import type { NativeMountPluginDescriptor } from "@rivet-dev/agentos-runtime-core/descriptors";
import type { VmUserConfig } from "@rivet-dev/agentos-runtime-core/vm-config";
import { type Bindings } from "./bindings.js";
import type { CodeEvaluationResult, CodeExecutionResult, ContextDescriptor, ExecutionSignal, InlineExecutionOptions, JavaScriptEvaluationOptions, JavaScriptExecutionOptions, LanguageExecutionOptions, LanguageSpawnOptions, NpmPackageInstallOptions, NpmProjectInstallOptions, OutputReplay, ProcessDescriptor, ProcessExit, PythonInstallOptions, SpawnOptions, TypeScriptCheckOptions, TypeScriptCheckResult, TypeScriptEvaluationOptions, TypeScriptExecutionOptions, TypeScriptFileExecutionOptions } from "./language-execution.js";
import type { ConnectTerminalOptions, Kernel, KernelExecOptions, KernelExecResult, OpenShellOptions, Permissions, VirtualFileSystem, VirtualStat } from "./runtime-compat.js";
import { type AgentOsSandboxInput } from "./sandbox.js";
import type { CancelPromptResult, PromptResult as DurablePromptResult, SessionInfo as DurableSessionInfo, HistoryPage, JsonValue, ListSessionsInput, OpenSessionInput, PermissionResponse, PermissionResponseResult, PromptInput, ReadHistoryInput, SessionAgentInfo, SessionCapabilities, SessionConfig, SessionPage, SessionStreamEntry, SessionTarget, SetSessionConfigOptionInput } from "./session-api.js";
export type { MountConfigJsonObject, MountConfigJsonPrimitive, MountConfigJsonValue, NativeMountPluginDescriptor, } from "@rivet-dev/agentos-runtime-core/descriptors";
export type { ConnectTerminalOptions } from "./runtime-compat.js";
export type * from "./session-api.js";
/** Process tree node using the same descriptor shape as process.get/list. */
export interface ProcessTreeNode extends ProcessDescriptor {
    ppid?: number;
    children: ProcessTreeNode[];
}
/** A directory entry with metadata. */
export interface DirEntry {
    /** Absolute path to the entry. */
    path: string;
    type: "file" | "directory" | "symlink";
    size: number;
}
/** One immediate child returned by a single readdirEntries operation. */
export interface ReaddirEntry {
    name: string;
    isDirectory: boolean;
    isSymbolicLink: boolean;
}
/** Fully buffered request to an HTTP service listening inside the VM. */
export interface HttpRequest {
    port: number;
    path: string;
    method?: string;
    headers?: Record<string, string>;
    body?: string | Uint8Array;
}
/** Fully buffered HTTP response from a service inside the VM. */
export interface HttpResponse {
    status: number;
    statusText: string;
    headers: Record<string, string>;
    body: Uint8Array;
}
export interface ProcessOutput {
    pid: number;
    stream: "stdout" | "stderr";
    data: Uint8Array;
}
export interface ShellData {
    shellId: string;
    data: Uint8Array;
}
export interface ShellExit {
    shellId: string;
    exitCode: number;
}
/** Sanitized live mount metadata. Plugin configuration is never exposed. */
export interface MountInfo {
    path: string;
    kind: string;
    readOnly: boolean;
}
export interface ExportRootFilesystemOptions {
    /** Maximum serialized snapshot bytes returned to this caller. */
    maxBytes: number;
}
/** Portable, sidecar-owned dynamic mount descriptor. */
export interface DynamicMountDescriptor {
    path: string;
    plugin: NativeMountPluginDescriptor;
    readOnly?: boolean;
}
/** Callback-free options accepted by the portable openShell API. */
export type ShellOptions = Omit<OpenShellOptions, "onStderr">;
/** Options for readdirRecursive(). */
export interface ReaddirRecursiveOptions {
    /** Maximum depth to recurse (0 = only immediate children). */
    maxDepth?: number;
    /** Directory names to skip. */
    exclude?: string[];
}
/** Entry for batch write operations. */
export interface BatchWriteEntry {
    path: string;
    content: string | Uint8Array;
}
/** Result of a single file in a batch write. */
export interface BatchWriteResult {
    path: string;
    success: boolean;
    error?: string;
}
/** Result of a single file in a batch read. */
export interface BatchReadResult {
    path: string;
    content: Uint8Array | null;
    error?: string;
}
/** Entry in the agent registry, describing an available agent type. */
export interface AgentRegistryEntry {
    id: string;
    installed: boolean;
}
import { type PackageDescriptor } from "./agentos-package.js";
import type { ScheduleDriver } from "./cron/schedule-driver.js";
import type { CronEventHandler, CronJob, CronJobInfo, CronJobOptions } from "./cron/types.js";
import { type LayerStore, type OverlayFilesystemMode, type RootSnapshotExport, type SnapshotLayerHandle } from "./layers.js";
import type { SoftwareInput } from "./packages.js";
import { type AgentOsSidecarPlacement } from "./sidecar/rpc-client.js";
export interface AgentOsSharedSidecarOptions {
    pool?: string;
}
export interface AgentOsCreateSidecarOptions {
    sidecarId?: string;
}
export type AgentOsSidecarConfig = {
    kind: "shared";
    pool?: string;
} | {
    kind: "explicit";
    handle: AgentOsSidecar;
};
export interface AgentOsSidecarDescription {
    sidecarId: string;
    placement: AgentOsSidecarPlacement;
    state: "ready" | "disposing" | "disposed";
    activeVmCount: number;
}
export type RootLowerInput = {
    kind: "bundled-base-filesystem";
} | RootSnapshotExport;
export interface OverlayRootFilesystemConfig {
    type?: "overlay";
    mode?: OverlayFilesystemMode;
    disableDefaultBaseLayer?: boolean;
    lowers?: RootLowerInput[];
}
/** Declarative sidecar-native root filesystem. */
export interface NativeRootFilesystemConfig {
    type: "native";
    plugin: NativeMountPluginDescriptor;
    readOnly?: boolean;
}
export type RootFilesystemConfig = OverlayRootFilesystemConfig | NativeRootFilesystemConfig;
/** VM-scoped SQLite storage shared by VFS and AgentOS durable state. */
export type VmSqliteConfig = {
    type: "actor_uds";
    path: string;
} | {
    type: "sqlite_file";
    path: string;
};
/**
 * Compatibility path for arbitrary caller-supplied filesystems.
 * This maps to the sidecar `js_bridge` plugin during the migration.
 */
export interface PlainMountConfig {
    /** Path inside the VM to mount at. */
    path: string;
    /** The filesystem driver to mount. */
    driver: VirtualFileSystem;
    /** Filesystem type exposed through guest mount discovery. */
    guestFstype?: string;
    /** Source name exposed through guest mount discovery. */
    guestSource?: string;
    /** If true, write operations throw EROFS. */
    readOnly?: boolean;
}
/** Declarative native mount configuration that the sidecar can serialize. */
export interface NativeMountConfig {
    path: string;
    plugin: NativeMountPluginDescriptor;
    /** Filesystem type exposed through guest mount discovery. */
    guestFstype?: string;
    /** Source name exposed through guest mount discovery. */
    guestSource?: string;
    readOnly?: boolean;
}
export interface OverlayMountConfig {
    path: string;
    filesystem: {
        type: "overlay";
        store: LayerStore;
        mode?: OverlayFilesystemMode;
        lowers: SnapshotLayerHandle[];
    };
}
export type MountConfig = PlainMountConfig | NativeMountConfig | OverlayMountConfig;
/**
 * Operator-tunable runtime limits for a VM. Every field is optional; unset fields fall back to
 * built-in defaults that match the runtime's historical hardcoded constants, so behavior is
 * unchanged unless a value is overridden. All values are JSON-serializable integers and are
 * forwarded to the native sidecar in the typed create-VM JSON config. Unknown, negative, or
 * non-integer values are rejected by the sidecar before VM construction.
 */
export interface AgentOsLimits {
    /** Kernel resource limits (processes, FDs, sockets, filesystem bytes, WASM caps, etc.). */
    resources?: {
        cpuCount?: number;
        maxProcesses?: number;
        maxOpenFds?: number;
        maxPipes?: number;
        maxPtys?: number;
        maxSockets?: number;
        maxConnections?: number;
        maxSocketBufferedBytes?: number;
        maxSocketDatagramQueueLen?: number;
        maxFilesystemBytes?: number;
        maxInodeCount?: number;
        maxBlockingReadMs?: number;
        maxPreadBytes?: number;
        maxFdWriteBytes?: number;
        maxProcessArgvBytes?: number;
        maxProcessEnvBytes?: number;
        maxReaddirEntries?: number;
        maxWasmFuel?: number;
        maxWasmMemoryBytes?: number;
        maxWasmStackBytes?: number;
    };
    /** HTTP body buffering limits. */
    http?: {
        /** Cap on `vm.httpRequest()` buffered response bodies. Must be <= the sidecar wire frame cap. */
        maxFetchResponseBytes?: number;
    };
    /** TLS plaintext buffering limits. */
    tls?: {
        maxBufferedBytes?: number;
    };
    /** Host binding registration and invocation limits. */
    bindings?: {
        defaultBindingTimeoutMs?: number;
        maxBindingTimeoutMs?: number;
        maxRegisteredCollections?: number;
        maxRegisteredBindingsPerVm?: number;
        maxBindingsPerCollection?: number;
        maxBindingSchemaBytes?: number;
        maxExamplesPerBinding?: number;
        maxBindingExampleInputBytes?: number;
    };
    /** Mount plugin manifest size limits. */
    plugins?: {
        maxPersistedManifestBytes?: number;
        maxPersistedManifestFileBytes?: number;
    };
    /** ACP adapter, active-turn, history-retention, and page limits. */
    acp?: {
        maxReadLineBytes?: number;
        stdoutBufferByteLimit?: number;
        maxCompletedMessageBytes?: number;
        maxTurnOutputBytes?: number;
        maxPromptBytes?: number;
        maxPromptBlocks?: number;
        maxFallbackContinuationBytes?: number;
        maxSessionHistoryBytes?: number;
        maxSessionHistoryEvents?: number;
        maxHistoryPageEntries?: number;
        maxSessionListEntries?: number;
    };
    /** Shared local-file/actor-UDS SQLite result materialization limit. */
    sqlite?: {
        maxResultBytes?: number;
    };
    /** Guest JavaScript runtime buffering limits. */
    jsRuntime?: {
        v8HeapLimitMb?: number;
        syncRpcWaitTimeoutMs?: number;
        cpuTimeLimitMs?: number;
        wallClockLimitMs?: number;
        importCacheMaterializeTimeoutMs?: number;
        capturedOutputLimitBytes?: number;
        stdinBufferLimitBytes?: number;
        eventPayloadLimitBytes?: number;
        v8IpcMaxFrameBytes?: number;
    };
    /** Guest Python runtime limits. */
    python?: {
        outputBufferMaxBytes?: number;
        executionTimeoutMs?: number;
        maxOldSpaceMb?: number;
        vfsRpcTimeoutMs?: number;
    };
    /** Guest WASM runtime limits. */
    wasm?: {
        maxModuleFileBytes?: number;
        capturedOutputLimitBytes?: number;
        syncReadLimitBytes?: number;
        prewarmTimeoutMs?: number;
        runnerHeapLimitMb?: number;
        runnerCpuTimeLimitMs?: number;
    };
    /** Process spawn, I/O, and lifecycle-event backlog limits. */
    process?: {
        maxSpawnFileActions?: number;
        maxSpawnFileActionBytes?: number;
        pendingStdinBytes?: number;
        pendingEventCount?: number;
        pendingEventBytes?: number;
    };
}
export interface AgentStderrEvent {
    sessionId: string;
    agentType: string;
    processId: string;
    pid: number | null;
    chunk: Uint8Array;
}
export type AgentStderrHandler = (event: AgentStderrEvent) => void;
/**
 * Restart disposition reported on an {@link AgentExitEvent}. AgentOS never
 * respawns an adapter or replays an interrupted request implicitly.
 */
export type AgentRestartOutcome = "not_attempted";
/**
 * An unexpected ACP adapter process exit — a crash from the host's
 * perspective (any spontaneous exit before `unloadSession()`, including exit
 * code 0). The live route is evicted and must be restored explicitly.
 */
export interface AgentExitEvent {
    sessionId: string;
    agentType: string;
    /** Sidecar process id of the adapter that exited. */
    processId: string;
    pid: number | null;
    /** Adapter exit code; `null` when the exit was observed indirectly. */
    exitCode: number | null;
    /** Always `"not_attempted"`; AgentOS does not restart adapters implicitly. */
    restart: AgentRestartOutcome;
    /** Always zero. */
    restartCount: number;
    /** Always zero. */
    maxRestarts: number;
}
export type AgentExitHandler = (event: AgentExitEvent) => void;
/**
 * A near-capacity warning for one bounded limit (a queue/buffer, a saturating
 * resource cap, or a memory envelope) inside the VM runtime. Delivered the moment
 * usage crosses the runtime's warning threshold (~80%), once per crossing — the
 * runtime applies edge-triggering + hysteresis, so this never spams.
 */
export interface LimitWarning {
    /** Stable limit name, e.g. `"javascript_event_channel"` or `"vm_open_fds"`. */
    limit: string;
    /** Limit class: `"queue"`, `"resource"`, or `"memory"`. */
    category: string;
    /** Current observed usage. */
    observed: number;
    /** Configured capacity. */
    capacity: number;
    /** Observed fill as a percentage of capacity (0–100). */
    fillPercent: number;
}
export type LimitWarningHandler = (warning: LimitWarning) => void;
/**
 * Public core VM options.
 *
 * Keep this interface in sync with
 * `packages/core/src/options-schema.ts::agentOsOptionsSchema`. The TypeScript
 * Rivet actor accepts this surface directly alongside ordinary actor options.
 */
export interface AgentOsOptions {
    /** Initial virtual Linux credentials and account record. Defaults to `1000:1000` (`agentos`). */
    user?: VmUserConfig;
    /**
     * Software to install in the VM. Each entry is a package-dir ref. Arrays are
     * flattened, so meta-packages that export arrays of sub-packages work directly.
     */
    software?: SoftwareInput[];
    /**
     * Whether to auto-include the default software bundle (`@agentos-software/common`
     * — `sh` + coreutils + the standard CLI tools agents rely on) in addition to
     * any `software` you pass. Defaults to `true`; set `false` for a bare VM with
     * only the software you list explicitly. Entries already present in `software`
     * are not duplicated.
     */
    defaultSoftware?: boolean;
    /** Loopback ports to exempt from SSRF checks (for testing with host-side mock servers). */
    loopbackExemptPorts?: number[];
    /**
     * Allowed Node.js builtins for guest Node processes.
     * Defaults to the hardened builtin set used by the native sidecar bridge.
     */
    allowedNodeBuiltins?: string[];
    /**
     * Opt in to a high-resolution monotonic guest clock (microsecond class)
     * for guest Node processes. Default `false` keeps the security-oriented
     * 1ms timer resolution — untrusted guest code should not get a precise
     * timer (timing side channels). Enable only for trusted benchmarking or
     * profiling workloads.
     */
    highResolutionTime?: boolean;
    /** Durable SQLite storage for VM-owned filesystem and session state. */
    database?: VmSqliteConfig;
    /** Root filesystem configuration. Defaults to an overlay with the bundled base snapshot as its deepest lower. */
    rootFilesystem?: RootFilesystemConfig;
    /** Filesystems to mount at boot time. */
    mounts?: MountConfig[];
    /** External sandbox mounted into this VM with process bindings. */
    sandbox?: AgentOsSandboxInput;
    /** Custom schedule driver for cron jobs. Defaults to TimerScheduleDriver. */
    scheduleDriver?: ScheduleDriver;
    /** Host-side bindings available to agents inside the VM. */
    bindings?: Bindings[];
    /**
     * Custom permission policy for the kernel. Controls access to filesystem,
     * network, child process, and environment operations. Defaults to allowAll.
     */
    permissions?: Permissions;
    /**
     * Sidecar placement for the VM. Defaults to the shared `default` pool.
     * Pass an explicit sidecar handle to pin the VM to a caller-managed sidecar.
     */
    sidecar?: AgentOsSidecarConfig;
    /**
     * Operator-tunable runtime limits. Unset fields use built-in defaults that match the
     * runtime's historical constants, so omitting this leaves behavior unchanged.
     */
    limits?: AgentOsLimits;
    /**
     * Called with stderr chunks from the top-level ACP-speaking agent process.
     * The agent process uses stdout for ACP JSON-RPC protocol traffic, so only
     * stderr is forwarded through this hook. Defaults to writing chunks to
     * `process.stderr`.
     */
    onAgentStderr?: AgentStderrHandler;
    /**
     * Called when the ACP adapter process behind a session exits unexpectedly.
     * The sidecar evicts the live
     * route and never retries the adapter or interrupted request implicitly.
     * Defaults to writing a warning line to `process.stderr`.
     */
    onAgentExit?: AgentExitHandler;
    /**
     * Called when a bounded limit inside the VM runtime approaches capacity
     * (~80%, edge-triggered with hysteresis so it does not spam). Use it to alert
     * on a slow consumer or a runaway guest before the limit is actually hit.
     */
    onLimitWarning?: LimitWarningHandler;
}
export interface AgentOsRuntimeAdmin {
    kernel: Kernel;
    rootView: VirtualFileSystem;
    env: Record<string, string>;
    sidecar: AgentOsSidecar;
}
export declare class AgentOs {
    #private;
    readonly sidecar: AgentOsSidecar;
    private _durableSessionEventHandlers;
    private _agentExitHandlers;
    private _processes;
    private _languageProcesses;
    private _languageProcessIds;
    private _executionOutputHandlers;
    private _executionCompletedHandlers;
    private _shells;
    private _closedShellIds;
    private _pendingShellExitPromises;
    private _shellCounter;
    private _acpTerminals;
    private _acpTerminalCounter;
    private _softwareRoots;
    private _cronManager;
    private _bindings;
    private _bindingReference;
    private _permissions;
    private _hostMounts;
    private _env;
    private _rootFilesystem;
    private _sidecarLease;
    private readonly _sidecarClient;
    private readonly _sidecarSession;
    private readonly _sidecarVm;
    private readonly _disposeSidecarEventListener;
    private readonly _agentStderrHandler?;
    private readonly _agentExitHandler?;
    private readonly _limitWarningHandler?;
    private readonly _disposeHooks;
    /**
     * Execute commands and manage child processes in the VM.
     *
     * `exec` evaluates a command with the configured shell, while `execFile`
     * invokes an executable directly with an argv array.
     */
    readonly process: {
        exec: (command: string, options?: LanguageExecutionOptions) => Promise<CodeExecutionResult>;
        execFile: (command: string, args?: readonly string[], options?: Omit<LanguageExecutionOptions, "args">) => Promise<CodeExecutionResult>;
        spawn: (command: string, args?: string[], options?: SpawnOptions) => Promise<ProcessDescriptor>;
        get: (pid: number) => Promise<ProcessDescriptor>;
        list: () => Promise<ProcessDescriptor[]>;
        tree: () => Promise<ProcessTreeNode[]>;
        wait: (pid: number) => Promise<ProcessExit>;
        signal: (pid: number, signal: ExecutionSignal) => Promise<void>;
        kill: (pid: number) => Promise<void>;
        writeStdin: (pid: number, data: string | Uint8Array) => Promise<void>;
        closeStdin: (pid: number) => Promise<void>;
        resizePty: (pid: number, size: {
            cols: number;
            rows: number;
        }) => Promise<void>;
        readOutput: (pid: number, options?: {
            after?: number;
        }) => Promise<OutputReplay>;
    };
    readonly javascript: {
        execute: (source: string, options?: JavaScriptExecutionOptions) => Promise<CodeExecutionResult>;
        evaluate: <T = JsonValue>(expression: string, options?: JavaScriptEvaluationOptions) => Promise<CodeEvaluationResult<T>>;
        executeFile: (path: string, options?: LanguageExecutionOptions) => Promise<CodeExecutionResult>;
        spawn: (source: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        spawnFile: (path: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        npm: {
            install: {
                (options?: NpmProjectInstallOptions): Promise<CodeExecutionResult>;
                (packages: string | string[], options?: NpmPackageInstallOptions): Promise<CodeExecutionResult>;
            };
            runScript: (script: string, options?: LanguageExecutionOptions) => Promise<CodeExecutionResult>;
            runPackage: (packageSpec: string, options?: LanguageExecutionOptions & {
                binary?: string;
            }) => Promise<CodeExecutionResult>;
        };
    };
    readonly typescript: {
        execute: (source: string, options?: TypeScriptExecutionOptions) => Promise<CodeExecutionResult>;
        evaluate: <T = JsonValue>(expression: string, options?: TypeScriptEvaluationOptions) => Promise<CodeEvaluationResult<T>>;
        executeFile: (path: string, options?: TypeScriptFileExecutionOptions) => Promise<CodeExecutionResult>;
        spawn: (source: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        spawnFile: (path: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        check: (source: string, options?: TypeScriptCheckOptions) => Promise<TypeScriptCheckResult>;
        checkProject: (options?: Omit<TypeScriptCheckOptions, "filePath" | "compilerOptions">) => Promise<TypeScriptCheckResult>;
    };
    readonly python: {
        execute: (source: string, options?: InlineExecutionOptions) => Promise<CodeExecutionResult>;
        evaluate: <T = JsonValue>(expression: string, options?: InlineExecutionOptions) => Promise<CodeEvaluationResult<T>>;
        executeFile: (path: string, options?: LanguageExecutionOptions) => Promise<CodeExecutionResult>;
        executeModule: (module: string, options?: LanguageExecutionOptions) => Promise<CodeExecutionResult>;
        spawn: (source: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        spawnFile: (path: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        spawnModule: (module: string, options?: LanguageSpawnOptions) => Promise<ProcessDescriptor>;
        install: {
            (options?: PythonInstallOptions): Promise<CodeExecutionResult>;
            (packages: string | string[], options?: PythonInstallOptions): Promise<CodeExecutionResult>;
        };
    };
    readonly contexts: {
        get: (contextId: string) => Promise<ContextDescriptor>;
        list: () => Promise<ContextDescriptor[]>;
        reset: (contextId: string) => Promise<void>;
        delete: (contextId: string) => Promise<void>;
    };
    readonly terminal: {
        open: (options?: ShellOptions) => {
            shellId: string;
        };
        write: (shellId: string, data: string | Uint8Array) => Promise<void>;
        resize: (shellId: string, cols: number, rows: number) => void;
        wait: (shellId: string) => Promise<number>;
        close: (shellId: string) => void;
    };
    readonly filesystem: {
        readFile: (path: string) => Promise<Uint8Array>;
        writeFile: (path: string, content: string | Uint8Array) => Promise<void>;
        readFiles: (paths: string[]) => Promise<BatchReadResult[]>;
        writeFiles: (entries: BatchWriteEntry[]) => Promise<BatchWriteResult[]>;
        stat: (path: string) => Promise<VirtualStat>;
        mkdir: (path: string, options?: {
            recursive?: boolean;
        }) => Promise<void>;
        readdir: (path: string) => Promise<string[]>;
        readdirEntries: (path: string) => Promise<ReaddirEntry[]>;
        readdirRecursive: (path: string, options?: ReaddirRecursiveOptions) => Promise<DirEntry[]>;
        exists: (path: string) => Promise<boolean>;
        move: (from: string, to: string) => Promise<void>;
        remove: (path: string, options?: {
            recursive?: boolean;
        }) => Promise<void>;
        export: (options: ExportRootFilesystemOptions) => Promise<RootSnapshotExport>;
        mount: (descriptor: DynamicMountDescriptor) => Promise<void>;
        unmount: (path: string) => Promise<void>;
        listMounts: () => Promise<MountInfo[]>;
    };
    readonly network: {
        httpRequest: (request: HttpRequest) => Promise<HttpResponse>;
    };
    readonly software: {
        list: () => Promise<{
            packageName: string;
            commands: string[];
        }[]>;
        link: (descriptor: PackageDescriptor) => Promise<void>;
    };
    readonly agents: {
        list: () => Promise<AgentRegistryEntry[]>;
    };
    readonly sessions: {
        open: (input: OpenSessionInput) => Promise<void>;
        get: (input?: SessionTarget) => Promise<DurableSessionInfo>;
        list: (input?: ListSessionsInput) => Promise<SessionPage>;
        delete: (input?: SessionTarget) => Promise<void>;
        unload: (input?: SessionTarget) => Promise<void>;
        prompt: (input: PromptInput) => Promise<DurablePromptResult>;
        cancelPrompt: (input?: SessionTarget) => Promise<CancelPromptResult>;
        respondPermission: (input: PermissionResponse) => Promise<PermissionResponseResult>;
        readHistory: (input?: ReadHistoryInput) => Promise<HistoryPage>;
        getConfig: (input?: SessionTarget) => Promise<SessionConfig>;
        setConfigOption: (input: SetSessionConfigOptionInput) => Promise<SessionConfig>;
        getCapabilities: (input?: SessionTarget) => Promise<SessionCapabilities | null>;
        getAgentInfo: (input?: SessionTarget) => Promise<SessionAgentInfo | null>;
    };
    readonly cron: {
        schedule: (options: CronJobOptions) => CronJob;
        list: () => CronJobInfo[];
        cancel: (id: string) => void;
    };
    private constructor();
    static createSidecar(options?: AgentOsCreateSidecarOptions): Promise<AgentOsSidecar>;
    static getSharedSidecar(options?: AgentOsSharedSidecarOptions): Promise<AgentOsSidecar>;
    static create(options?: AgentOsOptions): Promise<AgentOs>;
    createContext(contextId: string): Promise<void>;
    private _executionOperation;
    private _spawnLanguageOperation;
    private _exec;
    private _execFile;
    /** @deprecated Use `process.exec()` for lifecycle-aware execution. */
    exec(command: string, options?: KernelExecOptions): Promise<KernelExecResult>;
    /** @deprecated Use `process.execFile()` for lifecycle-aware execution. */
    execArgv(command: string, args?: readonly string[], options?: KernelExecOptions): Promise<KernelExecResult>;
    private _executeJavaScript;
    private _evaluationOperation;
    private _evaluateJavaScript;
    private _executeJavaScriptFile;
    private _spawnJavaScript;
    private _spawnJavaScriptFile;
    private _executeTypeScript;
    private _evaluateTypeScript;
    private _executeTypeScriptFile;
    private _spawnTypeScript;
    private _spawnTypeScriptFile;
    private _checkTypeScript;
    private _checkTypeScriptProject;
    private _installNpmPackages;
    private _executeNpmScript;
    private _executeNpmPackage;
    private _executePython;
    private _evaluatePython;
    private _executePythonFile;
    private _executePythonModule;
    private _spawnPython;
    private _spawnPythonFile;
    private _spawnPythonModule;
    private _installPythonPackages;
    private _getContext;
    private _listContexts;
    private _waitExecutionResult;
    private _cancelExecution;
    private _signalExecution;
    private _resetContext;
    private _descriptorLifecycleRequest;
    private _deleteContext;
    private _writeExecutionStdin;
    private _closeExecutionStdin;
    private _resizeExecutionPty;
    private _readExecutionOutput;
    private _onExecutionOutput;
    private _onExecutionCompleted;
    private _trackProcess;
    private _spawnProcess;
    spawn(command: string, args?: string[], options?: SpawnOptions): Promise<ProcessDescriptor>;
    /** Write data to a process's stdin. */
    private _writeProcessStdin;
    /** Close a process's stdin stream. */
    private _closeProcessStdin;
    /** Subscribe to stdout and stderr from a process. */
    onProcessOutput(pid: number, handler: (event: ProcessOutput) => void): () => void;
    /** Subscribe to process exit. Returns an unsubscribe function. */
    onProcessExit(pid: number, handler: (event: ProcessExit) => void): () => void;
    /** Wait for a process to exit. Returns the exit code. */
    private _waitProcess;
    private _assertSafeAbsolutePath;
    private _assertWritableAbsolutePath;
    private _vfs;
    private _readFile;
    private _writeFile;
    private _writeFiles;
    private _readFiles;
    /** Recursively create directories (mkdir -p). */
    private _mkdirp;
    private _mkdir;
    private _readdir;
    private _readdirEntries;
    private _readdirRecursive;
    private _stat;
    private _exists;
    private _exportRootFilesystem;
    /**
     * Mount a filesystem into the running VM. Resolves once the mount has been
     * delivered to the native sidecar, so guest code can use it immediately
     * after the returned promise settles; a delivery failure rejects instead of
     * leaving the mount silently host-only.
     */
    private _mountFs;
    private _unmountFs;
    private _listMounts;
    private _move;
    private _remove;
    /** @deprecated Use `filesystem.readFile()`. */
    readFile(path: string): Promise<Uint8Array>;
    /** @deprecated Use `filesystem.writeFile()`. */
    writeFile(path: string, content: string | Uint8Array): Promise<void>;
    /** @deprecated Use `filesystem.writeFiles()`. */
    writeFiles(entries: BatchWriteEntry[]): Promise<BatchWriteResult[]>;
    /** @deprecated Use `filesystem.readFiles()`. */
    readFiles(paths: string[]): Promise<BatchReadResult[]>;
    /** @deprecated Use `filesystem.mkdir()`. */
    mkdir(path: string, options?: {
        recursive?: boolean;
    }): Promise<void>;
    /** @deprecated Use `filesystem.readdir()`. */
    readdir(path: string): Promise<string[]>;
    /** @deprecated Use `filesystem.readdirEntries()`. */
    readdirEntries(path: string): Promise<ReaddirEntry[]>;
    /** @deprecated Use `filesystem.readdirRecursive()`. */
    readdirRecursive(path: string, options?: ReaddirRecursiveOptions): Promise<DirEntry[]>;
    /** @deprecated Use `filesystem.stat()`. */
    stat(path: string): Promise<VirtualStat>;
    /** @deprecated Use `filesystem.exists()`. */
    exists(path: string): Promise<boolean>;
    /** @deprecated Use `filesystem.export()`. */
    exportRootFilesystem(options: ExportRootFilesystemOptions): Promise<RootSnapshotExport>;
    /** @deprecated Use `filesystem.mount()`. */
    mountFs(descriptor: DynamicMountDescriptor): Promise<void>;
    /** @deprecated Use `filesystem.unmount()`. */
    unmountFs(path: string): Promise<void>;
    /** @deprecated Use `filesystem.listMounts()`. */
    listMounts(): Promise<MountInfo[]>;
    /** @deprecated Use `filesystem.move()`. */
    move(from: string, to: string): Promise<void>;
    /** @deprecated Use `filesystem.remove()`. */
    remove(path: string, options?: {
        recursive?: boolean;
    }): Promise<void>;
    private _httpRequest;
    /** @deprecated Use `network.httpRequest()`. */
    httpRequest(request: HttpRequest): Promise<HttpResponse>;
    /**
     * Fetch an HTTP endpoint inside the VM while preserving duplicate response
     * headers and arbitrary binary bodies. agentOS Apps uses this compatibility
     * surface for its direct actor API.
     */
    fetch(port: number, request: Request): Promise<Response>;
    fetchStreamStart(port: number, request: Request): Promise<{
        streamId: string;
        status: number;
        statusText: string;
        headers: Array<[string, string]>;
    }>;
    fetchStreamRead(streamId: string, maxBytes?: number): Promise<{
        body: Uint8Array;
        done: boolean;
    }>;
    fetchStreamCancel(streamId: string): Promise<void>;
    private _openTerminal;
    connectTerminal(options?: ConnectTerminalOptions): Promise<number>;
    /** Write data to a shell's PTY input. */
    private _writeTerminal;
    /**
     * Subscribe to ordered PTY output (stdout and stderr). Returns an unsubscribe
     * function. `OpenShellOptions.onStderr` is a diagnostic tap for callers that
     * need channel identity; do not render both surfaces.
     */
    onShellData(shellId: string, handler: (event: ShellData) => void): () => void;
    /** Subscribe to the stderr-only diagnostic stream for a shell. */
    onShellStderr(shellId: string, handler: (event: ShellData) => void): () => void;
    /** Subscribe to shell exit. */
    onShellExit(shellId: string, handler: (event: ShellExit) => void): () => void;
    /** Notify a shell of terminal resize. */
    private _resizeTerminal;
    /**
     * Wait for a shell to exit and return its process exit code. Resolves
     * immediately for a shell that has already exited (within the closed-shell
     * retention window).
     */
    private _waitTerminal;
    /** Kill a shell process and remove it from tracking. */
    private _closeTerminal;
    /** @deprecated Use `terminal.open()`. */
    openShell(options?: ShellOptions): {
        shellId: string;
    };
    /** @deprecated Use `terminal.write()`. */
    writeShell(shellId: string, data: string | Uint8Array): Promise<void>;
    /** @deprecated Use `terminal.resize()`. */
    resizeShell(shellId: string, cols: number, rows: number): void;
    /** @deprecated Use `terminal.wait()`. */
    waitShell(shellId: string): Promise<number>;
    /** @deprecated Use `terminal.close()`. */
    closeShell(shellId: string): void;
    private _resolveVmPathToHostPath;
    /** Returns info about all processes spawned via spawn(). */
    private _listProcesses;
    /** Returns all kernel processes across all active runtimes (WASM and Node). */
    private _listAllProcesses;
    /** Returns processes organized as a tree using ppid relationships. */
    private _processTree;
    /** Returns info about a specific process by PID. Throws if not found. */
    private _getProcess;
    private _signalProcess;
    /** Send SIGKILL to force-kill a process. No-op if already exited. */
    private _killProcess;
    private _resizeProcessPty;
    private _readProcessOutput;
    private _openSession;
    private _getSession;
    private _listSessions;
    private _deleteSession;
    private _unloadSession;
    private _prompt;
    private _cancelPrompt;
    private _respondPermission;
    private _readHistory;
    private _getSessionConfig;
    private _setSessionConfigOption;
    private _getSessionCapabilities;
    private _getSessionAgentInfo;
    /** @deprecated Use `sessions.open()`. */
    openSession(input: OpenSessionInput): Promise<void>;
    /** @deprecated Use `sessions.get()`. */
    getSession(input?: SessionTarget): Promise<DurableSessionInfo>;
    /** @deprecated Use `sessions.list()`. */
    listSessions(input?: ListSessionsInput): Promise<SessionPage>;
    /** @deprecated Use `sessions.delete()`. */
    deleteSession(input?: SessionTarget): Promise<void>;
    /** @deprecated Use `sessions.unload()`. */
    unloadSession(input?: SessionTarget): Promise<void>;
    /** @deprecated Use `sessions.prompt()`. */
    prompt(input: PromptInput): Promise<DurablePromptResult>;
    /** @deprecated Use `sessions.cancelPrompt()`. */
    cancelPrompt(input?: SessionTarget): Promise<CancelPromptResult>;
    /** @deprecated Use `sessions.respondPermission()`. */
    respondPermission(input: PermissionResponse): Promise<PermissionResponseResult>;
    /** @deprecated Use `sessions.readHistory()`. */
    readHistory(input?: ReadHistoryInput): Promise<HistoryPage>;
    /** @deprecated Use `sessions.getConfig()`. */
    getSessionConfig(input?: SessionTarget): Promise<SessionConfig>;
    /** @deprecated Use `sessions.setConfigOption()`. */
    setSessionConfigOption(input: SetSessionConfigOptionInput): Promise<SessionConfig>;
    /** @deprecated Use `sessions.getCapabilities()`. */
    getSessionCapabilities(input?: SessionTarget): Promise<SessionCapabilities | null>;
    /** @deprecated Use `sessions.getAgentInfo()`. */
    getSessionAgentInfo(input?: SessionTarget): Promise<SessionAgentInfo | null>;
    /**
     * Dynamically link a software package into the RUNNING VM. The package's
     * `bin/` commands appear under `/opt/agentos/bin` (on `$PATH`) and its `share/man`
     * pages under MANPATH immediately — the `/opt/agentos` mount is host-backed, so
     * writing into its staging dir is reflected live with no reboot. An `agent`
     * block registers the package for `openSession({ agent: name })`. Persists for the VM's
     * lifetime (and across a snapshot iff the volume persists).
     */
    private _linkSoftware;
    private _listSoftware;
    /**
     * Returns all registered agents with their installation status. Thin forwarder:
     * sends `AcpListAgentsRequest` and maps the response. The sidecar enumerates the
     * projected `/opt/agentos` packages (the client parses no manifests). Every such
     * agent is a package materialized into the VM, so `installed` is always `true`.
     */
    private _listAgents;
    /** @deprecated Use `software.link()`. */
    linkSoftware(descriptor: PackageDescriptor): Promise<void>;
    /** @deprecated Use `software.list()`. */
    listSoftware(): Promise<{
        packageName: string;
        commands: string[];
    }[]>;
    /** @deprecated Use `agents.list()`. */
    listAgents(): Promise<AgentRegistryEntry[]>;
    private _recordAgentStderr;
    private _recordAgentExit;
    private _handleSidecarEvent;
    private _handleLimitWarning;
    private _handleAcpExtEvent;
    private _emitDurableSessionEvent;
    private _sendAcpRequest;
    private _installSidecarRequestHandler;
    private _handleAcpExtSidecarRequest;
    private _dispatchAcpSidecarRequest;
    private _handleSupportedAcpSidecarRequest;
    private _acpParams;
    private _requireAcpStringParam;
    private _optionalAcpStringParam;
    private _optionalAcpNumberParam;
    private _optionalAcpStringArrayParam;
    private _optionalAcpEnvParam;
    private _requireAcpTerminal;
    private _appendAcpTerminalOutput;
    private _handleAcpReadFile;
    private _handleAcpWriteFile;
    private _handleAcpReadDir;
    private _handleAcpCreateTerminal;
    private _handleAcpWriteTerminal;
    private _handleAcpReadTerminal;
    private _handleAcpWaitForTerminalExit;
    private _handleAcpKillTerminal;
    private _handleAcpReleaseTerminal;
    private _handleAcpResizeTerminal;
    onSessionEvent(handler: (entry: SessionStreamEntry) => void): () => void;
    onSessionEvent(sessionId: string | undefined, handler: (entry: SessionStreamEntry) => void): () => void;
    /** Subscribe to unexpected adapter exits without changing session liveness. */
    onAgentExit(handler: AgentExitHandler): () => void;
    onAgentExit(sessionId: string | undefined, handler: AgentExitHandler): () => void;
    /** Schedule a cron job. Returns a handle with the job ID and a cancel method. */
    private _scheduleCron;
    /** List all registered cron jobs. */
    private _listCronJobs;
    /** Cancel a cron job by ID. */
    private _cancelCronJob;
    /** @deprecated Use `cron.schedule()`. */
    scheduleCron(options: CronJobOptions): CronJob;
    /** @deprecated Use `cron.list()`. */
    listCronJobs(): CronJobInfo[];
    /** @deprecated Use `cron.cancel()`. */
    cancelCronJob(id: string): void;
    /** Subscribe to cron lifecycle events (fire, complete, error). */
    onCronEvent(handler: CronEventHandler): void;
    dispose(): Promise<void>;
}
export declare function getAgentOsRuntimeAdmin(vm: AgentOs): AgentOsRuntimeAdmin;
export declare function getAgentOsKernel(vm: AgentOs): Kernel;
export declare class AgentOsSidecar {
    constructor(sidecarId: string, placement: AgentOsSidecarPlacement, sharedPool?: string);
    describe(): AgentOsSidecarDescription;
    dispose(): Promise<void>;
}
/**
 * Test-only escape hatch: dispose every cached shared sidecar so vitest
 * workers can exit cleanly. The shared sidecar is normally process-global and
 * keeps its native subprocess alive across `AgentOs.create()` calls; without
 * this hook the vitest worker can hold open piped stdio handles after the
 * test suite finishes and stall `pnpm test` indefinitely.
 */
export declare function __disposeAllSharedSidecarsForTesting(): Promise<void>;