.d.ts
-interface ContextCandidate {
-  readonly id: string;
-  readonly kind: 'asset' | 'artifact' | 'finding' | 'evidence' | 'related_task' | 'guidance';
-  readonly source: ContextSource;
-  readonly summary?: string;
-  readonly text?: string;
-  readonly mediaType?: string;
-  readonly producedByTaskId?: TaskId;
-  readonly assetIds?: readonly string[];
-  readonly findingIds?: readonly string[];
-  readonly stageId?: StageId;
-  readonly targetTaskId?: TaskId;
-  readonly targetAgentRunId?: AgentRunId;
-  readonly createdAt: number;
-  readonly sizeBytes?: number;
-}
-interface ContextDataProvider {
-  getAssets(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-  getArtifacts(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-  getFindings(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-  getEvidence(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-  getRelatedTasks(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-  getUserGuidance(snapshot: EngagementStateSnapshot): Promise<readonly ContextCandidate[]>;
-}
-//#endregion
-//#region src/context/builder.d.ts
-interface TemplateLookup {
-  get(id: AgentTemplateId): AgentTemplate | undefined;
-}
-interface ContextBuilderDeps {
-  readonly data: ContextDataProvider;
-  readonly templates: TemplateLookup;
-  readonly delivery: ContextDeliveryStateStore;
-  readonly budget?: ContextBudget;
-  readonly now?: () => string;
-}
-interface ContextBuildRequest {
-  readonly snapshot: EngagementStateSnapshot;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly agentTemplateId: AgentTemplateId;
-  readonly explicitRefs?: readonly ExplicitContextRef[];
-  readonly taskConstraints?: readonly ContextConstraint[];
-}
-declare class ContextBuilder {
-  private readonly data;
-  private readonly templates;
-  private readonly delivery;
-  private readonly budget;
-  private readonly now;
-  constructor(deps: ContextBuilderDeps);
-  buildForSpawn(request: ContextBuildRequest): Promise<ContextBuildResult<TaskContextBundle>>;
-  buildForContinue(request: ContextBuildRequest): Promise<ContextBuildResult<TaskContextDelta>>;
-  recordDelivery(agentRunId: AgentRunId, items: readonly ContextItem[], constraints?: readonly ContextConstraint[]): Promise<void>;
-  private buildBundle;
-  private loadMandatory;
-  private collect;
-}
-//#endregion
-//#region src/orchestrator/controller.d.ts
-interface OrchestratorControllerDeps {
-  readonly store: EngagementStateStore;
-  readonly engine: WorkflowEngine;
-  readonly reasoning: OrchestratorAgentRuntime;
-  readonly templates: AgentTemplateRegistry;
-  readonly agentRuns: AgentRunRuntime;
-  readonly produced: ProducedDataSink;
-  readonly outbound: PtapOutbound;
-  readonly audit: AuditSink;
-  readonly toolboxGrants?: ToolboxGrantStore;
-  /** Effective Global Config source (Stage Agent policies + Agent entities). */
-  readonly config?: EffectiveConfigSource;
-  /**
-   * P0-A Parent Wakeup Bridge sink: receives the deterministic TerminalInfo
-   * for every canonical task.completed/blocked/failed so the host can wake the
-   * parent Orchestrator session exactly once.
-   */
-  readonly terminalSink?: (info: TaskTerminalInfo) => Promise<void> | void;
-  /** P0-3/P0-5: cancel in-flight tool calls for one AgentRun (broker). */
-  readonly cancelAgentRunCalls?: (agentRunId: AgentRunId) => Promise<number>;
-}
-/** Async source of the Effective Pentester Config (the store is async + cached). */
-interface EffectiveConfigSource {
-  resolve(): Promise<EffectivePentesterConfig>;
-}
-declare class OrchestratorController {
-  private readonly store;
-  private readonly engine;
-  private readonly reasoning;
-  private readonly templates;
-  private readonly agentRuns;
-  private readonly produced;
-  private readonly outbound;
-  private readonly audit;
-  private readonly toolboxGrants?;
-  private readonly config?;
-  private readonly terminalSink?;
-  private readonly cancelAgentRunCalls?;
-  private chain;
-  private draining;
-  private readonly pending;
-  private readonly progress;
-  private readonly attempts;
-  private readonly pendingDelegates;
-  readonly pendingCapabilities: Set<string>;
-  private readonly pendingCapabilityRecords;
-  lastWorkflowResult?: WorkflowTransitionResult;
-  readonly decisionResults: OrchestratorDecisionResult[];
-  constructor(deps: OrchestratorControllerDeps);
-  getProgress(agentRunId: AgentRunId): RuntimeProgress | undefined;
-  notifyEngagementCreated(): Promise<void>;
-  notifyUserMessage(): Promise<void>;
-  notifyRecovered(): Promise<void>;
-  steerAgentRun(agentRunId: AgentRunId, message: string): Promise<OrchestratorDecisionResult>;
-  handlePtapEvent(input: unknown): Promise<{
-    woke: boolean;
-  }>;
-  private handleValidatedPtap;
-  private handleTaskFailed;
-  /** Deliver the deterministic TerminalInfo to the Parent Wakeup Bridge sink. */
-  private emitTerminal;
-  private handleCapabilityRequested;
-  private enqueueWake;
-  private drain;
-  applyDecision(raw: unknown, engagementId: EngagementId): Promise<OrchestratorDecisionResult>;
-  private executeDecision;
-  private applyCreateTask;
-  /** Resolve the effective Agent entity for an immutable AgentRun snapshot. */
-  private snapshotForAgent;
-  private applyContinue;
-  /**
-   * P0-3/P0-5: user-initiated Task cancel. Resolves the target Task (explicit
-   * taskRef, or the current running Task), cancels the Worker's live AgentRun
-   * (native session cancel), cancels in-flight tool calls via the broker, marks
-   * Task + AgentRun `cancelled` (reason user_requested — NEVER failed), keeps
-   * already-produced artifacts/evidence/findings, emits the canonical
-   * terminal event, and wakes the parent Orchestrator.
-   */
-  private applyCancelTask;
-  private applyStageTransition;
-  private applyDelegate;
-  private applyCapabilityResponse;
-  private persistToolboxGrant;
-  /**
-   * Auto-grant every Toolbox the Template is allowed to use. Normal Workers
-   * never negotiate capabilities for their own execution tools — the Template
-   * decides model-facing tools (resolveWorkerTools) and the grants that back
-   * them. ptap_request_capability stays for extra escalation only.
-   */
-  private grantTemplateToolboxes;
-}
-//#endregion
-//#region src/harness/errors.d.ts
-type AgentRuntimeFailureKind = 'transport' | 'session_unavailable' | 'session_terminated' | 'configuration' | 'tool_runtime' | 'invalid_output' | 'cancelled' | 'unknown';
-type RuntimeRetryHint = 'transient' | 'permanent' | 'unknown';
-interface AgentRuntimeFailure {
-  readonly kind: AgentRuntimeFailureKind;
-  readonly retryHint: RuntimeRetryHint;
-  readonly message: string;
-}
-//#endregion
-//#region src/harness/outcome.d.ts
-type HarnessSessionStatus = 'resumable' | 'running' | 'terminated' | 'unavailable' | 'unknown';
-type AgentRuntimeOutcome = {
-  readonly status: 'accepted';
-  readonly observation?: 'turn_finished_without_terminal_event' | 'turn_kicked_in_background';
-} | {
-  readonly status: 'failed';
-  readonly failure: AgentRuntimeFailure;
-};
-//#endregion
-//#region src/harness/client.d.ts
-interface CreateSessionInput {
-  readonly instructions: string;
+  readonly systemPrompt: string;
+  readonly skills: readonly string[];
+  readonly mcpServers: readonly string[];
   readonly model?: string;
-  readonly provider?: string;
-  /** The Root Orchestrator Session this worker is a child of (official subagent parentage). */
-  readonly parentSessionId?: string;
-  /** Trusted workspace/cwd inherited from the Root Session. */
-  readonly cwd?: string;
-  /** Composition identity (pentester-mode). */
-  readonly agentPreset?: string;
-  /** Stable display label for the native subagent dropdown (e.g. "Recon · 192.168.107.5"). */
-  readonly workerLabel?: string;
-  readonly skillIds: readonly string[];
-  readonly mcpIds: readonly string[];
-  /** The complete worker allow-list. Host setup must not add orchestration tools. */
-  readonly toolNames: readonly string[];
-  readonly onToolCall?: (name: string, args: Record<string, unknown>) => Promise<void>;
-  /**
-   * P0-A: invoked when the Worker's DSH turn/end settles (native `whenIdle`,
-   * fake startTurn completion). The adapter runs the Worker Finalizer from it
-   * so a Worker that ends without a terminal PTAP never leaves the Task
-   * running/starting forever.
-   */
-  readonly onTurnSettled?: (sessionId: string) => Promise<void> | void;
-}
-interface HarnessSession {
-  readonly sessionId: string;
-}
-interface HarnessClient {
-  createSession(input: CreateSessionInput): Promise<HarnessSession>;
-  /** Materialize a cold persisted session before continuation. */
-  resumeSession?(sessionId: string, input: CreateSessionInput): Promise<HarnessSession>;
-  appendContext(sessionId: string, text: string): Promise<void>;
-  /** Start exactly one foreground agent turn and wait for its activity to settle. */
-  startTurn(sessionId: string): Promise<AgentRuntimeOutcome>;
-  /**
-   * Kick a Worker turn without blocking until it completes (async lifecycle).
-   * Used by spawn so `create_task` returns as soon as the Worker is started.
-   * Completion / failure reaches the Orchestrator through PTAP events.
-   */
-  kickTurn?(sessionId: string): Promise<void>;
-  steer(sessionId: string, instruction: string): Promise<void>;
-  cancel(sessionId: string): Promise<void>;
-  inspect(sessionId: string): Promise<HarnessSessionStatus>;
-  /** Deliver controller data as a trusted internal message when supported. */
-  deliverCommand?(sessionId: string, command: PtapCommand): Promise<void>;
-}
-//#endregion
-//#region src/harness/launch-spec.d.ts
-interface HarnessTemplateSpec {
-  readonly id: AgentTemplateId;
-  readonly role: string;
-  readonly model?: string;
-  readonly provider?: string;
-}
-interface HarnessSkillRef {
-  readonly id: string;
-}
-interface HarnessMcpServerRef {
-  readonly id: string;
-}
-interface HarnessAgentLaunchSpec {
-  readonly engagementId: EngagementId;
-  readonly stageId: StageId;
-  readonly taskId: TaskId;
-  readonly agentRunId: AgentRunId;
-  readonly template: HarnessTemplateSpec;
-  readonly skills: readonly HarnessSkillRef[];
-  readonly mcpServers: readonly HarnessMcpServerRef[];
-  readonly context: TaskContextBundle | TaskContextDelta;
-  /** Root Orchestrator Session this worker is a child of (official subagent parentage). */
-  readonly parentSessionId?: string;
-  /** Trusted workspace/cwd inherited from the Root Session. */
-  readonly cwd?: string;
-  /** Composition identity (pentester-mode). */
-  readonly agentPreset?: string;
-  /** Stable display label for the native subagent dropdown. */
-  readonly workerLabel?: string;
-  /**
-   * The Worker's model-facing tool allowlist, resolved from the Template via
-   * resolveWorkerTools. The ONLY source for request/header tool assembly —
-   * never inferred from prompt text or capabilities.
-   */
-  readonly toolNames: readonly string[];
-}
-//#endregion
-//#region src/harness/ptap-tool-handler.d.ts
-interface PtapEventSink {
-  handle(message: PtapEvent): Promise<void>;
-}
-//#endregion
-//#region src/harness/contract-breaker.d.ts
-interface ContractFailureSignature {
-  readonly tool: string;
-  readonly code: string;
-  readonly path?: string;
-}
-interface ContractBreakerState {
-  readonly signature: ContractFailureSignature;
-  readonly attempts: number;
-  readonly lastPayload?: unknown;
-}
-declare class ContractBreaker {
-  private readonly byRun;
-  private readonly threshold;
-  constructor(threshold?: number);
-  /** Record a deterministic contract failure; true when the breaker trips. */
-  record(agentRunId: AgentRunId, signature: ContractFailureSignature, lastPayload?: unknown): boolean;
-  /** Snapshot diagnostics for one run (for the failure report). */
-  snapshot(agentRunId: AgentRunId): readonly ContractBreakerState[];
-  reset(agentRunId: AgentRunId): void;
-}
-//#endregion
-//#region src/harness/runtime-events.d.ts
-type HarnessRuntimeEvent = {
-  readonly kind: 'session_terminated';
-  readonly agentRunId: AgentRunId;
-  readonly sessionId: string;
-} | {
-  readonly kind: 'session_unavailable';
-  readonly agentRunId: AgentRunId;
-  readonly sessionId?: string;
-} | {
-  readonly kind: 'transport_failure';
-  readonly agentRunId: AgentRunId;
-  readonly message: string;
-} | {
-  readonly kind: 'worker_diagnostics';
-  readonly agentRunId: AgentRunId;
-  /** Developer-observable runtime contract snapshot (never model-visible). */
-  readonly diagnostics: {
-    readonly templateId: string;
-    readonly sessionId: string;
-    readonly engagementBindingPresent: boolean;
-    readonly workspaceResolved: boolean;
-    readonly resolvedTools: readonly string[];
-    readonly executionTools: readonly string[];
-    readonly ptapTools: readonly string[];
-    readonly capabilities: readonly string[];
-    readonly preflightStatus: 'ok';
-  };
-};
-interface HarnessRuntimeEventSink {
-  handle(event: HarnessRuntimeEvent): Promise<void>;
-}
-//#endregion
-//#region src/harness/adapter.d.ts
-interface HarnessSteerInput {
-  readonly engagementId: EngagementId;
-  readonly agentRunId: AgentRunId;
-  readonly instruction: string;
-}
-interface HarnessCancelInput {
-  readonly agentRunId: AgentRunId;
-}
-interface HarnessAgentRuntime {
-  spawn(spec: HarnessAgentLaunchSpec): Promise<AgentRuntimeOutcome>;
-  continue(spec: HarnessAgentLaunchSpec): Promise<AgentRuntimeOutcome>;
-  steer(input: HarnessSteerInput): Promise<AgentRuntimeOutcome>;
-  cancel(input: HarnessCancelInput): Promise<AgentRuntimeOutcome>;
-  inspectSession(agentRunId: AgentRunId): Promise<HarnessSessionStatus>;
-  deliverPtapCommand(agentRunId: AgentRunId, command: PtapCommand): Promise<AgentRuntimeOutcome>;
 }
-interface HarnessAdapterDeps {
-  readonly client: HarnessClient;
-  readonly bindings: HarnessSessionBindingStore;
-  readonly delivery: ContextDeliveryStateStore;
-  readonly sink: PtapEventSink;
-  readonly runtimeEvents?: HarnessRuntimeEventSink;
-  /**
-   * P0-A Worker Finalizer: invoked when a Worker's DSH turn/end settles while
-   * its Task is still non-terminal. The host marks the Task failed/blocked
-   * with WORKER_TERMINATED_WITHOUT_TASK_TERMINAL — a plain turn/end never
-   * equals completion.
-   */
-  readonly onWorkerTurnSettled?: (spec: HarnessAgentLaunchSpec) => Promise<void> | void;
-}
-declare class HarnessAdapter implements HarnessAgentRuntime {
-  private readonly client;
-  private readonly bindings;
-  private readonly delivery;
-  private readonly sink;
-  private readonly runtimeEvents;
-  private readonly onWorkerTurnSettled?;
-  private readonly terminalByRun;
-  /** Runs whose turn settled and were already finalized (no double-finalize). */
-  private readonly finalizedByRun;
-  readonly invokedTools: string[];
-  /** Per-Worker deterministic contract-violation breaker. */
-  readonly contractBreaker: ContractBreaker;
-  constructor(deps: HarnessAdapterDeps);
-  spawn(spec: HarnessAgentLaunchSpec): Promise<AgentRuntimeOutcome>;
-  continue(spec: HarnessAgentLaunchSpec): Promise<AgentRuntimeOutcome>;
-  steer(input: HarnessSteerInput): Promise<AgentRuntimeOutcome>;
-  cancel(input: HarnessCancelInput): Promise<AgentRuntimeOutcome>;
-  inspectSession(agentRunId: AgentRunId): Promise<HarnessSessionStatus>;
-  deliverPtapCommand(agentRunId: AgentRunId, command: PtapCommand): Promise<AgentRuntimeOutcome>;
-  invokeWorkerTool(spec: HarnessAgentLaunchSpec, name: string, args: Record<string, unknown>): Promise<void>;
-  /**
-   * P0-A Worker Finalizer. A Worker's DSH turn/end is NEVER equivalent to
-   * Task completion: only a terminal PTAP (complete/blocked/fail) settles the
-   * Task. When a turn settles while the run has no terminal PTAP recorded,
-   * the host is notified via `onWorkerTurnSettled` so it can mark the Task
-   * failed/blocked deterministically (WORKER_TERMINATED_WITHOUT_TASK_TERMINAL)
-   * and wake the parent — the Task is never left running/starting forever.
-   *
-   * Idempotent per run: after the first finalize, further settle callbacks are
-   * no-ops (a continued run clears the flag on the next continue()).
-   */
-  finalizeTurn(spec: HarnessAgentLaunchSpec): Promise<void>;
-  /** Reset per-run finalize guard when a run is continued (new Task). */
-  private resetFinalize;
-  /**
-   * Emit developer-observable Worker runtime diagnostics (never model-visible):
-   * template, resolved tools, capabilities, bindings, workspace resolution.
-   */
-  private emitWorkerDiagnostics;
-  /**
-   * On circuit breaker trip: deliver a deterministic task.failed so the Task
-   * moves to failed with an actionable reason instead of looping.
-   */
-  private emitContractTrip;
-  /**
-   * Spawn path: deliver the TaskContextBundle, then kick the Worker turn
-   * WITHOUT blocking until completion (async lifecycle). The model turn runs
-   * in the background; completion/failure arrives via PTAP events.
-   */
-  private kickAndDeliver;
-  private deliverAndRun;
-  private sessionInput;
-  private getBinding;
-  private inspectBound;
-  private missing;
-  private failFrom;
-  private emit;
-}
-//#endregion
-//#region src/harness/session-binding-store.d.ts
-declare class FileHarnessSessionBindingStore implements HarnessSessionBindingStore {
-  readonly filePath: string;
-  constructor(engagementDir: string);
-  get(agentRunId: AgentRunId): Promise<HarnessSessionBinding | undefined>;
-  list(): Promise<readonly HarnessSessionBinding[]>;
-  bind(binding: HarnessSessionBinding): Promise<void>;
-  remove(agentRunId: AgentRunId): Promise<void>;
-  private readAll;
-  private writeAll;
-}
-//#endregion
-//#region src/harness/native-client.d.ts
-interface NativeAgent {
-  readonly id: string;
-  readonly status: 'idle' | 'running';
-  readonly options?: {
-    readonly model?: string;
-    readonly provider?: string;
-  };
-  readonly ctx: Context;
-  followup(message: NativeUserMessage): void;
-  inject(message: NativeUserMessage): void;
-  steer(message: NativeUserMessage): void;
-  cancel(cause: {
-    kind: string;
-    reason?: string;
-  }): void;
-  whenIdle(): Promise<void>;
-}
-interface NativeAgentHandle {
-  readonly agent: NativeAgent;
-  dispose(): Promise<void>;
-}
-interface NativeAgentRegistry {
-  create(input: {
-    sessionId: string;
-    agentOptions?: {
-      model?: string;
-      provider?: string;
-    };
-    meta?: {
-      cwd?: string;
-      parentSession?: string;
-      seedLength?: number;
-      origin?: 'subagent';
-      delegationDepth?: number;
-      agentPreset?: string;
-    };
-    setup?: (agentCtx: Context) => void | Promise<void>;
-  }): Promise<NativeAgentHandle>;
-  resume(input: {
-    resumeSessionId: string;
-    agentOptions?: {
-      model?: string;
-      provider?: string;
-    };
-    setup?: (agentCtx: Context) => void | Promise<void>;
-  }): Promise<NativeAgentHandle>;
-  get(sessionId: string): NativeAgent | undefined;
-}
-interface NativeSessionPersistence {
-  list(): Promise<readonly {
-    readonly id: string;
-  }[]>;
-}
-interface NativeHarnessContext extends Context {
-  readonly agents: NativeAgentRegistry;
-  readonly sessionPersistence?: NativeSessionPersistence;
-}
-interface NativeUserMessage {
-  readonly id: string;
-  readonly role: 'user';
-  readonly content: readonly [{
-    readonly type: 'text';
-    readonly text: string;
-  }];
-  readonly source: {
-    readonly kind: 'plugin';
-    readonly plugin: 'dsh-pentester';
-  };
-}
-//#endregion
-//#region src/runtime/composition.d.ts
-interface ComposeOptions {
-  readonly config?: unknown;
-  readonly engagementDir?: string;
-  readonly create?: {
-    readonly objectives: string;
-    readonly scopeSummary: string;
-    readonly targets: readonly {
-      readonly value: string;
-    }[];
-    readonly parentDir?: string;
-  };
-  readonly harnessClient?: HarnessClient;
-  readonly nativeCtx?: NativeHarnessContext;
-  readonly recover?: boolean;
-  /**
-   * Trusted DSH project working directory, bind-mounted to `/workspace` in
-   * every Toolbox container. Comes from the Host session header cwd — never
-   * from the model.
-   */
-  readonly workspacePath?: string;
-  /** Async Effective Global Config source (Stage policies + Agent entities). */
-  readonly globalConfig?: () => Promise<EffectivePentesterConfig>;
-}
-declare class PentesterComposition {
-  readonly config: RuntimeConfig;
-  readonly store: EngagementStateStore;
-  readonly ptes: DurablePtesCoreStore;
-  readonly broker: ToolBroker;
-  readonly controller: OrchestratorController;
-  readonly engine: WorkflowEngine;
-  readonly builder: ContextBuilder;
-  readonly adapter: HarnessAdapter;
-  readonly bindings: FileHarnessSessionBindingStore;
-  readonly grants: DurableToolboxGrantStore;
-  readonly templates: InMemoryAgentTemplateRegistry;
-  readonly audit: InMemoryAuditSink;
-  readonly outbound: InMemoryPtapOutbound;
-  orchestratorSessions: Record<string, EngagementId>;
-  readonly docker: DockerToolExecutor;
-  readonly mcp: McpToolExecutor;
-  readonly clientKind: 'native' | 'unavailable' | 'injected';
-  /** P0-A durable ParentWakeupOutbox (same commit window as terminal state). */
-  readonly wakeupOutbox: ParentWakeupOutbox;
-  /** P0-A ParentWakeupDispatcher (inbox injection + parent continuation). */
-  readonly wakeupDispatcher: ParentWakeupDispatcher;
-  private readonly client;
-  private bindingCache;
-  private rootSession?;
-  private constructor();
-  static open(options?: ComposeOptions): Promise<PentesterComposition>;
-  bindOrchestratorSession(sessionId: string, cwd?: string): void;
-  /**
-   * Rebuild the runtime template registry when the Global config changes.
-   * Running AgentRuns keep their immutable snapshot; only FUTURE create_task
-   * decisions / context assembly see the new Effective config.
-   */
-  refreshGlobalConfig(next: Promise<EffectivePentesterConfig>): void;
-  /**
-   * P0-1: detach an archived Root Orchestrator session from this Engagement.
-   * Removes it from the orchestrator-sessions map; clears the root session
-   * reference when it was the current root.
-   */
-  detachOrchestratorSession(sessionId: string): void;
-  /** The trusted Root Orchestrator session that owns this Engagement. */
-  rootOrchestratorSession(): {
-    readonly sessionId: string;
-    readonly cwd?: string;
-  } | undefined;
-  loadModel(): CanonicalReadModel;
-  /** agentRunId → has the Worker emitted any runtime activity yet (P1-9). */
-  private workerActivitySnapshot;
-  /** Host-enforced Environment Readiness Gate state (published to projection). */
-  private environmentState;
-  setEnvironmentState(state: EnvironmentProjection): void;
-  refreshBindings(): Promise<void>;
-  handleWorkerPtap(spec: HarnessAgentLaunchSpec, name: string, args: Record<string, unknown>): Promise<void>;
-  /**
-   * P0-A Worker Finalizer entry: a Worker's turn/end settled while its Task is
-   * still non-terminal. Marks the Task failed deterministically
-   * (WORKER_TERMINATED_WITHOUT_TASK_TERMINAL) and wakes the parent — a plain
-   * DSH turn/end NEVER equals completion. Idempotent at the store level (a
-   * Task already terminal is a no-op).
-   */
-  finalizeWorkerTurn(spec: HarnessAgentLaunchSpec): Promise<void>;
-  /**
-   * P0-A terminal handler: every canonical task.completed/blocked/failed
-   * creates the durable ParentWakeupRecord (same commit window as the store
-   * transition) and dispatches it. `childSessionId` / `parentSessionId` are
-   * resolved from the worker binding (the durable session→run mapping).
-   */
-  handleTaskTerminal(info: TaskTerminalInfo): Promise<void>;
-  /**
-   * Install the real ParentWakeupDispatcher deps (host-owned session map +
-   * native agent continuation). Called by the plugin host after the session
-   * environment is live. Also re-dispatches any pending records from a crash.
-   */
-  installWakeupDeps(deps: ParentWakeupDispatcherDeps): void;
-  /** P0-A startup recovery: re-dispatch pending wakeup records. */
-  recoverPendingWakeups(): Promise<number>;
-  /** Durable outbox records (diagnostics / tests). */
-  wakeupRecords(): readonly ParentWakeupRecord[];
-  decide(raw: unknown): Promise<OrchestratorDecisionResult>;
-  command(sessionId: string, command: PentesterCommand): Promise<PentesterCommandResult>;
-  invokeBroker(request: Omit<ToolCallRequest, 'engagementId' | 'taskId' | 'agentRunId'> & {
-    readonly taskId?: ToolCallRequest['taskId'];
-    readonly agentRunId?: ToolCallRequest['agentRunId'];
-  }): Promise<ToolExecuteResult>;
-  brokerToolId(name: string): ToolId | undefined;
-  buildReportDraft(draft: unknown): Promise<ReportBuildResult>;
-  overview(): PentesterProjection;
-  /**
-   * P0-2/P0-B execution round-trip smoke: run `printf dsh-pentester-preflight-ok`
-   * through the SAME production chain the Worker uses (resolver → factory
-   * container → exec → result adapter → lossless JSON). No target traffic —
-   * the command is inert.
-   *
-   * P0-B: the smoke uses DISPOSABLE execution — a transient container is
-   * created, the smoke runs, and it is ALWAYS removed (PASS or FAIL). It never
-   * creates a persistent engagement container. Persistent containers are
-   * created ONLY by ensureEngagementContainer (via docker.execute).
-   */
-  runExecutionSmoke(): Promise<ExecutionSmokeResult>;
-  engagementId(): EngagementId;
-  readEvidenceBytes(evidenceId: EvidenceId): Promise<{
-    error: "not_found";
-    record?: undefined;
-    bytes?: undefined;
-  } | {
-    record: EvidenceRecord;
-    bytes: Uint8Array<ArrayBufferLike>;
-    error?: undefined;
-  }>;
-  workerSpec(): HarnessAgentLaunchSpec;
-}
-//#endregion
-//#region src/runtime/register-dsh-tools.d.ts
-interface DshToolsService {
-  register(definition: {
-    name: string;
-    description: string;
-    parameters?: Record<string, unknown>;
-    output?: {
-      schema: unknown;
-      render?: (args: unknown, value: unknown) => unknown;
-    };
-    execute: (args: Record<string, unknown>, exec?: unknown) => Promise<unknown> | unknown;
-  }): unknown;
-}
-interface RegisteredToolCall {
-  readonly name: string;
-  readonly args: Record<string, unknown>;
-  readonly exec?: unknown;
-}
-//#endregion
-//#region src/runtime/workspace.d.ts
-/**
- * Trusted Host-side Workspace identity. The model can never override it:
- * it is derived from the session's durable `cwd` (Host-written SessionHeader),
- * canonicalized through realpath, and hashed so the raw absolute path never
- * leaks into model-visible output.
- *
- * `workspaceKey` is stable across Host restarts and symlink aliases (realpath
- * canonicalizes them). It is the discovery boundary key — NEVER an
- * authorization boundary for cross-Engagement data access.
- */
-type WorkspaceKey = string;
-//#endregion
-//#region src/config/global-config-store.d.ts
-/**
- * Durable, atomic, versioned Global Pentester Configuration store.
- *
- * This is GLOBAL product configuration — never stored inside an Engagement's
- * state / PTES Core / session log. Path: `$DSH_HOME/pentester-config.json`
- * (default `~/.dsh/pentester-config.json`) via the standard DSH home.
- */
-interface ConfigRevisionConflictError {
-  readonly code: 'config_revision_conflict';
-  readonly expectedRevision: number;
-  readonly actualRevision: number;
-}
-declare function dshHome(env?: string | undefined): string;
-declare function globalConfigPath(home?: string): string;
-declare function emptyGlobalConfig(): PentesterGlobalConfigV1;
-declare class PentesterGlobalConfigStore {
-  private readonly filePath;
-  private cache;
-  constructor(home?: string);
-  load(): Promise<PentesterGlobalConfigV1>;
-  save(config: PentesterGlobalConfigV1): Promise<void>;
-  /** Optimistic-concurrency guarded mutation. */
-  mutate(expectedRevision: number | undefined, fn: (config: PentesterGlobalConfigV1) => PentesterGlobalConfigV1): Promise<PentesterGlobalConfigV1>;
-}
-//#endregion
-//#region src/config/factory-defaults.d.ts
-/**
- * Factory Defaults — the version-controlled authoritative baseline for the
- * Global Pentester Configuration. Never edited by users; Global overrides
- * layer on top. Keep existing built-in IDs stable (tpl-recon etc.) so
- * persistence / tests / runtime bindings keep working.
- */
-declare const FACTORY_GLOBAL_CONFIG_SCHEMA_VERSION: 1;
-declare const FACTORY_AGENT_TEMPLATES: readonly AgentConfigEntity[];
-declare const FACTORY_SKILLS: readonly SkillConfigEntity[];
-declare const FACTORY_MCP_SERVERS: readonly McpConfigEntity[];
-declare const FACTORY_TOOLBOXES: readonly ToolboxConfigEntity[];
-/** Default Stage → allowed Agent mappings (Factory). */
-declare const FACTORY_STAGE_POLICIES: readonly StageAgentPolicy[];
-declare const FACTORY_AGENT_IDS: readonly AgentTemplateId[];
-declare const FACTORY_TOOLBOX_IDS: readonly ToolboxId[];
-declare const FACTORY_MCP_IDS: readonly McpServerId[];
-declare const FACTORY_SKILL_IDS: readonly SkillId[];
-//#endregion
-//#region src/config/validation.d.ts
-/**
- * Validate the persisted Global config. Returns a list of typed problems; an
- * empty list means the config is structurally valid. Reporting must always
- * have at least one enabled, valid Agent (cannot be skipped).
- */
-interface ConfigDiagnostic {
-  readonly severity: 'error' | 'warning';
-  readonly code: string;
-  readonly message: string;
-  readonly entityId?: string;
-}
-declare function validatePentesterGlobalConfig(config: PentesterGlobalConfigV1 | undefined, runtimeHints?: {
-  readonly mcpAvailable?: Readonly<Record<string, boolean>>;
-}): readonly ConfigDiagnostic[];
-declare function effectiveAgentsByStage(effective: EffectivePentesterConfig, stageKind: string): readonly AgentConfigEntity[];
-//#endregion
-//#region src/config/service.d.ts
-/**
- * Typed Global Config service — the Host face the Settings UI and runtime call.
- * All mutations go through the store (optimistic concurrency + atomic write),
- * bump `revision` on the saved entity, and re-validate before persisting.
- */
-type ConfigServiceResult<T> = {
-  readonly ok: true;
-  readonly value: T;
-} | {
-  readonly ok: false;
-  readonly error: string;
-  readonly code?: string;
-};
-declare class PentesterConfigService {
-  private readonly store;
-  constructor(store: PentesterGlobalConfigStore);
-  static open(home?: string): PentesterConfigService;
-  getGlobalConfig(): Promise<PentesterGlobalConfigV1>;
-  getEffective(): Promise<EffectivePentesterConfig>;
-  diagnostics(): Promise<readonly ConfigDiagnostic[]>;
-  saveAgent(entity: Omit<AgentConfigEntity, 'revision' | 'source'> & {
-    readonly source?: 'builtin' | 'custom';
-    readonly id: AgentTemplateId;
-  }, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    revision: number;
-    globalRevision: number;
-  }>>;
-  resetAgent(id: AgentTemplateId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  disableAgent(id: AgentTemplateId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  deleteAgent(id: AgentTemplateId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  /** Clone a built-in or custom Agent into a new custom entity (revision 1). */
-  duplicateAgent(id: AgentTemplateId, name: string, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    id: AgentTemplateId;
-    revision: number;
-    globalRevision: number;
-  }>>;
-  saveStagePolicy(stageKind: PtesStageKind, allowedAgentTemplateIds: readonly AgentTemplateId[], expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  resetStagePolicy(stageKind: PtesStageKind, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  restoreAllStageDefaults(expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  saveSkill(entity: Omit<SkillConfigEntity, 'revision' | 'source'> & {
-    readonly source?: 'builtin' | 'custom';
-    readonly id: SkillId;
-  }, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    revision: number;
-    globalRevision: number;
-  }>>;
-  duplicateSkill(id: SkillId, name: string, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    id: SkillId;
-    revision: number;
-    globalRevision: number;
-  }>>;
-  resetSkill(id: SkillId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  disableSkill(id: SkillId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  deleteSkill(id: SkillId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  saveMcp(entity: Omit<McpConfigEntity, 'revision' | 'source'> & {
-    readonly source?: 'builtin' | 'custom';
-    readonly id: McpServerId;
-  }, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    revision: number;
-    globalRevision: number;
-  }>>;
-  duplicateMcp(id: McpServerId, name: string, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    id: McpServerId;
-    revision: number;
-    globalRevision: number;
-  }>>;
-  resetMcp(id: McpServerId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  disableMcp(id: McpServerId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  deleteMcp(id: McpServerId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  saveToolbox(entity: Omit<ToolboxConfigEntity, 'revision' | 'source'> & {
-    readonly source?: 'builtin' | 'custom';
-    readonly id: ToolboxId;
-  }, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    revision: number;
-    globalRevision: number;
-  }>>;
-  duplicateToolbox(id: ToolboxId, name: string, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    id: ToolboxId;
-    revision: number;
-    globalRevision: number;
-  }>>;
-  resetToolbox(id: ToolboxId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  deleteToolbox(id: ToolboxId, expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  /**
-   * Restore Factory Defaults: clear built-in overrides + stage overrides.
-   * Custom objects are deliberately KEPT (per plan §84 — never one button
-   * deleting user MCP/Images).
-   */
-  restoreFactoryDefaults(expectedRevision: number | undefined): Promise<ConfigServiceResult<{
-    globalRevision: number;
-  }>>;
-  private mutate;
-}
-//#endregion
-//#region src/config/docker-image-service.d.ts
-type ImageRuntimeStatus = 'unknown' | 'available' | 'missing' | 'building' | 'pulling' | 'error';
-interface ImageRuntimeState {
-  readonly status: ImageRuntimeStatus;
-  readonly inspect?: DockerImageInspect;
-  readonly message?: string;
-}
-/**
- * Docker Image provisioning service. Derived runtime state is NEVER persisted
- * as canonical config (plan §67) — availability comes from live Docker engine
- * inspect. Pull / Build are explicit user actions; AgentRun start never
- * auto-pulls or auto-builds (plan §22-§23): runtime fails closed with
- * `image_unavailable` and points the user to Settings provisioning.
- */
-declare class DockerImageService {
-  private readonly engine;
-  constructor(engine: DockerEngineClient);
-  inspect(toolbox: ToolboxConfigEntity): Promise<ImageRuntimeState>;
-  pull(toolbox: ToolboxConfigEntity): Promise<ImageRuntimeState>;
-  build(toolbox: ToolboxConfigEntity): Promise<ImageRuntimeState>;
-}
-//#endregion
-//#region src/harness/worker-monitor.d.ts
-interface WorkerRuntimeStats {
-  readonly toolCalls: number;
-  readonly successfulExecutionCalls: number;
-  readonly validationFailures: number;
-  readonly deniedCalls: number;
-  readonly availableTools: readonly string[];
-}
-declare class WorkerRuntimeMonitor {
-  /** Keyed by the Worker Session id (stable per worker, host-side). */
-  private readonly byWorker;
-  recordToolCall(sessionId: string, kind: 'success' | 'contract' | 'denied', availableTools: readonly string[]): boolean;
-  snapshot(sessionId: string): WorkerRuntimeStats | undefined;
-  reset(sessionId: string): void;
-}
-//#endregion
-//#region src/runtime/plugin-host.d.ts
-/**
- * Typed Pre-engagement intake produced by the Orchestrator from user
- * answers. Never the raw conversation text.
- */
-interface EngagementBootstrapInput {
-  readonly name?: string;
-  readonly objectives: string;
-  readonly scopeSummary: string;
-  readonly targets: readonly {
-    readonly value: string;
-  }[];
-  readonly rulesOfEngagement?: string;
-  readonly credentialMode?: 'none' | 'provided' | 'collected';
-}
-interface EnsureEngagementResult {
-  readonly engagementId: EngagementId;
-  readonly created: boolean;
-}
-/** Lightweight candidate returned to the model for user selection (never business data). */
-interface EngagementCandidate {
-  readonly engagementId: string;
-  readonly displayName: string;
-  readonly currentStageId: string | null;
-  readonly workflowStatus: string;
-  readonly targetSummary: readonly string[];
-  readonly updatedAt?: string;
-}
-declare class PentesterPluginHost {
-  readonly compositions: Map<EngagementId, PentesterComposition>;
-  readonly ui: PentesterHostRuntime;
-  readonly config: RuntimeConfig;
-  readonly globalConfig: PentesterConfigService;
-  readonly dockerImages: DockerImageService;
-  /** Per-Worker stalled / no-execution detection. */
-  readonly workerMonitor: WorkerRuntimeMonitor;
-  /** Host-enforced Environment Readiness Gate (deterministic global preflight). */
-  readonly environmentGate: PentesterEnvironmentGate;
-  /** P0-6: deterministic runtime-contract failures (e.g. lossless-JSON) per Worker. */
-  private readonly runtimeContractFailures;
-  /** Test/embedding override: inject a fake engine + workspace to simulate a
-   *  ready environment (never used in production where the resolver runs). */
-  private testEngineOverride;
-  private testWorkspaceOverride;
-  private nativeCtx;
-  private harnessClient;
-  private rootBindings;
-  private workspaceRegistry;
-  constructor(ui: PentesterHostRuntime, config: RuntimeConfig);
-  /**
-   * Global environment preflight for an activated session. Emits real
-   * pentester/environment-preflight-* events into the session log so
-   * session.jsonl proves the gate ran BEFORE any workflow tool.
-   */
-  private runSessionPreflight;
-  /** Append a session-log event (writes session.jsonl via HostSession.append). */
-  private appendSessionEvent;
-  /** Resolve the Effective Global Config (async; cached by the store). */
-  resolveGlobalConfig(): Promise<EffectivePentesterConfig>;
-  /** Resolve an effective Toolbox entity by id (for image ops). */
-  resolveToolbox(id: string): Promise<ToolboxConfigEntity | undefined>;
-  /** Global Config event: future create_task decisions + context refresh. */
-  notifyConfigChanged(): Promise<void>;
-  /**
-   * Inject the CURRENT STAGE AGENT POLICY context into attached root sessions
-   * (plan §37, §79). Triggered on: stage transition, config change, recovery.
-   */
-  injectAvailableAgentsContext(effective?: EffectivePentesterConfig): Promise<void>;
-  /** Lazily open the durable Root binding store (created on first need). */
-  private bindings;
-  /** Lazily open the Workspace discovery registry (CASE B global root). */
-  private workspaces;
-  setNativeContext(ctx: NativeHarnessContext): void;
-  setHarnessClient(client: HarnessClient): void;
-  recoverExisting(): Promise<readonly PentesterComposition[]>;
-  /**
-   * P0-B: scan Docker for dsh.pentester.managed=true containers. Active
-   * Engagements keep their container (the executor rebinds on open); missing
-   * or CLOSED Engagements' containers are stopped+removed. Legacy
-   * 1-AgentRun=1-container leftovers are only cleaned when the Engagement
-   * directory is known; uncertain ownership is reported, never deleted.
-   */
-  private runStartupContainerGc;
-  createEngagement(input: {
-    readonly objectives: string;
-    readonly scopeSummary: string;
-    readonly targets: readonly {
-      readonly value: string;
-    }[];
-    readonly workspacePath?: string;
-  }): Promise<PentesterComposition>;
-  private readonly bootstrapChain;
-  private readonly lastCallerBySession;
-  /**
-   * Idempotent bootstrap: create a canonical Engagement for the given root
-   * Orchestrator Session, bind it durably, and return the same Engagement on
-   * retries / double submits. Concurrent calls for one Session serialize to a
-   * single canonical Engagement.
-   */
-  ensureEngagementForSession(input: {
-    readonly sessionId: string;
-    readonly intake: EngagementBootstrapInput;
-  }): Promise<EnsureEngagementResult>;
-  private ensureEngagementForSessionInner;
-  /** Resolve a root Orchestrator Session to an Engagement (durable Root binding store first). */
-  resolveEngagementForSession(sessionId: string): EngagementId | undefined;
-  /** Cache the caller for the current session so async create can bind with the trusted workspace. */
-  private lastCallerFor;
-  private rootBindingFor;
-  private rootBindingCache;
-  private loadRootBindings;
-  /**
-   * Discover Engagements belonging to the caller's Workspace discovery
-   * boundary. Lightweight candidates only — never business data. Archived
-   * Engagements (P0-1) are excluded from the default candidate list.
-   */
-  discoverCandidates(workspaceKey: WorkspaceKey): Promise<readonly EngagementCandidate[]>;
-  attach(composition: PentesterComposition): void;
-  /** Resolve the Root Orchestrator session id from a worker binding. */
-  private rootSessionIdFor;
-  registerCommands(ctx: HostContext): void;
-  registerTools(tools: DshToolsService): readonly string[];
-  executeRegisteredTool(call: RegisteredToolCall): Promise<unknown>;
-  /**
-   * P0-4: resolve the Worker's unresolved approval (if any) from the Broker's
-   * pending list. A Worker with a pending approval is suspended — no further
-   * tool calls dispatch, so at most one pending approval can exist per Worker.
-   */
-  private suspendedApprovalFor;
-  /**
-   * P0-6: count a deterministic runtime-contract failure for a Worker. The
-   * same signature (tool + code) reaching 2 trips the breaker — the model
-   * cannot fix a host serialization bug by retrying. Returns true when tripped.
-   */
-  private recordRuntimeContractFailure;
-  /** Stop a Worker after repeated runtime-contract failures (host bug, not model retry). */
-  private emitRuntimeContractStop;
-  /**
-   * P0-5/P0-A: true when the Worker's AgentRun is in `blocked` state. Terminal
-   * PTAP calls (complete/fail/block) are exempt so the Task can settle.
-   */
-  private workerRunBlocked;
-  private recordWorkerActivity;
-  /** True when the Worker is stalled (no progress, no execution, repeated failures). */
-  private workerStalled;
-  /** Emit a synthetic task.failed so a stalled Worker stops deterministically. */
-  private emitWorkerStalled;
-  /**
-   * Resolve Broker tool arguments with host-side identity, never model ids.
-   * container_exec: the model sends `{ argv }`; the host injects the Toolbox
-   * from the Worker Template AND converts to the internal broker DTO
-   * (`mode: argv`, `command`, `args`) so the Broker/docker backend sees a
-   * fully host-resolved request.
-   */
-  private resolveBrokerArguments;
-  /**
-   * Assemble and run the GLOBAL environment gate (host-enforced). READ-ONLY.
-   * Success is cached with generation/timestamp; invalidate() re-checks after
-   * Docker/runtime changes.
-   */
-  private assertEnvironmentReady;
-  /** P0-2 smoke runner installed by the host (runs the Broker chain). */
-  private executionSmokeRunner;
-  /**
-   * Install the execution round-trip smoke runner. The host composes it over
-   * the real Broker/Executor; it must resolve a container, exec the smoke
-   * command, and serialize the result lossless-JSON safe.
-   */
-  setExecutionSmokeRunner(runner: () => Promise<ExecutionSmokeResult>): void;
-  /**
-   * TEST-ONLY: inject an engine + workspace to simulate a ready environment.
-   * Production never calls this — the resolver runs against the real Docker.
-   */
-  setEnvironmentOverridesForTesting(input: {
-    readonly engine?: DockerEngineClient;
-    readonly workspacePath?: string;
-  }): void;
-  /** Resolve the trusted Root workspace path (host cwd) or the storage root. */
-  private rootWorkspacePath;
-  private dockerEngine;
-  /** Publish the gate state into every composition's projection (UI). */
-  private publishEnvironment;
-  /** Typed blocked result for a failed global gate. */
-  private environmentBlocked;
-  /**
-   * Template-specific preflight BEFORE create_task spawns a Worker. Any
-   * failure ⇒ the Worker's model invocation count stays 0 (spawn never runs).
-   * At this point the Task/Run do not exist yet, so binding/scope are already
-   * guaranteed by the controller; here we verify the runtime contract
-   * (manifest / required tools / factory image / workspace / commands).
-   */
-  private assertTemplateReady;
-  /**
-   * After any canonical mutation (decision / PTAP / Broker), re-publish the
-   * Engagement's projection bundle so the Panel (via official session
-   * projections) refreshes without a page reload or manual sync.
-   */
-  private afterCanonicalMutation;
-  /** A session id is a worker when it resolves through a HarnessSessionBinding. */
-  private isWorkerSessionId;
-  private readonly rejectionFingerprints;
-  /**
-   * Deterministic anti-loop guard: the same decision shape rejected against the
-   * same canonical state must not be retried indefinitely. After 3 consecutive
-   * identical rejections the Orchestrator gets an explicit "repeated_rejection"
-   * hint instead of a bare reason.
-   */
-  private guardRepeatedRejection;
-  /**
-   * Resolve a Worker Session's own trusted context (session → AgentRun →
-   * Task → Engagement) from the durable binding store. Returns undefined when
-   * the Worker has no binding (infrastructure failure — never a bootstrap
-   * prompt to the model).
-   */
-  private resolveWorkerContext;
-  private templateRoleOf;
-  private templateOf;
-  /** Execute a Worker PTAP tool against the caller's OWN binding. */
-  private runWorkerPtap;
-  private runEnsureEngagement;
-  /** Mode 2 — attach: validate existence + workspace + no conflicting binding, then bind. */
-  private attachEngagement;
-  /** Mode 3 — create: intake → create canonical Engagement → register in Workspace → bind. */
-  private createAndBind;
-  private isEngagementValid;
-  private engagementBindingInvalid;
-  /** Trusted Workspace key from the Host-written SessionHeader cwd. */
-  private workspaceKeyOf;
-  /** Establish the durable Root binding + ui association for a session. */
-  private bindRootSession;
-  /**
-   * P0-1: detach one Root Session from its Engagement (DSH Session archived).
-   * Removes the durable Root binding, the in-memory cache, the UI
-   * session→engagement association, and the composition's orchestrator
-   * session entry. When the Engagement has no remaining un-archived Root
-   * Session, it is marked `archived` (history retained, excluded from
-   * bootstrap candidates). Child worker session bindings of the same root are
-   * detached too (their parent is gone).
-   */
-  detachSessionFromEngagement(sessionId: string): Promise<void>;
-  /** P0-1: detach every archived Root Session (host calls after DSH archive). */
-  detachArchivedSessions(archivedSessionIds: readonly string[]): Promise<void>;
-  private engagementRequired;
-  private resolveComposition;
-  /**
-   * A caller is the Root Orchestrator iff it is a trusted pentester-preset
-   * root session (never a subagent child). Durable `orchestratorSessions`
-   * binding is NOT required — that is exactly the fresh-bootstrap case.
-   */
-  private isRootOrchestratorCaller;
-}
-//#endregion
-//#region src/config/effective-config.d.ts
-/**
- * EffectiveConfigResolver — the single authoritative resolver for the Global
- * Pentester Configuration. Runtime never reads Factory or the persisted config
- * directly; it resolves through this. Factory ⊕ Overrides ∖ Disabled.
- */
-declare class EffectiveConfigResolver {
-  static fromGlobal(config: PentesterGlobalConfigV1 | undefined): EffectivePentesterConfig;
-  private readonly config;
-  constructor(config: PentesterGlobalConfigV1 | undefined);
-  resolve(): EffectivePentesterConfig;
-}
-//#endregion
-//#region src/config/runtime-catalog.d.ts
-/**
- * Convert effective Global-config entities into the existing runtime types
- * (ToolboxDefinition / McpServerDefinition). Runtime never reads Factory or
- * the persisted config directly; it resolves through EffectiveConfigResolver.
- *
- * ToolboxDefinition maps the user-facing "Docker Image" to the Tool Broker's
- * trusted image definition (plan §15-§18): id / displayName / image ref /
- * lifecycle, with provisioning derived from the image source.
- */
-declare function toolboxDefinitionsFromEffective(effective: EffectivePentesterConfig): ToolboxDefinition[];
-declare function toolboxDefinitionFromConfig(toolbox: ToolboxConfigEntity): ToolboxDefinition | undefined;
-/** Resolve the primary execution image of an Agent (decision-friendly). */
-declare function primaryImageOfAgent(effective: EffectivePentesterConfig, agent: AgentConfigEntity): {
-  readonly toolboxId: ToolboxId;
-  readonly name: string;
-  readonly ref: string;
-} | undefined;
-declare function mcpServersFromEffective(effective: EffectivePentesterConfig): McpServerDefinition[];
-declare function mcpServerDefinitionFromConfig(server: McpConfigEntity): McpServerDefinition | undefined;
-//#endregion
-//#region src/config/mcp-test.d.ts
-interface McpTestResult {
-  readonly ok: boolean;
-  readonly tools?: readonly string[];
-  readonly message?: string;
-}
-/**
- * MCP Test Connection (plan §64): starts the real StdioMcpTransport server,
- * initialize + listTools, timeout, shutdown. NEVER calls a business tool and
- * never shows a raw stack trace to the user.
- */
-declare function testMcpConnection(server: McpConfigEntity): Promise<McpTestResult>;
-//#endregion
-//#region src/config/orchestrator-context.d.ts
-/**
- * Render the decision-friendly AVAILABLE AGENTS context for the Root
- * Orchestrator (plan §37, §79). This is trusted_internal context — the model
- * sees only decision-friendly summaries (name / description / skills / MCP /
- * primary execution image), never MCP commands, Docker internals, or secrets.
- */
-declare function renderAvailableAgentsContext(effective: EffectivePentesterConfig, stageKind: string): string;
-//#endregion
-//#region src/config/template-registry.d.ts
-/**
- * AgentTemplateRegistry backed by the Effective Pentester Config. Runtime
- * never reads Factory / persisted config directly; every template lookup
- * resolves through EffectiveConfigResolver → this registry. This replaces the
- * hardcoded built-in catalog lookup at the Controller / Context Builder /
- * HarnessAdapter seam (plan §76).
- */
-declare class EffectiveConfigTemplateRegistry implements AgentTemplateRegistry {
-  private effective;
-  private readonly cache;
-  constructor(effective: EffectivePentesterConfig);
-  /** Swap to a newer EffectiveConfig (Global config revision changed). */
-  refresh(effective: EffectivePentesterConfig): void;
-  get(id: AgentTemplateId): AgentTemplate | undefined;
-  entries(): IterableIterator<[AgentTemplateId, AgentTemplate]>;
-  listEligibleForStage(stageKind: AgentTemplate['attachedStages'][number]): readonly AgentTemplate[];
-}
-//#endregion
-//#region src/config/runtime-bridge.d.ts
-/**
- * Bridge from the Global-config domain (AgentConfigEntity / EffectiveConfig)
- * to the existing runtime `AgentTemplate` type. This is the ONLY mapping —
- * runtime never reads Factory or persisted config directly; it resolves
- * through EffectiveConfigResolver and converts here.
- *
- * `attachedStages` is derived from the Factory Stage Policies (which stage
- * kinds may use this Agent), keeping the existing `isTemplateEligibleForStage`
- * seam working while the Controller enforces the policy allowlist.
- */
-declare function agentTemplateFromEffective(effective: EffectivePentesterConfig, agent: AgentConfigEntity): AgentTemplate;
-/** Which PTES Stage kinds allow this Agent (Factory policies + overrides). */
-declare function stageKindsForAgent(effective: EffectivePentesterConfig, agentId: AgentTemplateId): readonly PtesStageKind[];
-/** Build the immutable AgentRun config snapshot from the effective Agent. */
-declare function snapshotFromEffectiveAgent(agent: AgentConfigEntity): AgentRunConfigSnapshot;
-/** Deterministic ordered prompt assembly: Base Worker + Agent instructions + Skills. */
-declare function assembleWorkerPrompt(agent: AgentConfigEntity, skills: Readonly<Record<SkillId, SkillConfigEntity>>): string;
 //#endregion
 //#region src/index.d.ts
 declare const name = "dsh-pentester";
 declare const inject: string[];
 interface Config {
   verbose: boolean;
-  /** DEV/test only. Must be the boolean `true` to load the fixture Engagement. */
-  devSeed: boolean;
-  /** UI Preview: development-only sample data for inspecting the Pentester interface. Never written to canonical stores. */
-  uiPreview: boolean;
-  storageRoot?: string;
-  dockerSocket?: string;
+  dockerHost?: string;
+  toolboxImages?: Record<string, string>;
 }
 declare const Config: Schema<Config>;
 declare function apply(ctx: Context, config: Config): Promise<void>;
+declare const STAGE_PROFILES_FILE = "stage-profiles.json";
+declare function writeStageProfilesManifest(presetDir: string, profiles: ReadonlyMap<string, AgentProfile>): Promise<void>;
+declare function publishPentesterPreset(home?: string): Promise<string | undefined>;
 //#endregion
-export { type AgentConfigEntity, type BaseConfigEntity, Config, type ConfigDiagnostic, type ConfigEntitySource, type ConfigRevisionConflictError, type ConfigServiceResult, DockerImageService, EffectiveConfigResolver, EffectiveConfigTemplateRegistry, type EffectivePentesterConfig, type EntityOverrideSet, FACTORY_AGENT_IDS, FACTORY_AGENT_TEMPLATES, FACTORY_GLOBAL_CONFIG_SCHEMA_VERSION, FACTORY_MCP_IDS, FACTORY_MCP_SERVERS, FACTORY_SKILLS, FACTORY_SKILL_IDS, FACTORY_STAGE_POLICIES, FACTORY_TOOLBOXES, FACTORY_TOOLBOX_IDS, type ImageRuntimeState, type ImageRuntimeStatus, type McpConfigEntity, type McpConfigLifecycle, type McpEnvVar, type McpTestResult, type NativeHarnessContext, PentesterComposition, PentesterConfigService, PentesterGlobalConfigStore, type PentesterGlobalConfigV1, PentesterPluginHost, type SkillConfigEntity, type StageAgentPolicy, type ToolboxConfigEntity, type ToolboxImageDefinition, type ToolboxImageSource, agentTemplateFromEffective, apply, assembleWorkerPrompt, dshHome, effectiveAgentsByStage, emptyGlobalConfig, globalConfigPath, inject, mcpServerDefinitionFromConfig, mcpServersFromEffective, name, primaryImageOfAgent, renderAvailableAgentsContext, resolvePluginConfig, resolveRuntimeConfig, snapshotFromEffectiveAgent, stageKindsForAgent, testMcpConnection, toolboxDefinitionFromConfig, toolboxDefinitionsFromEffective, validatePentesterGlobalConfig };
+export { Config, STAGE_PROFILES_FILE, apply, inject, name, publishPentesterPreset, writeStageProfilesManifest };
 //# sourceMappingURL=index.d.ts.map