toolroll 0.9.103 → 0.9.105

package/dist/provider-auth.d.ts

@@ -1,143 +0,0 @@
-/**
- * Sign-in pauses: when a provider's sign-in (or API key) stops working, its
- * runs fail in seconds and every retry fails the same way. So an
- * `auth-expired` run takes no strike and no retry: its task goes back to the
- * queue, dispatch for THAT provider pauses (the others keep working), and a
- * person is told once per incident, on every connected messaging channel, what
- * to run. The pause lifts when a run or a sign-in probe on that provider
- * succeeds, or when a person resumes it; one short message says so.
- *
- * One row per incident. At most one open incident per provider (a partial
- * unique index), so however many runs hit it, one notification goes out:
- * its key is `signin:auth-expired:<provider>:<ordinal>:<person>`, the ordinal
- * being the incident's own number for that provider.
- */
-import type { Store } from "./store.js";
-import { type ProviderId } from "./provider.js";
-import type { AuthMode } from "./keys.js";
-/** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
- * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
- * one stays out of the attention list — this one needs a person. */
-export declare const SIGN_IN_KEY_PREFIX = "signin:";
-export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
-export type AuthPause = {
-    id: number;
-    provider: ProviderId;
-    ordinal: number;
-    authMode: AuthMode;
-    openedAt: string;
-    firstRun: number | null;
-    taskRef: number | null;
-    runs: number;
-};
-export declare function providerName(provider: string): string;
-/** The plain reason: "Claude needs you to sign in again". */
-export declare function signInReason(pause: Pick<AuthPause, "provider" | "authMode">): string;
-/** What to run, as a command. */
-export declare function signInCommand(pause: Pick<AuthPause, "provider" | "authMode">): string;
-/** The same command for a chat message: the phone scrub hides anything shaped
- * like a path (`/login` included), so a message names Claude's equivalent
- * `claude auth login`. */
-export declare function messageCommand(pause: Pick<AuthPause, "provider" | "authMode">): string;
-/** One line for status, ready and the console. */
-export declare function signInWords(pause: AuthPause): string;
-/** The open pause for a provider, or null. */
-export declare function authPauseOf(store: Store, provider: string): AuthPause | null;
-/**
- * SQL: whether the pause `pause` (a provider_auth_pause alias) is on one of
- * the task_ref `taskRef`'s current providers — its pins, its working profile,
- * and route legs — so a task re-routed to another provider
- * stops saying it waits on the old one. A task that names none yet (an
- * unpinned planner, whose agent comes from configuration) keeps what the gate
- * found.
- */
-export declare function pauseOnTaskProviders(pause: string, taskRef: string): string;
-/** The open pause the dispatch gate last left this task waiting on, while it
- * is still on one of the task's providers; or null. */
-export declare function authWaitOf(store: Store, taskRef: number): AuthPause | null;
-/** Every open pause, oldest first. */
-export declare function openAuthPauses(store: Store): AuthPause[];
-/**
- * Record an auth-expired run against its provider's pause, opening the
- * incident (and its one notification) when none is open. Called inside the
- * run's own failure transaction. Returns whether this run opened it.
- */
-export declare function pauseForAuth(store: Store, args: {
-    provider: string;
-    authMode: AuthMode | null;
-    runId: number;
-    taskRef: number;
-    now: Date;
-}): {
-    opened: boolean;
-    pause: AuthPause;
-};
-/**
- * Lift a provider's open pause — a run or probe on it succeeded, or a person
- * resumed it — and send the one short "signed in again" message. Returns the
- * number of tasks its incident sent back to the queue, or null when nothing
- * was paused.
- */
-export declare function liftAuthPause(store: Store, provider: string, how: "run" | "probe" | "person", by: string, now: Date, 
-/** For a run: when it started. A run that began before the pause opened proves nothing about the sign-in now. */
-runStartedAt?: Date): {
-    resumed: number;
-    pause: AuthPause;
-} | null;
-/**
- * What a non-spending sign-in probe said. A probe lifts the pause only after
- * one during the same pause saw the provider signed out: a CLI that reports
- * "logged in" while its session cannot refresh must not lift and re-open the
- * pause over and over.
- */
-export declare function noteSignInProbe(store: Store, provider: string, state: string, now: Date): {
-    resumed: number;
-} | null;
-/** How often a paused provider lets one task through as a trial. */
-export declare const AUTH_TRIAL_MS: number;
-/** A trial taken: the pause, when it was taken, and the trial time it replaced. */
-export type AuthTrial = {
-    pauseId: number;
-    takenAt: string;
-    previous: string | null;
-};
-/**
- * Whether this task may go ahead as the paused provider's trial: at most one
- * every AUTH_TRIAL_MS. A trial that works lifts the pause (its run proves the
- * sign-in); one that fails the same way only counts against the open
- * incident, so nobody is told twice. Null when no trial is due.
- */
-export declare function claimAuthTrial(store: Store, pause: AuthPause, now: Date): AuthTrial | null;
-/** Give a trial back when its task never started (its claim failed), so the next pass may take it. */
-export declare function giveBackAuthTrial(store: Store, trial: AuthTrial): void;
-/** What the sign-in gate decided: the open pause the work waits on, or null
- * when it may go ahead; and, when it goes ahead as a pause's trial, how to
- * give that trial back if its claim then fails. */
-export type SignInGate = {
-    waiting: AuthPause | null;
-    giveBack: () => void;
-};
-/**
- * The sign-in gate every road that starts an agent asks before it claims
- * anything: the tick's queue and the roads beside it.
- * Waits when a provider is paused,
- * unless this is the pause's one trial. A waiting task is noted on its
- * task_ref, so the work index says exactly what the gate decided; a task let
- * through is un-noted. A road whose claim fails after a trial calls giveBack.
- */
-export declare function signInGate(store: Store, providers: readonly string[], now: Date, taskRef?: number): SignInGate;
-/** The loop beside the console: every two minutes, probe each paused
- * provider's sign-in (no model, nothing spent) and lift the pause when it
- * works again. Nothing is probed while nothing is paused. */
-export declare function startSignInProbes(store: Store, check: (provider: ProviderId, fresh?: boolean) => Promise<{
-    state: string;
-}>, everyMs?: number): () => void;
-/** The console's view of every open pause: title, command, one action. */
-export declare function signInNotices(store: Store): {
-    provider: string;
-    title: string;
-    command: string;
-    detail: string;
-    resumeLabel: string;
-    resumeHref: string;
-}[];

package/dist/provider-capture.d.ts

@@ -1,34 +0,0 @@
-import type { Store } from "./store.js";
-export declare const CAPTURE_TEXT_LIMIT = 4000;
-export type ProviderCapture = {
-    id: number;
-    run: number;
-    repo: string | null;
-    provider: string;
-    model: string | null;
-    authMode: string | null;
-    exitCode: number | null;
-    code: string | null;
-    text: string;
-    hint: boolean;
-    label: "exhausted" | "not-exhausted" | null;
-    labelledBy: string | null;
-    at: string;
-};
-/** Save one failed attempt's last words. Bookkeeping: it never costs the run anything. */
-export declare function captureProviderFailure(store: Store, input: {
-    run: number;
-    provider: string;
-    model: string | null;
-    authMode: string | null;
-    exitCode: number | null;
-    code: string | null;
-    texts: readonly (string | null | undefined)[];
-}, now: Date): void;
-/** Newest first, the ones mentioning limits at the top. */
-export declare function providerCaptures(store: Store, repos: readonly string[] | null, limit?: number): ProviderCapture[];
-export declare function providerCapture(store: Store, id: number): ProviderCapture | null;
-/** A person's reading of one capture. It marks it for keeping, and nothing routes on it. */
-export declare function labelProviderCapture(store: Store, id: number, label: "exhausted" | "not-exhausted", by: string): boolean;
-/** What goes in a fixture file: the provider's response and which version of what produced it. */
-export declare function captureFixture(capture: ProviderCapture): Record<string, unknown>;

package/dist/provider-connection.d.ts

@@ -1,23 +0,0 @@
-import { run, type ExecResult } from "./exec.js";
-import { type ProviderId } from "./provider.js";
-import { type KeyedProviderId } from "./acp-agents.js";
-import { type AuthMode, type KeyVerdict } from "./keys.js";
-export type ProviderConnection = {
-    state: "connected" | "signed-out" | "not-installed" | "unverified" | "key-present" | "key-works" | "key-refused" | "missing-key";
-    /** A saved key that was just tested: what the provider said. */
-    verdict?: KeyVerdict;
-    mode: AuthMode;
-    email?: string;
-    plan?: string;
-    method?: string;
-    checkedAt: string;
-};
-export type ConnectionChecker = (provider: ProviderId, fresh?: boolean) => Promise<ProviderConnection>;
-export declare function signInFacts(provider: ProviderId, result: ExecResult, now?: Date): ProviderConnection;
-export declare function createConnectionChecker(options?: {
-    probe?: typeof run;
-    home?: string;
-    clock?: () => Date;
-    env?: NodeJS.ProcessEnv;
-    verify?: (provider: KeyedProviderId, key: string) => Promise<KeyVerdict>;
-}): ConnectionChecker;

package/dist/provider-home.d.ts

@@ -1,22 +0,0 @@
-/** The operator's own choices a no-model build keeps. */
-export type ProviderDefaults = {
-    model?: string;
-    alwaysThinking?: boolean;
-    effort?: string;
-};
-export declare function claudeConfigDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
-export declare function codexHomeDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
-/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
-export declare function claudeDefaults(configDir: string): ProviderDefaults;
-/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
-export declare function codexDefaults(codexHome: string): ProviderDefaults;
-/**
- * One Codex launch's CODEX_HOME: a private folder linking the operator's
- * sign-in and sessions. A missing `auth.json` stays missing (an API-key
- * build needs none); a missing `sessions/` is made where Codex would make
- * it, so a resumed build finds the thread its first launch wrote.
- */
-export declare function isolatedCodexHome(source: string, root?: string): {
-    dir: string;
-    cleanup: () => void;
-};

package/dist/provider-limits.d.ts

@@ -1,37 +0,0 @@
-/**
- * Subscription limits (v105): how much of each plan's usage windows is used,
- * as the provider itself says. A subscription costs nothing per run, so these
- * windows (not dollars) are what bind it. Claude says on every turn (a
- * `rate_limit_event` in its stream: the 5-hour and weekly windows); Codex
- * answers when asked (its app server's `account/rateLimits/read`, which spends
- * nothing). The latest reading of each window is kept; the Tasks page shows
- * them beside the monthly budgets.
- */
-import type { Billing } from "./spend.js";
-export type LimitWindow = {
-    window: string;
-    usedPercent: number;
-    windowMinutes: number | null;
-    resetsAt: string | null;
-    reached: boolean;
-};
-/** A provider's reading: its windows (all of them, or `partial` when it named only one), and how it was seen billing. */
-export type LimitReading = {
-    provider: "claude" | "codex";
-    plan: string | null;
-    windows: LimitWindow[];
-    partial?: boolean;
-    billing?: Billing;
-};
-export declare const record: (value: unknown) => Record<string, unknown> | null;
-/** A Claude stream event's limits, or null when it isn't the session's own `rate_limit_event` or says nothing usable.
- * A subagent's (parent_tool_use_id set) is never read: the session reports its own windows each turn, and a
- * subagent-tagged reading can't be told apart from one shaped by the subagent's own traffic (stream-scope.ts). */
-export declare function claudeLimitsOf(event: unknown): LimitReading | null;
-/** Codex's `account/rateLimits/read` answer as a reading, or null. */
-export declare function codexLimitsOf(result: unknown): LimitReading | null;
-export declare function pushLimitSink(next: (reading: LimitReading) => void): () => void;
-/** A reading from a stream; never throws into the run that carried it. */
-export declare function noteLimits(reading: LimitReading | null): void;
-/** A window in words: "5-hour", "Weekly", "Weekly (Opus)". */
-export declare function windowLabel(window: string, minutes: number | null): string;

package/dist/provider.d.ts

@@ -1,369 +0,0 @@
-/**
- * The provider registry: every way this plane can spend money on an agent,
- * in one file (§5's "one door", widened to three harness shapes).
- *
- * A provider here is how to SPAWN a harness and how to READ its envelope —
- * argv dialect, transport, session identity, usage. The briefs, the mailbox
- * protocol, and every custody proof are provider-neutral and live where
- * they always did; this module owns only the dialect differences.
- *
- * Boundary (the architecture test enforces it): only `invoke.ts` may import
- * the spawning surface (`adapterFor`); everything else that needs provider
- * facts uses the non-spending inspection surface (`PROVIDERS`,
- * `inspectionOf`) — identification must never be a way to start an LLM.
- *
- * `openrouter` is deliberately not a fourth transport: it is the codex
- * harness pointed at OpenRouter through `-c` overrides whose keys and
- * values are CONSTANTS below — no caller-supplied dotted keys, values
- * TOML-quoted deterministically, and the API key excluded from every
- * shell the model itself launches (Codex provider review, Q5).
- */
-import { type FenceGrants } from "./agent-fence.js";
-import { type ExecResult, type RunOptions } from "./exec.js";
-import { MODEL_ID, type AgentSpec, type ProviderId } from "./contracts/provider.js";
-export type { AgentSpec, ProviderId } from "./contracts/provider.js";
-export declare const PROVIDER_IDS: readonly ProviderId[];
-export declare function isProviderId(value: string): value is ProviderId;
-/** 'review' (v29) is the reviewer's artifact-only pass — plan-shaped in
- * every clamp: read, comment, never build. */
-export type Phase = "plan" | "build" | "repair" | "review";
-/**
- * Model ids cross providers ("anthropic/claude-sonnet-4.5", "gpt-5-codex",
- * "opus"). Bounded and printable, never leading-dash (argv safety), and no
- * TOML-hostile characters — but NOT alphanumeric-only, which would refuse
- * real ids carrying `/ . : -` (Codex provider review, Q5).
- */
-export { MODEL_ID };
-export declare function validModelId(model: string | null): boolean;
-/** The one semantic request every provider renders into its own argv. */
-export type Invocation = {
-    phase: Phase;
-    brief: string;
-    model: string | null;
-    /** Claude's turn bound. Codex has no equivalent — see `clampTimeout`. */
-    maxTurns: number;
-    permissionMode: string;
-    skipPermissions: boolean;
-    /** Resume this session (repair). Meaningless across providers. */
-    resumeSession: string | null;
-    /** Claude's native dollar cap — the harness stops
-     * itself when spend reaches this. Ignored by providers without one. */
-    maxBudgetUsd?: number;
-    /** A plane-minted session identity, for providers that can START under a
-     * caller-chosen id (gemini `--session-id`). The gateway stamps it
-     * durably BEFORE spawn and requires the envelope's init id to EQUAL it
-     * (Phase 3 A5) — a mismatch is a provider-protocol failure, never a
-     * silent survivor. */
-    startSessionId?: string;
-    /** Sealed reviewer screenshots, attached explicitly by transports without a read tool. */
-    reviewImages?: readonly string[];
-    /** The project's tools for this launch (v80): the provider's own flags
-     * naming exactly those MCP servers and no others. Never rendered for a
-     * review, which keeps its own no-tools isolation. */
-    toolArgv?: readonly string[];
-    /** The agent fence (agent-fence.ts): paths no agent may read or write.
-     * Codex renders it as its own sandbox profile; Claude as deny rules for
-     * its file tools (its shell is fenced by the macOS sandbox around it). */
-    fence?: readonly string[];
-    /** What the fence gives back (agent-fence.ts): Codex renders read-only
-     * paths as "read", Claude's file tools never edit them. */
-    fenceGrants?: FenceGrants;
-    /** The operator's own model choices, for a build routed with no model
-     * (provider-home.ts): the model, Claude's always-on thinking and Codex's
-     * reasoning effort. Never rendered for a review or an explicit model. */
-    inherited?: {
-        model?: string;
-        alwaysThinking?: boolean;
-        effort?: string;
-    };
-    /** More paths Claude's own file tools refuse, beside the fence: home
-     * configuration its CLI still reads itself (so the sandbox around the
-     * whole process can't deny them). */
-    fileToolFence?: readonly string[];
-    /** The task's own folder (its worktree). A Claude build loads no settings
-     * files, so this is where the repository's CLAUDE.md is read from. */
-    workspace?: string;
-    /** A running build's steering folder (steer-mailbox.ts): the absolute path
-     * and the worktree-relative name its brief uses. Claude renders a
-     * PostToolUse hook that says when a note is waiting; every other provider
-     * relies on the brief's own rule to look. */
-    steerFolder?: {
-        dir: string;
-        name: string;
-    };
-    /** Live input (live-input.ts): the brief arrives as the first stdin message
-     * and stdin stays open, so the argv carries `--input-format stream-json`
-     * and never the brief (Claude drops a `-p` prompt once stdin carries
-     * input). Set by the gateway only, for a transport that streams input. */
-    streamInput?: boolean;
-    /** Claude's structured-output floor for a non-review phase: the scout's
-     * report rides the terminal result event instead of a file plan mode
-     * would refuse to write. Ignored by providers without `--json-schema`. */
-    jsonSchema?: Readonly<Record<string, unknown>>;
-    /** Claude tools allowed without asking, for a `dontAsk` launch: the scout's
-     * research and screenshot tools, and nothing that edits or runs commands. */
-    allowedTools?: readonly string[];
-    /** More MCP servers for this launch only, beside the project's own (the
-     * scout's headless browser). Claude-only; ignored for a review. */
-    extraMcpServers?: Readonly<Record<string, unknown>>;
-    /** A research step's project tools: only these servers, each offering only
-     * these read-only actions (Codex's `enabled_tools`). Others are left out. */
-    readOnlyTools?: Readonly<Record<string, readonly string[]>>;
-    /** Why a research step's connected service was left out, by server, when it isn't the usual reason (its grant writes). */
-    researchWithheld?: Readonly<Record<string, string>>;
-};
-export type ProviderRunner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-/** The harness's own account of how a turn ended. */
-export type AgentEnding = {
-    subtype: string | null;
-    turns: number | null;
-};
-/** What every envelope normalizes to, whatever dialect produced it. */
-export type ParsedEnvelope = {
-    sessionId: string | null;
-    /**
-     * A structurally impossible provider envelope. Unlike diagnostic prose,
-     * this is a control signal consumed by the invocation gateway: the
-     * process spent, but its output may not authorize a handoff or resume.
-     */
-    protocolError: string | null;
-    /** The agent's spoken conclusion — diagnostics only, never the handoff. */
-    finalMessage: string | null;
-    /** Claude's schema-validated `structured_output` alone, re-serialized —
-     * never the prose result, even when that prose is JSON. Absent or null
-     * when the turn ran without `--json-schema` or returned none. */
-    structuredOutput?: string | null;
-    /** How the harness said the turn ended (claude: the result's subtype and
-     * turn count) — absent on dialects that carry no such record. */
-    ending?: AgentEnding | null;
-    tokensIn: number | null;
-    tokensOut: number | null;
-    costUsd: number | null;
-    /** The run spent but its cost could not be read (Claude's main result was too large to keep): the gateway charges
-     * the run's dollar cap, or records it unmeasured when none applied. Absent = the cost is what costUsd says. */
-    costUnknown?: boolean;
-    usageRaw: string | null;
-    /**
-     * Whether the provider was seen to initialize (codex: thread.started;
-     * claude streaming: system/init). null = this transport carries no init
-     * signal (legacy buffered fixtures), so absence proves nothing. A `false`
-     * here on a failed run means the harness never came up — config, auth,
-     * or install — and the turn must not be treated as an agent's attempt
-     * (M5 provider audit).
-     */
-    initObserved: boolean | null;
-    /**
-     * Structural proof the MAIN QUERY consumed the prompt (arc 1 finding 15):
-     * true only when the primary result is a success. null = this transport
-     * carries no such signal, and the gateway falls back to its historical
-     * nothing-to-show rule. Never derived from result PROSE — an error
-     * result's diagnostic text must not read as an agent's attempt.
-     */
-    promptConsumed: boolean | null;
-    /**
-     * The harness's own first error message, bounded (2 KiB UTF-8), kept for
-     * refusal words and evidence — DIAGNOSTICS ONLY, control-normalized and
-     * secret-scanned at render, never classification (Phase 3 B6). null =
-     * the transport carries none or none was seen.
-     */
-    diagnostic: string | null;
-    /**
-     * The structural FAILURE terminal, when the harness emitted a typed one
-     * (codex turn.failed, a gemini error terminal) — retained to classify
-     * how the attempt ended (a sign-in that no longer works) AND to block
-     * success ingestion on a failed-but-exit-0 run (C5). null = no structural
-     * failure terminal seen.
-     */
-    structuralTerminal: import("./exhaustion.js").StructuralTerminal | null;
-    /** What an ACP agent itself reported it used — kept on the run, never priced. Absent for every other dialect. */
-    agentReportedUsage?: string | null;
-    /** v140: the exact model the provider itself reported for this turn (Claude: its session's init, or a buffered
-     * result's one `modelUsage` model). Absent or null: not reported — every other dialect today. */
-    modelReported?: string | null;
-    /** An ACP conversation's facts the conformance check reads (acp-client.ts AcpEnvelope): nothing else does. */
-    acp?: {
-        offered: string[];
-        exit: {
-            how: "eof" | "term" | "kill" | "self" | "error";
-            leftover: boolean;
-            timedOut: boolean;
-        } | null;
-        agent: {
-            name: string;
-            version: string;
-        } | null;
-        stop: string | null;
-        /** The conversation broke the protocol (acpParse's protocolError), or null. */
-        protocolError: string | null;
-        /** The plane's isolation probes for a check's first step (invoke.ts), when it ran them. */
-        isolation?: {
-            fileDenied: boolean;
-            envClear: boolean;
-        };
-    };
-};
-type Adapter = {
-    binary: string;
-    argv(invocation: Invocation): string[];
-    /** Environment the launch needs beside the argv (Claude: read the
-     * workspace's CLAUDE.md through `--add-dir`). */
-    env?(invocation: Invocation): Record<string, string>;
-    /** Prompt input for transports that use stdin instead of a bounded OS argument. */
-    stdin?(invocation: Invocation): string | undefined;
-    parse(stdout: string): ParsedEnvelope;
-    /** The production transport when no runner was injected. */
-    defaultRunner: ProviderRunner;
-    /** Other providers' keys, stripped from this provider's environment. Its
-     * own key (API-key mode only) stays: the provider needs it, and its
-     * agent's shell inherits the environment. */
-    extraOmitEnv: readonly string[];
-    /** Normalize the phase's bounded interval. For ordinary current profiles
-     * this is the no-progress watchdog; for repair and legacy profiles it is
-     * a hard wall clock. */
-    clampTimeout(phase: Phase, requestedMs: number): number;
-};
-export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
-/**
- * A build's own setup (plan, build and repair; never a review, which keeps
- * the isolation above). No settings file loads — not the user's, the
- * repository's or the local one — so none of their hooks, plugins or
- * permissions reach the run; Toolroll's one `--settings` (the fence and the
- * steering hook) is all there is. MCP servers come only from `--mcp-config`:
- * the project's named tools, or an explicit empty list. The repository's
- * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
- * the CLI's own (keychain or ~/.claude), which no setting source governs.
- * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
- * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
- * planted user, project and local hooks and MCP servers: none loaded.
- */
-export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
-export declare function claudePluginEnv(env: Readonly<Record<string, string | undefined>>): string[];
-/** Claude's own tools that only make sense with a person to wake them. */
-export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
-/**
- * Whether a failed launch was an installed CLI too old for a build's own
- * setup: it names one of those flags as unknown. Then nothing ran, and the
- * run says so plainly instead of reading as a failed sign-in or bad work.
- */
-export declare function isolationUnsupported(provider: ProviderId, stderr: string): string | null;
-/**
- * Codex's own fail-closed equivalent of `CLAUDE_REVIEW_ISOLATION_ARGV`:
- * read-only sandbox rather than the ordinary `workspace-write` (a reviewer
- * dispatched to codex was, until this, handed a write-capable sandbox —
- * the same class of leak the claude side had), approvals that REFUSE
- * rather than wait on a prompt a headless turn can never answer, and the
- * user's own `~/.codex/config.toml` — which can name arbitrary MCP
- * servers, exactly the surface `--strict-mcp-config` closes for claude —
- * ignored outright.
- */
-/**
- * A Codex build's own setup, the equivalent of Claude's: the operator's
- * config.toml (its MCP servers, model choices, profiles) and execpolicy
- * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
- * linking only the operator's sign-in and sessions (provider-home.ts), so no
- * skills or AGENTS.md of theirs load either. The project's named tools follow
- * as `-c mcp_servers.*` (project-tools.ts).
- */
-export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
-/**
- * The diagnostic discipline (Phase 3 B6/C6): the harness's own words are
- * untrusted bytes headed for refusal screens and notifications — controls
- * and line separators collapse to spaces (the fence's character class),
- * and a line that trips the secret scanner is REPLACED, never quoted.
- */
-export declare function safeDiagnostic(text: string): string | null;
-/** EVERY provider credential — what a version/help/which PROBE strips,
- * since a feature check needs no key at all (Codex gemini verify,
- * finding 2). Agent spawns keep their own; probes keep none. */
-export declare const ALL_CREDENTIAL_ENV: readonly string[];
-/**
- * The spawning surface. Imported by invoke.ts and NOWHERE else — the
- * architecture test reads imports, not string literals, because provider
- * ids and binary names are legitimately the same words elsewhere.
- */
-export declare function adapterFor(provider: ProviderId): Adapter;
-/**
- * The provider audit: what each harness supports, what we actually pass,
- * and what user-global configuration still reaches an unattended run.
- * None of this changes an invocation — it states facts an operator reads
- * on `providers`. Claude and Codex builds now run in their own setup
- * (`enforced`); Gemini's flag is still only reported.
- */
-export type ProviderAudit = {
-    /** How output reaches us — and therefore which signals can exist at all. */
-    transport: "buffered-json" | "streaming-jsonl" | "acp-jsonrpc";
-    /** Whether a later invocation can resume this provider's session. */
-    resume: "native" | "none";
-    /** The event whose absence on a failed run means "never initialized".
-     * CAPABILITY metadata, not a per-run observation (arc 1 finding 16):
-     * whether a given run actually saw it lives in ParsedEnvelope.initObserved. */
-    initSignal: "thread.started" | "system-init" | "init-event" | "acp-session" | "none";
-    /** How session identity is established: "announced" = read back from the
-     * harness's own stream; "minted" = the PLANE chooses the id pre-spawn
-     * (gemini --session-id) and the envelope must echo it (Phase 3 A5). */
-    sessionIdentity: "announced" | "minted";
-    /**
-     * Whether exit 0 is believed on its own (Phase 3 A4). "required" =
-     * the transport carries a structural terminal signal and the gateway
-     * accepts a zero exit ONLY with init observed AND promptConsumed true —
-     * a missing, truncated, or error-status terminal is a provider-protocol
-     * failure BEFORE handoff ingestion. "none" = today's exit-code
-     * discipline, byte-identical for tier-1 providers.
-     */
-    terminalContract: "required" | "none";
-    isolation: {
-        /** The harness's hermetic flag, if it has one. */
-        flag: string | null;
-        /** Whether that flag preserves resume. false = documented conflict. */
-        resumeSafe: boolean | null;
-        /** Whether every build, fresh or resumed, passes it. */
-        enforced: boolean;
-    };
-    /** What still reaches a build: its own sources and the user surfaces left. */
-    configSurface: readonly string[];
-};
-/** Read-only facts about a provider — safe anywhere, spawns nothing. */
-/**
- * The money capability matrix (design v3 finding 14): what each harness
- * can PROVE about money, stated as data. Codex and OpenRouter report
- * billable usage only at turn end (cumulative across resumed sessions),
- * so no mid-run cap exists to hold.
- */
-export type ProviderMoneyCapabilities = {
-    /** Usage events arrive during the run, not only at the end. */
-    incrementalUsage: boolean;
-    /** The harness's own dollar-cap flag, when one exists. */
-    nativeDollarCapFlag: string | null;
-    usageSemantics: "per-invocation" | "cumulative-session";
-};
-export declare const MONEY_CAPABILITIES: Record<ProviderId, ProviderMoneyCapabilities>;
-export declare function auditOf(provider: ProviderId): ProviderAudit;
-/**
- * A spec a person or a config row proposed, validated to a complete pair.
- * openrouter REQUIRES a model: there is no meaningful harness default
- * across a 300-model catalog.
- */
-export declare function validateSpec(spec: AgentSpec): {
-    ok: true;
-} | {
-    ok: false;
-    problem: string;
-};
-/**
- * Whether this provider reports dollar cost. A schedule's weekly limit interacts:
- * a ceiling against an unmeasured provider fails closed by design, so the
- * approval surfaces refuse the combination outright.
- */
-export declare function reportsCost(provider: ProviderId): boolean;
-/** The non-spending inspection surface: what `toolroll providers` reports. */
-export type ProviderInspection = {
-    id: ProviderId;
-    binary: string;
-    /** argv of a CHEAP identity probe, or null when none exists without spend. */
-    identityProbe: readonly string[] | null;
-    /** Env var whose PRESENCE matters (never its value). */
-    requiresEnv: string | null;
-    measuresCost: boolean;
-};
-export declare function inspectionOf(provider: ProviderId): ProviderInspection;