operon-agents 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/harness.d.ts

@@ -11,31 +11,25 @@
  * low-level "assemble it yourself / stateless server" path, import from
  * `operon-agents/core` instead.
  */
-import { type AgentEvent, type EventPublicationMode, type AgentEventListener, type AgentInput, SessionProjection, type SessionSnapshot, type SnapshotOptions, type DirectoryEntry, type ProjectionObservation, type ProjectionListener, type ApprovalRequest, type ApprovalResponse, type Capability, type InterruptAnswer, type ChatModel, ListenerSink, type PermissionManagerOptions, type PermissionMode, type PendingRunInterrupt, type QuestionRequest, type QuestionResult, type Responder, type RunHandle, type RunResult, type SessionStore, type SessionHandle, type SessionSummary, type ListSessionsFilter, type OpenSessionOptions, type DeleteSessionOptions, type ThinkingLevel, type Tool, type Logger, type ExternalOriginMetadataValue, type SteerChannel, type SteerOrigin, Agent, Runner, Session, McpOAuthService, type HookDef, type McpServerConfig, type PluginManager, type ApprovalRequestOptions, type Machine, type MachineFactory, type SessionRepository, type ResolvedAgentProfile, type SubagentProvider, type ModelRuntime } from "operon-agents-core";
+import { type AgentEvent, type EventPublicationMode, type TelemetryService, type AgentEventListener, type AgentInput, SessionProjection, type SessionSnapshot, type SnapshotOptions, type DirectoryEntry, type ProjectionObservation, type ProjectionListener, type ApprovalRequest, type ApprovalResponse, type Capability, type InterruptAnswer, type ChatModel, ListenerSink, type PermissionManagerOptions, type PermissionMode, type PendingRunInterrupt, type QuestionRequest, type QuestionResult, type Responder, type RunHandle, type RunResult, type SessionStore, type SessionHandle, type SessionSummary, type ListSessionsFilter, type OpenSessionOptions, type DeleteSessionOptions, type ThinkingLevel, type Tool, type SteerMessage, type SteerOptions, type SteerOrigin, type SteerReceipt, Agent, Runner, Session, McpOAuthService, SkillRegistry, type HookDef, type McpServerConfig, type McpTransportKind, type McpCredentialProvider, type PluginManager, type ApprovalRequestOptions, type Environment, type EnvironmentFactory, type SessionRepository, type ResolvedAgentProfile, type SubagentProvider } from "operon-agents-core";
+import type { SkillsService, CompactionService, BackgroundManager, McpServersHandle, GoalStore, PlanMode, Logger, ModelRuntime, TracingProcessor } from "operon-agents-core";
+import { type WorkspaceMcpPool } from "./workspace-mcp.ts";
 import { HarnessExtensionManager, ServiceRegistry, type ExtensionDefinition, type ServiceOptions } from "./extensions/index.ts";
-import { type CommandResult } from "operon-agents-core";
+import { type CommandResult, type TodoItem } from "operon-agents-core";
 export type ApprovalHandler = (request: ApprovalRequest, options?: ApprovalRequestOptions) => Promise<ApprovalResponse> | ApprovalResponse;
 export type QuestionHandler = (request: QuestionRequest, options?: {
     readonly signal?: AbortSignal;
 }) => Promise<QuestionResult> | QuestionResult;
 export type HarnessSessionState = "idle" | "running" | "interrupted" | "closed";
-export type DeliveryMode = "auto" | "steer" | "follow_up";
-export interface DeliveryOptions {
-    readonly source: string;
-    readonly actor?: string;
-    readonly metadata?: Readonly<Record<string, ExternalOriginMetadataValue>>;
-    /** auto: steer a running turn, or start an idle one. */
-    readonly mode?: DeliveryMode;
-}
-export interface DeliveryReceipt {
-    readonly deliveryId: string;
-    readonly sessionId: string;
-    readonly acceptedAt: number;
-    readonly status: "started" | "queued";
-    readonly channel: "turn" | SteerChannel;
-    readonly steerId?: string;
-    /** Present when delivery started an idle session. */
-    readonly completion?: Promise<RunResult>;
+/** Test-only (exported via `operon-agents/internal`): shrink the close deadlines. */
+export declare function setHarnessCloseTimeoutsForTest(ms: {
+    runSettle?: number;
+}): void;
+/** A slash command as listed by `HarnessSession.listCommands`. */
+export interface CommandInfo {
+    readonly name: string;
+    readonly aliases: readonly string[];
+    readonly description: string;
 }
 export interface HarnessSessionStatus {
     readonly state: HarnessSessionState;
@@ -43,10 +37,43 @@ export interface HarnessSessionStatus {
     readonly hasQueuedMessages: boolean;
 }
 export interface DefaultCapabilitiesOptions {
+    /**
+     * The harness's process-shared parts. When it carries a set of MCP connections, a skill scan or
+     * an OAuth service, the bundle uses THOSE instead of building per-session ones. Without it
+     * everything here is built per session.
+     */
+    readonly shared?: HarnessParts;
+    /**
+     * The session brought its own environment (`createSession({ environment })`). The shared
+     * `skillRegistry` was scanned through the HARNESS's environment and does not describe this one,
+     * so the skill scan runs per session through the session's environment instead — the catalog
+     * follows the filesystem the session's tools actually operate. Default false.
+     */
+    readonly ownEnvironment?: boolean;
     /** Context window budget used to size compaction. Defaults to 200_000. */
     readonly maxContextTokens?: number;
-    /** Workspace MCP servers. When set (or with `pluginManager`), an MCP capability is included. */
+    /** Harness-level MCP servers. When set (or with `pluginManager`), an MCP capability is included. */
     readonly mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * MCP servers private to the session being built — `SessionCapabilityContext.mcpServers`, i.e.
+     * what the caller passed to `createSession({ mcpServers })`. They are layered OVER the
+     * harness's shared servers (`HarnessParts.mcpServers`) and over `mcpServers` above: same name, the
+     * session's wins for this session only. Built, connected and shut down with the session.
+     */
+    readonly sessionMcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Share MCP connections per DIRECTORY instead of building them per session: every server this
+     * bundle would otherwise connect for the session — `mcpServers`, the plugins', and `servers`
+     * here (the directory's own, e.g. its `mcp.json`) — is borrowed from `pool` under `workDir`, so
+     * the sessions open in one directory run one set. `sessionMcpServers` stay the session's own,
+     * layered over it. Ignored when `shared.mcpServers` is set (a process-wide set already covers
+     * every directory) and for a session on its own environment. See {@link WorkspaceMcpPool}.
+     */
+    readonly workspaceMcp?: {
+        readonly pool: WorkspaceMcpPool;
+        readonly workDir: string;
+        readonly servers?: Record<string, McpServerConfig>;
+    };
     /**
      * Installed-plugin manager. When set, the framework self-drives the plugin's contributions into
      * this capability set: its skills (merged into the skills capability), its MCP servers (merged
@@ -67,6 +94,30 @@ export interface DefaultCapabilitiesOptions {
      * server. Only consulted when an MCP capability is built.
      */
     readonly oauthService?: McpOAuthService;
+    /**
+     * MCP transports this host will run. Omitted means both, which is right for a local host.
+     *
+     * A SERVER host should pass `["http"]`. An stdio server is a child process of the harness
+     * process, so it neither follows the session's environment into a sandbox nor survives the
+     * replica model a server is deployed under — and `transport` defaults to `"stdio"`, so
+     * leaving this unset means a config that merely forgot the field spawns a process on the
+     * server. `McpTransportNotPermittedError` names the offending server at startup.
+     *
+     * The same reasoning as Invariant 7 (cron is a local-only capability): what a host is willing
+     * to run is the host's statement, not the kernel's.
+     */
+    readonly allowedMcpTransports?: readonly McpTransportKind[];
+    /** Credentials the host hands out per connect for this session's http MCP servers. See
+     *  `McpCredentialProvider`. */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /**
+     * The session belongs to one tenant among many (a managed host's default): nothing the process
+     * shares reaches it — no process-wide MCP set, skill scan, OAuth service or directory pool —
+     * MCP runs over http only, and no server may read its token from the process environment.
+     * Each is refused rather than skipped where skipping would hide a misconfiguration. See
+     * docs/server-profile.md.
+     */
+    readonly strictIsolation?: boolean;
 }
 /**
  * The standard coding-agent capability bundle (goal / plan / todo / skills /
@@ -74,24 +125,62 @@ export interface DefaultCapabilitiesOptions {
  * on the agent (`filesystemTools()`), not a capability; so is AskUserQuestion
  * (`askUserQuestionTool`, wired through ToolRunContext.responder).
  *
- * With `mcpServers` and/or `pluginManager`, an MCP capability is added; with `pluginManager`, the
+ * With `mcpServers`, `sessionMcpServers` and/or `pluginManager`, an MCP capability is added; with `pluginManager`, the
  * plugin's skills/MCP/session-start are wired in too. Intended to be called fresh per session (via
  * a harness capability factory) so per-session state (goal/plan/todo/…) and the plugin set are
  * isolated per session, mirroring a fresh-Session-per-create model.
  */
 export declare function defaultCapabilities(options?: DefaultCapabilitiesOptions): Capability[];
+/**
+ * The process-lived objects a harness is built on — what `HarnessOptions.harness` returns.
+ * Each one is optional; what is absent simply has no provider, and the harness falls back to
+ * its own default (an in-memory repository, a silent logger, a `LocalEnvironment` per session).
+ */
+export interface HarnessParts {
+    readonly logger?: Logger;
+    readonly sessionRepository?: SessionRepository;
+    readonly modelRuntime?: ModelRuntime;
+    /** The default environment for sessions that bring none: an instance shared by all of them, or
+     *  a factory called once per session. */
+    readonly environment?: Environment | EnvironmentFactory;
+    readonly tracing?: TracingProcessor;
+    readonly telemetry?: TelemetryService;
+    readonly pluginManager?: PluginManager;
+    readonly eventPublication?: EventPublicationMode;
+    /** One set of MCP connections for every session in this process. */
+    readonly mcpServers?: McpServersHandle;
+    /** One skill scan for every session in this process. */
+    readonly skillRegistry?: SkillRegistry;
+    readonly oauthService?: McpOAuthService;
+    /**
+     * Tears down whatever this bag opened — the MCP connections, a pool, a log handle. Called by
+     * `harness.close()` after every session is closed. Without it, anything the preset connected
+     * outlives the harness that asked for it.
+     */
+    close?(): void | Promise<void>;
+}
 export interface HarnessOptions<TContext = unknown> {
     /** Model for the default agent. Either a constructed `ChatModel` or an id resolved via `resolveModel`. */
     readonly model: string | ChatModel;
     /** Resolve string model ids (needed only if `model`/agent models are strings). */
     readonly resolveModel?: (modelId: string) => ChatModel | Promise<ChatModel>;
     /**
-     * The model registry backing `resolveModel`. Only needed to let extensions register or override
-     * providers at runtime (`ctx.actions.registerProvider`). Harness-global by nature: one runtime
-     * serves every session, so a registration is visible to all of them. Without it those two
-     * actions throw and everything else works unchanged.
+     * The process-lived parts this harness runs on, built once. Everything a session needs that is
+     * NOT per-session lives here: the repository (disk locally, Pg/Redis on a server; in-memory
+     * when absent), the logger, the model runtime, the default environment, one set of MCP
+     * connections, one skill scan. Runs before the by-value extensions' `harness` halves, so they
+     * can consume what it returns.
+     *
+     * There is no tier between this and a session. A shared object is shared by the WHOLE process
+     * or it is built per session — nothing is shared by "the sessions in one directory".
      */
-    readonly modelRuntime?: ModelRuntime;
+    readonly harness?: () => HarnessParts | Promise<HarnessParts>;
+    /**
+     * Session-tier composition: called once per session being opened. Return its capabilities.
+     * Defaults to `defaultCapabilities()`. Always called fresh per session, so per-session state
+     * (goal/plan/todo/background/skills/mcp) is isolated by construction.
+     */
+    readonly session?: (ctx: SessionCapabilityContext) => readonly Capability[] | Promise<readonly Capability[]>;
     /** Default working directory for new sessions. Defaults to `process.cwd()`. */
     readonly workDir?: string;
     /**
@@ -100,15 +189,15 @@ export interface HarnessOptions<TContext = unknown> {
      * workflow would. Nested spawns are exempt by design (they would deadlock a shared pool).
      */
     readonly maxConcurrentSubagents?: number;
-    /**
-     * Session repository (the fleet's store + index) — the harness's only storage knob. Injecting one
-     * is how a deployment plugs in storage: `DiskSessionRepository(homeDir)` for local disk, Pg/Redis
-     * on a server. Omit for in-memory sessions (`MemorySessionRepository`).
-     */
-    readonly repository?: SessionRepository;
     /** Event durability policy. Defaults to `immediate` for low-latency local applications.
      *  Managed servers override each opened session to `committed`. */
     readonly eventPublication?: EventPublicationMode;
+    /**
+     * Product telemetry (docs/telemetry.md). Process-lifetime: create ONE service, attach the
+     * appenders once, pass the same instance to every harness. Absent = nothing is counted.
+     * The harness never shuts it down; the product does, before exit.
+     */
+    readonly telemetry?: TelemetryService;
     /**
      * Extra subagent profiles merged into the builtin `coder`/`explore`/`plan` fleet. The SOURCE is
      * the composition root's concern — disk (`loadAgentProfiles`) locally, external on a server —
@@ -128,13 +217,13 @@ export interface HarnessOptions<TContext = unknown> {
      */
     readonly context?: TContext;
     /**
-     * Process-level shared services, registered into the harness's `ServiceRegistry` at
-     * construction. An extension consumes one by naming it in `uses` and receiving it as
-     * `ctx.services[name]` -- a stable handle that resolves the current provider on every call,
-     * which is what makes a host-side
-     * `harness.services.replace()` land without touching any session. A plain value registers
-     * as-is (not replaceable); wrap it as `{ instance, replaceable, dispose }` to opt into hot
-     * swapping. Design: docs/architecture.md §5.5.
+     * Process-level shared services BY NAME, registered into the harness scope at construction
+     * (extension services are the one string-keyed corner: an extension is loaded by its id and
+     * names what it consumes in `uses`). An extension receives one as `ctx.services[name]` -- a
+     * stable handle that resolves the current provider on every call, which is what makes a
+     * host-side `harness.services.replace()` land without touching any session. A plain value
+     * registers as-is (not replaceable); wrap it as `{ instance, replaceable, dispose }` to opt
+     * into hot swapping. Design: docs/architecture.md §5.5.
      */
     readonly services?: Record<string, unknown | ({
         readonly instance: unknown;
@@ -143,15 +232,15 @@ export interface HarnessOptions<TContext = unknown> {
      * Opt-in to FILE extensions, both tiers, from this directory (one folder per extension).
      * The single explicit switch: without it no file-extension machinery exists ("default
      * closed"); with it, `harness.extensions` loads/reloads/unloads them — each load being the
-     * manual approval. Extensions with a `create` half publish process-level services and may
+     * manual approval. Extensions with a `harness` half publish process-level services and may
      * embed a session half; see docs/architecture.md §5.4-5.5. (Unrelated to
      * `pluginManager`, the Codex-compatible skill/MCP plugin system.)
      */
     readonly extensionDir?: string;
     /**
-     * Root of the per-extension data folders handed to `create` halves as `host.dataDir`
+     * Root of the per-extension data folders handed to `harness` halves as `host.dataDir`
      * (`<root>/<id>`). Defaults to `<extensionDir>/.data` when `extensionDir` is set; by value
-     * only, set it to give `create` halves a place for their files (absent ⇒ `dataDir` is
+     * only, set it to give `harness` halves a place for their files (absent ⇒ `dataDir` is
      * `undefined`). Kept outside the code folders so an update never touches state.
      */
     readonly extensionDataDir?: string;
@@ -185,45 +274,21 @@ export interface HarnessOptions<TContext = unknown> {
      * `subagentProvider: null`, which necessarily takes both tools with it.
      */
     readonly workflowTool?: boolean;
-    /**
-     * Machine for sessions — one shared `Machine` (the sandbox case), or a
-     * {@link MachineFactory} for a per-session one. Defaults to a `LocalMachine`
-     * rooted at each session's own `workDir`.
-     */
-    readonly machine?: Machine | MachineFactory;
-    /**
-     * Capabilities for sessions. Defaults to `defaultCapabilities()`. Pass a factory (sync or async)
-     * to build a FRESH capability set per session — so per-session state (goal/plan/todo/background/
-     * skills/mcp) is isolated and re-reads sources like a plugin manager each session. A plain array
-     * is shared across the harness's sessions (fine only when state needn't be isolated).
-     *
-     * The factory receives the session it is being built for, so capabilities can be
-     * scoped to it — see {@link SessionCapabilityContext}. Existing zero-argument
-     * factories keep working unchanged.
-     */
-    readonly capabilities?: readonly Capability[] | ((ctx: SessionCapabilityContext) => readonly Capability[] | Promise<readonly Capability[]>);
     /**
      * Programmatic runtime extensions, registered once here — the by-value twin of `extensionDir`.
-     * Every definition's `setup` runs in every session; a session varies that with
+     * Every definition's `session` runs in every session; a session varies that with
      * `createSession({ params })` (a value configures, `false` skips). A definition with a
-     * `create` half has it run here, once, and the result registered as a service under its `id`
+     * `harness` half has it run here, once, and the result registered as a service under its `id`
      * before any session opens; `harness.close()` unregisters (and disposes) those services.
      * Each definition's `uses` is checked at this point, in order — a consumer comes after its
-     * provider (or after `services`). Synchronous `create`s finish before `createHarness`
-     * returns; an async one makes sessions wait for it, so `create` must not open a session of
+     * provider (or after `services`). Synchronous `harness`s finish before `createHarness`
+     * returns; an async one makes sessions wait for it, so `harness` must not open a session of
      * its own. Intentionally independent from Codex-compatible plugins (`pluginManager`): those
      * are skills/MCP/hooks metadata, extensions are trusted host code.
      */
     readonly extensions?: readonly ExtensionDefinition[];
     /** Permission config. Defaults to `{ mode: "yolo" }`. */
     readonly permission?: PermissionManagerOptions;
-    /**
-     * Logger for loop diagnostics (LLM request/response, tool I/O, compaction). Defaults to the
-     * `AGENTS_LOG` env var (`AGENTS_LOG=debug` builds a console logger); omit both to stay silent.
-     */
-    readonly logger?: Logger;
-    /** Context budget for the default compaction capability. */
-    readonly maxContextTokens?: number;
     readonly maxTurns?: number;
     readonly maxStepsPerTurn?: number;
 }
@@ -233,9 +298,9 @@ export interface HarnessOptions<TContext = unknown> {
  * Exists so conversation-scoped resources don't force conversation-scoped harnesses.
  * MCP is the motivating case: a host that gives each conversation its own server
  * (a REPL kernel keyed by conversation id, say) used to need a whole separate
- * harness per conversation, duplicating the workspace's agent profile, tool palette,
- * plugins and skills along with it. Session-scoped servers keep the harness at
- * workspace scope, where it belongs — `mcpServers` here is the session-level
+ * harness per conversation, duplicating the agent profile, tool palette, plugins and
+ * skills along with it. Session-level servers keep one harness serving every
+ * conversation — `mcpServers` here is the session-level
  * counterpart of the harness-level `DefaultCapabilitiesOptions.mcpServers`.
  */
 export interface SessionCapabilityContext {
@@ -243,6 +308,14 @@ export interface SessionCapabilityContext {
     readonly workDir: string;
     /** Session-scoped MCP servers, as given to createSession / resumeSession / forkSession. */
     readonly mcpServers?: Record<string, McpServerConfig>;
+    /** The session brought its own environment (`{ environment }` on this open): harness-shared objects
+     *  derived from the harness's environment (the skill scan) do not apply to it. */
+    readonly ownEnvironment: boolean;
+    /** {@link OpenSessionOptionsBase.mcpCredentials} for this open. */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /** {@link OpenSessionOptionsBase.strictIsolation} for this open. A custom factory owns honouring
+     *  it the way `defaultCapabilities` does. */
+    readonly strictIsolation: boolean;
 }
 /**
  * Options common to every way of opening a session.
@@ -258,20 +331,32 @@ export interface SessionCapabilityContext {
 interface OpenSessionOptionsBase<TContext = unknown> {
     /** Override the agent for this session only. */
     readonly agent?: Agent<TContext>;
-    /** Override the execution machine for this session only. Lifecycle remains host-owned. */
-    readonly machine?: Machine | MachineFactory;
+    /** Override the execution environment for this session only. Lifecycle remains host-owned. */
+    readonly environment?: Environment | EnvironmentFactory;
     /** Runtime-only application context for this session. Overrides `HarnessOptions.context`. */
     readonly context?: TContext;
     /**
      * MCP servers scoped to this session, surfaced to the capability factory via
      * {@link SessionCapabilityContext}. Merge policy is the factory's call — the
-     * harness only carries them across.
+     * harness only carries them across. `defaultCapabilities` (and so the local preset)
+     * layers them OVER the harness's shared servers, a reused name shadowing the
+     * shared one for this session; a custom factory can decide otherwise.
      */
     readonly mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Where this session's http MCP servers get their credentials, asked on every connect: the
+     * seam a host builds a per-user vault on. Not persisted — a resume passes it again.
+     */
+    readonly mcpCredentials?: McpCredentialProvider;
+    /**
+     * This session is one tenant's among many: see `DefaultCapabilitiesOptions.strictIsolation`.
+     * A managed host's worker sets it on every open unless it runs single-tenant.
+     */
+    readonly strictIsolation?: boolean;
     /**
      * Per-session argument for each registered extension, by extension id — handed to that
-     * extension's `setup(api, ctx)` as `ctx.params`. A value of `false` skips the extension for
-     * this session entirely (its `setup` never runs). Persisted with the session, so a
+     * extension's `session(api, ctx)` as `ctx.params`. A value of `false` skips the extension for
+     * this session entirely (its `session` never runs). Persisted with the session, so a
      * `resumeSession` or a reload re-applies the same params without the caller repeating them.
      * This is the per-session knob: definitions themselves are registered once, on the harness.
      */
@@ -317,6 +402,9 @@ declare class MutableResponder implements Responder {
     /** No handler ⇒ not a live approver ⇒ the run interrupts durably (resume later via
      *  `HarnessSession.resume`) instead of auto-rejecting the tool. */
     isLiveApprover(): boolean;
+    /** Same rule for questions: no handler ⇒ nobody attached ⇒ AskUserQuestion suspends durably
+     *  (the question is on the paused run's pending list) instead of being dismissed unanswered. */
+    isLiveQuestioner(): boolean;
     requestApproval(request: ApprovalRequest, options?: ApprovalRequestOptions): Promise<ApprovalResponse>;
     requestQuestion(request: QuestionRequest, options?: {
         readonly signal?: AbortSignal;
@@ -346,22 +434,34 @@ export declare class HarnessSession<TContext = unknown> {
     private readonly responder;
     private readonly onClosed;
     private runContext;
-    private currentRun;
     /** Barrier gate (docs/architecture.md §5.5): while set, no NEW run starts on this
      *  session — prompt/resume park at it, promptStream starts lazily behind it. The in-flight
      *  run is never touched. */
     private runGate;
-    /** Resolves when the latest run settles — the "arrived at the boundary" signal a barrier
-     *  coordinator awaits. Undefined while idle. */
-    private runSettled;
-    private readonly runSettles;
+    /**
+     * Every run this facade has begun and not yet seen settle, by its controller. More than one
+     * entry means runs are queued behind the core's run lock (`prompt` while a turn is in flight):
+     * "busy" is this set being non-empty, `cancel()` aborts ALL of them, and the barrier's
+     * quiescence is ALL of them settling — tracking only the last-begun run would abort the
+     * queued one and leave the running one untouched.
+     */
+    private readonly runs;
     private lastRunInterrupted;
-    private closed;
-    private deliveryCounter;
+    /** open → closing (runs being drained, resources going down) → closed. Never goes back. */
+    private lifecycle;
+    /** The one close in flight (or finished): every `close()` call returns THIS promise. */
+    private closing;
+    /** Resolves the moment close() begins — what wakes a caller parked at the barrier gate so it
+     *  can fail with the closed error instead of hanging on a gate nobody will release. */
+    private notifyClosing;
+    private readonly closingNotified;
     /** A wake is already scheduled on the microtask queue; more enqueues fold into it. */
     private wakeScheduled;
     /** Per-session turn cap; the Runner's own config is the fallback. */
     private readonly maxTurns;
+    /** Builds the capability an extension attached to THIS session runs as — bound to the
+     *  session's harness reach and its per-session params. */
+    private readonly mountExtension;
     constructor(args: {
         core: Session;
         agent: Agent<TContext>;
@@ -373,17 +473,26 @@ export declare class HarnessSession<TContext = unknown> {
         context?: TContext;
         maxTurns?: number;
         interrupted?: boolean;
-        onClosed: (id: string) => void;
+        mountExtension: (definition: ExtensionDefinition) => Capability;
+        onClosed: (id: string) => void | Promise<void>;
     });
     /**
      * Start a turn to consume queued follow-ups, once the current synchronous work is done.
      *
      * Deferred to a microtask for two reasons: several enqueues in one stack fold into a single
-     * wake, and a settle that lands in a finishing run's own stack sees `currentRun` already
+     * wake, and a settle that lands in a finishing run's own stack sees its run already
      * cleared. Re-checked at fire time because either can change in between — and re-checked
      * again after every run, since the queue may have filled during one whose drain had passed.
      */
     private scheduleIdleWake;
+    /** Not open: closing or closed. Every run entry point refuses from here on. */
+    private get closed();
+    /**
+     * Park at the barrier gate until released — or until this session starts closing, in which
+     * case fail with the closed error rather than wait on a gate no coordinator will release.
+     * Re-checked in a loop: a new hold can land between a release and this task resuming.
+     */
+    private parkAtGate;
     /** Run options every run on this session carries — currently the session's turn cap. */
     private get runOverrides();
     /** Current runtime-only application context supplied to Agent callbacks. */
@@ -396,6 +505,10 @@ export declare class HarnessSession<TContext = unknown> {
     setContext(context: TContext | undefined): void;
     private beginRun;
     private endRun;
+    /** A run is in flight or queued behind the core's run lock. */
+    private hasActiveRuns;
+    /** Settles when every run begun so far has settled (trivially, when idle). */
+    private allRunsSettled;
     /**
      * Barrier support (docs/architecture.md §5.5): refuse NEW runs until released and
      * report when this session reaches its run boundary. Installing the gate is synchronous — a
@@ -413,41 +526,32 @@ export declare class HarnessSession<TContext = unknown> {
     private runPrompt;
     /**
      * Hand a message to the frame running at `address` in this session (`main` for the root agent,
-     * `main/<agentId>` for a subagent); `false` when nobody is there. The seam an out-of-process
-     * coordinator uses to address a specific subagent.
+     * `main/<agentId>` for a subagent); undefined when nobody is there, or the session is paused
+     * on a question. The seam an out-of-process coordinator uses to address a specific subagent.
+     *
+     * The receipt's `journaled` settles once the `steer.queued` record is on disk — the moment a
+     * caller may answer "accepted" to someone else and mean it survives a crash. A running frame
+     * drains the message at its next boundary; an idle root frame is woken to take it.
      */
-    steerTo(address: string, content: string, origin: SteerOrigin): boolean;
+    steerTo(address: string, content: string, origin: SteerOrigin, options?: SteerOptions): SteerReceipt | undefined;
     /**
-     * Deliver an externally-originated message. A running session receives it through the
-     * requested SteerBus channel; an idle session starts a new turn immediately.
+     * Put a message whose `steer.queued` record ALREADY exists back on the bus.
      *
-     * ACCEPTANCE IS DURABLE BEFORE THIS RESOLVES. The input is journaled as `inbox.received`
-     * and that write is awaited before a receipt exists, so the receipt means "this survives a
-     * crash", not merely "this reached a process". Previously the message lived only in memory
-     * (SteerBus, or an argument to `runPrompt`) until the run that consumed it journaled it —
-     * a crash in that window lost a delivery the caller had already been told was accepted.
-     *
-     * The provenance of what the model ultimately sees is still persisted on the eventual
-     * `message.appended` record: acceptance and processing are journaled separately because
-     * they can legitimately differ (capability rewrite, guardrail rejection, or a capability
-     * answering the prompt outright).
+     * For whoever holds a reopened session and finds, in its log, accepted messages no turn ever
+     * consumed — a `steer.queued` with no `message.appended` carrying its `steerId`. That happens
+     * when acceptance and execution are different processes (a managed API node writes the record,
+     * a worker runs it later, possibly on another machine) or when the process that accepted a
+     * message died before a turn drained it. Nothing is journaled again: the record and its
+     * `steer.queued` event exist from the first acceptance. Run state is read NOW, not then — a
+     * running turn drains it at its next boundary, an idle session is woken to take it.
      */
-    deliver(input: string, options: DeliveryOptions): Promise<DeliveryReceipt>;
+    requeue(item: SteerMessage): SteerReceipt;
     /**
-     * Dispatch an input whose acceptance is ALREADY journaled.
-     *
-     * A worker draining a session's inbox calls this directly: the `inbox.received` record exists,
-     * so going back through `deliver` would write a second one and count the delivery twice. The
-     * split is the whole reason acceptance and dispatch are separable — accepting is a durable
-     * write that must happen before a receipt exists, dispatching is what someone holding the
-     * session's lease does with it afterwards, possibly on another machine, possibly much later.
-     *
-     * Run state is read HERE, not at acceptance: by now a turn may have started or ended, so
-     * whether this steers work in flight or starts a fresh turn can only be decided now.
+     * Settles when no run is in flight. Yields once first, so a run that an enqueue on the
+     * previous line scheduled (the idle wake fires from a microtask) is counted as in flight
+     * rather than missed. A run that starts afterwards is not waited for.
      */
-    dispatchAccepted(input: string, origin: SteerOrigin & {
-        readonly kind: "external";
-    }, acceptedAt?: number): DeliveryReceipt;
+    whenIdle(): Promise<void>;
     /**
      * Resume a durably-interrupted run. When a `prompt` returns `status:"interrupted"` — which
      * happens when no live approval handler is registered (`no live responder ⇒ durable`) — the run's
@@ -473,18 +577,19 @@ export declare class HarnessSession<TContext = unknown> {
     /** Synthesize the terminal RunResult for a guardrail tripwire (facade contract). */
     private guardrailBlocked;
     /**
-     * Inject a user message into the in-flight (or next) turn. Returns the steer's correlation
-     * id: a `steer.queued` event carries it now, and the consuming `message.appended` event's
-     * `origin.steerId` matches it when the model actually sees the message.
+     * Inject a user message into the in-flight (or next) turn. The receipt's `steerId` is the
+     * correlation key: a `steer.queued` event carries it now, and the consuming `message.appended`
+     * event's `origin.steerId` matches it when the model actually sees the message; `journaled`
+     * settles once the `steer.queued` record is durable.
      */
-    steer(input: string): string;
+    steer(input: string): SteerReceipt;
     /**
      * Queue a user message for a new turn after the current run's active turn finishes.
-     * Returns the steer's correlation id (see `steer`), or null when the session has no
-     * active run — use `prompt` instead in that case.
+     * Returns the receipt (see `steer`), or null when the session has no active run — use
+     * `prompt` instead in that case.
      */
-    followUp(input: string): string | null;
-    /** Abort the current run. */
+    followUp(input: string): SteerReceipt | null;
+    /** Abort every run this session has accepted: the one in flight AND any queued behind it. */
     cancel(): void;
     /** Subscribe to this session's event stream. Returns an unsubscribe fn. */
     onEvent(listener: AgentEventListener): () => void;
@@ -506,33 +611,45 @@ export declare class HarnessSession<TContext = unknown> {
     setThinking(level: ThinkingLevel): void;
     /** In-memory switch is immediate; await the returned promise to confirm it was journaled. */
     setPermissionMode(mode: PermissionMode): Promise<void>;
-    createGoal(...args: Parameters<Session["createGoal"]>): ReturnType<Session["createGoal"]>;
-    getGoal(): ReturnType<Session["getGoal"]>;
-    setPlanMode(...args: Parameters<Session["setPlanMode"]>): ReturnType<Session["setPlanMode"]>;
-    getPlan(): ReturnType<Session["getPlan"]>;
-    compact(...args: Parameters<Session["compact"]>): ReturnType<Session["compact"]>;
-    listSkills(): ReturnType<Session["listSkills"]>;
-    activateSkill(...args: Parameters<Session["activateSkill"]>): ReturnType<Session["activateSkill"]>;
-    listPlugins(): ReturnType<Session["listPlugins"]>;
-    installPlugin(...args: Parameters<Session["installPlugin"]>): ReturnType<Session["installPlugin"]>;
-    listBackgroundTasks(...args: Parameters<Session["listBackgroundTasks"]>): ReturnType<Session["listBackgroundTasks"]>;
+    /** The model this session runs on, as last set; undefined means the agent's own. */
+    get modelSetting(): string | ChatModel | undefined;
+    /** The thinking level this session runs at, as last set; undefined means the model's default. */
+    get thinkingSetting(): ThinkingLevel | undefined;
+    /** The permission mode in force right now — what a status line reads instead of tracking it. */
+    get permissionMode(): PermissionMode | undefined;
+    get goal(): GoalStore;
+    get plan(): PlanMode;
+    get skills(): SkillsService;
+    get plugins(): PluginManager;
+    get compaction(): CompactionService;
+    /** PROBE tier: absent without the background capability — see `Session.background`. */
+    get background(): BackgroundManager | undefined;
+    /** PROBE tier: absent without an MCP capability. */
+    get mcp(): McpServersHandle | undefined;
     getRecords(...args: Parameters<Session["getRecords"]>): ReturnType<Session["getRecords"]>;
-    listSubagents(...args: Parameters<Session["listSubagents"]>): ReturnType<Session["listSubagents"]>;
-    reconcileSubagents(...args: Parameters<Session["reconcileSubagents"]>): ReturnType<Session["reconcileSubagents"]>;
+    getAuditRecords(): ReturnType<Session["getAuditRecords"]>;
     getContextBreakdown(): ReturnType<Session["getContextBreakdown"]>;
+    /** Where this session's tools run. A host uses it to run a command in the same place the agent
+     *  does — one shell, one filesystem, one working directory. */
+    get environment(): Environment;
+    /** The current todo list (the `TodoList` tool's latest state); empty without the todo capability. */
+    getTodos(): readonly TodoItem[];
+    /** Every slash command this session answers to — the static registry plus the ones its
+     *  capabilities and extensions contribute — for a UI's palette and autocompletion. */
+    listCommands(): readonly CommandInfo[];
     /**
      * Add an extension mid-session. Applied at the next quiet point: immediately when idle,
      * at the run's stop boundary when one is in flight — its tools appear at the next run's
      * assembly. The change is journaled; it does NOT survive `resumeSession` (re-attach, or
      * register it in `createHarness({ extensions })`, which every open re-evaluates). A definition
-     * with a `create` half is accepted only once registered — its service must already exist.
+     * with a `harness` half is accepted only once registered — its service must already exist.
      */
     attachExtension(definition: ExtensionDefinition): Promise<void>;
     /** Remove an extension mid-session: `session.end("detach")` fires, then its scope unwinds. */
     detachExtension(extensionId: string): Promise<void>;
-    /** Ids of currently attached extensions; empty when the session has no extensions capability. */
+    /** Ids of currently attached extensions, in mount order. */
     attachedExtensionIds(): readonly string[];
-    /** Currently attached extensions with what each `uses`; empty without an extensions capability. */
+    /** Currently attached extensions with what each `uses`. */
     attachedExtensions(): readonly {
         readonly id: string;
         readonly uses: readonly string[];
@@ -547,38 +664,35 @@ export declare class HarnessSession<TContext = unknown> {
      *  facade methods (e.g. cron's — see `cronExtension`). */
     extensionHandle<T = unknown>(extensionId: string): T | undefined;
     private extensionRuntime;
-    pauseGoal(...args: Parameters<Session["pauseGoal"]>): ReturnType<Session["pauseGoal"]>;
-    resumeGoal(...args: Parameters<Session["resumeGoal"]>): ReturnType<Session["resumeGoal"]>;
-    cancelGoal(...args: Parameters<Session["cancelGoal"]>): ReturnType<Session["cancelGoal"]>;
-    setGoalBudget(...args: Parameters<Session["setGoalBudget"]>): ReturnType<Session["setGoalBudget"]>;
-    clearPlan(...args: Parameters<Session["clearPlan"]>): ReturnType<Session["clearPlan"]>;
-    pendingCompaction(...args: Parameters<Session["pendingCompaction"]>): ReturnType<Session["pendingCompaction"]>;
-    cancelCompaction(...args: Parameters<Session["cancelCompaction"]>): ReturnType<Session["cancelCompaction"]>;
-    readBackgroundTaskOutput(...args: Parameters<Session["readBackgroundTaskOutput"]>): ReturnType<Session["readBackgroundTaskOutput"]>;
-    readBackgroundTaskOutputDelta(...args: Parameters<Session["readBackgroundTaskOutputDelta"]>): ReturnType<Session["readBackgroundTaskOutputDelta"]>;
-    stopBackgroundTask(...args: Parameters<Session["stopBackgroundTask"]>): ReturnType<Session["stopBackgroundTask"]>;
-    /** Move a running detachable tool call (bash/subagent/workflow) into a background task. */
-    detachTool(...args: Parameters<Session["detachTool"]>): ReturnType<Session["detachTool"]>;
-    getPluginInfo(...args: Parameters<Session["getPluginInfo"]>): ReturnType<Session["getPluginInfo"]>;
-    setPluginEnabled(...args: Parameters<Session["setPluginEnabled"]>): ReturnType<Session["setPluginEnabled"]>;
-    setPluginMcpServerEnabled(...args: Parameters<Session["setPluginMcpServerEnabled"]>): ReturnType<Session["setPluginMcpServerEnabled"]>;
-    removePlugin(...args: Parameters<Session["removePlugin"]>): ReturnType<Session["removePlugin"]>;
-    reloadPlugins(...args: Parameters<Session["reloadPlugins"]>): ReturnType<Session["reloadPlugins"]>;
-    listMcpServers(...args: Parameters<Session["listMcpServers"]>): ReturnType<Session["listMcpServers"]>;
-    reconnectMcpServer(...args: Parameters<Session["reconnectMcpServer"]>): ReturnType<Session["reconnectMcpServer"]>;
-    /** Close the session and release its resources. */
+    /**
+     * Close the session and release its resources. Order: stop accepting runs, abort the ones
+     * accepted (in flight and queued) and wait for them to settle — their tools' finally blocks,
+     * their journal writes — then detach the projection and take the core down. Every call
+     * returns the SAME promise, so nobody returns while the teardown is still running.
+     *
+     * The wait for runs is bounded (`CLOSE_RUN_WAIT_MS`, 5s): a run that ignores its abort signal
+     * is logged and left behind, and the teardown continues — the deadline caps the wait for
+     * runs, not the whole close (flushes and disposes carry their own deadlines).
+     */
     close(): Promise<void>;
+    private runClose;
 }
 /** Manages a fleet of in-process sessions over a shared engine config. */
 export declare class Harness<TContext = unknown> {
     private readonly options;
     private readonly runner;
-    private readonly repo;
     /** Concrete tools the default profile's tool NAMES resolve against (keyed by schema name). */
     private readonly toolPalette;
     private readonly activeSessions;
-    /** Process-level shared services. The host replaces providers here (`services.replace`);
-     *  sessions only ever see handles (`ctx.shared`, `ctx.services`). */
+    /** Opens in flight by session id (`resumeSession`): concurrent callers share ONE open — the
+     *  whole of it, reconcile and failure cleanup included — instead of each building an instance. */
+    private readonly opening;
+    /** The one close in flight (or finished): every `close()` call returns THIS promise. */
+    private closing;
+    /** The process-lived objects this harness runs on (`HarnessOptions.harness`), plus defaults. */
+    private parts;
+    /** Process-level extension services by name (a facade over `scope`). The host replaces
+     *  providers here (`services.replace`); sessions only ever see handles (`ctx.shared`, `ctx.services`). */
     readonly services: ServiceRegistry;
     /** The one in-flight reshape barrier (mutex: a second barrier operation rejects). Sessions
      *  appearing while it holds are gated at birth — see the tail of `openFromStore`. */
@@ -586,7 +700,7 @@ export declare class Harness<TContext = unknown> {
     /** File-extension manager (both tiers) — present only when the host opted in with
      *  `extensionDir`. NOT the Codex-compatible skill/MCP plugin system (`pluginManager`). */
     readonly extensions: HarnessExtensionManager | undefined;
-    /** Service ids published by by-value `create` halves, in creation order — unregistered (and
+    /** Service ids published by by-value `harness` halves, in creation order — unregistered (and
      *  disposed) by `close()`, newest first. */
     private readonly createdServices;
     /** The by-value definitions this harness currently mounts into newborn sessions, in
@@ -597,26 +711,39 @@ export declare class Harness<TContext = unknown> {
     private readonly valueDefs;
     /** Root of extensions' data folders (`host.dataDir` = `<root>/<id>`); absent ⇒ none handed out. */
     private readonly dataRoot;
-    /** Settles once every by-value `create` half has published its service; sessions open after it. */
+    /** Settles once every by-value `harness` half has published its service; sessions open after it. */
     private readonly sharedReady;
-    /** The extension whose `create` is running right now — its `createSession` must refuse. */
+    /** The extension whose `harness` is running right now — its `createSession` must refuse. */
     private runningCreate;
     constructor(options: HarnessOptions<TContext>);
     /**
-     * Run one by-value definition's `create` half against a staging host: the service is COLLECTED,
-     * not registered, so a throwing `create` publishes nothing. Stays synchronous when `create` is
+     * Which session-facing parts the `harness` hook built for the whole process — what a
+     * multi-tenant host must not have, since every session on the process would share them.
+     * Infrastructure (repository, logger, model runtime) is not listed: sharing it is the point.
+     */
+    processSharedParts(): Promise<readonly ("mcpServers" | "oauthService" | "skillRegistry")[]>;
+    /** The session repository, once the `harness` hook has had its say. */
+    private repository;
+    /** The fallback repository, built once so two opens share one in-memory store. */
+    private memoryRepository;
+    /** The harness logger: the preset's, else the `AGENTS_LOG` env logger, else silent. */
+    private get logger();
+    private defaultLogger;
+    /**
+     * Run one by-value definition's `harness` half against a staging host: the service is COLLECTED,
+     * not registered, so a throwing `harness` publishes nothing. Stays synchronous when `harness` is
      * — what lets a synchronous extension's service exist the moment `createHarness` returns.
      * Shared by construction and `replaceExtension`.
      */
     private stageValue;
     /**
      * Register the by-value definitions, in order: check each one's `uses` against the registry
-     * (a consumer must come after its provider), then run its `create` half if it has one and
+     * (a consumer must come after its provider), then run its `harness` half if it has one and
      * register the result as a service under the extension's `id`. Stays synchronous as long as
-     * every `create` is — so `createHarness` returns with a synchronous extension's service
-     * already registered; the first async `create` turns the rest of the sequence into a promise
+     * every `harness` is — so `createHarness` returns with a synchronous extension's service
+     * already registered; the first async `harness` turns the rest of the sequence into a promise
      * chain that `openFromStore` awaits. Staging (`stageDefinition`) collects before registering,
-     * so a throwing `create` publishes nothing.
+     * so a throwing `harness` publishes nothing.
      */
     private registerDefinitions;
     /**
@@ -626,12 +753,25 @@ export declare class Harness<TContext = unknown> {
      * session's capabilities.
      *
      * Built fresh per session. Runtime-specific prompt data is not captured here: `instructions`
-     * resolves the current frame's machine + cwd through the Session cache, so root/subagent/worktree
-     * prompts stay isolated without coupling Agent lifetime to machine lifetime.
+     * resolves the current frame's environment + cwd through the Session cache, so root/subagent/worktree
+     * prompts stay isolated without coupling Agent lifetime to environment lifetime.
      */
     private buildDefaultAgent;
     get sessions(): ReadonlyMap<string, HarnessSession<TContext>>;
     createSession(opts?: CreateSessionOptions<TContext>): Promise<HarnessSession<TContext>>;
+    /**
+     * Register an open in flight under its id for as long as it runs. Every path that builds a
+     * session goes through here — create, resume, fork — so a `resumeSession` for an id that is
+     * being created joins that open instead of building a twin over the same store, and
+     * `closeSession` / `harness.close()` wait for it instead of closing its scope under it.
+     */
+    private trackOpen;
+    /**
+     * The open session with this id, or reopen it from the store. Concurrent calls for one id share
+     * a single open (`opening`): the second caller waits for the first's — reconcile included — and
+     * receives the same instance, never a second one that a close would then unregister. An
+     * instance that is closing is not handed out: the reopen waits for its close to finish first.
+     */
     resumeSession(id: string, opts?: ResumeSessionOptions<TContext>): Promise<HarnessSession<TContext>>;
     /** Fork an existing session into a new one (copies its log + state) and open it. */
     forkSession(sourceId: string, opts?: ForkSessionOptions<TContext>): Promise<HarnessSession<TContext>>;
@@ -643,7 +783,8 @@ export declare class Harness<TContext = unknown> {
     inspectSession(id: string, options?: OpenSessionOptions): Promise<SessionHandle | undefined>;
     /** Read one catalog row without the O(N) `listSessions()` scan. */
     getSessionSummary(id: string): Promise<SessionSummary | undefined>;
-    /** Close one open session by id (no-op if it isn't open). */
+    /** Close one open session by id (no-op if it isn't open). An open in flight for this id is
+     *  waited for and then closed, so a close/delete never races a half-built session. */
     closeSession(id: string): Promise<void>;
     /**
      * Delete a session after releasing any open in-process handle. Soft by default — the durable
@@ -653,12 +794,23 @@ export declare class Harness<TContext = unknown> {
     /** Undo a soft delete. No-op when the session is absent or was never deleted. */
     restoreSession(id: string): Promise<void>;
     listSessions(filter?: ListSessionsFilter): Promise<readonly SessionSummary[]>;
+    /** Set a session's title (an empty string clears it). Works on open and closed sessions alike. */
+    renameSession(id: string, title: string): Promise<void>;
+    /**
+     * Close every open session, then the harness scope — which disposes everything registered
+     * there in reverse order: by-value `harness` halves die with the harness that ran them (each
+     * drained, then its dispose hook — default the instance's close()), then the host's own
+     * registrations, then the defaults.
+     */
     close(): Promise<void>;
+    private runClose;
+    /** Every path that opens a session starts here: a closing harness opens nothing new. */
+    private assertAcceptingSessions;
     /**
      * Replace by-value extensions with new versions, as one coordinated act — the by-value twin of
      * `harness.extensions.reload()` (docs/architecture.md §5.5). Every session holding
      * one of them rendezvous at its run boundary (in-flight runs finish untouched — nothing is
-     * aborted); in that global quiet moment the old halves detach, each `create` half re-runs and
+     * aborted); in that global quiet moment the old halves detach, each `harness` half re-runs and
      * its service is swapped, and the new halves attach; then everyone resumes. Sessions born from
      * the quiet moment on are born with the new definitions. On rendezvous timeout NOTHING changes:
      * the barrier lifts, `BarrierTimeout` names the stuck sessions, and the caller retries later
@@ -670,7 +822,7 @@ export declare class Harness<TContext = unknown> {
      *
      * `services` swaps HOST-registered services (`createHarness({ services })`) in the same quiet
      * moment, for when the shape that changed is the host's rather than an extension's. Those obey
-     * their `replaceable` flag; an extension's own `create` service swaps unconditionally, since
+     * their `replaceable` flag; an extension's own `harness` service swaps unconditionally, since
      * its owner is being replaced along with it.
      *
      * Implementation-only swaps need none of this — `harness.services.replace` (layer 1) lands on
@@ -684,13 +836,13 @@ export declare class Harness<TContext = unknown> {
         readonly drainTimeoutMs?: number;
     }): Promise<void>;
     /**
-     * The service half of one replaced extension: publish what its `create` staged. `replace`
+     * The service half of one replaced extension: publish what its `harness` staged. `replace`
      * rather than unregister + register, so consumers this barrier never gated — other extensions
      * holding a `uses` handle — see no gap; `force` because the owner is being replaced along with
      * it (see `ServiceRegistry.replace`).
      */
     private publishValueService;
-    /** Dispose a `create` result that was staged but never published (default rule: its `close()`). */
+    /** Dispose a `harness` result that was staged but never published (default rule: its `close()`). */
     private disposeStaged;
     /**
      * The barrier itself (docs/architecture.md §5.5), shared by `replaceExtension` and
@@ -701,7 +853,7 @@ export declare class Harness<TContext = unknown> {
      * Whatever happens, every gate is released.
      */
     private withBarrier;
-    /** Resolve the capability set for one session — calling the factory fresh when one was given. */
+    /** Resolve the capability set for one session — the `session` hook, called fresh every time. */
     private resolveCapabilities;
     /**
      * The harness-tier reach handed to a session's extensions: other sessions, and the model
@@ -713,6 +865,13 @@ export declare class Harness<TContext = unknown> {
      */
     private extensionHost;
     private openFromStore;
+    /**
+     * Undo a failed `openFromStore`, newest artifact first. Every step runs even if an earlier one
+     * throws (a cleanup failure is logged, never allowed to mask the open's own error).
+     */
+    private rollbackOpen;
+    /** Every definition this harness mounts, by value then from files. */
+    private allDefinitions;
     private contextFor;
 }
 /**
@@ -726,7 +885,7 @@ export declare class Harness<TContext = unknown> {
  *
  * A worker that dies mid-turn journals no `turn.ended`; to every reader the turn is still
  * running. Opening the session repairs that (the same recovery runs inside `resumeSession`),
- * but opening boots capabilities and a machine just to write two records. This does only the
+ * but opening boots capabilities and an environment just to write two records. This does only the
  * repair: fold the log, and for every frame still inside a turn append `turn.ended` with
  * `reason: "failed"` (and `agent.ended` for a live sub-agent). Returns the events those records
  * project to, so a host that has live subscribers can hand them on — a record appended here