@gajae-code/coding-agent 0.10.2 → 0.11.1

package/dist/types/modes/components/settings-selector.d.ts

@@ -1,9 +1,9 @@
 import { type ThinkingLevel as ThinkingLevelValue } from "@gajae-code/agent-core";
 import type { Effort } from "@gajae-code/ai";
-import { Container, SettingsList } from "@gajae-code/tui";
+import { type Component, Container } from "@gajae-code/tui";
 import { type SettingPath } from "../../config/settings";
 import type { StatusLinePreset, StatusLineSegmentId, StatusLineSeparatorStyle } from "../../config/settings-schema";
-import { PluginSettingsComponent } from "./plugin-settings";
+import { type NotificationsEditorOperations } from "./notifications-settings-editor";
 import type { StatusLineSegmentOptions } from "./status-line";
 /**
  * Dynamic context for settings that need runtime data.
@@ -67,7 +67,9 @@ export declare class SettingsSelectorComponent extends Container {
     #private;
     private readonly context;
     private readonly callbacks;
-    constructor(context: SettingsRuntimeContext, callbacks: SettingsCallbacks);
-    getFocusComponent(): SettingsList | PluginSettingsComponent;
+    private readonly notificationsOperations?;
+    constructor(context: SettingsRuntimeContext, callbacks: SettingsCallbacks, notificationsOperations?: NotificationsEditorOperations | undefined);
+    getFocusComponent(): Component;
+    dispose(): void;
     handleInput(data: string): void;
 }

package/dist/types/modes/components/welcome.d.ts

@@ -5,7 +5,7 @@ export interface RecentSession {
 }
 export interface LspServerInfo {
     name: string;
-    status: "ready" | "error" | "connecting";
+    status: "idle" | "ready" | "error" | "connecting";
     fileTypes: string[];
 }
 export type WelcomeLogoMode = "unicode" | "square" | "ascii";

package/dist/types/modes/controllers/command-controller.d.ts

@@ -22,9 +22,9 @@ export declare class CommandController {
     handleToolsCommand(): void;
     handleContextCommand(): void;
     handleMemoryCommand(text: string): Promise<void>;
-    handleClearCommand(): Promise<void>;
+    handleClearCommand(): Promise<boolean>;
     handleContextClearCommand(): Promise<void>;
-    handleDropCommand(): Promise<void>;
+    handleDropCommand(): Promise<boolean>;
     handleForkCommand(): Promise<void>;
     handleMoveCommand(targetPath: string): Promise<void>;
     handleRenameCommand(title: string): Promise<void>;

package/dist/types/modes/controllers/extension-ui-controller.d.ts

@@ -7,6 +7,7 @@ export declare class ExtensionUiController {
     #private;
     private ctx;
     constructor(ctx: InteractiveModeContext);
+    captureSessionUiCleanup(): () => void;
     /**
      * Initialize the hook system with TUI-based UI context.
      */

package/dist/types/modes/controllers/selector-controller.d.ts

@@ -2,6 +2,13 @@ import type { Component } from "@gajae-code/tui";
 import type { ModelProfileConfig } from "../../config/models-config-schema";
 import { type Settings } from "../../config/settings";
 import type { InteractiveModeContext, OAuthSelectorOptions } from "../../modes/types";
+import { getNotificationConfig, maskToken } from "../../sdk/bus/config";
+import { proposedTelegramIdentity, reconcileCommittedTelegramConfiguration, removeTelegramConfiguration, saveTelegramInactive } from "../../sdk/bus/notification-orchestration";
+import { buildNotificationStatusReport, checkNotificationHealth, recoverNotifications, sanitizeDiagnostic, sendNotificationTest } from "../../sdk/bus/notification-service";
+import { ensureTelegramDaemonRunningDetailed, unregisterNotificationRoot } from "../../sdk/bus/telegram-daemon";
+import { runTelegramSetup } from "../../sdk/bus/telegram-setup";
+import { type CredentialAutoImportStateStore } from "../../setup/credential-auto-import";
+import type { NotificationsEditorOperations } from "../components/notifications-settings-editor";
 import type { StatusLineSettings } from "../components/status-line";
 import type { JobsObserver } from "../jobs-observer";
 import type { SessionObserverRegistry } from "../session-observer-registry";
@@ -11,10 +18,37 @@ import type { SessionObserverRegistry } from "../session-observer-registry";
  * previewed row count (and every other field) can never drift out of sync.
  */
 export declare function buildStatusLineSettings(settingsInstance: Settings): StatusLineSettings;
+export interface NotificationsEditorAdapterContext {
+    settings: Settings;
+    session: Pick<InteractiveModeContext["session"], "notificationSessionController">;
+    sessionManager: Pick<InteractiveModeContext["sessionManager"], "getCwd" | "getSessionId">;
+    notifyConfigChanged?: () => Promise<void> | void;
+}
+export interface NotificationsEditorOperationDependencies {
+    getNotificationConfig: typeof getNotificationConfig;
+    maskToken: typeof maskToken;
+    buildNotificationStatusReport: typeof buildNotificationStatusReport;
+    checkNotificationHealth: typeof checkNotificationHealth;
+    sendNotificationTest: typeof sendNotificationTest;
+    recoverNotifications: typeof recoverNotifications;
+    sanitizeDiagnostic: typeof sanitizeDiagnostic;
+    ensureTelegramDaemonRunningDetailed: typeof ensureTelegramDaemonRunningDetailed;
+    runTelegramSetup: typeof runTelegramSetup;
+    proposedTelegramIdentity: typeof proposedTelegramIdentity;
+    reconcileCommittedTelegramConfiguration: typeof reconcileCommittedTelegramConfiguration;
+    saveTelegramInactive: typeof saveTelegramInactive;
+    removeTelegramConfiguration: typeof removeTelegramConfiguration;
+    unregisterNotificationRoot: typeof unregisterNotificationRoot;
+}
+/**
+ * Concrete service adapter for the direct Notifications settings tab. Secrets remain in this closure's
+ * WeakMap and are never exposed through the editor's safe draft contract.
+ */
+export declare function createNotificationsEditorOperations(ctx: NotificationsEditorAdapterContext, overrides?: Partial<NotificationsEditorOperationDependencies>): NotificationsEditorOperations;
 export declare class SelectorController {
     #private;
     private ctx;
-    constructor(ctx: InteractiveModeContext);
+    constructor(ctx: InteractiveModeContext, credentialAutoImportStateStore?: CredentialAutoImportStateStore);
     /**
      * Shows a selector component in place of the editor.
      * @param create Factory that receives a `done` callback and returns the component and focus target

package/dist/types/modes/index.d.ts

@@ -2,9 +2,5 @@
  * Run modes for the coding agent.
  */
 export { runAcpMode } from "./acp";
-export { runBridgeMode } from "./bridge/bridge-mode";
 export { InteractiveMode, type InteractiveModeOptions } from "./interactive-mode";
 export { type PrintModeOptions, runPrintMode } from "./print-mode";
-export { defineRpcClientTool, type ModelInfo, RpcClient, type RpcClientCustomTool, type RpcClientOptions, type RpcClientToolContext, type RpcClientToolResult, type RpcEventListener, } from "./rpc/rpc-client";
-export { runRpcMode } from "./rpc/rpc-mode";
-export type { RpcCommand, RpcHostToolCallRequest, RpcHostToolCancelRequest, RpcHostToolDefinition, RpcHostToolResult, RpcHostToolUpdate, RpcResponse, RpcSessionState, } from "./rpc/rpc-types";

package/dist/types/modes/interactive-mode.d.ts

@@ -9,6 +9,7 @@ import type { ExtensionUIContext, ExtensionUIDialogOptions, ExtensionWidgetConte
 import type { CompactOptions } from "../extensibility/extensions/types";
 import { type Skill } from "../extensibility/skills";
 import { type PlanApprovalDetails } from "../plan-mode/approved-plan";
+import type { NotificationSessionReconcileResult, NotificationSessionStatus } from "../sdk/bus/session-control";
 import type { AgentSession, AgentSessionEvent } from "../session/agent-session";
 import { HistoryStorage } from "../session/history-storage";
 import type { SessionContext, SessionManager } from "../session/session-manager";
@@ -119,6 +120,8 @@ export declare class InteractiveMode implements InteractiveModeContext {
     readonly lspServers: LspStartupServerInfo[] | undefined;
     mcpManager?: import("../runtime-mcp").MCPManager;
     constructor(session: AgentSession, version: string, changelogMarkdown?: string | undefined, setToolUIContext?: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers?: LspStartupServerInfo[] | undefined, mcpManager?: import("../runtime-mcp").MCPManager, eventBus?: EventBus);
+    getCurrentSessionNotificationStatus(): NotificationSessionStatus | undefined;
+    setCurrentSessionNotificationsEnabled(enabled: boolean): Promise<NotificationSessionReconcileResult | undefined>;
     init(): Promise<void>;
     /** Reload slash commands and autocomplete for the provided working directory. */
     refreshSlashCommandState(cwd?: string): Promise<void>;
@@ -208,9 +211,9 @@ export declare class InteractiveMode implements InteractiveModeContext {
     handleHelpCommand(): void;
     handleToolsCommand(): void;
     handleContextCommand(): void;
-    handleClearCommand(): Promise<void>;
+    handleClearCommand(): Promise<boolean>;
     handleContextClearCommand(): Promise<void>;
-    handleDropCommand(): Promise<void>;
+    handleDropCommand(): Promise<boolean>;
     handleForkCommand(): Promise<void>;
     handleMoveCommand(targetPath: string): Promise<void>;
     handleRenameCommand(title: string): Promise<void>;

package/dist/types/modes/runtime-init.d.ts

@@ -7,9 +7,9 @@ export interface InitializeExtensionsOptions {
     reportSendError: (action: ExtensionSendAction, error: Error) => void;
     /** Reports a runtime error surfaced through {@link ExtensionRunner.onError}. */
     reportRuntimeError: (error: ExtensionError) => void;
-    /** Optional shutdown hook (rpc mode signals its loop; print mode is a no-op). */
+    /** Optional shutdown hook for caller-specific lifecycle signaling. */
     onShutdown?: () => void;
-    /** Optional UI context (rpc supplies one; print runs headless). */
+    /** Optional interactive UI context; omitted for headless callers. */
     uiContext?: ExtensionUIContext;
 }
 /**

package/dist/types/modes/shared/agent-wire/approval-gate.d.ts

@@ -7,16 +7,13 @@
  *  - ultragoal execution sign-off -> `workflow_gate` { kind: "execution" } whose
  *    answer is approve / decline (+ optional reason).
  *
- * Gates remain mandatory; the external agent substitutes for the human at the
- * answer boundary only. Declining / requesting changes is honored and is NEVER
- * silently treated as approval.
+ * Gates remain mandatory; the remote SDK client answers at the gate boundary.
+ * Declining / requesting changes is honored and is NEVER silently treated as approval.
  *
- * This is the pure mapping primitive; routing ralplan/ultragoal through it when
- * an unattended controller + gate broker are attached is wired with the transport
- * in #321 and exercised end-to-end by #323.
+ * This is the pure mapping primitive used by SDK-native workflow gate emitters.
  */
-import type { RpcWorkflowGateContext } from "../../rpc/rpc-types";
 import type { OpenGateInput } from "./workflow-gate-broker";
+import type { WorkflowGateContext } from "./workflow-gate-types";
 export type ApprovalDecision = "approve" | "request-changes" | "reject";
 export type ExecutionDecision = "approve" | "decline";
 export interface ApprovalGateAnswer {
@@ -42,9 +39,9 @@ export declare class ApprovalGateError extends Error {
     constructor(code: "invalid_answer_shape" | "unknown_decision" | "missing_comments", message: string);
 }
 /** Build the ralplan `pending approval` -> `workflow_gate { kind: "approval" }` open-input. */
-export declare function approvalGate(context?: RpcWorkflowGateContext): OpenGateInput;
+export declare function approvalGate(context?: WorkflowGateContext): OpenGateInput;
 /** Build the ultragoal execution sign-off -> `workflow_gate { kind: "execution" }` open-input. */
-export declare function executionGate(context?: RpcWorkflowGateContext): OpenGateInput;
+export declare function executionGate(context?: WorkflowGateContext): OpenGateInput;
 /**
  * Decode a ralplan approval answer. `request-changes` requires comments and is
  * NEVER treated as approval; only an explicit `approve` advances.

package/dist/types/modes/shared/agent-wire/deep-interview-gate.d.ts

@@ -7,12 +7,10 @@
  * back into the exact QuestionResult shape the human path produces, so ambiguity
  * scoring/state updates proceed identically whether a human or an agent answers.
  *
- * This is the pure mapping primitive. Routing the ask tool through it (instead of
- * the interactive select/editor UI) when an unattended controller + gate broker
- * are attached is wired with the transport in #321 and exercised by #323.
+ * This is the pure mapping primitive used by SDK-native workflow gate emitters.
  */
-import type { RpcWorkflowGateKind, RpcWorkflowStage } from "../../rpc/rpc-types";
 import type { OpenGateInput } from "./workflow-gate-broker";
+import type { WorkflowGateKind, WorkflowStage } from "./workflow-gate-types";
 /** "Other (type your own)" sentinel, mirroring the interactive ask tool. */
 export declare const GATE_OTHER_OPTION = "Other (type your own)";
 /** Optional structured deep-interview round metadata supplied by the agent. */
@@ -24,8 +22,8 @@ export interface AskGateDeepInterviewState {
     ambiguity: number;
 }
 export interface AskGateWorkflowGateMeta {
-    stage: RpcWorkflowStage;
-    kind: RpcWorkflowGateKind;
+    stage: WorkflowStage;
+    kind: WorkflowGateKind;
 }
 export interface AskGateQuestion {
     id: string;

package/dist/types/modes/shared/agent-wire/event-contract.d.ts

@@ -3,8 +3,8 @@
  * for AgentSession events and bounded owner observations.
  *
  * Two distinct consumer-facing shapes, deliberately NOT collapsed into one:
- * - `AgentWireEventPayload`: rich, full `AgentSessionEvent` for renderers
- *   (ACP SDK notifications, RPC/Bridge event frames).
+ * - `AgentWireEventPayload`: rich, full `AgentSessionEvent` for event
+ *   consumers on any agent-wire transport.
  * - `AgentWireOwnerObservation`: bounded/redacted owner evidence for control
  *   planes (Harness). Never carries assistant text, message deltas, raw tool
  *   args, raw command output, raw tool results, answers, or oversize strings.
@@ -23,8 +23,8 @@ export type AgentWireEventType = AgentSessionEvent["type"];
 /** Every agent-session event type, derived from the exhaustive registry. */
 export declare const AGENT_WIRE_EVENT_TYPES: readonly AgentWireEventType[];
 /**
- * Rich event payload. Carries the full `AgentSessionEvent` so renderers (ACP,
- * RPC, Bridge) can present message content, tool args/results, todo state, etc.
+ * Rich event payload. Carries the full `AgentSessionEvent` so event consumers
+ * can present message content, tool args/results, todo state, and related data.
  */
 export interface AgentWireEventPayload {
     event_type: AgentWireEventType;
@@ -35,7 +35,7 @@ export type AgentWireCompactAssistantMessageEvent = AssistantMessageEvent extend
 } ? Omit<TEvent, "partial" | "message" | "error"> : never : never;
 export interface AgentWireCompactMessageUpdatePayload {
     event_type: "message_update";
-    /** Compact RPC opt-in payload: delta-only update plus minimal routing metadata. */
+    /** Compact opt-in payload: delta-only update plus minimal routing metadata. */
     compact: true;
     message_id: string | null;
     content_index: number | null;
@@ -66,7 +66,7 @@ export interface AgentWireOwnerObservation {
     eventType?: AgentWireEventType;
     /** Set when this observation derives from a non-event wire frame. */
     frameType?: string;
-    /** Owner event kind (e.g. `rpc_tool_started`). */
+    /** Owner event kind (for example, a tool-started observation). */
     kind: string;
     /** Bounded observed signal, or null when the frame carries no signal. */
     signal: AgentWireObservedSignal | null;

package/dist/types/modes/shared/agent-wire/event-envelope.d.ts

@@ -21,9 +21,6 @@ export declare class AgentWireFrameSequencer {
     /** Build the next envelope of the given type with a fresh seq + frame id. */
     next<TType extends AgentWireFrameType, TPayload>(type: TType, payload: TPayload, correlationId?: string): AgentWireFrameEnvelope<TType, TPayload>;
 }
-/** Back-compat alias for {@link AgentWireFrameSequencer}. */
-export declare const BridgeFrameSequencer: typeof AgentWireFrameSequencer;
-export type BridgeFrameSequencer = AgentWireFrameSequencer;
 /** Serialize a single `AgentSessionEvent` into a canonical `event` wire frame. */
 export declare function toAgentWireEventFrame(event: AgentSessionEvent, sequencer: AgentWireFrameSequencer): AgentWireEventFrame;
 /** Build the rich event payload (renderer-facing) for an `AgentSessionEvent`. */
@@ -35,13 +32,13 @@ export interface AgentWireCompactMessageUpdateOptions {
     checkpointInterval?: number;
 }
 /**
- * Stateful compact event serializer for opt-in RPC clients.
+ * Stateful compact event serializer for opt-in wire clients (e.g. the SDK).
  *
  * Only `message_update` changes shape: it carries the immutable provider delta
  * plus message/content identifiers, with periodic full-message checkpoints that
  * are cloned synchronously before the caller returns to the event loop. All other
- * event variants remain canonical full event frames so legacy bridge/RPC behavior
- * and terminal `message_end` reconstruction are unchanged.
+ * event variants remain canonical full event frames so downstream consumers and
+ * terminal `message_end` reconstruction are unchanged.
  */
 export declare class AgentWireCompactEventEncoder {
     #private;
@@ -49,12 +46,10 @@ export declare class AgentWireCompactEventEncoder {
     frame(event: AgentSessionEvent): AgentWireCompactEventFrame;
 }
 export declare function toAgentWireCompactEventFrame(event: AgentSessionEvent, encoder: AgentWireCompactEventEncoder): AgentWireCompactEventFrame;
-/** Back-compat alias for {@link toAgentWireEventFrame}. */
-export declare const toBridgeEventFrame: typeof toAgentWireEventFrame;
 /**
  * Serialize a `workflow_gate` event into a sequenced wire frame (#321). The
  * gate_id is stamped as the correlation id so the answer (posted to the
  * ui-responses endpoint) can be matched, and the monotonic `seq` gives replay
  * while `frame_id` + gate_id give idempotency.
  */
-export declare function toBridgeWorkflowGateFrame(gate: import("../../rpc/rpc-types").RpcWorkflowGate, sequencer: AgentWireFrameSequencer): import("./protocol").BridgeWorkflowGateFrame;
+export declare function toAgentWireWorkflowGateFrame(gate: import("./workflow-gate-types").WorkflowGate, sequencer: AgentWireFrameSequencer): AgentWireFrameEnvelope<"workflow_gate", import("./workflow-gate-types").WorkflowGate>;

package/dist/types/modes/shared/agent-wire/event-observation.d.ts

@@ -34,4 +34,4 @@ export declare function observeAgentWireEventPayload(payload: AgentWireEventPayl
  * frames delegate to {@link observeAgentWireEventPayload}; non-event frames are
  * mapped here so owners never re-parse protocol semantics privately.
  */
-export declare function observeRpcOutboundFrame(frame: Record<string, unknown>): AgentWireOwnerObservation | null;
+export declare function observeAgentWireFrame(frame: Record<string, unknown>): AgentWireOwnerObservation | null;

package/dist/types/modes/shared/agent-wire/workflow-gate-broker.d.ts

@@ -1,14 +1,12 @@
 import type { AskSelectedAckOutcome } from "../../../tools";
-import type { RpcWorkflowGate, RpcWorkflowGateContext, RpcWorkflowGateKind, RpcWorkflowGateOption, RpcWorkflowGateResolution, RpcWorkflowGateResponse, RpcWorkflowGateValidationError, RpcWorkflowStage } from "../../rpc/rpc-types";
+import type { WorkflowGate, WorkflowGateContext, WorkflowGateDiagnostic, WorkflowGateKind, WorkflowGateOption, WorkflowGateQueryRecord, WorkflowGateResolution, WorkflowGateResponse, WorkflowGateValidationError, WorkflowStage } from "./workflow-gate-types";
 export type PersistedSemanticDisposition = "commit" | "resolve_without_commit";
 export type PersistedResolutionOrigin = {
     kind: "generic";
-    channel: "rpc" | "bridge" | "other";
+    channel: "sdk" | "other";
 } | {
     kind: "telegram_notification";
     interactionActionId: string;
-} | {
-    kind: "legacy_unknown";
 };
 export type PersistedAckPolicy = {
     kind: "none";
@@ -27,51 +25,154 @@ export interface GateResolutionOptions {
     ackPolicy?: PersistedAckPolicy;
     beforeAdvance?: () => Promise<void>;
 }
+export type WorkflowGateTerminalProof = "retired" | "already_terminal" | "not_published";
+export interface WorkflowGateTerminalController {
+    completeGateInteractions(gateId: string): WorkflowGateTerminalProof | Promise<WorkflowGateTerminalProof>;
+    cancelGateInteractions(gateId: string, reason: string): void | Promise<void>;
+}
+export interface NotificationGateResolutionOptions {
+    interactionActionId: string;
+    replyReceiptId: string;
+    answerJson: string;
+    idempotencyKey?: string;
+    requestSelectedAck(input: {
+        replyReceiptId: string;
+        actionId: string;
+        commitKey: string;
+        daemonDeadlineAt: number;
+        hostTimeoutMs: number;
+    }): Promise<AskSelectedAckOutcome>;
+    resolveClaim(): void;
+    closeClaimInvalid(reason: string): void;
+}
+export interface AskSelectedAckRecoveryParticipant {
+    requestRecoveredAskSelectedAck(input: {
+        sessionId: string;
+        actionId: string;
+        commitKey: string;
+        deadlineAt: number;
+        hostTimeoutMs: number;
+    }): Promise<AskSelectedAckOutcome>;
+}
+/** SDK-native surface for emitting a workflow gate and awaiting its answer. */
+export interface WorkflowGateEmitter {
+    isUnattended(): boolean;
+    emitGate(input: OpenGateInput): Promise<unknown>;
+    onGateEmitted?(listener: (gate: WorkflowGate) => void): () => void;
+    resolveGate?(response: WorkflowGateResponse): Promise<WorkflowGateResolution>;
+    resolveGateFromNotification?(response: WorkflowGateResponse, options: NotificationGateResolutionOptions): Promise<WorkflowGateResolution>;
+    registerGateTerminalController?(controller: WorkflowGateTerminalController): () => void;
+    /** Records the exact terminalization proof established by direct control preparation. */
+    prepareTerminalization?(gateId: string, proof: WorkflowGateTerminalProof): boolean;
+    /** Discards a prepared proof when the gate remains pending after a rejected direct response. */
+    clearPreparedTerminalization?(gateId: string): void;
+    listPendingGates?(): WorkflowGate[];
+    listGateDiagnostics?(): WorkflowGateDiagnostic[];
+    listWorkflowGateQueryRecords?(): WorkflowGateQueryRecord[];
+    quarantineGate?(gateId: string): void;
+    setAckRecoveryParticipant?(participant: AskSelectedAckRecoveryParticipant | null): void;
+    /** Explicit host hook for same-process accepted-but-unadvanced recovery. */
+    recoverAcceptedGates?(): Promise<string[]>;
+    /** Permanently revoke all in-process continuation authority and reject their waiters. */
+    fence?(): void;
+    /** Temporarily make this emitter unavailable while a session transition is reversible. */
+    suspend?(): void;
+    resume?(): void;
+}
+/**
+ * SDK-native workflow-gate emitter backed by a durable broker/store pair.
+ *
+ * Answers are resolved by the broker, so validation and idempotency have one
+ * authority. Listeners replay durable pending gates when attached, allowing an
+ * SDK host that starts after a gate was opened to discover it.
+ */
+export declare class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
+    #private;
+    constructor(runId: string, store: GateStore, emitterHooks?: Pick<BrokerHooks, "advance">);
+    isUnattended(): boolean;
+    emitGate(input: OpenGateInput): Promise<unknown>;
+    onGateEmitted(listener: (gate: WorkflowGate) => void): () => void;
+    resolveGate(response: WorkflowGateResponse): Promise<WorkflowGateResolution>;
+    prepareTerminalization(gateId: string, proof: WorkflowGateTerminalProof): boolean;
+    clearPreparedTerminalization(gateId: string): void;
+    listPendingGates(): WorkflowGate[];
+    listGateDiagnostics(): WorkflowGateDiagnostic[];
+    listWorkflowGateQueryRecords(): WorkflowGateQueryRecord[];
+    suspend(): void;
+    resume(): void;
+    fence(): void;
+    quarantineGate(gateId: string): void;
+    registerGateTerminalController(controller: WorkflowGateTerminalController): () => void;
+    setAckRecoveryParticipant(participant: AskSelectedAckRecoveryParticipant | null): void;
+    recoverAcceptedGates(): Promise<string[]>;
+    resolveGateFromNotification(response: WorkflowGateResponse, options: NotificationGateResolutionOptions): Promise<WorkflowGateResolution>;
+}
 export interface PersistedGate {
-    gate: RpcWorkflowGate;
-    status: "pending" | "accepted";
+    gate: WorkflowGate;
+    status: "pending" | "accepted" | "quarantined";
+    ownerInstanceId?: string;
     idempotencyKey?: string;
     responseHash?: string;
-    /** Raw accepted answer, retained so a crashed advance can be replayed. */
+    /** Raw accepted answer, retained so a same-process advance can be replayed. */
     answer?: unknown;
-    resolution?: RpcWorkflowGateResolution;
+    resolution?: WorkflowGateResolution;
     advanced: boolean;
+    /** Exact presentation terminalization completed before workflow advancement. */
+    terminalized?: boolean;
+    /** Exact presentation terminalization proof recorded before workflow advancement. */
+    terminalProof?: WorkflowGateTerminalProof;
     semanticDisposition?: PersistedSemanticDisposition;
     resolutionOrigin?: PersistedResolutionOrigin;
     ackPolicy?: PersistedAckPolicy;
+    lifecycle?: WorkflowGateDiagnostic["lifecycle"];
 }
 export interface GateStore {
-    nextSeq(stage: RpcWorkflowStage): number;
+    nextSeq(stage: WorkflowStage): number;
     put(record: PersistedGate): void;
     get(gateId: string): PersistedGate | undefined;
-    /** All persisted gate records (used for crash recovery). */
+    /** Atomically quarantines records owned by a prior runtime before exposure. */
+    beginRuntimeInstance(instanceId: string): void;
+    /** All persisted gate records (used for same-process recovery and Q12). */
     list(): PersistedGate[];
 }
 export declare class MemoryGateStore implements GateStore {
     private counters;
     private gates;
-    nextSeq(stage: RpcWorkflowStage): number;
+    private runtimeInstanceId;
+    nextSeq(stage: WorkflowStage): number;
     put(record: PersistedGate): void;
     get(gateId: string): PersistedGate | undefined;
+    beginRuntimeInstance(instanceId: string): void;
     list(): PersistedGate[];
 }
+export declare function isUnsupportedWindowsDirectorySyncError(error: unknown, platform?: NodeJS.Platform): boolean;
+/** A write may have reached `rename` but not the directory fsync durability barrier. */
+export declare class GateStoreWriteError extends Error {
+    readonly certainty: "not_committed" | "uncertain";
+    constructor(certainty: "not_committed" | "uncertain", cause: unknown);
+}
 /** Crash-durable JSON-file backed store. Writes the full state on every mutation. */
 export declare class FileGateStore implements GateStore {
     private readonly filePath;
+    private readonly sync;
     private state;
-    constructor(filePath: string);
+    private certaintyUnknown;
+    constructor(filePath: string, sync?: (fd: number) => void);
     private load;
-    private flush;
-    nextSeq(stage: RpcWorkflowStage): number;
+    private flushState;
+    private commit;
+    private reconcileCertainty;
+    nextSeq(stage: WorkflowStage): number;
     put(record: PersistedGate): void;
     get(gateId: string): PersistedGate | undefined;
+    beginRuntimeInstance(instanceId: string): void;
     list(): PersistedGate[];
 }
 export type GateAuditEvent = {
     event: "gate_emitted";
     gate_id: string;
-    stage: RpcWorkflowStage;
-    kind: RpcWorkflowGateKind;
+    stage: WorkflowStage;
+    kind: WorkflowGateKind;
 } | {
     event: "gate_response_accepted";
     gate_id: string;
@@ -98,49 +199,88 @@ export type GateAuditEvent = {
 };
 export interface BrokerHooks {
     /** Called once when a pending gate has been persisted and should be emitted. */
-    emit?(gate: RpcWorkflowGate): void;
+    emit?(gate: WorkflowGate): void;
     /**
      * Invoked to advance the workflow after an accepted resolution is durably
      * committed. MUST be idempotent keyed by `gate.gate_id`: `recover()` replays
      * it for any gate left `accepted` but not `advanced` by a crash.
      */
-    advance?(gate: RpcWorkflowGate, answer: unknown): void | Promise<void>;
-    /** Runs after durable acceptance and before advance, including crash recovery. */
+    advance?(gate: WorkflowGate, answer: unknown): void | Promise<void>;
+    /** Runs after durable acceptance and before presentation terminalization, including crash recovery. */
     finalizeAccepted?(record: PersistedGate): Promise<void>;
+    /**
+     * Terminalizes the exact presentation before `advance` can run and returns
+     * proof for the durable record. `not_published` explicitly proves that no
+     * presentation existed. On failure it MUST revoke authority or throw.
+     */
+    terminalizeAccepted?(record: PersistedGate): WorkflowGateTerminalProof | Promise<WorkflowGateTerminalProof>;
+    /** Runs only after a successful advance has been durably marked advanced. */
+    completeAccepted?(record: PersistedGate): void | Promise<void>;
     /** Append-only audit sink. */
     audit?(event: GateAuditEvent): void;
 }
+/** Live in-process continuation authority for one emitted gate. */
+export interface GateContinuation {
+    activate(gate: WorkflowGate): void;
+    isLive(gateId: string): boolean;
+    release?(gateId: string): void;
+    /** Explicitly declares that this direct continuation owns no presentation. */
+    terminalProof?: "not_published";
+}
 export interface OpenGateInput {
-    stage: RpcWorkflowStage;
-    kind: RpcWorkflowGateKind;
-    schema: RpcWorkflowGate["schema"];
-    options?: RpcWorkflowGateOption[];
-    context?: RpcWorkflowGateContext;
+    stage: WorkflowStage;
+    kind: WorkflowGateKind;
+    schema: WorkflowGate["schema"];
+    options?: WorkflowGateOption[];
+    context?: WorkflowGateContext;
+    /** Optional diagnostic gate replaced by this newly persisted gate. */
+    supersedesGateId?: string;
 }
 export declare class WorkflowGateBrokerError extends Error {
     readonly code: "unknown_gate" | "already_resolved" | "idempotency_conflict" | "invalid_workflow_stage";
     constructor(code: "unknown_gate" | "already_resolved" | "idempotency_conflict" | "invalid_workflow_stage", message: string);
 }
 export declare class WorkflowGateBroker {
+    #private;
     private readonly runId;
     private readonly store;
     private readonly hooks;
+    private readonly instanceId;
     private readonly recovering;
     private readonly gateLocks;
+    private readonly continuations;
     private withGateLock;
-    constructor(runId: string, store: GateStore, hooks?: BrokerHooks);
+    constructor(runId: string, store: GateStore, hooks?: BrokerHooks, instanceId?: `${string}-${string}-${string}-${string}-${string}`);
     classifyDisposition(gateId: string, answer: unknown): PersistedSemanticDisposition;
-    validationError(gateId: string, keyword: string, message: string): RpcWorkflowGateValidationError;
+    validationError(gateId: string, keyword: string, message: string): WorkflowGateValidationError;
     updateAckPolicy(gateId: string, ackPolicy: PersistedAckPolicy): void;
     private runShort;
+    private hasLiveContinuation;
+    hasRecoverableAcceptedGate(): boolean;
+    prepareTerminalization(gateId: string, proof: WorkflowGateTerminalProof): boolean;
+    clearPreparedTerminalization(gateId: string): void;
+    /**
+     * Fences a gate after an uncertain control outcome by deliberately releasing
+     * this runtime's continuation authority. The durable diagnostic is retained
+     * for recovery; it is never republished as a pending gate.
+     */
+    quarantineGate(gateId: string): void;
+    /** Revoke every live continuation, including accepted-but-unadvanced recovery authority. */
+    fenceContinuations(): void;
+    /** Fence a cancelled/lost continuation before it can be exposed or advanced. */
+    loseContinuation(gateId: string): void;
+    listPendingGates(): WorkflowGate[];
+    listGateDiagnostics(): WorkflowGateDiagnostic[];
+    listWorkflowGateQueryRecords(): WorkflowGateQueryRecord[];
     /** Open and emit a gate. The pending record is persisted BEFORE emission. */
-    openGate(input: OpenGateInput): RpcWorkflowGate;
+    openGate(input: OpenGateInput, continuation?: GateContinuation): WorkflowGate;
     /**
      * Resolve a gate with an answer. Validates against the advertised schema.
-     * On success the resolution is persisted BEFORE `advance` is invoked exactly
-     * once. Invalid answers leave the gate pending (per #315 acceptance).
+     * Accepted answers are persisted first, then their presentation is terminalized,
+     * then the workflow advances and commits `advanced:true` exactly once. Invalid
+     * answers leave the gate pending (per #315 acceptance).
      */
-    resolve(response: RpcWorkflowGateResponse, options?: GateResolutionOptions): Promise<RpcWorkflowGateResolution>;
+    resolve(response: WorkflowGateResponse, options?: GateResolutionOptions): Promise<WorkflowGateResolution>;
     private resolveUnlocked;
     /**
      * Recover any gate left `accepted` but not `advanced` by a crash between the

package/dist/types/modes/shared/agent-wire/workflow-gate-schema.d.ts

@@ -1,4 +1,4 @@
-import type { RpcJsonSchema, RpcWorkflowGateValidationError } from "../../rpc/rpc-types";
+import type { JsonSchema, WorkflowGateValidationError } from "./workflow-gate-types";
 export declare const GATE_SCHEMA_LIMITS: {
     readonly maxSchemaBytes: number;
     readonly maxDepth: 16;
@@ -13,10 +13,10 @@ export declare class WorkflowGateSchemaError extends Error {
 }
 /** Canonical (stable-key-ordered) JSON serialization used for hashing. */
 export declare function canonicalJson(value: unknown): string;
-export declare function schemaHash(schema: RpcJsonSchema): string;
+export declare function schemaHash(schema: JsonSchema): string;
 declare function answerHashOf(answer: unknown): string;
 /** Validate the schema *shape*. Throws WorkflowGateSchemaError on any problem. */
-export declare function assertSupportedGateSchema(schema: RpcJsonSchema): void;
+export declare function assertSupportedGateSchema(schema: JsonSchema): void;
 type SchemaError = {
     path: string;
     keyword: string;
@@ -25,15 +25,15 @@ type SchemaError = {
 };
 /** A compiled, cached validator for one schema. */
 export interface CompiledGateSchema {
-    readonly schema: RpcJsonSchema;
+    readonly schema: JsonSchema;
     readonly hash: string;
     validate(answer: unknown): SchemaError[];
 }
 /** Compile (and cache) a validator for a schema. Asserts shape on first compile. */
-export declare function compileGateSchema(schema: RpcJsonSchema): CompiledGateSchema;
+export declare function compileGateSchema(schema: JsonSchema): CompiledGateSchema;
 /**
  * Validate an answer against a compiled gate schema. Returns `null` on success
- * or a typed {@link RpcWorkflowGateValidationError} on mismatch.
+ * or a typed {@link WorkflowGateValidationError} on mismatch.
  */
-export declare function validateGateAnswer(compiled: CompiledGateSchema, gateId: string, answer: unknown): RpcWorkflowGateValidationError | null;
+export declare function validateGateAnswer(compiled: CompiledGateSchema, gateId: string, answer: unknown): WorkflowGateValidationError | null;
 export { answerHashOf };