agentruntime

type ACPAgentPreset struct {
	// ID is the profile ID suggested for the preset.
	ID string
	// Title is the human name shown in the picker.
	Title string
	// Command is the argv that starts the agent's ACP server.
	Command []string
	// Note explains a non-obvious installation or naming detail.
	Note string
	// Driver is the ACP flavor. It is generic-acp for every verified preset
	// today; a flavor is only introduced when real interop exposes a protocol
	// gap that generic ACP cannot describe.
	Driver workerdriver.WorkerDriver
}

type ACPChildBackend struct {
	Runtime  *SessionRuntime
	Settings *config.Settings
	// Worktrees is the Runtime-owned worktree manager used for child isolation
	// and immutable change-set capture. It may be nil for headless tests.
	Worktrees *WorktreeManager
	// contains filtered or unexported fields
}

type ACPWorkerBridge struct{}

type ACPWorkerInvocation struct {
	Profile               config.ACPAgentProfile
	Contract              SubagentTaskContract
	WorkDir               string
	AdditionalDirectories []string
	// ResumeSessionID requests an explicit reconnect through session/resume or
	// session/load (Runtime chooses from advertised capabilities). It is used
	// only for an already-created remote session; the caller must not send a
	// prompt through the old connection after this value is set.
	ResumeSessionID string
	Launcher        acpclient.Launcher
	ClientInfo      acpclient.Implementation
	// ReadTextFile advertises the Runtime-owned read-only filesystem bridge.
	// WriteTextFile advertises the Runtime-owned scoped write bridge, and
	// TerminalAccess opts into the profile-gated terminal bridge.
	ReadTextFile   bool
	WriteTextFile  bool
	TerminalAccess bool
	// MCPBridgeAvailable reports that this process has a live loopback worker
	// bridge. The Runtime sets it when (and only when) the bridge is running;
	// a false value degrades MCPHTTP without affecting the prompt.
	MCPBridgeAvailable bool
	// PrepareMCPServers is called after initialize negotiated the capability set.
	// It returns the session/new mcpServers payload and a revoke function. A
	// preparation failure only logs and degrades the bridge; the prompt proceeds.
	PrepareMCPServers func(workerdriver.WorkerCapabilities) ([]any, func(), error)
	HandleRequest     acpclient.RequestHandler
	OnNotification    func(acpclient.Message)
	// OnEvent receives canonical, non-terminal child events. The proxy owns the
	// single EventRunFinished terminal event.
	OnEvent func(agentpkg.Event)
	// contains filtered or unexported fields
}

type ACPWorkerProfileDescriptor struct {
	ID        string                   `json:"id"`
	Title     string                   `json:"title,omitempty"`
	Transport config.ACPAgentTransport `json:"transport"`
	// Model is the external Agent's configured default model ID, or empty when
	// the worker keeps its own default. It is display/management metadata only:
	// the Runtime owns how it is applied to a worker session.
	Model string `json:"model,omitempty"`
	// Endpoint is the administrator-configured remote URL with any query or
	// fragment removed. Empty for stdio profiles.
	Endpoint              string                     `json:"endpoint,omitempty"`
	Enabled               bool                       `json:"enabled"`
	RouterEligible        bool                       `json:"routerEligible"`
	PermissionPolicy      config.ACPPermissionPolicy `json:"permissionPolicy"`
	MaxConcurrentChildren int                        `json:"maxConcurrentChildren"`
	// MaxConcurrentChildrenEnforced is the live-worker ceiling actually applied by
	// this release. It matches the configured ceiling.
	MaxConcurrentChildrenEnforced int `json:"maxConcurrentChildrenEnforced"`
	// ParallelBaseWorkspaceWrites reports that the profile opted into
	// concurrent base-workspace writers. MothX cannot confine an external
	// Agent's own tools to the declared write scope, so this is explicit
	// operator trust and stays visible in every management projection.
	ParallelBaseWorkspaceWrites bool `json:"parallelBaseWorkspaceWrites,omitempty"`
	// Driver is the configured ACP flavor (default generic-acp). It is behavior
	// metadata only; business code reads resolved capabilities instead.
	Driver string `json:"driver"`
	// MCPBridge is "auto" or "off". It reports intent, not reachability; remote
	// profiles project an unreachable bridge in child metadata.
	MCPBridge string `json:"mcpBridge"`
	// CapabilityOverrides lists the capabilities this profile explicitly
	// tightens. It is diagnostic: resolution applies the profile map directly.
	CapabilityOverrides []string `json:"capabilityOverrides,omitempty"`
	InvalidReason       string   `json:"invalidReason,omitempty"`
}

type ACPWorkerResult struct {
	AgentInfo  acpclient.Implementation
	SessionID  string
	StopReason string
	Output     string
	Truncated  bool
	ToolCalls  int
	// DroppedUpdates counts session updates the Runtime discarded because the
	// Agent emitted them faster than they could be projected. A non-zero value
	// means the transcript is missing its beginning.
	DroppedUpdates uint64
}

type AgentBuildOptions struct {
	ID                     agentpkg.AgentID
	ParentID               agentpkg.AgentID
	Provider               provider.Provider
	ProviderName           string
	Model                  *provider.Model
	Settings               *config.Settings
	Allow                  *config.AllowConfig
	Mode                   string
	ToolExecutionMode      string
	MaxToolConcurrency     int
	ExtraContext           string
	RuleContent            string
	ThinkingLevel          provider.ThinkingLevel
	SandboxMgr             *sandbox.Manager
	SandboxEnabled         *bool
	MaxTokens              int
	MaxTokensSet           bool
	MultiAgent             bool
	DelegateMode           bool
	Workflows              bool
	ApprovalHandler        func(string, string, map[string]any) bool
	ApprovalDecisionLookup func(string, string, map[string]any) (bool, bool)
	MaxIterations          int
	ContextPressure        float64
	BudgetPressure         float64
	// IterationBudget overrides the Runtime-resolved iteration-budget policy for
	// this build. The zero value uses the policy resolved by the SessionRuntime
	// (source-aware defaults); only a conversational lead receives renewal.
	IterationBudget      agent.IterationBudgetPolicy
	BeforeToolCall       func(agent.BeforeToolCallContext) *agent.ToolCallBlockResult
	BeforeToolExecute    func(agent.BeforeToolExecuteContext) *agent.ToolCallBlockResult
	AfterToolCall        func(agent.AfterToolCallContext) *agent.ToolCallResult
	GetSteeringMessages  func() []provider.Message
	ConversationTurnID   string
	IntentID             string
	RunID                string
	ConversationTurn     bool
	RuntimeOwnsTurnEnd   bool
	RuntimeOwnsUserEntry bool
	UserEntryID          string
	// SyntheticContinuation starts a Runtime-owned continuation without a user
	// submission. Its seed message is system-injected context, not a fake user
	// entry, so the build must not reserve a run user-entry ID.
	SyntheticContinuation bool
	// AuxiliaryRole marks a build that is not the session's conversational lead
	// even though it runs on the session's own manager (the legacy knowledge
	// librarian query bridge). Such a build never receives the team member
	// mailbox hooks: it must not wait for the session's members nor consume
	// member notifications that belong to the lead.
	AuxiliaryRole bool
}

type AgentEventObservation struct {
	Retry *RetryInfo
	Error *ErrorInfo
}

type AgentManagerOptions struct {
	Runtime           *SessionRuntime
	Provider          provider.Provider
	Model             *provider.Model
	Settings          *config.Settings
	ProviderName      string
	Allow             *config.AllowConfig
	MultiAgentEnabled bool
	DelegateEnabled   bool
	WorkflowsEnabled  bool
	// Worktree, when set, lets sub-agents run in an on-demand isolated worktree
	// (tool parameter or member declaration). WorktreePerChild additionally makes
	// every sub-agent get its own worktree (policy trigger).
	Worktree         *WorktreeManager
	WorktreePerChild bool
}

type ArtifactCollector struct {
	// contains filtered or unexported fields
}

type ArtifactReconciliation struct {
	// Scanned counts the entries found directly under the artifact store.
	Scanned int
	// Removed counts the directories reclaimed in this pass.
	Removed int
	// Freed is the total size of the reclaimed content.
	Freed int64
	// SkippedReferenced counts directories a durable row still claims.
	SkippedReferenced int
	// SkippedYoung counts unreferenced directories still inside the retention
	// plus grace floor.
	SkippedYoung int
	// SkippedUnrecognized counts entries that are not artifact storage this
	// function may interpret - an unexpected name, a file, or a symlink.
	SkippedUnrecognized int
	// AgeFloor is the modification time a directory must be older than to be
	// reclaimable. It is reported so callers can state the rule they applied.
	AgeFloor time.Time
}

type AttachedResources struct {
	ID                    string
	Source                RuntimeSource
	EntrySource           RuntimeSource
	WorkDir               string
	Manager               *session.Manager
	Registry              *tools.Registry
	SandboxMgr            *sandbox.Manager
	SkillsMgr             *skills.Manager
	MCPClients            []*mcp.Client
	Providers             ProviderCatalog
	ExtraContext          string
	RuleContent           string
	AdditionalDirectories []string
	// Settings and capability flags describe the shared resource assembly policy
	// for this compatibility bridge. When present, AttachSessionResources uses
	// them to reload context/skills with the persisted expert package included.
	Settings        *config.Settings
	Workflows       bool
	Browser         bool
	ArtifactEnabled bool
	// WorkerBridge is the process-wide loopback MCP bridge. ACP and other
	// attach-based entry points pass their one shared instance; nil disables it.
	WorkerBridge *WorkerBridgeServer
}

type AttachmentKind string

type AttachmentPolicy struct {
	MaxImageBytes int64
	MaxFileBytes  int64
	Retention     time.Duration
}

type AttachmentService struct {
	// contains filtered or unexported fields
}

type BuildOptions struct {
	ID              string
	Source          RuntimeSource
	WorkDir         string
	Manager         *session.Manager
	Workflows       bool
	Browser         bool
	ArtifactEnabled bool
	RegistryHooks   []RegistryHook
	// WorkerBridge is the process-wide loopback MCP bridge for Router workers.
	// It is created by top-level assembly (TUI/CLI, serve, ACP) and shared by
	// every session; nil disables the bridge without changing any task path.
	WorkerBridge *WorkerBridgeServer
	// MCP controls how configured MCP servers are connected during build. The
	// zero value preserves strict, synchronous connection; an interactive entry
	// point defers it so a slow server cannot freeze first paint.
	MCP MCPConnectPolicy
}

type Builder struct {
	Settings     *config.Settings
	SandboxLevel sandbox.Level
}

type CommandRisk string

type ContextResources struct {
	SkillsMgr    *skills.Manager
	ExtraContext string
	RuleContent  string
}

type CreateSessionOptions struct {
	WorkDir     string
	SessionDir  string
	ID          string
	ChannelType string
	ChannelID   string
}

type CreateWorktreeRequest struct {
	BaseCwd      string
	Name         string
	Detached     bool
	StartCommand string
	ProjectID    string
}

type DecisionKind string

type DecisionRecord struct {
	ID        string          `json:"id"`
	SessionID string          `json:"sessionId"`
	RunID     string          `json:"runId"`
	Kind      DecisionKind    `json:"kind"`
	Status    string          `json:"status"`
	Value     string          `json:"value,omitempty"`
	Payload   json.RawMessage `json:"payload,omitempty"`
	CreatedAt time.Time       `json:"createdAt,omitempty"`
	ExpiresAt time.Time       `json:"expiresAt,omitempty"`
}

type DecisionRequest struct {
	ID        string
	RunID     string
	SessionID string
	Kind      DecisionKind
	Resolve   func(string) error
}

type DecisionResolution struct {
	ID     string
	Kind   DecisionKind
	Status string
	Value  string
}

type DecisionService struct {
	// contains filtered or unexported fields
}

type DecisionTransition struct {
	Request   DecisionRequest
	Status    string
	Value     string
	Payload   any
	ExpiresAt time.Time
	Source    string
	Model     string
	Mode      string
}

type DeliveryCapability struct {
	Text      bool
	SendImage bool
	SendFile  bool
	SendVideo bool
}

type DeliveryCoordinator struct {
	SessionDir string
	Owner      string
	Lease      time.Duration
	// RetryWindow is the wall-clock budget for transient failures. Zero uses
	// DefaultDeliveryRetryWindow.
	RetryWindow time.Duration
	// MaxRetries is an optional hard attempt cap in addition to RetryWindow.
	// Zero disables it (the window is the production bound).
	MaxRetries int
}

type DeliveryExecutor func(context.Context, session.DeliveryOperation) (DeliveryResult, error)

type DeliveryIntentPlan struct {
	ID               string
	SessionID        string
	RunID            string
	Platform         string
	TargetID         string
	ReplyMessageID   string
	TransportContext json.RawMessage
	Status           string
	CreatedAt        time.Time
}

type DeliveryPlan struct {
	Intent     DeliveryIntentPlan
	Operations []OrderedDeliveryOperationPlan
}

type DeliveryPlanRequest struct {
	SessionID        string
	RunID            string
	Platform         string
	TargetID         string
	ReplyMessageID   string
	TransportContext json.RawMessage
	Caption          string
	Attachments      []SessionAttachment
	Capability       DeliveryCapability
	CreatedAt        time.Time
}

type DeliveryRecord struct {
	RunID          string
	SessionID      string
	Pending        bool
	AssistantEntry string
	Status         string
	Source         string
}

type DeliveryResult struct {
	Status            string
	ProviderAssetID   string
	ProviderMessageID string
	ProviderState     json.RawMessage
	FailureCode       string
	NextAttemptAt     *time.Time
}

type DurableConversationTurnEventFinisher interface {
	FinishRunAndConversationTurn(DurableRun, RunState, string, RunEvent) (string, error)
}

type DurableConversationTurnFinisher interface {
	FinishConversationTurn(DurableRun, RunState, string) error
}

type DurableConversationTurnStore interface {
	CreateIntentAndRunWithEventAndTurn(ExecutionIntent, DurableRun, RunEvent) (string, error)
	CreateRunWithEventAndTurn(DurableRun, RunEvent) (string, error)
}

type DurableIntentEventStore interface {
	DurableIntentStore
	CreateIntentAndRunWithEvent(ExecutionIntent, DurableRun, RunEvent) (string, error)
}

type DurableIntentStore interface {
	CreateIntentAndRun(ExecutionIntent, DurableRun) error
	GetIntent(string) (*ExecutionIntent, error)
}

type DurableRun struct {
	ID           string
	SessionID    string
	IntentID     string
	RetryOf      string
	Attempt      int
	WorkDir      string
	Source       string
	Model        string
	Mode         string
	Status       string
	StartedAt    time.Time
	FinishedAt   *time.Time
	Error        string
	ErrorInfo    ErrorInfo
	Progress     RetryInfo
	Usage        json.RawMessage
	ContextUsage json.RawMessage
	// InputResourceIDs are Runtime-prepared resources that this admission must
	// bind to the Run in the same transaction as the intent, Run row, and start
	// event. Retries may reference resources already bound to the original Run;
	// the store preserves that canonical ownership.
	InputResourceIDs      []string
	SubmissionKeyHash     string
	SubmissionScope       string
	SubmissionFingerprint string
	UserEntryID           string
	UserMessage           *provider.Message
	AssistantEntryID      string
	AssistantMessage      *provider.Message
	DeliveryPlan          *DeliveryPlan
	ConversationTurnID    string
	ConversationTurn      bool
}

type DurableRunEventStore interface {
	CreateRunWithEvent(DurableRun, RunEvent) (string, error)
}

type DurableRunMetadataStore interface {
	UpdateErrorInfo(string, ErrorInfo) error
	UpdateProgress(string, RetryInfo) error
}

type DurableRunStore interface {
	Create(DurableRun) error
	Update(string, RunState, string) error
	Finish(string, RunState, string) error
}

type DurableRunUsageStore interface {
	UpdateUsage(string, json.RawMessage, json.RawMessage) error
}

type DurableTerminalPersistenceStore interface {
	MarkTerminalizing(string, string) error
}

type ErrorClassificationOptions struct {
	Code            string
	Type            string
	Phase           RunPhase
	Message         string
	Detail          string
	MessageKey      string
	HTTPStatus      int
	RetryAfterMS    int
	Attempt         int
	MaxAttempts     int
	SideEffectState SideEffectState
	PartialOutput   bool
	RunID           string
	IntentID        string
	RequestID       string
}

type ErrorInfo struct {
	Code            string          `json:"code,omitempty"`
	Type            string          `json:"type,omitempty"`
	FailureClass    FailureClass    `json:"failureClass,omitempty"`
	Phase           RunPhase        `json:"phase,omitempty"`
	MessageKey      string          `json:"messageKey,omitempty"`
	Message         string          `json:"message,omitempty"`
	Detail          string          `json:"detail,omitempty"`
	RetryMode       RetryMode       `json:"retryMode,omitempty"`
	Retryable       bool            `json:"retryable,omitempty"`
	RetryAfterMS    int             `json:"retryAfterMs,omitempty"`
	Attempt         int             `json:"attempt,omitempty"`
	MaxAttempts     int             `json:"maxAttempts,omitempty"`
	SideEffectState SideEffectState `json:"sideEffectState,omitempty"`
	PartialOutput   bool            `json:"partialOutput,omitempty"`
	RunID           string          `json:"runId,omitempty"`
	IntentID        string          `json:"intentId,omitempty"`
	RequestID       string          `json:"requestId,omitempty"`
}

type ExecutionAdmissionOptions struct {
	Wait           bool
	PollInterval   time.Duration
	RecoveryPolicy RunRecoveryPolicy
	BeforeRecover  func(session.SessionRun) error
}

type ExecutionCompletion struct {
	SubmissionID string
	RunID        string
	Error        error
}

type ExecutionHandle struct {
	SubmissionID string
	RunID        string
	Completed    <-chan ExecutionCompletion
	Events       <-chan SubmissionEvent
	// contains filtered or unexported fields
}

type ExecutionIntent = session.ExecutionIntent

type ExecutionPolicy struct {
	Source      RuntimeSource
	DefaultMode string
	// IterationBudget governs model-requested iteration renewal for this run's
	// conversational lead. It is resolved once together with the source/mode
	// policy so agent construction, run records, and UI projections share one
	// budget. The zero value resolves to the Runtime defaults when a run is built
	// (see ResolveIterationBudget); renewal is a lead-only capability, so
	// sub-agents and team members keep their capability ceiling.
	IterationBudget agent.IterationBudgetPolicy
}

type ExecutionRuntime struct {
	// contains filtered or unexported fields
}

type ExpertBinding struct {
	ID   string // expert bundle name (= session header expertId)
	Type string // expert.TypeAgent | expert.TypeTeam
	// Team is true for team-type bindings; it forces multi-agent capability
	// for the session (single resolution, adapters may not downgrade).
	Team           bool
	Bundle         *expert.Bundle
	IdentityPrompt string
	RosterPrompt   string
	MemberDefs     []*agent.MemberDef
}

type FailureClass string

type ForkOptions = session.ForkOptions

type ForkResult = session.ForkResult

type InputIngress struct {
	Origin        string
	EventID       string
	ItemIndex     int
	Reference     string
	Kind          AttachmentKind
	FilenameHint  string
	MediaTypeHint string
	SizeHint      int64
	Open          func(context.Context) (InputStream, error)
}

type InputMaterializer struct {
	// contains filtered or unexported fields
}

type InputPolicy struct {
	MaxImageBytes  int64
	MaxFileBytes   int64
	MaxImagePixels int64
	// MaxInlineMediaBytes caps the audio/video payload BuildUserMessage may
	// inline into a provider request. Larger media stay workspace files with a
	// manifest note because OpenAI-compatible base64 media inputs are limited
	// (Qwen-Omni accepts at most a 10MB base64 payload).
	MaxInlineMediaBytes int64
	DraftMaxAge         time.Duration
}

type InputResource struct {
	ID           string
	SessionID    string
	RunID        string
	Origin       string
	EventID      string
	ItemIndex    int
	ItemKey      string
	Kind         AttachmentKind
	Filename     string
	MediaType    string
	Bytes        int64
	SHA256       string
	RelativePath string
	Status       string
	CreatedAt    time.Time
}

type InputStream struct {
	Reader      io.ReadCloser
	Filename    string
	MediaType   string
	ContentSize int64
}

type InputSubmission struct {
	Text                    string
	Resources               []PreparedInput
	KnowledgeBaseReferences []KnowledgeBaseReference
	KnowledgeCapsules       []KnowledgeCapsule
	IdempotencyKey          string
}

type KnowledgeBaseIndexPolicy struct {
	MaxFiles      int
	MaxFileBytes  int64
	MaxChunkBytes int
}

type KnowledgeBaseProviderFactory func(*config.Settings, string, string) (provider.Provider, *provider.Model, error)

type KnowledgeBaseReference struct {
	KnowledgeBaseID string `json:"knowledgeBaseId"`
	Required        bool   `json:"required,omitempty"`
}

type KnowledgeBaseService struct {
	// contains filtered or unexported fields
}

type KnowledgeCapsule struct {
	KnowledgeBaseID   string              `json:"knowledgeBaseId"`
	KnowledgeBaseName string              `json:"knowledgeBaseName"`
	SnapshotID        string              `json:"snapshotId"`
	Text              string              `json:"text"`
	Citations         []KnowledgeCitation `json:"citations"`
}

type KnowledgeCitation struct {
	ChunkID      string `json:"chunkId"`
	RelativePath string `json:"relativePath"`
	StartLine    int    `json:"startLine"`
	EndLine      int    `json:"endLine"`
}

type KnowledgeIndexJob struct {
	// contains filtered or unexported fields
}

type KnowledgeIndexProgress struct {
	Running    bool      `json:"running"`
	Phase      string    `json:"phase,omitempty"`
	FilesTotal int64     `json:"filesTotal"`
	FilesDone  int64     `json:"filesDone"`
	Chunks     int64     `json:"chunks"`
	StartedAt  time.Time `json:"startedAt,omitempty"`
	RunID      string    `json:"runId,omitempty"`
	Error      string    `json:"error,omitempty"`
}

type KnowledgeIndexRun struct {
	RunID        string     `json:"runId"`
	SnapshotID   string     `json:"snapshotId,omitempty"`
	Status       string     `json:"status"`
	StartedAt    time.Time  `json:"startedAt"`
	FinishedAt   *time.Time `json:"finishedAt,omitempty"`
	ErrorCode    string     `json:"errorCode,omitempty"`
	ErrorSummary string     `json:"errorSummary,omitempty"`
	FileCount    int        `json:"fileCount"`
	ChunkCount   int        `json:"chunkCount"`
	NodeCount    int        `json:"nodeCount"`
	EdgeCount    int        `json:"edgeCount"`
	Active       bool       `json:"active"`
}

type KnowledgeMCPHandler struct {
	// contains filtered or unexported fields
}

type LocalSessionExecutionFacts struct {
	SessionID     string
	SessionExists bool
	// Active means a durable run is registered as executing in this process.
	Active    bool
	RunID     string
	RunStatus string
	// LegacyBusy carries the pre-durable "running" bit of embedded fixtures.
	LegacyBusy bool
}

type MCPConnectPolicy struct {
	// Deferred skips connecting configured servers during build. The entry point
	// connects them later through ConnectDeferredMCP, keeping an interactive
	// surface responsive while a slow server starts.
	Deferred bool
	// Optional tolerates individual server failures instead of aborting build.
	// Tolerated failures are exposed through MCPConnectFailures.
	Optional bool
	// OverallTimeout bounds the whole connection group independently of the
	// per-operation timeouts. Zero uses only the per-operation timeouts.
	OverallTimeout time.Duration
}

type MCPPolicy struct {
	Servers   []mcp.ServerConfig
	Callbacks mcp.Callbacks
	Optional  bool
	// OverallTimeout bounds the whole connection group. Zero uses only the
	// per-operation timeouts. It lets an entry point cap how long a set of slow
	// configured servers may collectively delay a run without changing the
	// per-server timeout semantics.
	OverallTimeout time.Duration
	OnError        func(error)
}

type MailboxWakeOptions struct {
	Build      AgentBuildOptions
	OnStarted  func(MailboxWakeRun)
	OnEvent    func(MailboxWakeRun, agent.Event)
	OnArtifact func(MailboxWakeRun, SessionAttachment)
	// OnAgent publishes the freshly built lead Agent so an adapter can answer
	// Runtime-owned questions through its existing protocol hook. The Agent is
	// already registered on the shared ExecutionRuntime and is never owned by
	// the adapter.
	OnAgent func(MailboxWakeRun, *agent.Agent)
	// ConfigureBuild applies entry-point policy that must be read at wake time
	// (capabilities, approvals, adapter hooks). It runs after the Runtime has
	// overwritten the run identity/provider snapshot, so it cannot fork the
	// canonical Run facts.
	ConfigureBuild func(*AgentBuildOptions)
	OnFinished     func(MailboxWakeRun, RunState, error)
	// Debounce coalesces a burst of completions into one admission attempt.
	Debounce time.Duration
}

type MailboxWakeRun struct {
	RunID     string
	SessionID string
	Source    string
	Model     string
	Mode      string
	StartedAt time.Time
}

type MaintenancePolicy struct {
	// ReclaimAttachmentStorage gates the private attachment-store reconciliation.
	ReclaimAttachmentStorage bool
	// StorageReconcileSchedule is the schedule expression the scheduler should
	// project for that reconciliation. It is validated where the schedule grammar
	// lives (internal/cron), not here.
	StorageReconcileSchedule string
	// ReclaimSessionStorage gates Runtime-owned session-storage maintenance.
	ReclaimSessionStorage bool
	// SessionStorageSchedule is the schedule expression for that maintenance.
	SessionStorageSchedule string
	// ToolExecutionRetention bounds completed/abandoned tool-execution
	// idempotency records. Zero keeps them forever. Transcript messages are
	// never governed by this field.
	ToolExecutionRetention time.Duration
	// VacuumSessionStorage opts into VACUUM after pruning.
	VacuumSessionStorage bool
}

type ManagerBackedToolsOptions struct {
	// Registry overrides the Runtime registry. Nil uses the Runtime's Registry.
	Registry *tools.Registry
	// Policy is the adapter's resolved capability/tool-selection policy.
	Policy ToolGroupPolicy
	// Manager is the adapter's current manager handle.
	Manager *agent.AgentManager
	// Build creates a session-scoped manager. It is called only when the
	// Runtime resolves that a manager-backed capability is active and either
	// Manager is nil or Rebuild is true.
	Build ManagerFactory
	// Rebuild discards Manager before Build so manager-owned session state
	// (expert roster/mailbox, Router worker binding, provider/model changes) is
	// recreated instead of reusing a stale roster. Build is required when
	// Rebuild is set and Manager is non-nil; the Runtime fails closed otherwise.
	Rebuild bool
	// RequireManager keeps a manager even when the capability predicate is
	// false. The TUI and CLI use it because root-agent bookkeeping, ESM
	// supervision, and the cron scheduler hold the manager handle independently
	// of which manager-backed tools the model can see.
	RequireManager bool
}

type ManagerFactory func() (*agent.AgentManager, error)

type ModeResolver struct {
	Policy ExecutionPolicy
}

type MutationLeaseGroup struct {
	// contains filtered or unexported fields
}

type OrderedDeliveryOperationPlan struct {
	ID             string
	OperationKey   string
	ArtifactID     string
	OperationKind  string
	Sequence       int
	DependsOn      string
	IdempotencyKey string
	PayloadDigest  string
	Status         string
	CreatedAt      time.Time
}

type Policy = ExecutionPolicy

type PreparedInput struct {
	ResourceID   string
	Kind         AttachmentKind
	RelativePath string
	Filename     string
	MediaType    string
	Bytes        int64
}

type ProviderCatalog map[string]provider.Provider

type PublishArtifactTool struct {
	// contains filtered or unexported fields
}

type RecoveryAction string

type RecoveryCoordinator struct {
	// contains filtered or unexported fields
}

type RecoveryCoordinatorOptions struct {
	ScanInterval   time.Duration
	AttemptTimeout time.Duration
	Policy         RunRecoveryPolicy
	BeforeFail     func(session.SessionRun) error
	OnResult       func(RunRecoveryResult)
	OnError        func(error)
}

type RefreshOptions struct {
	Workflows    bool
	Browser      bool
	ActiveSkills map[string]bool
}

type RegistryHook func(*SessionRuntime) error

type RegistryMutator func(*tools.Registry) error

type RegistryPolicy struct {
	RegisterDefaults bool
	EnablePlanTool   *bool
	SkillsMgr        *skills.Manager
	Browser          bool
	// ImageGeneration exposes the image-generation tool when settings enable
	// it. Entries opt in; the settings gate remains the shared owner of the
	// switch, so resource refresh can reconcile it.
	ImageGeneration bool
	// Question exposes the interactive question tool. Entries map it to their
	// protocol surface (for example ACP request_permission); it is not part of
	// the default tool surface.
	Question bool
	Mutators []RegistryMutator
}

type RemoteStopRequest struct {
	SessionID   string `json:"sessionId"`
	RunID       string `json:"runId"`
	RemoteRunID string `json:"remoteRunId"`
	Provider    string `json:"provider"`
	State       string `json:"state"`
}

type RetryInfo struct {
	Attempt      int      `json:"attempt,omitempty"`
	MaxAttempts  int      `json:"maxAttempts,omitempty"`
	Phase        RunPhase `json:"phase,omitempty"`
	ReasonCode   string   `json:"reasonCode,omitempty"`
	RetryAfterMS int      `json:"retryAfterMs,omitempty"`
	Continue     bool     `json:"continue,omitempty"`
	MessageKey   string   `json:"messageKey,omitempty"`
	Message      string   `json:"message,omitempty"`
}

type RetryMode string

type RouterBinding struct {
	ACPProfileID     string
	ApprovalStrategy config.ACPPermissionPolicy
	Profiles         []RouterProfileBinding
	PolicyRevision   string
}

type RouterProfileBinding struct {
	ProfileID        string
	ApprovalStrategy config.ACPPermissionPolicy
}

type RunEvent struct {
	ID        string
	SessionID string
	RunID     string
	EventType string
	Source    string
	Status    string
	Model     string
	Mode      string
	Timestamp time.Time
	Data      json.RawMessage
	// Assistant fields are Runtime-only terminal transaction inputs. They are
	// not serialized into the generic event envelope or exposed to prompts.
	AssistantEntryID string
	AssistantMessage provider.Message
}

type RunEventProjector interface {
	Project(RunEvent, string) error
}

type RunEventSink interface {
	Record(RunEvent) (string, error)
}

type RunEventSinkFunc func(RunEvent) (string, error)

type RunInput = InputSubmission

type RunPhase string

type RunRecoveryPolicy func(session.SessionRun) RecoveryAction

type RunRecoveryResult struct {
	Failed  []session.SessionRun
	Kept    []session.SessionRun
	Skipped []session.SessionRun
}

type RunReplay struct {
	SessionID string
	RunID     string
	Events    []RunEvent
	Status    RunState
	Terminal  bool
}

type RunState string

type RunStore struct {
	SessionDir string
}

type RuntimeChangeSetIntegrator struct {
	Runtime   *SessionRuntime
	Worktrees *WorktreeManager
}

type RuntimeSource string

type RuntimeWorkerQuestionResolver struct {
	Runtime *SessionRuntime
}

type SessionAttachment struct {
	ID         string
	SessionID  string
	RunID      string
	Origin     string
	Kind       AttachmentKind
	Filename   string
	MediaType  string
	Bytes      int64
	SHA256     string
	StorageKey string
	Status     string
	CreatedAt  time.Time
	ExpiresAt  time.Time
}

type SessionConfigOption struct {
	Type         string                      `json:"type"`
	ID           string                      `json:"id"`
	Name         string                      `json:"name"`
	Description  string                      `json:"description,omitempty"`
	Category     string                      `json:"category,omitempty"`
	CurrentValue string                      `json:"currentValue"`
	Options      []SessionConfigOptionChoice `json:"options,omitempty"`
}

type SessionConfigOptionChoice struct {
	Value       string `json:"value"`
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
}

type SessionExecutionSnapshot struct {
	SessionID            string                `json:"sessionId"`
	SessionExists        bool                  `json:"sessionExists"`
	ActiveRun            *SessionRunSummary    `json:"activeRun,omitempty"`
	State                SessionExecutionState `json:"state"`
	Phase                string                `json:"phase,omitempty"`
	Running              bool                  `json:"running"`
	Busy                 bool                  `json:"busy"`
	CanSubmit            bool                  `json:"canSubmit"`
	CanCancelLocal       bool                  `json:"canCancelLocal"`
	CanCancelRemote      bool                  `json:"canCancelRemote"`
	LeasePurpose         string                `json:"leasePurpose,omitempty"`
	LeaseEpoch           int64                 `json:"leaseEpoch,omitempty"`
	LeaseExpiresAt       *time.Time            `json:"leaseExpiresAt,omitempty"`
	LeaseOwnerInstanceID string                `json:"ownerInstanceId,omitempty"`
	LeaseOwnerPID        int                   `json:"ownerPid,omitempty"`
	LeaseTokenIdentity   string                `json:"leaseTokenIdentity,omitempty"`
	LinkageState         string                `json:"linkageState"`
	RecoveryAction       string                `json:"recoveryAction"`
	RecoveryAttempt      int                   `json:"recoveryAttempt,omitempty"`
	RecoveryLastError    string                `json:"recoveryLastError,omitempty"`
	RecoveryNextAt       *time.Time            `json:"recoveryNextAt,omitempty"`
	DisplayOwnerScope    string                `json:"ownerScope"`
	RemoteRunID          string                `json:"remoteRunId,omitempty"`
	RemoteProvider       string                `json:"remoteProvider,omitempty"`
	RemoteState          string                `json:"remoteState,omitempty"`
	// Source records how the projection was produced ("db" from a SQLite read or
	// "cache" from the synchronized ownership view). It is a projection-authority
	// marker, never an authorization input.
	Source string `json:"source,omitempty"`
}

type SessionExecutionState string

type SessionModelBinding struct {
	ProviderName string
	Model        *provider.Model
}

type SessionRunEventSink struct {
	SessionDir string
}

type SessionRunSummary struct {
	ID        string    `json:"runId"`
	Status    string    `json:"status"`
	Source    string    `json:"source,omitempty"`
	Model     string    `json:"model,omitempty"`
	Mode      string    `json:"mode,omitempty"`
	StartedAt time.Time `json:"startedAt"`
	UpdatedAt time.Time `json:"updatedAt"`
}

type SessionRuntime struct {
	ID           string
	Source       RuntimeSource
	EntrySource  RuntimeSource
	Policy       ExecutionPolicy
	WorkDir      string
	Manager      *session.Manager
	Inputs       *InputMaterializer
	Attachments  *AttachmentService
	Registry     *tools.Registry
	SandboxMgr   *sandbox.Manager
	SkillsMgr    *skills.Manager
	MCPClients   []*mcp.Client
	ExtraContext string
	RuleContent  string
	LastUsed     time.Time
	Execution    *ExecutionRuntime
	Decisions    *DecisionService

	// Provider, Model, Mode, and ThinkingLevel are session-owned bindings used by
	// BuildAgent when adapters omit overrides. Providers contains the selectable
	// catalog and allows ACP sessions to switch credentials/models in-process.
	Provider              provider.Provider
	ProviderName          string
	Providers             ProviderCatalog
	Model                 *provider.Model
	Mode                  string
	ThinkingLevel         provider.ThinkingLevel
	AdditionalDirectories []string
	SandboxEnabled        bool
	BrowserEnabled        bool
	WebSearchEnabled      bool
	ArtifactEnabled       bool
	// Expert is the resolved expert binding (nil when the session has no
	// expert identity). Mailbox is the runtime-owned member completion queue
	// drained into steering at run input boundaries. ExpertCenter resolves
	// bundle names for this session's project directory.
	Expert       *ExpertBinding
	Mailbox      *agent.MemberMailbox
	ExpertCenter *expert.Center
	Submissions  *SubmissionCoordinator

	// WorkerBridge is the process-wide loopback MCP bridge shared by sessions. It
	// is injected by top-level assembly; a nil bridge simply degrades every ACP
	// worker to mcpBridge=unavailable.
	WorkerBridge *WorkerBridgeServer
	// contains filtered or unexported fields
}