@gajae-code/coding-agent 0.11.1 → 0.11.2

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -0,0 +1,102 @@
+import type { ResumeSessionIdentity } from "../session-manager";
+export declare const MANAGED_SESSION_LAYOUT_VERSION: 2;
+export declare const MANAGED_SESSION_IDENTITY_VERSION: 1;
+export declare const MANAGED_SESSION_BINDING_FILE = ".gjc-managed-session-scope.v2.json";
+export interface ManagedScope {
+    apiVersion: 1;
+    layoutVersion: 2;
+    identityVersion: 1;
+    agentDir: string;
+    sessionsRoot: string;
+    canonicalCwd: string;
+    legacyLexicalCwd: string;
+    directoryName: string;
+    directoryPath: string;
+    platform: "posix" | "win32";
+}
+export type ManagedMigrationPolicy = "copy-retain" | "disabled";
+export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid";
+export type ManagedScopeResolution = {
+    kind: "resolved";
+    scope: ManagedScope;
+} | {
+    kind: "error";
+    code: ManagedScopeErrorCode;
+    message: string;
+};
+export interface ManagedCandidate {
+    sessionId: string;
+    path: string;
+    cwd: string;
+    provenance: "v2" | "legacy";
+    identity: ResumeSessionIdentity;
+    migrationState: "native_v2" | "legacy_unmigrated" | "migrated_v2";
+}
+export type ManagedCandidateListing = {
+    kind: "complete";
+    scope: ManagedScope;
+    owned: readonly ManagedCandidate[];
+    foreignCount: number;
+    invalid: readonly {
+        code: string;
+    }[];
+} | {
+    kind: "error";
+    code: "scan_failed" | "unsafe_root" | "invalid_candidate";
+    message: string;
+};
+export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
+export type ManagedOpenCandidateResult = {
+    kind: "opened";
+    path: string;
+    candidate: ManagedCandidate;
+    migrated: boolean;
+} | {
+    kind: "error";
+    code: ManagedOpenFailure;
+    message: string;
+};
+export type ManagedDeleteCandidateResult = {
+    kind: "deleted";
+    tombstonePath: string;
+} | {
+    kind: "already_deleted";
+    tombstonePath: string;
+} | {
+    kind: "error";
+    code: ManagedOpenFailure;
+    message: string;
+};
+declare function scopeDigest(platform: "posix" | "win32", canonicalPath: string): string;
+export declare const computeManagedScopeDigest: typeof scopeDigest;
+/**
+ * Resolve benign symlinks in the deepest existing ancestor of a trusted storage
+ * root (e.g. macOS `/var -> /private/var`, or a symlinked `$HOME`) while keeping
+ * any not-yet-created tail verbatim. The native owner-only primitive and the
+ * session-storage reparse guard traverse with `O_NOFOLLOW` and reject every
+ * symlink component, so the trusted root must be canonical before it reaches
+ * them; canonicalizing only the existing prefix never follows an
+ * attacker-plantable component below the root.
+ */
+export declare function canonicalizeTrustedPath(target: string): string;
+export declare function resolveManagedScope(input: {
+    cwd: string;
+    agentDir: string;
+    sessionsRoot: string;
+}): ManagedScopeResolution;
+export declare function ensureManagedScope(scope: ManagedScope): Promise<ManagedScopeResolution>;
+/** Synchronously create and validate the v2 binding before a default session writer exists. */
+export declare function prepareManagedSessionScopeForWriteSync(scope: ManagedScope): ManagedScopeResolution;
+export declare function listManagedCandidates(scope: ManagedScope): ManagedCandidateListing;
+/** Resume tombstoned cleanup under its original operation lease without restoring retired candidates. */
+export declare function reconcileManagedTombstones(scope: ManagedScope): Promise<void>;
+/** Create the v2 binding and private write protocol directories before managed writes. */
+export declare function prepareManagedSessionScopeForWrite(scope: ManagedScope): Promise<ManagedScopeResolution>;
+/**
+ * Open a validated candidate for mutation. Legacy transcripts are copied exactly once
+ * into v2 and retained at their original location; no transcript data is merged.
+ */
+export declare function openManagedCandidateForWrite(scope: ManagedScope, candidate: ManagedCandidate, migrationPolicy?: ManagedMigrationPolicy): Promise<ManagedOpenCandidateResult>;
+/** Tombstone a verified managed candidate before exact-identity deletion. */
+export declare function deleteManagedSessionCandidate(scope: ManagedScope, candidate: ManagedCandidate): Promise<ManagedDeleteCandidateResult>;
+export {};

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -0,0 +1,38 @@
+export declare const MANAGED_ARTIFACT_MAX_DEPTH = 32;
+export declare const MANAGED_ARTIFACT_MAX_FILES = 10000;
+export declare const MANAGED_ARTIFACT_MAX_FILE_BYTES: number;
+export declare const MANAGED_ARTIFACT_MAX_TOTAL_BYTES: number;
+export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "migration_retired" | "managed_storage_unsupported";
+export interface ManagedStorageLock {
+    path: string;
+    attemptId: string;
+    assertOwned(): void;
+    release(): Promise<void>;
+}
+export interface ManagedFileSnapshot {
+    bytes: Buffer;
+    identity: {
+        dev: bigint;
+        ino: bigint;
+        size: number;
+        mtimeNs: bigint;
+    };
+}
+export declare function shouldFsyncManagedDirectory(platform?: NodeJS.Platform): boolean;
+/** Create a managed directory and fail closed unless its owner-only mode/ACL verifies. */
+export declare function ensureManagedDirectory(pathname: string): void;
+/** Captures header/hash/copy input from one no-follow descriptor and rechecks the pathname before use. */
+export declare function captureManagedFileNoFollow(pathname: string): ManagedFileSnapshot;
+/** Atomically publishes bytes without replacing an existing destination. */
+export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void): Promise<void>;
+export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array): void;
+/** Copy the exact bytes captured from one no-follow source descriptor. */
+export declare function copyManagedFileNoReplace(source: string, destination: string, snapshot?: ManagedFileSnapshot): Promise<void>;
+/** Acquire a lease lock with bounded wait, heartbeats, conservative stale reclaim, and fencing. */
+export declare function acquireManagedLock(locksDirectory: string, name: string): Promise<ManagedStorageLock>;
+/** Bounds a no-follow artifact tree before it can be copied or deleted. */
+export declare function validateManagedArtifactTree(root: string): void;
+/** Flush a copied managed artifact tree, including empty directories, before publishing its receipt. */
+export declare function fsyncManagedArtifactTree(root: string): void;
+export declare function publishManagedTombstone(destination: string, record: Record<string, unknown>, assertOwned?: () => void): Promise<void>;
+export declare function unlinkManagedFileVerified(pathname: string, expected: ManagedFileSnapshot["identity"]): Promise<void>;

package/dist/types/session/messages.d.ts

@@ -10,6 +10,14 @@ import type { AssistantMessage, ImageContent, Message, MessageAttribution, TextC
 export { type BranchSummaryMessage, type CompactionSummaryMessage, createBranchSummaryMessage, createCompactionSummaryMessage, } from "@gajae-code/agent-core/compaction/messages";
 import type { LoadedSubskillActivation } from "../extensibility/gjc-plugins";
 import type { OutputMeta } from "../tools/output-meta";
+/**
+ * Encode untrusted values embedded in prompt markup. Control and bidi characters become visible
+ * escape sequences so they cannot alter markup structure or display. Isolated UTF-16 surrogates
+ * are also escaped; valid Unicode pairs remain intact.
+ */
+export declare function escapePromptMetadata(value: string, options?: {
+    preserveNewlines?: boolean;
+}): string;
 export declare const SKILL_PROMPT_MESSAGE_TYPE = "skill-prompt";
 export interface SkillPromptDetails {
     name: string;
@@ -58,6 +66,14 @@ export declare const INTERNAL_DETAILS_FIELDS: readonly ["__pendingDisplayTag"];
  *  (null/non-object, or no listed fields present) so callers don't pay a
  *  clone cost on the common path. */
 export declare function stripInternalDetailsFields<T>(details: T | undefined): T | undefined;
+export declare const PRE_ADMISSION_ARTIFACT_SPILL_HEAD_BYTES = 4096;
+export declare const PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES = 4096;
+/**
+ * Build the deterministic inline receipt for a tool result saved before the
+ * next provider context is constructed. Byte boundaries never split UTF-8
+ * code points, so head/tail recovery remains readable for emoji and CJK text.
+ */
+export declare function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string): string;
 /**
  * Message type for bash executions via the ! command.
  */

package/dist/types/session/session-manager-internal.d.ts

@@ -0,0 +1,14 @@
+import type { SessionContext, SessionEntry, SessionManager, SessionTreeNode } from "./session-manager";
+/**
+ * Opaque capability for zero-copy session snapshots. This module is deliberately
+ * excluded from package exports; only trusted in-package readers may use it.
+ */
+export declare const sessionManagerReadCapability: unique symbol;
+export interface SessionManagerReadAccess {
+    getEntries(): readonly SessionEntry[];
+    getSessionContext(): Readonly<SessionContext>;
+    getTree(): SessionTreeNode[];
+}
+export declare function getEntriesForInternalRead(manager: SessionManager): readonly SessionEntry[];
+export declare function getSessionContextForInternalRead(manager: SessionManager): Readonly<SessionContext>;
+export declare function getTreeForInternalRead(manager: SessionManager): SessionTreeNode[];

package/dist/types/session/session-manager.d.ts

@@ -4,9 +4,11 @@ import type { ImageContent, Message, MessageAttribution, ServiceTier, TextConten
 import type { TtsrInjectionRecord } from "../export/ttsr";
 import { ArtifactManager } from "./artifacts";
 import { type BlobPutResult, BlobStore } from "./blob-store";
+import { type ManagedMigrationPolicy } from "./internal/managed-session-scope";
 import { type BashExecutionMessage, type CustomMessage, type FileMentionMessage, type HookMessage, type PythonExecutionMessage } from "./messages";
+import { type SessionManagerReadAccess, sessionManagerReadCapability } from "./session-manager-internal";
 import type { SessionStorage, SessionStorageStat, VerifiedSessionDeleteResult, VerifiedSessionDeleteTarget } from "./session-storage";
-export declare const CURRENT_SESSION_VERSION = 3;
+export declare const CURRENT_SESSION_VERSION = 4;
 export interface SessionHeader {
     type: "session";
     version?: number;
@@ -80,6 +82,8 @@ export declare function associateSessionMessageObservationId(message: AgentMessa
 export declare function getSessionMessageObservationId(message: AgentMessage): string | undefined;
 export declare function associateSessionMessageViewportAnchorId(message: AgentMessage, anchorId: string): void;
 export declare function getSessionMessageViewportAnchorId(message: AgentMessage): string | undefined;
+/** Returns registered viewport anchors for durable user messages in session order. */
+export declare function getUserMessageViewportAnchorIds(messages: readonly AgentMessage[]): string[];
 export declare function transferSessionMessageIdentity(source: AgentMessage[], target: AgentMessage[]): void;
 export interface ThinkingLevelChangeEntry extends SessionEntryBase {
     type: "thinking_level_change";
@@ -211,7 +215,19 @@ export interface CustomMessageEntry<T = unknown> extends SessionEntryBase {
 }
 /** Session entry - has id/parentId for tree structure (returned by "read" methods in SessionManager) */
 export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TtsrInjectionEntry | MCPToolSelectionEntry | SessionInitEntry | ModeChangeEntry | ConfiguredModelChainEntry;
-/** Raw file entry (includes header) */
+/** Append-only replacement for mutable fields on the session header. */
+export interface HeaderPatchRecord {
+    type: "header_patch";
+    patch: Partial<Pick<SessionHeader, "title" | "titleSource" | "cwd">>;
+}
+/** Append-only replacement for replay metadata on one existing session entry. */
+export interface EntryPatchRecord {
+    type: "entry_patch";
+    entryId: string;
+    patch: Partial<Pick<SessionMessageEntry, "message">>;
+}
+export type SessionPatchRecord = HeaderPatchRecord | EntryPatchRecord;
+/** Resolved file entries; patch records are applied by parseSessionEntries(). */
 export type FileEntry = SessionHeader | SessionEntry;
 export type DefaultModelSelectionStage = {
     readonly entryRevision: number;
@@ -282,7 +298,16 @@ export interface ResumeTailTerminal {
 }
 export interface ResumeTailError {
     kind: "error";
-    reason: "missing" | "malformed" | "unstable" | "read-failed";
+    reason: "missing" | "malformed" | "unstable" | "read-failed" | "legacy_migration_disabled";
+}
+export type SessionDirectoryMigrationPolicy = ManagedMigrationPolicy;
+export declare class SessionManagedStorageError extends Error {
+    readonly code = "managed_storage_unsupported";
+    constructor();
+}
+export declare class SessionMigrationPolicyError extends Error {
+    readonly code = "legacy_migration_disabled";
+    constructor();
 }
 export type ResumeTailInspection = ResumeTailResumable | ResumeTailTerminal | ResumeTailError;
 export interface StrictSessionOpenSuccess {
@@ -321,6 +346,8 @@ export interface SessionInfo {
     created: Date;
     modified: Date;
     messageCount: number;
+    /** True when messageCount was counted from only the bounded list prefix. */
+    messageCountIsEstimate?: boolean;
     /** File size in bytes on disk; used for compact list rendering. */
     size: number;
     firstMessage: string;
@@ -367,7 +394,35 @@ export type SessionManagerCloseOutcome = {
     kind: "close_unknown";
     error: Error;
 };
-export type ReadonlySessionManager = Pick<SessionManager, "getCwd" | "getSessionDir" | "getSessionId" | "getSessionFile" | "getSessionName" | "getArtifactsDir" | "getArtifactManager" | "allocateArtifactPath" | "saveArtifact" | "getArtifactPath" | "getLeafId" | "getLeafEntry" | "getEntry" | "getLabel" | "getBranch" | "getHeader" | "getEntries" | "getTree" | "getUsageStatistics" | "putBlob">;
+/** Read-only session state made available to extensions and custom tools. */
+/** Frozen read-only session facade made available to extensions and custom tools. */
+export interface ReadonlySessionManager {
+    getCwd(): string;
+    getSessionDir(): string;
+    getSessionId(): string;
+    getSessionFile(): string | undefined;
+    getSessionName(): string | undefined;
+    getArtifactsDir(): string | null;
+    getArtifactPath(id: string): Promise<string | null>;
+    getLeafId(): string | null;
+    getLeafEntry(): SessionEntry | undefined;
+    getEntry(id: string): SessionEntry | undefined;
+    getLabel(id: string): string | undefined;
+    getBranch(fromId?: string): SessionEntry[];
+    getHeader(): SessionHeader | null;
+    getEntries(): SessionEntry[];
+    getTree(): SessionTreeNode[];
+    getUsageStatistics(): UsageStatistics;
+}
+/** Creates an immutable facade that never exposes SessionManager mutation authority. */
+export declare function createReadonlySessionManager(manager: SessionManager): ReadonlySessionManager;
+/** Internal artifact-writing capability. Read-only facades expose it only through a private weak-map lookup. */
+export type SessionArtifactCapability = Readonly<Pick<SessionManager, "allocateArtifactPath" | "saveArtifact" | "putBlob">>;
+/**
+ * Returns the artifact capability for a concrete persistence owner or one of its
+ * immutable read-only facades. Structural lookalikes remain unauthorized.
+ */
+export declare function sessionArtifactCapability(value: unknown): SessionArtifactCapability | undefined;
 /** Exported for testing */
 export declare function migrateSessionEntries(entries: FileEntry[]): void;
 /** Exported for compaction.test.ts */
@@ -408,6 +463,11 @@ declare class RecentSessionInfo {
 export declare function recoverOrphanedBackups(sessionDir: string, storage: SessionStorage): Promise<void>;
 /** Exported for testing */
 export declare function findMostRecentSession(sessionDir: string, storage?: SessionStorage): Promise<string | null>;
+interface SessionMoveDirectoryHandle {
+    sync(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function syncSessionMoveDirectory(directory: string, platform?: NodeJS.Platform, openDirectory?: (directory: string) => Promise<SessionMoveDirectoryHandle>): Promise<void>;
 declare const RESIDENT_BLOB_SENTINEL_KEY = "__gjcResidentBlob";
 type ResidentBlobKind = "text" | "imageUrl" | "imageData";
 interface ResidentBlobSentinel {
@@ -481,7 +541,7 @@ export declare class SessionManager {
     setSessionFile(sessionFile: string): Promise<void>;
     /** Start a new session. Closes any existing writer first. */
     newSession(options?: NewSessionOptions): Promise<string | undefined>;
-    /** Delete a session file and its artifacts. Drains the persist writer first to avoid EPERM on Windows. ENOENT is treated as success. */
+    /** Tombstone and exact-delete managed transcripts, detaching the active transcript first. */
     dropSession(sessionPath: string): Promise<void>;
     /**
      * Fork the current session, creating a new session file with the same entries.
@@ -639,6 +699,8 @@ export declare class SessionManager {
      * the canonical store. This applies such mutations for real.
      */
     applyEntryMessageUpdates(entries: readonly SessionMessageEntry[]): void;
+    /** Write mutated custom-message entries back into the canonical entry store by id. */
+    applyCustomMessageEntryUpdates(entries: readonly CustomMessageEntry[]): void;
     /**
      * Rewrite the session file after in-place entry updates.
      * Use sparingly (e.g., pruning old tool outputs).
@@ -717,8 +779,11 @@ export declare class SessionManager {
      * Build the session context (what gets sent to the LLM).
      * Uses tree traversal from current leaf.
      */
+    /**
+     * Return a defensive context snapshot for public consumers.
+     */
     buildSessionContext(): SessionContext;
-    /** Strip stale OpenAI Responses assistant replay metadata from loaded in-memory entries. */
+    /** Strip stale OpenAI Responses assistant replay metadata from loaded in-memory entries without persisting it. */
     sanitizeLoadedOpenAIResponsesReplayMetadata(): boolean;
     /**
      * Get session header.
@@ -726,11 +791,12 @@ export declare class SessionManager {
     getHeader(): SessionHeader | null;
     getEntries(): SessionEntry[];
     /**
-     * Get the session as a tree structure. Returns a shallow defensive copy of all entries.
+     * Get the session as a tree structure. Returns defensive copies of all entries.
      * A well-formed session has exactly one root (first entry with parentId === null).
      * Orphaned entries (broken parent chain) are also returned as roots.
      */
     getTree(): SessionTreeNode[];
+    [sessionManagerReadCapability](): SessionManagerReadAccess;
     /**
      * Start a new branch from an earlier entry.
      * Moves the leaf pointer to the specified entry. The next appendXXX() call
@@ -768,21 +834,25 @@ export declare class SessionManager {
      * @param sessionDir Optional session directory. If omitted, uses default (~/.gjc/agent/sessions/<encoded-cwd>/).
      */
     static create(cwd: string, sessionDir?: string, storage?: SessionStorage): SessionManager;
+    /** Resolve a default-managed candidate through binding validation and copy-retain migration before mutation. */
+    static prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy): Promise<string>;
     /**
      * Fork a session into the current project directory.
      * Copies history from another session file while creating a new session file in the current sessionDir.
      */
-    static forkFrom(sourcePath: string, cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionManager>;
+    static forkFrom(sourcePath: string, cwd: string, sessionDir?: string, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
     /**
      * Open a specific session file.
      * @param path Path to session file
      * @param sessionDir Optional session directory for /new or /branch. If omitted, derives from file's parent.
      */
-    static open(filePath: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionManager>;
+    static open(filePath: string, sessionDir?: string, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
     /**
      * List sessions for the resume picker without recovery or other maintenance writes.
      */
     static listForResumePickerReadOnly(cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionInfo[]>;
+    /** Tombstone and exact-delete a default-managed candidate. */
+    static deleteManagedCandidate(sessionPath: string): Promise<void>;
     /** Capture exact source content for a strict fork without granting write ownership. */
     static captureTranscriptStrict(filePath: string, storage?: SessionStorage): StrictSessionCaptureResult;
     /**
@@ -790,7 +860,7 @@ export declare class SessionManager {
      * revalidate captured authority before destination initialization and transcript
      * persistence; destination history always comes from the captured bytes.
      */
-    static forkFromCaptured(snapshot: CapturedSessionTranscriptSnapshot, cwd: string, sessionDir?: string): Promise<StrictSessionForkResult>;
+    static forkFromCaptured(snapshot: CapturedSessionTranscriptSnapshot, cwd: string, sessionDir?: string, _migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<StrictSessionForkResult>;
     /** Inspect a selected session without acquiring write-capable ownership. */
     static inspectSessionTailReadOnly(filePath: string, storage?: SessionStorage): Promise<ResumeTailInspection>;
     /**
@@ -798,13 +868,13 @@ export declare class SessionManager {
      * the returned discriminant; an error result never creates, rewrites, or adopts
      * the selected path. Breadcrumb ownership begins only after `kind: "opened"`.
      */
-    static openExistingStrict(identity: ResumeSessionIdentity, sessionDir?: string, storage?: SessionStorage): Promise<StrictSessionOpenResult>;
+    static openExistingStrict(identity: ResumeSessionIdentity, sessionDir?: string, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<StrictSessionOpenResult>;
     /**
      * Continue the most recent session, or create new if none.
      * @param cwd Working directory
      * @param sessionDir Optional session directory. If omitted, uses default (~/.gjc/agent/sessions/<encoded-cwd>/).
      */
-    static continueRecent(cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionManager>;
+    static continueRecent(cwd: string, sessionDir?: string, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
     /** Create an in-memory session (no file persistence) */
     static inMemory(cwd?: string, storage?: SessionStorage): SessionManager;
     /**

package/dist/types/session/session-storage.d.ts

@@ -109,10 +109,13 @@ export interface SessionStorage {
     deleteSessionVerified?(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
 }
-/** Exact (dev, ino) identity fields used for ACP authorization binding. */
+/** Exact authorization evidence for a transcript or artifact path. */
 export interface SessionStorageFileIdentity {
     dev: bigint;
     ino: bigint;
+    size: number;
+    mtimeNs: bigint;
+    sha256: string;
 }
 /** Kind of verification failure surfaced by {@link deleteSessionVerified}. */
 export type VerifiedDeleteFailureKind = "containment" | "symlink" | "stat" | "identity" | "header" | "cwd" | "artifacts";
@@ -149,6 +152,18 @@ export interface VerifiedSessionDeleteTarget {
      * fails closed. Omit on first attempt or to accept recorded absence.
      */
     expectedArtifactsIdentity?: SessionStorageFileIdentity;
+    /** Stable native recursive-tree evidence captured before artifact detachment. */
+    expectedArtifactsTree?: NativeDirectoryTreeSnapshot;
+    /** Identity-bound quarantine path retained when recursive artifact cleanup failed. */
+    detachedArtifactsPath?: string;
+    /** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
+    detachedTranscriptPath?: string;
+    /** Caller-published, no-replace quarantine pathname for the next artifact detach. */
+    plannedArtifactsPath?: string;
+    /** Caller-published, no-replace quarantine pathname for the next transcript detach. */
+    plannedTranscriptPath?: string;
+    /** Set only after a durable caller receipt records successful artifact removal. */
+    artifactsRemoved?: true;
 }
 /**
  * Outcome of a verified hard delete. Artifact removal happens first; only after
@@ -157,6 +172,10 @@ export interface VerifiedSessionDeleteTarget {
  * `deleted` and never `{}`.
  */
 export type VerifiedSessionDeleteResult = {
+    kind: "artifacts_removed";
+    phase: "artifacts";
+    transcriptIdentity: SessionStorageFileIdentity;
+} | {
     kind: "deleted";
 } | {
     kind: "cleanup_pending";
@@ -164,6 +183,10 @@ export type VerifiedSessionDeleteResult = {
     error: Error;
     /** Artifact directory identity at failure time; undefined when absent. */
     artifactsIdentity: SessionStorageFileIdentity | undefined;
+    /** Identity-bound quarantine path retained when recursive cleanup failed. */
+    detachedArtifactsPath: string;
+    /** Native snapshot required for an identity-bound recursive retry. */
+    artifactsTree: NativeDirectoryTreeSnapshot;
     /** Transcript identity (unchanged) for retry binding. */
     transcriptIdentity: SessionStorageFileIdentity;
 } | {
@@ -172,6 +195,22 @@ export type VerifiedSessionDeleteResult = {
     error: Error;
     /** Transcript identity at failure time for retry binding. */
     transcriptIdentity: SessionStorageFileIdentity;
+    /** Optional identity-bound transcript quarantine path for restart cleanup. */
+    detachedTranscriptPath?: string;
+};
+type NativeDirectoryTreeEntry = {
+    relativePath: string;
+    kind: string;
+    dev: string;
+    ino: string;
+    size: string;
+    mtimeNs: string;
+    sha256?: string;
+};
+export type NativeDirectoryTreeSnapshot = {
+    rootDev: string;
+    rootIno: string;
+    entries: NativeDirectoryTreeEntry[];
 };
 export declare class FileSessionStorage implements SessionStorage {
     #private;
@@ -194,8 +233,8 @@ export declare class FileSessionStorage implements SessionStorage {
     unlinkSync(path: string): void;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
     /**
-     * Delete a session file and its artifacts directory.
-     * Artifacts are stored in a sibling directory with the same name minus .jsonl extension.
+     * Delete a session and sibling artifacts in an operator-selected explicit directory.
+     * Default managed roots use deleteSessionVerified and never call this path.
      */
     deleteSessionWithArtifacts(sessionPath: string): Promise<void>;
     /**
@@ -228,3 +267,4 @@ export declare class MemorySessionStorage implements SessionStorage {
     deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
 }
+export {};

package/dist/types/session/volatile-context-pruning.d.ts

@@ -0,0 +1,15 @@
+import type { CustomMessageEntry, SessionEntry } from "./session-manager";
+/**
+ * Volatile context is refreshed for every prompt. Only its newest copy is useful;
+ * replacing older copies at a maintenance boundary preserves the audit trail
+ * without repeatedly charging the model for stale workspace snapshots.
+ */
+export declare function pruneSupersededVolatileProjectContext(entries: readonly SessionEntry[]): {
+    changed: CustomMessageEntry[];
+    bytesSaved: number;
+};
+/** Retire superseded known singleton maintenance reminders without touching ordinary user context. */
+export declare function pruneSupersededMaintenanceReminders(entries: readonly SessionEntry[]): {
+    changed: CustomMessageEntry[];
+    bytesSaved: number;
+};

package/dist/types/skill-state/{deep-interview-mutation-guard.d.ts → workflow-mutation-guard.d.ts}

@@ -1,4 +1,5 @@
 import type { AgentTool } from "@gajae-code/agent-core";
+import { readVisibleSkillActiveState } from "./active-state";
 export declare const DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE = "Deep-interview phase boundary: continue gathering context/questions/risks and emit a handoff/spec before code edits. Mutation tools and patch execution are blocked while deep-interview is active; finalize specs through `gjc deep-interview --write --stage final` or hand off to an execution phase.";
 export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow state and artifacts are runtime-owned. Agent mutation tools cannot edit `.gjc/**`; use the sanctioned `gjc` CLI instead.";
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
@@ -7,7 +8,7 @@ type ToolWithEditMode = AgentTool & {
     mode?: unknown;
     customWireName?: unknown;
 };
-export interface DeepInterviewMutationGuardInput {
+export interface WorkflowMutationGuardInput {
     cwd: string;
     sessionId?: string;
     threadId?: string;
@@ -15,24 +16,39 @@ export interface DeepInterviewMutationGuardInput {
     args: unknown;
     forceOverride?: boolean;
     enforceWorkflowState?: boolean;
+    guardContext?: WorkflowGuardContext;
 }
-export interface DeepInterviewMutationDecision {
+export interface WorkflowMutationDecision {
     blocked: boolean;
     message?: string;
     targets: string[];
     reason?: string;
     command?: string;
 }
-export declare function assertDeepInterviewMutationRawPathsAllowed(input: {
+export interface WorkflowGuardContext {
+    sessionId: string | null;
+    activeState: Awaited<ReturnType<typeof readVisibleSkillActiveState>>;
+    modeStates: ReadonlyMap<string, ModeState | null>;
+}
+interface ModeState {
+    active?: boolean;
+    current_phase?: string;
+    session_id?: string;
+    thread_id?: string;
+    [key: string]: unknown;
+}
+export declare function readWorkflowGuardContext(cwd: string, options?: {
+    sessionId?: string;
+    threadId?: string;
+}): Promise<WorkflowGuardContext>;
+export declare function assertWorkflowMutationRawPathsAllowed(input: {
     cwd: string;
     sessionId?: string;
     threadId?: string;
     rawPaths: string[];
     forceOverride?: boolean;
+    guardContext?: WorkflowGuardContext;
 }): Promise<void>;
-export declare function getDeepInterviewMutationDecision(input: DeepInterviewMutationGuardInput): Promise<DeepInterviewMutationDecision>;
-export declare function assertDeepInterviewMutationAllowed(input: DeepInterviewMutationGuardInput): Promise<void>;
-export declare const getWorkflowMutationDecision: typeof getDeepInterviewMutationDecision;
-export declare const assertWorkflowMutationAllowed: typeof assertDeepInterviewMutationAllowed;
-export declare const assertWorkflowMutationRawPathsAllowed: typeof assertDeepInterviewMutationRawPathsAllowed;
+export declare function getWorkflowMutationDecision(input: WorkflowMutationGuardInput): Promise<WorkflowMutationDecision>;
+export declare function assertWorkflowMutationAllowed(input: WorkflowMutationGuardInput): Promise<void>;
 export {};

package/dist/types/skill-state/workflow-state-contract.d.ts

@@ -40,14 +40,12 @@ export interface AuditEntry {
     paths: string[];
 }
 export declare function workflowModeStateFileName(skill: CanonicalGjcWorkflowSkill): string;
-export declare function workflowStateStoragePath(cwd: string, skill: CanonicalGjcWorkflowSkill, sessionId?: string): string;
-export declare function workflowActiveStatePath(cwd: string, sessionId?: string): string;
 export declare function buildWorkflowStateReceipt(input: {
     cwd: string;
     skill: CanonicalGjcWorkflowSkill;
     owner: WorkflowStateMutationOwner;
     command: string;
-    sessionId?: string;
+    sessionId: string;
     nowIso?: string;
     mutationId?: string;
 }): WorkflowStateReceipt;

package/dist/types/slash-commands/builtin-registry.d.ts

@@ -1,7 +1,10 @@
+import { type ComposerSubmissionOptions } from "../modes/types";
 import type { BuiltinSlashCommand, ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime, SlashCommandSpec, TuiSlashCommandRuntime } from "./types";
 export type { BuiltinSlashCommand, SubcommandDef } from "./types";
 /** TUI-specific runtime accepted by `executeBuiltinSlashCommand`. */
-export type BuiltinSlashCommandRuntime = TuiSlashCommandRuntime;
+export type BuiltinSlashCommandRuntime = TuiSlashCommandRuntime & {
+    composer?: ComposerSubmissionOptions;
+};
 export declare function formatUnknownBuiltinSlashCommandDiagnostic(commandName: string): string | undefined;
 /** Builtin command metadata used for slash-command autocomplete and help text. */
 export declare const BUILTIN_SLASH_COMMAND_DEFS: ReadonlyArray<BuiltinSlashCommand>;

package/dist/types/system-prompt.d.ts

@@ -3,7 +3,7 @@
  */
 import type { AgentTool } from "@gajae-code/agent-core";
 import type { SkillsSettings } from "./config/settings";
-import { type Skill } from "./extensibility/skills";
+import type { Skill } from "./extensibility/skills";
 import { type WorkspaceTree } from "./workspace-tree";
 interface AlwaysApplyRule {
     name: string;
@@ -75,17 +75,8 @@ export interface BuildSystemPromptOptions {
     }>;
     /** Intent field name injected into every tool schema. If set, explains the field in the prompt. */
     intentField?: string;
-    /** Whether MCP tool discovery is active for this prompt build. */
-    mcpDiscoveryMode?: boolean;
-    /** Discoverable MCP server summaries to advertise when discovery mode is active. */
-    mcpDiscoveryServerSummaries?: string[];
-    /** Whether built-in tool discovery ("all" mode) is active; enables the tool-discovery prompt block. */
+    /** Whether built-in tool discovery is active; enables the tool-discovery prompt block. */
     toolDiscoveryActive?: boolean;
-    /** Hidden discoverable tools to advertise (name + one-line summary) when tool discovery is active. */
-    discoverableTools?: Array<{
-        name: string;
-        summary: string;
-    }>;
     /** Encourage the agent to delegate via tasks unless changes are trivial. */
     eagerTasks?: boolean;
     /** Rules with alwaysApply=true — their full content is injected into the prompt. */