export interface CallerIdentity {
    actor: string;
    launchId?: string;
    sessionId?: string;
    /** Agent pid when identity came from the process-table anchor. */
    agentPid?: number;
}
/**
 * Resolve caller identity once per CLI process for browser IPC stamping.
 *
 * Starts from `process.ppid` — the shell or harness that launched this
 * `agents browser` invocation — and walks up until a state file or known
 * agent comm is found.
 */
export declare function resolveCallerIdentity(env?: NodeJS.ProcessEnv): CallerIdentity;
/**
 * The env a `browser --device` dispatch forwards so the HUB resolves the SAME
 * caller identity the worker would stamp locally. Without it a forwarded verb
 * lands on the hub with BLANK identity, and the daemon's no-identity task bucket
 * matches any other no-identity task — so a cold verb could attach to (or a
 * `done`/`stop` could close) an unrelated agent's or a human's browser. This is
 * the same surface-parity fix the `run --device` path already carries via
 * `--env AGENT_LAUNCH_ID` (remote-session-id.ts). Absent fields are omitted so a
 * genuinely-unidentifiable caller forwards nothing rather than an empty string
 * that would read as a real (blank) identity on the far side.
 */
export declare function callerIdentityEnv(caller: Pick<CallerIdentity, 'sessionId' | 'launchId'>): Record<string, string>;
/**
 * True when a live task belongs to this caller. Match on sessionId or
 * launchId — either is enough. A task with no recorded identity never
 * matches a caller that has one (and vice versa for the no-identity case
 * handled separately by the resolver).
 */
export declare function taskMatchesCaller(task: {
    sessionId?: string;
    launchId?: string;
}, caller: {
    sessionId?: string;
    launchId?: string;
}): boolean;
