specrails-core 6.3.0 → 6.5.0

package/dist/agent-runtime/graph/nodes.js

@@ -1,14 +1,14 @@
 import { guardrailEnabled } from '../guardrails.js';
 import { verificationFailureSummary } from '../verification-diagnostics.js';
 import { addDeveloperChecks, bindPlan, expandedPlanCommands, initializeVerificationPlan, readVerificationPlan, validateProposedChecks } from '../verification-plan.js';
-import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { OpenSpecTools } from '../openspec.js';
 import { candidateManifest, fingerprintCandidate, frozenAcceptanceCriteria, inspectPipeline, recordAcceptance, transitionPipeline, validateAcceptanceReport, verifyPipeline, } from '../../pipeline/pipeline-state.js';
 import { ARCHITECT_OUTPUT_SCHEMA, DEVELOPER_OUTPUT_SCHEMA, REVIEW_OUTPUT_SCHEMA, correctionInstructions, deepenInstructions, roleInstructions } from '../prompts.js';
 import { archive, child, journal, object, parseArchitecture, proposedVerification, write, writeDesignConfidence } from './artifacts.js';
 import { evaluateReview } from './review-policy.js';
-import { hostPreconditionFailure, installEnvironment, isEnvironmentFailure } from '../compact/environment.js';
+import { isEnvironmentFailure } from '../compact/environment.js';
+import { hostPreconditionMessage, preconditionBlock, repairEnvironment } from '../verification-repair.js';
 import { unreachedTestFiles, unreachedTestsReason } from '../compact/test-reachability.js';
 import { exitCodeContradiction, exitHonestyReason } from '../compact/exit-code-honesty.js';
 import { boundedReviewManifest, reviewChanges } from '../review-context.js';
@@ -287,52 +287,6 @@ function fixerNode(deps) {
         },
     };
 }
-/** Where a missing dependency install belongs: the nearest directory with a lockfile or manifest above the failing command, else the repository root. */
-const INSTALL_MARKERS = ['package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb', 'requirements.txt', 'pyproject.toml', 'go.mod', 'Cargo.toml'];
-function installRoots(context, commands) {
-    const roots = [];
-    for (const command of commands) {
-        const repository = context.repositories.find(repo => repo.id === command.repositoryId);
-        if (!repository)
-            continue;
-        let directory = command.cwd;
-        let chosen = repository.path;
-        for (;;) {
-            const relative = path.relative(repository.path, directory);
-            if (relative.startsWith('..') || path.isAbsolute(relative))
-                break;
-            if (INSTALL_MARKERS.some(name => existsSync(path.join(directory, name)))) {
-                chosen = directory;
-                break;
-            }
-            if (!relative)
-                break;
-            directory = path.dirname(directory);
-        }
-        roots.push(chosen);
-    }
-    // Every repository root stays a candidate: its plan is a no-op when it is already installed.
-    return [...new Set([...roots, ...context.repositories.map(repository => repository.path)])];
-}
-/** A directory as the log should name it: relative to the checkout that contains it. */
-function checkoutRelative(context, directory) {
-    const repository = context.repositories.find(repo => { const relative = path.relative(repo.path, directory); return !relative.startsWith('..') && !path.isAbsolute(relative); });
-    return repository ? path.relative(repository.path, directory).split(path.sep).join('/') || '.' : directory;
-}
-function hostPreconditionMessage(reason, command, args, directory) {
-    return `Verification cannot run in this environment: ${reason} (\`${[command, ...args].join(' ')}\` in ${directory}). This is not a defect in the change, so no correction round was started. Make it available to Specrails (for example in the login shell profile Specrails loads, or with a refreshed registry token), then resume.`;
-}
-/** A failed check the host must unblock (credentials, registry access, a missing variable): no correction round can repair it. */
-function preconditionBlock(context, receipt) {
-    for (const command of receipt.commands) {
-        if (command.exitCode === 0)
-            continue;
-        const reason = hostPreconditionFailure(command.output);
-        if (reason)
-            return hostPreconditionMessage(reason, command.command, command.args, checkoutRelative(context, command.cwd));
-    }
-    return undefined;
-}
 function verifyNode(deps) {
     const { context, note, config } = deps;
     const roots = context.repositories.map(repository => repository.path);
@@ -388,25 +342,25 @@ function verifyNode(deps) {
                 note('fixer', 'Verification failed on the environment, not on the change; stopping for the host instead of starting a correction round.');
                 return { status: 'blocked', error: reason, usage: NO_SPEND };
             };
+            const blockerMessage = (blocker) => hostPreconditionMessage(blocker.reason, blocker.command, blocker.args, blocker.cwd);
             let precondition = receipt.valid ? undefined : preconditionBlock(context, receipt);
             if (precondition)
-                return hostBlocked(precondition);
+                return hostBlocked(blockerMessage(precondition));
             // A failure that is really a missing toolchain or dependency (exit 127,
             // "command not found", "Cannot find module"…) is the HOST's to fix, not
             // the model's — for every developer: a fresh worktree has no
             // node_modules whatever wrote the code. Install once where the failing
             // command runs and re-verify; only a second failure becomes feedback.
             if (!receipt.valid && guardrailEnabled(config.guardrails, 'environment-repair') && receipt.commands.some(command => isEnvironmentFailure(command.exitCode, command.output))) {
-                const installs = installEnvironment(installRoots(context, receipt.commands.filter(command => command.exitCode !== 0)), { failureOutput: receipt.commands.map(command => command.output).join('\n'), lockfileRepair: guardrailEnabled(config.guardrails, 'lockfile-repair'), onEvent: event => note('developer', event.kind === 'text' ? event.text ?? '' : `[environment] ${event.tool ?? ''} ${event.detail ?? ''}`.trim()) });
-                const refused = installs.find(outcome => outcome.precondition);
-                if (refused)
-                    return hostBlocked(hostPreconditionMessage(`installing its dependencies failed because ${refused.precondition}`, refused.command, refused.args, checkoutRelative(context, refused.root)));
-                if (installs.some(outcome => outcome.ok)) {
+                const repair = repairEnvironment(context, receipt, config.guardrails, text => note('developer', text));
+                if (repair.refused)
+                    return hostBlocked(blockerMessage(repair.refused));
+                if (repair.installs.some(outcome => outcome.ok)) {
                     note('developer', 'Verification failed on the environment (missing dependencies or tools); the host installed them and is verifying again.');
                     receipt = await run();
                     precondition = receipt.valid ? undefined : preconditionBlock(context, receipt);
                     if (precondition)
-                        return hostBlocked(precondition);
+                        return hostBlocked(blockerMessage(precondition));
                 }
             }
             const evidence = {

package/dist/agent-runtime/prompts.d.ts

@@ -3,7 +3,7 @@ import type { PipelineContext, VerificationCommand } from '../pipeline/pipeline-
 import { type ReviewPolicy } from './graph/review-policy.js';
 import type { DeveloperRecord } from './graph/state.js';
 /** Bump whenever the wording changes: the version is part of the frozen run identity. */
-export declare const ROLE_INSTRUCTIONS_VERSION = "13";
+export declare const ROLE_INSTRUCTIONS_VERSION = "14";
 export interface RoleFeedback {
     verification?: unknown;
     review?: unknown;

package/dist/agent-runtime/prompts.js

@@ -1,7 +1,7 @@
 import { isBuiltinRole } from './executor-types.js';
 import { DEFAULT_REVIEW_POLICY, REVIEW_ASPECTS } from './graph/review-policy.js';
 /** Bump whenever the wording changes: the version is part of the frozen run identity. */
-export const ROLE_INSTRUCTIONS_VERSION = '13';
+export const ROLE_INSTRUCTIONS_VERSION = '14';
 const OUTPUT_TAIL = 6_000;
 /** One senior engineer, rendered once per role prompt (never repeated inside it): the identity the implement pipeline's roles share. */
 const ENGINEER = 'a T-shaped principal engineer with decades of delivery across web, mobile and backend systems: deep in software design and testing, broad across product, UX, data, security, infrastructure and operations; fluent in hexagonal (ports and adapters) architecture, SOLID, design patterns, Clean Code, The Pragmatic Programmer, refactoring, legacy-code seams and AI-assisted development. You work for the user, the operator and the next maintainer, and you treat AI-generated code, including your own, with the scepticism owed to any untrusted contribution.';
@@ -116,7 +116,7 @@ function boundarySection(role, custom = false) {
         role === 'developer'
             ? [
                 '- Edit only the repositories in scope, and only inside a repository\'s scope when it declares one. Prefer the smallest change that fully satisfies the tasks; do not refactor, reformat, rename or upgrade unrelated code, tests or configuration. On a fixer turn, a failing host test in that scope may receive the minimal compatibility repair described in the correction instructions; preserve its required behavior and assertions. Other unrelated problems belong in your summary.',
-                '- Never edit package-manager, registry, credential, CI or environment configuration (for example `.npmrc`, `.yarnrc*`, `.env*`, CI workflows) to make a command work. A missing credential, environment variable, registry access or tool is the host\'s to fix: report it under `incomplete` with the exact error.',
+                '- Never edit package-manager, registry, credential, CI or environment configuration (for example `.npmrc`, `.yarnrc*`, `.env*`, CI workflows) to make a command work. A missing credential, environment variable, registry access or tool is the host\'s to fix: report it under `incomplete` with the exact error. Installing a documented, idempotent toolchain artifact inside the admitted workspace (for example a Playwright browser with `npx playwright install <browser>`, or a Python virtualenv) is allowed and must be reported under verification; editing package-manager, registry, credential, CI or environment configuration remains forbidden.',
                 '- Check with the narrowest command that covers what you touched (the specific test files or test names), never the whole checkout or every workspace; Core runs the complete verification plan after your turn.',
             ].join('\n')
             : role === 'architect' ? '- Read code without modifying it. Author OpenSpec artifacts only through the supplied scoped workflow tools.' + (custom ? '' : ' Return confidence and verification metadata in JSON.') : '- This role is read-only. Do not create, edit or delete files' + (custom ? '.' : '; return your result as the requested JSON object.'),
@@ -191,7 +191,7 @@ function fixerSection(verification, definition) {
         '4. Fix the cause, not the symptom: a repair that satisfies the assertion while leaving the defect, or that special-cases the test input, is not a fix. Fix incorrect implementation behavior. A failing mandatory host test inside the admitted repository/workspace may also receive a minimal compatibility repair when you prove that its expected behavior is unchanged. For example, a source assertion broken only by formatting may tolerate whitespace while retaining every required operand and guard. This applies even to a pre-existing test outside the current changed-file list. Explain the original expectation and why the repair still rejects the prohibited behavior. Never weaken an assertion, delete or skip a test, hardcode success, change acceptance criteria, add dependencies or widen the repair beyond the diagnosed failure.',
         '5. A test file the host reports as never executed must be wired into the repository\'s test command (the test script or runner configuration) and then made to pass.',
         '6. Confirm the repair with the focused test command and a negative case for any repaired assertion: removing a required safety guard or returning the wrong value must still fail. Preserve the original test exit status; never pipe test execution through grep/head or another command that masks it. Capture stdout/stderr in a temporary log and inspect that log separately. Core runs the complete verification plan after your turn.',
-        '7. Inspect only the reported files, direct dependencies and the evidence needed to establish the cause. Never edit outside the admitted repository/workspace, credentials, environment or unrelated configuration. For an external or unrepairable scope blocker, make no speculative edits and report the exact error, observed evidence and required action. `proposal.md`, `design.md` and the specs remain frozen; only tick completed tasks.',
+        '7. Inspect only the reported files, direct dependencies and the evidence needed to establish the cause. Never edit outside the admitted repository/workspace, credentials, environment or unrelated configuration. When the diagnosed cause is a host precondition or environment blocker (missing network, credentials, environment variable, toolchain, setup command or an out-of-scope repository), make no speculative edits, state in summary that the candidate was intentionally left unchanged, and return `blocker` as {"kind":"network|credential|environment-variable|toolchain|setup|environment|scope","command":"…","cwd":"…","evidence":"exact error","requiredAction":"one imperative sentence the host can act on"}. `proposal.md`, `design.md` and the specs remain frozen; only tick completed tasks.',
         '8. Return the requested JSON contract. Include the diagnosis, exact focused commands and original exit codes, repair and preserved assertion in summary. List every unresolved failure and its reason under incomplete, even when the implementation tasks are already ticked. A failed test remains failed until real host verification passes.',
     ] : [definition, ''];
     return [...lines, ...developerTail(verification)];
@@ -208,7 +208,7 @@ function developerSection(verification, corrections, definition) {
         '1. Load and execute openspec-apply-change through the supplied binding. Consult its status and instructions apply, read the context files OpenSpec returns, then the relevant existing code and tests.',
         '2. Work task by task in order. Use test-driven development: write or extend the test first, make it pass with the smallest correct change, then tidy up. Run only focused tests that cover what you touched while iterating. Core owns the complete verification plan and runs it after your turn; do not duplicate that full run. Fix the precise failures Core returns on a correction pass.',
         '3. Immediately after completing each task, mark it `- [x]` in `tasks.md`; do not postpone all progress updates until the end of the phase. Only mark tasks whose code and tests are complete. Change nothing else in `tasks.md`, and never edit `proposal.md`, `design.md` or the specs: those documents are frozen, and editing them invalidates the run. If a task cannot be completed, leave it `- [ ]` and list it under `incomplete` with the reason.',
-        '4. Keep the implementation consistent with the repository: naming, error handling, import style, formatting and existing utilities. Do not add dependencies unless the design requires them. Change only what the tasks require: the diff should contain the requested change and its tests, nothing else.',
+        '4. Keep the implementation consistent with the repository: naming, error handling, import style, formatting and existing utilities. Do not add dependencies unless the design requires them. Change only what the tasks require: the diff should contain the requested change and its tests, nothing else. Never validate with a temporary configuration, alternate runner or local browser the host verification plan does not use, and never delete such a file to hide it: the host runs the plan as-is. When a required tool is missing, install it through the project\'s documented command or report it as a blocker.',
         'Blast radius: the files design.md and tasks.md name are your boundary. Touch a file outside it only when a task cannot be completed otherwise; keep that edit to the strict need and explain it in summary. Inside a file, change only the lines the task needs: no reformatting, import reordering, renames, type widening, comment rewrites or "while I am here" fixes. Leave an unrelated problem alone and mention it in summary. Keep public signatures, exported contracts, schemas and persisted formats as the design states. Never delete or rewrite a test a task does not name, and never regenerate lockfiles, snapshots or generated files unless the task\'s own change requires it.',
         'Quality bar: write code a senior maintainer would merge unchanged. Intention-revealing names from the domain vocabulary; small functions that do one thing at one level of abstraction; guard clauses over nested conditionals; no boolean flag parameters, magic values or hidden side effects; immutability by default and explicit types at module boundaries; parse and validate at the boundary, trust typed values inside; every error path handled the way neighbouring code handles it (fail fast at the boundary, never swallow, errors carry context); domain logic out of adapters and dependencies pointing inward as the repository already does; comments explain why, never what; no dead code, commented-out code, debug output, TODO placeholders or speculative options.',
         'Engineering judgement: understand before you change and never program by coincidence (if you cannot explain why it works, you are not done); never delete or bypass a guard, branch or workaround you cannot explain. Handle what tests rarely reach: empty, huge and malformed inputs, boundary values, time zones and Unicode, partial failures, retries with idempotency, races, cancellation, timeouts and resource cleanup (handles, listeners, subscriptions, temp files). Security hygiene is non-negotiable: parameterized queries, escaped output, no secrets or personal data in code or logs, least privilege, authorization where the repository enforces it. Logs and metrics follow the repository\'s conventions; migrations and persisted-format changes stay additive and backward compatible. Verify every API, signature and option against the source or installed types, never from memory. Do the simplest thing that fully works, then refactor only inside the blast radius. Tests are the specification: one behavior per test (arrange, act, assert) covering inputs, outputs, side effects and errors; no logic in tests; mock only at real boundaries; deterministic; failing without the change; in the repository\'s existing style. A task is done only when its code, tests and every artifact it makes stale (localized strings in every shipped locale, documentation, schemas, configuration examples) are updated and its focused checks pass.',
@@ -220,14 +220,18 @@ function developerSection(verification, corrections, definition) {
     return [...lines, ...developerTail(verification)];
 }
 /** Verification commands, durable-progress guidance and the output contract shared by the developer and fixer stances. */
+/** The complete host verification plan a write role must see: what Core runs after the turn, so nothing is validated through a bypass the plan does not use. */
+function hostPlanSection(verification) {
+    if (!verification?.length)
+        return [];
+    return [
+        '', 'Core owns these complete verification commands and will run them after your turn. Use focused tests while iterating instead of repeating this plan:',
+        ...verification.map(command => `- repository \`${command.repositoryId}\`${command.cwd ? ' in `' + command.cwd + '`' : ''}: \`${shellWords(command)}\``),
+    ];
+}
 function developerTail(verification) {
-    const lines = [];
-    if (verification?.length) {
-        lines.push('', 'Core owns these complete verification commands and will run them after your turn. Use focused tests while iterating instead of repeating this plan:');
-        for (const command of verification)
-            lines.push(`- repository \`${command.repositoryId}\`${command.cwd ? ' in `' + command.cwd + '`' : ''}: \`${shellWords(command)}\``);
-    }
-    lines.push('', '## Durable implementation progress', '', 'When loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.', 'After each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly.', '', '## Output contract', '', 'Finish with exactly one JSON object and nothing after it: no prose after the object, no Markdown fence.', '', '```', '{"summary":"What you implemented and how","files":["src/feature.ts"],"tests":["src/feature.test.ts"],"verification":"npm test passed (12 tests)","incomplete":[{"task":"3. …","reason":"why it could not be completed"}]}', '```', '', '- `files` and `tests`: repository-relative paths you created or modified (test files appear in `tests`, other files in `files`).', '- `verification`: the commands you ran and their outcome, or `none` when no shell was available.', '- `incomplete`: every task still `- [ ]` in `tasks.md`, with its reason; an empty array when everything is done.', '- Do not paste full test logs; the reviewer reads the real verification evidence separately.', '');
+    const lines = [...hostPlanSection(verification)];
+    lines.push('', '## Durable implementation progress', '', 'When loading the official apply skill, read its savedProgress handoff before repeating investigation. Reconcile it with the current diff and tasks; it is advisory history, never accepted verification evidence. Preserve completed work and previously discovered test commands or environment blockers. Recheck a blocker only when its relevant condition changed.', 'After each completed task, and whenever the next action or a blocker changes, call the scoped workflow action write_progress with progress: {summary, completedTasks, nextTasks, checks: [{command, outcome}], blockers}. Replace the previous handoff with a concise current account (at most 8 KB); include exact focused test commands, original exit outcomes, relevant paths and the next discriminating action. Keep nextTasks concrete enough for a fresh session to continue unfinished work. Do not include full logs, credentials or claims that old checks authorize acceptance. The host persists this record outside the frozen OpenSpec artifacts. Use read_progress to refresh it. If interrupted, the next session receives it from load_skill; do not write runtime files directly.', '', '## Output contract', '', 'Finish with exactly one JSON object and nothing after it: no prose after the object, no Markdown fence.', '', '```', '{"summary":"What you implemented and how","files":["src/feature.ts"],"tests":["src/feature.test.ts"],"verification":"npm test passed (12 tests)","incomplete":[{"task":"3. …","reason":"why it could not be completed"}],"blocker":{"kind":"toolchain","command":"npx playwright test","cwd":".","evidence":"exact error","requiredAction":"Run npx playwright install chromium"}}', '```', '', '- `files` and `tests`: repository-relative paths you created or modified (test files appear in `tests`, other files in `files`).', '- `verification`: the commands you ran and their outcome, or `none` when no shell was available.', '- `incomplete`: every task still `- [ ]` in `tasks.md`, with its reason; an empty array when everything is done.', '- `blocker`: only when the cause lies outside the change; omit otherwise. The host ends the run with your `requiredAction` instead of starting another correction round.', '- Do not paste full test logs; the reviewer reads the real verification evidence separately.', '');
     return lines;
 }
 function reviewerSection(policy, criteria, definition) {
@@ -388,7 +392,9 @@ export function roleInstructions(roleOrDescriptor, context, change, options = {}
             `Workspace access: ${roleOrDescriptor.access}. OpenSpec artifact permission: ${roleOrDescriptor.artifacts}.`, '',
             'Execute only this assigned role. Traversal, retries, verification, approval, archive and delivery belong to Core. Do not spawn another role or change runtime metadata.',
             ...boundarySection(roleOrDescriptor.access === 'write' ? 'developer' : roleOrDescriptor.artifacts === 'all' ? 'architect' : 'reviewer', true),
-            ...conventionsSection(), ...scopeSection(context, change), ...feedbackSection(options.feedback),
+            ...conventionsSection(), ...scopeSection(context, change),
+            ...(roleOrDescriptor.access === 'write' ? hostPlanSection(options.verification) : []),
+            ...feedbackSection(options.feedback),
         ].join('\n').trimEnd() + '\n';
     }
     const feedback = feedbackSection(options.feedback);

package/dist/agent-runtime/session/application/active-session.d.ts

@@ -0,0 +1,176 @@
+import type { SessionEventEnvelope, ToolActivity } from '../domain/events.js';
+import { type SessionSnapshot } from '../domain/snapshot.js';
+import { type SessionPolicy, type SubagentPhase, type Usage } from '../domain/types.js';
+import { type RateCard } from '../domain/usage.js';
+import type { Clock, CloseReason, DriverFactory, DriverInput, Ids, SessionJournal } from '../ports.js';
+import { type OutputLimits } from './output-buffer.js';
+export interface ActiveSessionDeps {
+    journal: SessionJournal;
+    factory: DriverFactory;
+    clock: Clock;
+    ids: Ids;
+    rateCard: (driver: string, model: string) => RateCard | null;
+    publish: (envelopes: SessionEventEnvelope[]) => void;
+    /** Called whenever the session's process liveness or recency changes (LRU bookkeeping). */
+    touched: (session: ActiveSession) => void;
+    outputLimits?: OutputLimits;
+    /** How long `interrupt` waits for the provider before ending the process. */
+    interruptGraceMs?: number;
+    /** Delay before buffered deltas are flushed. */
+    flushMs?: number;
+}
+export interface SessionConfig {
+    cwd: string;
+    model: string;
+    effort: string | null;
+    systemPrompt: string | null;
+    policy: SessionPolicy;
+}
+/** How work that was running ends when the process goes away. */
+interface Teardown {
+    turnStatus: 'stopped' | 'interrupted' | 'failed';
+    subagentPhase: SubagentPhase;
+    reason: string;
+    error?: string;
+}
+/**
+ * Coordinates one session: turns driver facts into journaled events, owns the
+ * provider process lifecycle, phases, settlement, limits and teardown.
+ * All mutation goes through `commit`, which folds before appending, so the
+ * journal never holds an event the domain would reject.
+ */
+export declare class ActiveSession {
+    readonly sessionId: string;
+    private config;
+    private readonly deps;
+    state: SessionSnapshot;
+    private driver;
+    private opening;
+    private generation;
+    /** Generation whose events are accepted (the live or opening process); null when none. */
+    private liveGeneration;
+    private closing;
+    private baseline;
+    private readonly timers;
+    private readonly output;
+    private readonly descriptor;
+    /** Inputs held back for drivers without a native input queue. */
+    private readonly heldInputs;
+    /** Inputs the application wrote on its own (policy-driven turns). */
+    private readonly systemInputIds;
+    private pendingDeferred;
+    private roster;
+    private handoffs;
+    private finishedSinceLastTurn;
+    /** Finished delegated sub-agents whose results the agent has not received yet. */
+    private readonly delegatedResults;
+    private lastUserTurnAt;
+    lastUsedAt: number;
+    constructor(sessionId: string, snapshot: SessionSnapshot, config: SessionConfig, deps: ActiveSessionDeps);
+    get processAlive(): boolean;
+    get isBusy(): boolean;
+    get policy(): SessionPolicy;
+    send(input: {
+        inputId: string;
+        text: string;
+        attachments?: DriverInput['attachments'];
+        delivery: 'queue' | 'steer';
+    }): Promise<{
+        inputId: string;
+        state: string;
+    }>;
+    interrupt(): Promise<string | null>;
+    stopSubagents(ids?: string[]): Promise<string[]>;
+    /**
+     * Policy says no sub-agents, yet the provider started one (a provider switch
+     * can be ignored by a model or CLI version). Stop it and say so: the policy
+     * holds whatever the provider's own switch does.
+     */
+    private blockSubagent;
+    /** Apply now when nothing is running; otherwise defer to the next idle point. */
+    update(changes: {
+        model?: string;
+        effort?: string;
+        systemPrompt?: string;
+        policy?: SessionPolicy;
+    }): Promise<'applied' | 'deferred'>;
+    close(reason: string): Promise<void>;
+    /**
+     * Record work a previous host left running as interrupted. Nothing is
+     * restarted: the next user input carries the interruption notice instead.
+     */
+    recoverAfterHostLoss(reason: 'restart' | 'host_lost'): void;
+    /** Retire the provider process; running work ends as described by `teardown`. */
+    retire(reason: CloseReason, teardown: Teardown): Promise<void>;
+    private deliver;
+    private ensureDriver;
+    private onDriverEvent;
+    private handleDriverEvent;
+    private startTurn;
+    private completeTurn;
+    /**
+     * Inputs whose receipts never reported completion are completed with their
+     * turn: the ones that opened it and the ones steered into it.
+     */
+    private completeTurnInputs;
+    private settlePhaseAfterTurn;
+    private afterSubagentChange;
+    private onSettled;
+    /** Live = running in our tree and, when the provider reports a roster, still on it. */
+    private liveCount;
+    private maybeResumeAgent;
+    /** Give the agent the results of delegated sub-agents it has not seen. */
+    private maybeDeliverDelegatedResults;
+    /** Running sub-agents Core launched for this session. */
+    delegatedLive(): string[];
+    delegatedStarted(child: {
+        subagentId: string;
+        description: string;
+        agentType: string;
+        prompt: string;
+        driver: string;
+        model: string;
+    }): void;
+    delegatedOutput(subagentId: string, event: {
+        channel: 'text';
+        delta: string;
+    } | {
+        channel: 'tool';
+        tool: ToolActivity;
+    }): void;
+    /**
+     * A delegated child ended. Its usage is its own provider's spend (billed
+     * separately); unless a host already collected the result, the agent gets it
+     * when the session next settles.
+     */
+    delegatedFinished(subagentId: string, outcome: {
+        status: 'completed' | 'failed' | 'stopped' | 'interrupted';
+        text: string;
+        usage: Usage | null;
+        reason?: string;
+        collected: boolean;
+    }): void;
+    /** A host received these results through a wait; never inject them again. */
+    collectDelegated(subagentIds: readonly string[]): void;
+    private enterIdle;
+    private enterBackground;
+    private idleTeardown;
+    private armTurnInactivity;
+    private markActivity;
+    private applyChanges;
+    private releaseHeldInput;
+    /** End whatever was running; used by retire and unexpected exits. */
+    private endRunningWork;
+    private turnUsage;
+    private subagentUsage;
+    private commitBuffered;
+    /**
+     * Validate (fold) then append atomically, then publish. Buffered deltas are
+     * flushed first so ordering is preserved.
+     */
+    private commit;
+    private requireTurn;
+    private assertOpen;
+    private touch;
+}
+export {};